deadbyte-mcp 0.15.43 → 0.15.44

package/test/r65-release-contract.test.mjs

@@ -12,7 +12,7 @@ const PARENT={
   generation_manifest_sha256:'19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'
 };
 
-test('R65 release identity binds exact production R64 parent and durable authority-continuity train',{skip:currentPackage.version!=='0.15.42'},async()=>{
+test('R65 release identity binds exact production R64 parent and durable authority-continuity train',{skip:currentPackage.version!=='0.15.42' ? 'Historical R65 release contract requires 0.15.42; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate,gaps,design]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r66-release-contract.test.mjs

@@ -4,6 +4,7 @@ import {readFile} from 'node:fs/promises';
 
 const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
 const json=async rel=>JSON.parse((await read(rel)).replace(/^\uFEFF/,''));
+const currentPackage=await json('package.json');
 const PARENT={
   version:'0.15.42',
   release_id:'v0.15.42-1b4754103dd4ca43',
@@ -11,7 +12,7 @@ const PARENT={
   generation_manifest_sha256:'62dc68be55ad627f8d872b8be8c1369ecca0edf08fdedc8336c9ccee2d2809fb'
 };
 
-test('R66 identity is an exact prepublish doctor hotfix of sealed R65',async()=>{
+test('R66 identity is an exact prepublish doctor hotfix of sealed R65',{skip:currentPackage.version!=='0.15.43' ? 'Historical R66 release contract requires 0.15.43; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r67-cli-integration.test.mjs

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {nativeInspectArgs} from '../src/native-inspector-r67.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const cli=path.join(root,'src','deadbyte-cli.mjs');
+const exe=path.join(root,'bin','deadbyte-native-inspect-r67.exe');
+function invoke(...args){
+ const r=spawnSync(process.execPath,[cli,'inspect',...args],{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:30000,maxBuffer:2097152});
+ assert.equal(r.error,undefined,r.error?.message);return {r,value:JSON.parse(r.stdout.trim())};
+}
+test('R67 CLI inspect exposes native process snapshot without MCP tool additions',()=>{
+ const {r,value}=invoke('process','4');
+ assert.equal(r.status,0,r.stderr);assert.equal(value.status,'ok');assert.equal(value.operation,'process');assert.ok(value.data.processes.length<=4);
+});
+test('R67 CLI inspect memory self is metadata-only and PE uses actual bytes',()=>{
+ const m=invoke('memory','self','4');
+ assert.equal(m.r.status,0,m.r.stderr);assert.equal(m.value.status,'ok');assert.ok(m.value.data.regions.length<=4);
+ const p=invoke('pe',exe);
+ assert.equal(p.r.status,0,p.r.stderr);assert.equal(p.value.status,'ok');assert.match(p.value.data.file_sha256,/^[a-f0-9]{64}$/);
+});
+test('R67 CLI typed input rejects invalid selectors before spawning native process',()=>{
+ for(const selector of [['process','0'],['process','999999'],['memory','0'],['memory','self','9999'],['memory','4148'],['identity'],['identity','0'],['memory','4148','0'],['memory','4148','18446744073709551616'],['pe'],['unknown']]){
+  assert.throws(()=>nativeInspectArgs(selector));
+ }
+ const error=spawnSync(process.execPath,[cli,'inspect','memory','0'],{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:30000});
+ assert.equal(error.status,1);assert.match(error.stderr,/invalid positive limit|limit out of range|creation_filetime/);
+});
+test('R67 CLI preserves raw Windows error instead of fabricating data',()=>{
+ const {r,value}=invoke('memory','4294967295','1','4');
+ assert.equal(r.status,2);assert.equal(value.status,'failed');assert.match(value.error,/win32|PID/);
+});
+
+test('R67 CLI rejects stale PID identity before successful region inspection',()=>{
+ const {r,value}=invoke('memory',String(process.pid),'1','4');
+ assert.equal(r.status,2);
+ assert.equal(value.error_code,'PROCESS_IDENTITY_MISMATCH');
+ assert.equal(value.win32_error,0);
+});

