deadbyte-mcp 0.15.43 → 0.15.44

package/test/r67-native-inspector.test.mjs

@@ -0,0 +1,131 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFile,writeFile,mkdtemp,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const exe=path.join(root,'bin','deadbyte-native-inspect-r67.exe');
+const hash=b=>createHash('sha256').update(b).digest('hex');
+function run(...args){
+ const r=spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:30000,maxBuffer:4*1024*1024});
+ assert.equal(r.error,undefined,r.error?.message);
+ const out=JSON.parse((r.stdout??'').trim());
+ assert.equal(out.schema,'deadbyte.native-inspect.r67.v1');
+ if(out.status==='ok')assert.equal(out.data_sha256,hash(Buffer.from(JSON.stringify(out.data),'utf8')),'independent serialized data digest');
+ return {...out,exit_code:r.status};
+}
+test('R67 native process snapshot is bounded, identity-bearing, and honestly partial',()=>{
+ const r=run('process','48');
+ assert.equal(r.status,'ok');
+ assert.equal(r.exit_code,0);
+ assert.equal(r.operation,'process');
+ assert.equal(r.data.api,'CreateToolhelp32Snapshot+OpenProcess+GetProcessTimes+QueryFullProcessImageNameW');
+ assert.ok(r.data.processes.length>=1&&r.data.processes.length<=48);
+ for(const p of r.data.processes){
+  assert.ok(Number.isSafeInteger(p.pid)&&p.pid>=0);
+  assert.ok(Number.isSafeInteger(p.parent_pid)&&p.parent_pid>=0);
+  assert.ok(['observed','unavailable','stale_or_reused'].includes(p.state));
+  if(p.state==='unavailable')assert.ok(Number.isInteger(p.win32_error)&&p.win32_error>0);
+  else if(p.state==='stale_or_reused'){assert.equal(p.snapshot_binding,'NAME_MISMATCH');assert.equal(p.win32_error,0);}
+  else {assert.equal(p.snapshot_binding,'UNVERIFIED');assert.match(p.creation_time_utc,/^\d{4}-\d\d-\d\dT/);assert.match(p.creation_filetime,/^\d+$/);assert.equal(p.win32_error,0);}
+ }
+});
+test('R67 VirtualQueryEx memory map records process identity, monotone bounded regions, and zero private memory data',()=>{
+ const r=run('map','self','64');
+ assert.equal(r.status,'ok');
+ assert.equal(r.exit_code,0);
+ assert.equal(r.operation,'map');
+ assert.equal(r.data.api,'VirtualQueryEx');
+ assert.match(r.data.creation_filetime,/^\d+$/);
+ assert.ok(r.data.regions.length>=1&&r.data.regions.length<=64);
+ let prev=-1n;
+ for(const row of r.data.regions){
+  const base=BigInt(row.base),size=BigInt(row.size);
+  assert.ok(base>prev&&size>0n);
+  prev=base;
+  assert.ok(Number.isInteger(row.state)&&Number.isInteger(row.protect)&&Number.isInteger(row.type));
+  assert.deepEqual(Object.keys(row),['base','allocation_base','size','state','protect','type']);
+ }
+ assert.equal(r.data.process_exited,false);
+ assert.equal(r.data.outcome,'HANDLE_IDENTITY_CONFIRMED');
+});
+test('R67 PE bytes and section table agree with an independent raw-file oracle',async()=>{
+ const b=await readFile(exe);
+ assert.equal(b.readUInt16LE(0),0x5a4d);
+ const p=b.readInt32LE(0x3c);
+ assert.ok(p>=64&&p+24<b.length);
+ assert.equal(b.readUInt32LE(p),0x4550);
+ const machine=b.readUInt16LE(p+4),sectionCount=b.readUInt16LE(p+6);
+ const optLength=b.readUInt16LE(p+20),magic=b.readUInt16LE(p+24);
+ const sectionOff=p+24+optLength;
+ const r=run('pe',exe);
+ assert.equal(r.status,'ok');assert.equal(r.exit_code,0);
+ assert.equal(r.data.file_sha256,hash(b));
+ assert.equal(r.data.file_size,b.length);
+ assert.equal(r.data.machine,machine);
+ assert.equal(r.data.number_of_sections,sectionCount);
+ assert.equal(r.data.format,magic===0x20b?'PE32+':'PE32');
+ assert.equal(r.data.sections.length,sectionCount);
+ for(let i=0;i<sectionCount;i++){
+  const off=sectionOff+i*40,row=r.data.sections[i];
+  assert.equal(row.rva,'0x'+b.readUInt32LE(off+12).toString(16));
+  assert.equal(row.raw_size,b.readUInt32LE(off+16));
+  assert.equal(row.raw_offset,b.readUInt32LE(off+20));
+  assert.equal(row.characteristics,b.readUInt32LE(off+36));
+  assert.ok(!row.raw_size||row.raw_offset+row.raw_size<=b.length);
+ }
+});
+test('R67 returns failed/error for inaccessible PID and malformed PE, never fabricated empty observations',async()=>{
+ const bad=run('map','4294967295','1','4');
+ assert.equal(bad.status,'failed');assert.equal(bad.exit_code,2);
+ assert.match(bad.error,/OpenProcess.*win32=|invalid PID/);
+ assert.ok(['ACCESS_DENIED','INVALID_PARAMETER','WIN32_FAILURE'].includes(bad.error_code));
+ assert.ok(Number.isInteger(bad.win32_error)&&bad.win32_error>0);
+ const folder=await mkdtemp(path.join(tmpdir(),'deadbyte-r67-pe-'));
+ try{
+  const file=path.join(folder,'invalid.exe');await writeFile(file,Buffer.alloc(128,0));
+  const invalid=run('pe',file);
+  assert.equal(invalid.status,'failed');assert.equal(invalid.exit_code,2);assert.match(invalid.error,/MZ|PE/);
+  assert.equal(invalid.error_code,'INVALID_INPUT');assert.equal(invalid.win32_error,0);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+
+test('R67 external PID memory map fails closed on missing or mismatched creation FILETIME',()=>{
+ const missing=run('map',String(process.pid));
+ assert.equal(missing.status,'failed');assert.equal(missing.exit_code,2);
+ assert.match(missing.error,/creation_filetime/);
+ const swapped=run('map',String(process.pid),'1','4');
+ assert.equal(swapped.status,'failed');assert.equal(swapped.exit_code,2);
+ assert.equal(swapped.error_code,'PROCESS_IDENTITY_MISMATCH');
+ assert.equal(swapped.win32_error,0);
+ const observed=run('identity',String(process.pid));
+ assert.equal(observed.status,'ok',observed.error);
+ assert.equal(observed.data.pid,process.pid);
+ const valid=run('map',String(process.pid),observed.data.creation_filetime,'4');
+ assert.equal(valid.status,'ok',valid.error);
+ assert.equal(valid.data.creation_filetime,observed.data.creation_filetime);
+ assert.equal(valid.data.pid,process.pid);
+});
+
+test('R67 exited process cannot silently turn into a successful PID-reused memory map',async()=>{
+ const {spawn}=await import('node:child_process');
+ const {once}=await import('node:events');
+ const child=spawn(process.execPath,['-e','setInterval(()=>{},500)'],{shell:false,windowsHide:true,stdio:'ignore'});
+ try{
+  await once(child,'spawn');
+  const identity=run('identity',String(child.pid));
+  assert.equal(identity.status,'ok',identity.error);
+  assert.equal(identity.data.pid,child.pid);
+  const stopped=once(child,'exit');
+  assert.equal(child.kill(),true);
+  await stopped;
+  const after=run('map',String(child.pid),identity.data.creation_filetime,'4');
+  assert.equal(after.status,'failed');
+  assert.equal(after.exit_code,2);
+  assert.equal(Object.hasOwn(after,'data'),false);
+  assert.ok(['WIN32_FAILURE','INVALID_PARAMETER','PROCESS_EXITED','PROCESS_IDENTITY_MISMATCH'].includes(after.error_code),after.error_code);
+ }finally{if(child.exitCode===null)child.kill();}
+});

package/test/r67-native-observation-authority.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createR67NativeObservationAuthority} from '../src/r67-native-observation-authority.mjs';
+
+const hex=c=>c.repeat(64);
+const policy={policy_sha256:hex('a'),roots:{projects:{read:true}}};