package/test/r67-diagnostics-cli.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const cli=path.join(root,'src','deadbyte-cli.mjs');
+test('R67 offline diagnostic CLI exports without activating remote, uploading or revealing raw log bytes',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-diagnostic-cli-'));
+ try{
+  const state=path.join(folder,'state');
+  const output=path.join(folder,'report.zip');
+  await mkdir(path.join(state,'runtime','logs'),{recursive:true});
+  await writeFile(path.join(state,'active-release.json'),JSON.stringify({release_id:'v0.15.43-'+'a'.repeat(16),manifest_sha256:'a'.repeat(64)}));
+  await writeFile(path.join(state,'runtime','logs','controller-start.stderr.log'),'WARN reconnect win32=109 SECRET_CANARY_52917\n');
+  const run=spawnSync(process.execPath,[cli,'diagnostics','export','--output',output],{
+   cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:state},encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(run.status,0,run.stderr);
+  const result=JSON.parse(run.stdout);
+  assert.equal(result.status,'written_local_only');
+  assert.equal(result.uploaded,false);
+  const b=await readFile(output);
+  assert.equal(b.includes(Buffer.from('SECRET_CANARY_52917')),false);
+  assert.equal(b.readUInt32LE(0),0x04034b50);
+  const reject=spawnSync(process.execPath,[cli,'diagnostics','export','--output',path.join(folder,'second.zip'),'--upload'],{
+   cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:state},encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(reject.status,1);
+  assert.match(reject.stderr,/upload|syntax|diagnostics/i);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+
+test('R67 diagnostic CLI verify checks local ZIP without starting remote session',async()=>{
+ const {makeOfflineDiagnosticBundle}=await import('../src/r67-diagnostic-export.mjs');
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-diagnostic-verify-cli-'));
+ try{
+  const file=path.join(folder,'report.zip');
+  const bundle=makeOfflineDiagnosticBundle({
+   releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:'a'.repeat(64),logs:[]
+  });
+  await writeFile(file,bundle.zip);
+  const r=spawnSync(process.execPath,[cli,'diagnostics','verify','--input',file],{
+   cwd:root,encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(r.status,0,r.stderr);
+  const result=JSON.parse(r.stdout);
+  assert.equal(result.status,'VERIFIED_LOCAL_STRUCTURE');
+  assert.equal(result.archive_sha256,bundle.archive_sha256);
+  const broken=Buffer.from(bundle.zip);broken[50]^=1;
+  const brokenPath=path.join(folder,'corrupt.zip');await writeFile(brokenPath,broken);
+  const denial=spawnSync(process.execPath,[cli,'diagnostics','verify','--input',brokenPath],{
+   cwd:root,encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(denial.status,1);
+  assert.match(denial.stderr,/integrity|ZIP|unsafe/i);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});

package/test/r67-diagnostics-verify.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {makeOfflineDiagnosticBundle} from '../src/r67-diagnostic-export.mjs';
+import {verifyOfflineDiagnosticsZip} from '../src/r67-diagnostics-verify.mjs';
+const sha='a'.repeat(64);
+const archive=()=>makeOfflineDiagnosticBundle({releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:sha,
+ logs:[{source:'controller-start.stderr.log',content:'2026-10-11T03:04:05.000Z WARN reconnect win32=109 PASSWORD_CANARY_91020'}]}).zip;
+test('R67 offline diagnostic independently verifies ZIP CRC, bounded entries and fixed schemas',()=>{
+ const v=verifyOfflineDiagnosticsZip(archive());
+ assert.equal(v.status,'VERIFIED_LOCAL_STRUCTURE');
+ assert.equal(v.uploaded,false);
+ assert.equal(v.entry_count,2);
+ assert.equal(v.summary.redaction,'FIXED_FIELDS_ONLY');
+ assert.equal(v.summary.network_upload,'NEVER');
+ assert.match(v.archive_sha256,/^[a-f0-9]{64}$/);
+ assert.equal(v.summary.raw_log_lines_exported,0);
+});
+test('R67 verifier rejects byte tampering without an updated CRC',()=>{
+ const corrupted=Buffer.from(archive());
+ const phrase=Buffer.from('FIXED_FIELDS_ONLY');
+ const offset=corrupted.indexOf(phrase);
+ assert.ok(offset>0);
+ corrupted[offset]^=1;
+ assert.throws(()=>verifyOfflineDiagnosticsZip(corrupted),/CRC|hash|corrupt/i);
+});
+test('R67 verifier rejects trailing junk, extra archive entries and invalid size bounds',()=>{
+ const good=archive();
+ assert.throws(()=>verifyOfflineDiagnosticsZip(Buffer.concat([good,Buffer.alloc(20)])),/trailing|eocd|boundary|ZIP/i);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(good.subarray(0,good.length-5)),/truncated|eocd|boundary|ZIP/i);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(Buffer.alloc(4*1024*1024+1)),/size|large/i);
+});
+test('R67 verify rejects semantic tampering even when attacker recomputes all ZIP CRCs',()=>{
+ const buf=Buffer.from(archive());
+ const find=Buffer.from('FIXED_FIELDS_ONLY');
+ const at=buf.indexOf(find);
+ assert.ok(at>0);
+ buf.write('ALLOW_RAW_LOGS___',at,'utf8');
+ const dataStart=30+buf.readUInt16LE(26),dataLength=buf.readUInt32LE(18);
+ let crc=0xffffffff;
+ for(const byte of buf.subarray(dataStart,dataStart+dataLength)){
+  crc^=byte;
+  for(let j=0;j<8;j++)crc=(crc>>>1)^((crc&1)?0xedb88320:0);
+ }
+ crc=(crc^0xffffffff)>>>0;
+ const dir=buf.readUInt32LE(buf.length-22+16);
+ buf.writeUInt32LE(crc,14);
+ buf.writeUInt32LE(crc,dir+16);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(buf),/unsafe diagnostic summary/i);
+});

package/test/r67-diagnostics-zip-oracle.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {makeOfflineDiagnosticBundle} from '../src/r67-diagnostic-export.mjs';
+test('R67 ZIP interoperates with independent Windows .NET ZipArchive reader',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-dotnet-zip-'));
+ try{
+  const file=path.join(folder,'diag.zip');
+  const x=makeOfflineDiagnosticBundle({releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:'a'.repeat(64),logs:[
+   {source:'controller-start.stderr.log',content:'2026-10-11T01:02:03.000Z ERROR timeout win32=109 TOKEN_CANARY_7841'}
+  ]});
+  await writeFile(file,x.zip);
+  const escaped=file.replaceAll("'","''");
+  const ps=[
+    '$ErrorActionPreference="Stop"',
+    'Add-Type -AssemblyName System.IO.Compression.FileSystem',
+    "$zip=[System.IO.Compression.ZipFile]::OpenRead('"+escaped+"')",
+    "try{",
+    "  $entries=@($zip.Entries|ForEach-Object {$_.FullName})",
+    "  if($entries.Count -ne 2 -or $entries[0] -ne 'diagnostics.json' -or $entries[1] -ne 'redacted-events.json'){throw 'ZIP_ENTRY_MISMATCH'}",
+    "  foreach($entry in $zip.Entries){",
+    "    $reader=New-Object System.IO.StreamReader($entry.Open())",
+    "    try{$body=$reader.ReadToEnd();$parsed=ConvertFrom-Json -InputObject $body;if(!$parsed){throw 'INVALID_JSON'}}finally{$reader.Dispose()}",
+    "    if($body.Contains('TOKEN_CANARY_7841')){throw 'SECRET_LEAK'}",
+    "  }",
+    "  Write-Output 'ZIP_ORACLE_PASS'",
+    "}finally{$zip.Dispose()}"
+  ].join(';');
+  const r=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',ps],
+   {windowsHide:true,shell:false,encoding:'utf8',timeout:20000,maxBuffer:1024*1024});
+  assert.equal(r.error,undefined,r.error?.message);
+  assert.equal(r.status,0,r.stderr);
+  assert.match(r.stdout,/ZIP_ORACLE_PASS/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});