+let alive=true,generation=17;
+const getSession=async()=>alive?{
+ armed:true,standing:true,reason:'standing-grant',instance_nonce:hex('b'),root_ids:['projects'],
+ authority_epoch:{trusted:true,seq:generation,event_sha256:hex('c')}
+}:{armed:false,reason:'disarmed'};
+
+test('R67 observer fails closed without explicit owner opt-in, and denies other PID reads',async()=>{
+ const disabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession});
+ await assert.rejects(()=>disabled({operation:'process',args:['process','4']}),/DISABLED/);
+ const enabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession,enabled:true});
+ await assert.rejects(()=>enabled({operation:'map',args:['map','4148','3']}),/OTHER_PID/);
+ await assert.rejects(()=>enabled({operation:'identity',args:['identity','4148']}),/OTHER_PID/);
+ await assert.rejects(()=>enabled({operation:'exec',args:['exec','whoami']}),/SCOPE_DENIED/);
+});
+test('R67 observer binds machine-supplied authority to real standing epoch, not client grant',async()=>{
+ alive=true;
+ const enabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession,enabled:true});
+ const first=await enabled({operation:'map',args:['map','self','4']});
+ assert.equal(first.scope,'native-observe-readonly');
+ assert.equal(first.policy_sha256,policy.policy_sha256);
+ assert.equal(first.authority_generation,generation);
+ assert.match(first.grant_id,/^coding\.r67\.[0-9a-f]{32}$/);
+ const next=await enabled({operation:'map',args:['map','self','4']});
+ assert.deepEqual(first,next);
+ generation+=1;
+ const rotated=await enabled({operation:'map',args:['map','self','4']});
+ assert.notEqual(first.authority_generation,rotated.authority_generation);
+ alive=false;
+ await assert.rejects(()=>enabled({operation:'process',args:['process','4']}),/AUTHORITY_REVOKED/);
+});
+test('R67 observer rejects unverified lease epoch or changed policy',async()=>{
+ const disabled=createR67NativeObservationAuthority({
+  getCodingPolicy:()=>policy,enabled:true,sessionStatus:async()=>({
+   armed:true,standing:true,reason:'standing-grant',instance_nonce:hex('b'),root_ids:['projects'],
+   authority_epoch:{trusted:false,seq:100,event_sha256:hex('c')}
+  })
+ });
+ await assert.rejects(()=>disabled({operation:'process',args:['process','4']}),/AUTHORITY_REVOKED/);
+ const malformed=createR67NativeObservationAuthority({
+  getCodingPolicy:()=>({policy_sha256:hex('a'),roots:{}}),enabled:true,sessionStatus:getSession
+ });
+ await assert.rejects(()=>malformed({operation:'process',args:['process','4']}),/POLICY_MISSING/);
+});

package/test/r67-npm-cross-volume.test.mjs

@@ -0,0 +1,74 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,writeFile,rm,lstat,stat,readdir,symlink} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {preserveNpmTarball,assertVacantPackDestination} from '../scripts/npm-preserve-artifact-r67.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const digest=(bytes,algo='sha256')=>createHash(algo).update(bytes).digest(algo==='sha512'?'base64':'hex');
+const artifact=Buffer.concat([Buffer.from('R67 immutable npm tarball fixture\\n'),Buffer.alloc(4194305,0x5a)]);
+const integrity='sha512-'+digest(artifact,'sha512');
+
+async function fixture(fn){
+ await mkdir(path.join(root,'tmp'),{recursive:true});
+ const srcDir=await mkdtemp(path.join(root,'tmp','r67-xdev-src-'));
+ const dstDir=await mkdtemp(path.join(tmpdir(),'r67-xdev-dst-'));
+ const source=path.join(srcDir,'deadbyte-mcp-0.15.44.tgz');
+ const destination=path.join(dstDir,'deadbyte-mcp-0.15.44.tgz');
+ try{return await fn({source,destination,srcDir,dstDir});}
+ finally{await rm(srcDir,{recursive:true,force:true});await rm(dstDir,{recursive:true,force:true});}
+}
+test('R67 preserves immutable package across Windows drives without EXDEV, hash-verifies, and removes source only after successful commit',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);
+ const srcDrive=(await stat(path.dirname(source))).dev,dstDrive=(await stat(path.dirname(destination))).dev;
+ if(process.platform==='win32')assert.notEqual(srcDrive,dstDrive,'Windows test must cover different volumes D and C');
+ const result=await preserveNpmTarball({source,destination,expectedIntegrity:integrity});
+ assert.equal(result.status,'VERIFIED_PRESERVED');
+ assert.equal(result.sha256,digest(artifact));
+ assert.equal(result.bytes,artifact.length);
+ assert.deepEqual(await readFile(destination),artifact);
+ await assert.rejects(()=>lstat(source),{code:'ENOENT'});
+ assert.deepEqual((await readdir(path.dirname(destination))).sort(),[path.basename(destination)]);
+}));
+test('R67 rejects incorrect npm-integrity before writing any destination and retains source',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:'sha512-'+digest(Buffer.from('wrong'),'sha512')}),/integrity/i);
+ assert.deepEqual(await readFile(source),artifact);
+ await assert.rejects(()=>lstat(destination),{code:'ENOENT'});
+}));
+test('R67 never clobbers pre-existing different destination bytes',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);await writeFile(destination,Buffer.from('other release artifact'));
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:integrity}),/exists|conflict|different/i);
+ assert.deepEqual(await readFile(source),artifact);
+ assert.equal((await readFile(destination)).toString(),'other release artifact');
+}));
+test('R67 repairs post-commit/pre-cleanup crash without repeating publication and validates immutable destination',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);await writeFile(destination,artifact);
+ const result=await preserveNpmTarball({source,destination,expectedIntegrity:integrity});
+ assert.equal(result.status,'VERIFIED_ALREADY_PRESERVED');
+ assert.deepEqual(await readFile(destination),artifact);
+ await assert.rejects(()=>lstat(source),{code:'ENOENT'});
+}));
+test('R67 rejects a symlink/reparse source and leaves destination absent',()=>fixture(async ({source,destination})=>{
+ await writeFile(source+'.real',artifact);
+ try{await symlink(source+'.real',source);}
+ catch(error){
+  if(process.platform!=='win32'||error?.code!=='EPERM')throw error;
+  const junctionTarget=source+'.junction-target';
+  await mkdir(junctionTarget);
+  await symlink(junctionTarget,source,'junction');
+ }
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:integrity}),/symlink|regular/i);
+ await assert.rejects(()=>lstat(destination),{code:'ENOENT'});
+}));
+
+test('R67 npm pack never overwrites pre-existing unclaimed artifact after EXDEV',()=>fixture(async ({source})=>{
+ await writeFile(source,artifact);
+ await assert.rejects(()=>assertVacantPackDestination({root:path.dirname(source),filename:path.basename(source)}),/PACK_BLOCKED|preserv|exists/i);
+ assert.deepEqual(await readFile(source),artifact);
+ const fresh=await assertVacantPackDestination({root:path.dirname(source),filename:'new-artifact.tgz'});
+ assert.equal(fresh,path.join(path.dirname(source),'new-artifact.tgz'));
+}));