package/test/r67-diagnostics.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {redactDiagnosticLine,makeOfflineDiagnosticBundle,exportOfflineDiagnostics} from '../src/r67-diagnostic-export.mjs';
+const secret='SENTINEL_SECRET_CANARY_984031';
+const token='sk-proj-FAKE_DIAGNOSTIC_SECRET';
+const sha='a'.repeat(64);
+test('R67 local diagnostics use irreversible token-free allowlist, not regex-redacted raw log',()=>{
+ const line='2026-10-11T05:44:03.000Z ERROR reconnect win32=109 Authorization: Bearer '+secret+' '+token+' C:\\Users\\DEADBYTE\\passwords.txt';
+ const output=redactDiagnosticLine(line);
+ assert.deepEqual(output,{timestamp:'2026-10-11T05:44:03.000Z',level:'ERROR',event:'reconnect',win32_error:109});
+ assert.ok(!JSON.stringify(output).includes('FAKE'));
+ const unknown=redactDiagnosticLine('password='+secret+' '+token+' cwd=/private/location');
+ assert.equal(unknown,null,'unknown free-form lines must be dropped');
+});
+test('R67 offline ZIP contains only fixed names, derived summaries, no raw secrets or network URL',()=>{
+ const bundle=makeOfflineDiagnosticBundle({
+  releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:sha,
+  logs:[{source:'controller-start.stderr.log',content:'ERROR reconnect win32=109 Bearer '+secret+'\nINFO ready '+token+'\npassword='+secret+'\n'}]
+ });
+ assert.ok(Buffer.isBuffer(bundle.zip));
+ assert.equal(bundle.zip.readUInt32LE(0),0x04034b50,'ZIP local file header');
+ assert.ok(bundle.zip.includes(Buffer.from('diagnostics.json')));
+ assert.ok(bundle.zip.includes(Buffer.from('redacted-events.json')));
+ for(const value of [secret,token,'password=','Bearer','C:\\Users\\','https://'])
+  assert.equal(bundle.zip.includes(Buffer.from(value)),false,'raw or sensitive text leaked');
+ assert.equal(bundle.summary.schema,'deadbyte.r67-offline-diagnostics.v1');
+ assert.equal(bundle.summary.network_upload,'NEVER');
+ assert.equal(bundle.summary.source_count,1);
+ assert.equal(bundle.summary.redacted_event_count,2);
+ assert.match(bundle.archive_sha256,/^[a-f0-9]{64}$/);
+});
+test('R67 exports only to owner-selected local path, absent target and no arbitrary logs',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-diagnostic-test-'));
+ try{
+  const stateRoot=path.join(folder,'state');
+  await mkdir(path.join(stateRoot,'runtime','logs'),{recursive:true});
+  await writeFile(path.join(stateRoot,'active-release.json'),JSON.stringify({release_id:'v0.15.43-'+'a'.repeat(16),manifest_sha256:sha}));
+  await writeFile(path.join(stateRoot,'runtime','logs','controller-start.stderr.log'),'ERROR timeout Authorization: Bearer '+secret+'\nINFO connected '+token+'\n');
+  await writeFile(path.join(stateRoot,'runtime','logs','arbitrary.log'),'ERROR THIS MUST NOT BE INCLUDED '+secret+'\n');
+  const output=path.join(folder,'owner-approved.zip');
+  const result=await exportOfflineDiagnostics({stateRoot,outputPath:output});
+  assert.equal(result.status,'written_local_only');
+  assert.equal(result.uploaded,false);
+  const actual=await readFile(output);
+  assert.equal(actual.readUInt32LE(0),0x04034b50);
+  assert.equal(actual.includes(Buffer.from(secret)),false);
+  assert.equal(actual.includes(Buffer.from(token)),false);
+  assert.equal(actual.includes(Buffer.from('arbitrary.log')),false);
+  const info=await lstat(output);
+  assert.ok(info.isFile()&&!info.isSymbolicLink());
+  await assert.rejects(()=>exportOfflineDiagnostics({stateRoot,outputPath:output}),/EEXIST|already exists/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+test('R67 without output path fails before read and upload option is always forbidden',async()=>{
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a'}),/outputPath/);
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a',outputPath:'X',upload:true}),/upload.*disabled|no network/i);
+});