package/test/r67-npm-publish-gate.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {assertR67NpmPublishReady} from '../scripts/npm-release-readiness-r67.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+test('R67 current sealed prepublish candidate satisfies the exact publish-readiness metadata gate',async()=>{
+ const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+ assert.equal(release.r67_native_observation.status,'CANDIDATE_SEALED');
+ assert.doesNotThrow(()=>assertR67NpmPublishReady(release));
+});
+test('R67 exact mandatory gate flags must all pass before candidate npm publication',()=>{
+ const seed={version:'0.15.44',train:'R67',r67_native_observation:{
+  status:'CANDIDATE_SEALED',full_release_gate:'PASS',current_source_full_shards:'PASS',
+  native_fault_injection:'PASS',protocol_parity:'PASS',isolated_activation_rollback_restore:'PASS',
+  independent_machine_observation:'PASS'}};
+ assert.doesNotThrow(()=>assertR67NpmPublishReady(seed));
+ for(const k of Object.keys(seed.r67_native_observation)){
+  const bad=structuredClone(seed);bad.r67_native_observation[k]='PENDING';
+  assert.throws(()=>assertR67NpmPublishReady(bad),/PUBLISH_BLOCKED/);
+ }
+});
+test('R67 real npm publisher must enforce publish readiness before npm pack / dispatch',async()=>{
+ const src=await readFile(path.join(root,'scripts','npm-release-r48.mjs'),'utf8');
+ const guard=src.indexOf('assertR67NpmPublishReady(release)');
+ const pack=src.indexOf("'pack', '--json'");
+ const submit=src.indexOf("'publish',publishTarball");
+ assert.ok(guard>0&&guard<pack&&guard<submit,'trusted metadata gate precedes network/npm pack and publication');
+ assert.ok(src.includes('preserveNpmTarball({source:tarball,destination:preservedTarball'));
+});
+
+test('R67 publisher checks for an existing tarball before npm pack can overwrite historical evidence',async()=>{
+ const src=await readFile(path.join(root,'scripts','npm-release-r48.mjs'),'utf8');
+ const guard=src.indexOf('await assertVacantPackDestination(');
+ const pack=src.indexOf("'pack', '--json'");
+ assert.ok(guard>0&&guard<pack,'pre-existing tarball guard must run before npm pack');
+});

package/test/r67-regression-shards.test.mjs

@@ -0,0 +1,184 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createR67ShardPlan,reconcileR67Shards,r67ShardTimeoutMs,r67RegressionTreeHash,parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+import {mkdtemp,mkdir,writeFile,rm,symlink} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const names=Array.from({length:326},(_,i)=>'test/f-'+String(i).padStart(3,'0')+'.test.mjs');
+test('R67 deterministic shards cover 326 files exactly once and remain stable under input reordering',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const other=createR67ShardPlan([...names].reverse(),32);
+ assert.deepEqual(other,plan);
+ assert.equal(plan.shards.length,32);
+ assert.deepEqual(plan.shards.flatMap(x=>x.files).sort(),names);
+ assert.equal(new Set(plan.shards.flatMap(x=>x.files)).size,326);
+ assert.match(plan.plan_sha256,/^[a-f0-9]{64}$/);
+ for(const shard of plan.shards){
+  assert.ok(shard.files.length>=10&&shard.files.length<=11);
+  assert.match(shard.files_sha256,/^[a-f0-9]{64}$/);
+ }
+});
+test('R67 verifier must BLOCK incomplete coverage, reject duplicates and never forge full PASS',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const make=shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0});
+ const receipts=plan.shards.slice(0,31).map(make);
+ const incomplete=reconcileR67Shards(plan,receipts);
+ assert.equal(incomplete.status,'BLOCKED');
+ assert.deepEqual(incomplete.missing,[31]);