package/test/r67-evidence-reconcile.test.mjs

@@ -0,0 +1,186 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createR67ShardPlan,r67RegressionTreeHash,r67ShardTimeoutMs} from '../src/r67-regression-shards.mjs';
+import {reconcileR67Evidence} from '../src/r67-evidence-reconcile.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const op='r67-e2e-fixture-contract';
+async function fixture(){
+ const parent=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-e2e-'));
+ const root=path.join(parent,'candidate'),evidenceRoot=path.join(parent,'evidence');
+ await mkdir(path.join(root,'test'),{recursive:true});
+ await mkdir(path.join(root,'src'));
+ await mkdir(evidenceRoot);
+ await writeFile(path.join(root,'package.json'),'{}\n');
+ await writeFile(path.join(root,'src','core.mjs'),'export const r67 = true;\n');
+ const names=Array.from({length:32},(_,i)=>'test/fixture-'+String(i).padStart(2,'0')+'.test.mjs');
+ for(const name of names)await writeFile(path.join(root,name),'import test from "node:test"; test("fixture",()=>{});\n');
+ const plan=createR67ShardPlan(names,32);
+ const hashes=await Promise.all(names.map(async name=>[name,sha(await readFile(path.join(root,name)))]));
+ const testTree=sha(Buffer.from(JSON.stringify(hashes)));
+ const opts={roots:['src','test'],topLevel:['package.json'],extra:[]};
+ const tree=await r67RegressionTreeHash(root,opts);
+ async function writeShard(index,{kind='valid',signed=false}={}){
+  const shard=plan.shards[index],folder=path.join(evidenceRoot,op+'-shard-'+String(index).padStart(2,'0'));
+  await mkdir(folder,{recursive:true});
+  const intent={schema:'deadbyte.r67-shard-intent.v1',operation:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,started_at_utc:'2026-10-11T00:00:00.000Z',files:shard.files};
+  await writeFile(path.join(folder,'intent.json'),JSON.stringify(intent));
+  const status=kind==='unknown'?'OUTCOME_UNKNOWN':'PASS';
+  const result={schema:kind==='v1'?'deadbyte.r67-shard-result.v1':'deadbyte.r67-shard-result.v2',
+   operation_id:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,status,exit_code:status==='PASS'?0:null,
+   test_count:status==='PASS'?1:null,passed:status==='PASS'?1:null,failed:status==='PASS'?0:null,
+   skipped:status==='PASS'?0:null,cancelled:status==='PASS'?0:null,todo:status==='PASS'?0:null,
+   configured_timeout_ms:r67ShardTimeoutMs(shard),timed_out:false,failure_reason:null,elapsed_ms:1,
+   stdout_sha256:sha(Buffer.from('fixture output')),stderr_sha256:sha(Buffer.alloc(0))};
+  if(kind==='tampered')result.files_sha256='f'.repeat(64);
+  const receipt_sha256=sha(Buffer.from(JSON.stringify(result)));
+  await writeFile(path.join(folder,'result.json'),JSON.stringify({...result,receipt_sha256}));
+  return folder;
+ }
+ return {parent,root,evidenceRoot,plan,opts,writeShard,cleanup:()=>rm(parent,{recursive:true,force:true})};
+}
+test('R67 real reconciliation consumes 32 durable v2 receipts and reports PASS from fixture source bytes',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'PASS',JSON.stringify(r));
+  assert.equal(r.verified_receipts,32);
+  assert.equal(r.verdict.test_count,32);
+  assert.deepEqual(r.integrity_faults,[]);
+ }finally{await x.cleanup();}
+});
+test('R67 verified legacy v1 receipts cannot count toward a new full suite PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===5?'v1':'valid'});
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+  assert.deepEqual(r.stale_indices,[5]);
+  assert.equal(r.verified_receipts,31);
+ }finally{await x.cleanup();}
+});
+test('R67 rejects changed receipts before considering source staleness',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===7?'tampered':'valid'});
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const broken=JSON.parse(await readFile(file,'utf8'));broken.result_sha256='0'.repeat(64);
+  await writeFile(file,JSON.stringify(broken));
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(e=>e.index===7));
+ }finally{await x.cleanup();}
+});
+test('R67 source mutation, missing shard and unknown outcome never produce PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<31;i++)await x.writeShard(i);
+  let r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED');
+  await x.writeShard(31,{kind:'unknown'});
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'OUTCOME_UNKNOWN');
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+ }finally{await x.cleanup();}
+});
+
+test('R67 changed test plan makes authentic historical v1 receipts STALE, not integrity failures',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:'v1'});
+  await writeFile(path.join(x.root,'test','fixture-added.test.mjs'),'import test from "node:test"; test("new",()=>{});\\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE',JSON.stringify(r.integrity_faults));
+  assert.deepEqual(r.integrity_faults,[]);
+  assert.equal(r.stale_indices.length,32);
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 PASS cannot coexist with timed_out=true even if receipt SHA is recomputed',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-08','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.timed_out=true;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(v=>v.index===8));
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 skips cannot silently produce a full regression PASS without classification',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.passed=0;result.skipped=1;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED_NONPASS_CLASSIFICATION');
+  assert.deepEqual(r.unclassified_nonpass,[{index:9,skipped:1,todo:0,cancelled:0}]);
+ }finally{await x.cleanup();}
+});
+
+test('R67 case-level SKIP evidence stays visible and forged case counts fail integrity',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const report=JSON.parse(await readFile(file,'utf8'));
+  report.passed=0;report.skipped=1;
+  report.nonpass_cases=[{kind:'SKIP',name:'offline fixture',reason:'unsupported platform'}];
+  report.nonpass_fully_classified=true;
+  const seal=async()=>{
+    const {receipt_sha256,...body}=report;report.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+    await writeFile(file,JSON.stringify(report));
+  };
+  await seal();
+  const observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'PASS','Fully reasoned skips must be honestly recorded but should not fabricate test failures');
+  assert.deepEqual(observed.classified_nonpass[0].cases,report.nonpass_cases);
+  assert.equal(observed.verdict.passed,31);
+  assert.equal(observed.verdict.test_count,32);
+  report.nonpass_cases.push({kind:'SKIP',name:'forged',reason:'unsupported platform'});
+  await seal();
+  const broken=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(broken.status,'FAILED_INTEGRITY');
+ }finally{await x.cleanup();}
+});
+
+
+test('R67 v2 FAILED result must bind a complete named failure case ledger, not an empty passing-shaped ledger',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));
+  const name='remote ownership race';
+  result.status='FAILED';result.exit_code=1;result.failed=1;result.passed=0;
+  result.failure_cases=[{name,name_sha256:sha(Buffer.from(name,'utf8'))}];
+  result.failure_cases_complete=true;
+  const seal=async()=>{const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));await writeFile(file,JSON.stringify(result));};
+  await seal();
+  let observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED');
+  assert.deepEqual(observed.integrity_faults,[]);
+  result.failure_cases=[];result.failure_cases_complete=true;await seal();
+  observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED_INTEGRITY');
+  assert.ok(observed.integrity_faults.some(v=>v.index===7));
+ }finally{await x.cleanup();}
+});

package/test/r67-isolated-slot-rollback-restore.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
+
+const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const parent=path.resolve(candidate,'..','deadbyte-mcp-0.15.43-r66');
+const parentManifestSha='4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33';
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function generation(state,label){
+  const root=path.join(state,'generations',label);
+  await mkdir(root,{recursive:true});
+  const config=Buffer.from(`@{ Label = '${label}' }\r\n`,'utf8');
+  await writeFile(path.join(root,'controller-config.psd1'),config,{flag:'wx'});
+  const manifest=Buffer.from(`${sha(config)}  controller-config.psd1\n`,'utf8');
+  await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
+  return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
+}
+
+test('R67 isolated immutable slot activates, rolls back exact R66, and restores the same R67 bytes with no authority',async()=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-slot-parity-'));
+  const state=path.join(base,'state');
+  try{
+    const parentManifest=await readFile(path.join(parent,'MANIFEST.SHA256'));
+    const candidateManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+    assert.equal(sha(parentManifest),parentManifestSha);
+    const candidateManifestSha=sha(candidateManifest);
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.43',manifestSha256:parentManifestSha});
+    const candidateSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version:'0.15.44',manifestSha256:candidateManifestSha});
+    const parentGeneration=await generation(state,'r66-parent');
+    const candidateGeneration=await generation(state,'r67-candidate');
+    const launcherSha=sha(Buffer.from(renderStableLauncherPs1(),'utf8'));
+    const pointerPath=path.join(state,'active-release.json');
+    const pointer=(slot,version,g)=>({schema:'deadbyte.active-release.v1',release_id:slot.release_id,version,
+      manifest_sha256:slot.manifest_sha256,release_root:slot.release_root,generation_root:g.root,
+      generation_manifest_sha256:g.manifest_sha256,launcher_sha256:launcherSha,config_path:g.config_path});
+
+    const activated=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.44',candidateGeneration));
+    assert.equal(activated.release_id,candidateSlot.release_id);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+
+    const rolledBack=await atomicWriteActivePointer(pointerPath,pointer(parentSlot,'0.15.43',parentGeneration));
+    assert.equal(rolledBack.release_id,parentSlot.release_id);
+    assert.equal(rolledBack.manifest_sha256,parentManifestSha);
+    await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));
+
+    const restored=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.44',candidateGeneration));
+    assert.deepEqual(restored,activated);
+    assert.deepEqual(parseActivePointer(await readFile(pointerPath,'utf8')),activated);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+    for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+      await assert.rejects(()=>lstat(path.join(state,'runtime',name)),{code:'ENOENT'});
+    }
+  }finally{
+    await rm(base,{recursive:true,force:true});
+  }
+});

package/test/r67-live-log-secret-canary.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {formatRemoteToolCall,createLiveTimelineTracker} from '../src/remote-live-log.mjs';
+const token='sk-proj-SENTINEL_CANARY_NEVER_PRINT_8675309';
+test('R67 live log does not echo credential-shaped token in path argument, including verbose call',()=>{
+ const evt={event_type:'tool.request',request_id:'canary-00000001',tool:'coding_file_read',args:{root_id:'projects',path:'sensitive/'+token+'/file.txt'}};
+ const verbose=formatRemoteToolCall(evt);
+ assert.equal(typeof verbose,'string');
+ assert.doesNotMatch(verbose,/SENTINEL_CANARY_NEVER_PRINT/);
+ const track=createLiveTimelineTracker({clock:()=>1000,verbose:true});
+ const start=track.observe(evt,{sequence:10});
+ const end=track.observe({event_type:'tool.result',request_id:evt.request_id,tool:evt.tool,outcome:{is_error:false,duration_ms:1}},{sequence:11});
+ assert.doesNotMatch(String(start)+String(end),/SENTINEL_CANARY_NEVER_PRINT/);
+});
+
+test('R67 compact live activity refuses credential in path and pattern even when caller passes unsanitized event',async()=>{
+ const {formatCompactAuditEvent,createLiveActivityTracker}=await import('../src/remote-live-log.mjs');
+ const sentinel='ghp_PRIVATE_CANARY_ABCDEF0123456789Q';
+ const event={event_type:'tool.request',request_id:'span-safe-121',tool:'coding_search',
+  args:{root_id:'projects',path:'source/'+sentinel+'/target',pattern:'token='+sentinel}};
+ const line=formatCompactAuditEvent(event);
+ assert.equal(typeof line,'string');
+ assert.doesNotMatch(line,/PRIVATE_CANARY/);
+ const activity=createLiveActivityTracker();
+ assert.doesNotMatch(activity.observe(event),/PRIVATE_CANARY/);
+});
+test('R67 trace-enabled live log does not disclose credential-shaped user session id or script_path',async()=>{
+ const event={event_type:'tool.request',request_id:'good-span-5678',tool:'coding_command_run',
+  context:{trace_id:'sk-proj-SENTINEL_TRACE_CANARY_3456789'},
+  args:{root_id:'projects',command_id:'node_script',script_path:'tmp/github_pat_PRIVATE_SCRIPT_CANARY_1234567890.ps1'}};
+ const tracker=createLiveTimelineTracker({clock:()=>1000,trace:true});
+ const line=tracker.observe(event,{sequence:77});
+ assert.equal(typeof line,'string');
+ assert.doesNotMatch(line,/SENTINEL_TRACE_CANARY|PRIVATE_SCRIPT_CANARY/);
+});
+test('R67 result error reason does not reveal github token in user supplied text',()=>{
+ const token='github_pat_SECRET_RESULT_CANARY_ABCDEFGHIJKLMNOP';
+ const tracker=createLiveTimelineTracker({clock:()=>1000,trace:true});
+ tracker.observe({event_type:'tool.request',request_id:'foo-1',tool:'coding_command_run',args:{root_id:'projects',command_id:'node_script'}},{sequence:4});
+ const output=tracker.observe({event_type:'tool.result',request_id:'foo-1',tool:'coding_command_run',
+  outcome:{is_error:true,reason:'failure after credential '+token,duration_ms:33}},{sequence:5});
+ assert.equal(typeof output,'string');
+ assert.doesNotMatch(output,/SECRET_RESULT_CANARY/);
+});

package/test/r67-machine-fs-smoke-epoch.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+test('R67 isolated machine-fs smoke binds its Coding grant to a durable authority epoch',()=>{
+  const env={...process.env};
+  delete env.DEADBYTE_STATE_ROOT;
+  const result=spawnSync(process.execPath,['src/machine-fs-smoke-client.mjs'],{
+    cwd:root,env,encoding:'utf8',windowsHide:true,shell:false,timeout:30000,maxBuffer:4*1024*1024
+  });
+  assert.equal(result.error,undefined,String(result.error??''));
+  assert.equal(result.status,0,`${result.stdout}\n${result.stderr}`);
+  const receipt=JSON.parse(String(result.stdout));
+  assert.equal(receipt.status,'passed');
+  assert.equal(receipt.mutation_receipts,5);
+  assert.equal(receipt.signature_valid,true);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/legacy-no-epoch/);
+});