+ assert.throws(()=>reconcileR67Shards(plan,[...receipts,receipts[0]]),/duplicate/i);
+ const complete=reconcileR67Shards(plan,plan.shards.map(make));
+ assert.equal(complete.status,'PASS');
+ assert.equal(complete.file_count,326);
+ assert.equal(complete.failed,0);
+});
+test('R67 verifier fails closed for tampered test partition, nonzero exit and UNKNOWN outcomes',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const good=plan.shards.map(shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0}));
+ const altered=structuredClone(good);altered[5].files_sha256='0'.repeat(64);
+ assert.equal(reconcileR67Shards(plan,altered).status,'FAILED');
+ const failed=structuredClone(good);failed[3].exit_code=1;failed[3].status='FAILED';failed[3].failed=1;
+ assert.equal(reconcileR67Shards(plan,failed).status,'FAILED');
+ const unknown=structuredClone(good);unknown[2].status='OUTCOME_UNKNOWN';unknown[2].exit_code=null;
+ assert.equal(reconcileR67Shards(plan,unknown).status,'OUTCOME_UNKNOWN');
+ assert.throws(()=>createR67ShardPlan([...names,names[0]],32),/duplicate/);
+});
+
+test('R67 real timed-out shard with null TAP counts remains OUTCOME_UNKNOWN, not forged FAILED',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const receipts=plan.shards.map(shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0}));
+ receipts[5]={...receipts[5],status:'OUTCOME_UNKNOWN',exit_code:null,test_count:null,passed:null,failed:null};
+ const result=reconcileR67Shards(plan,receipts);
+ assert.equal(result.status,'OUTCOME_UNKNOWN');
+ assert.equal(result.integrity_failed,false);
+});
+
+test('R67 measured 110.4s remote and 53.2s controller integration suites get isolated bounded deadlines',()=>{
+ const remote='test/remote-session-cli.test.mjs';
+ const controller='test/r58-controller-live-local.test.mjs';
+ const input=[...names,remote,controller];
+ const first=createR67ShardPlan(input,32);
+ const repeat=createR67ShardPlan([...input].reverse(),32);
+ assert.deepEqual(repeat,first);
+ const remoteShard=first.shards.find(s=>s.files.includes(remote));
+ const controllerShard=first.shards.find(s=>s.files.includes(controller));
+ assert.deepEqual(remoteShard.files,[remote]);
+ assert.deepEqual(controllerShard.files,[controller]);
+ assert.notEqual(remoteShard.index,controllerShard.index);
+ assert.equal(r67ShardTimeoutMs(remoteShard),165000);
+ assert.equal(r67ShardTimeoutMs(controllerShard),120000);
+ assert.deepEqual(first.shards.flatMap(s=>s.files).sort(),[...input].sort());
+ for(const shard of first.shards.filter(s=>s.index!==remoteShard.index&&s.index!==controllerShard.index)){
+  assert.ok(shard.files.length>=10&&shard.files.length<=11);
+  assert.equal(r67ShardTimeoutMs(shard),58000);
+ }
+});
+
+test('R67 regression fingerprint detects implementation-only source drift even if tests are untouched',async()=>{
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-fingerprint-'));
+ try{
+  await mkdir(path.join(dir,'src'));await mkdir(path.join(dir,'test'));
+  await writeFile(path.join(dir,'package.json'),'{}');
+  await writeFile(path.join(dir,'src','core.mjs'),'export const number = 1;');
+  await writeFile(path.join(dir,'test','core.test.mjs'),'test does not change');
+  const opts={roots:['src','test'],topLevel:['package.json'],extra:[]};
+  const baseline=await r67RegressionTreeHash(dir,opts);
+  assert.match(baseline.sha256,/^[a-f0-9]{64}$/);
+  assert.equal(baseline.file_count,3);
+  const same=await r67RegressionTreeHash(dir,opts);
+  assert.deepEqual(same,baseline);
+  await writeFile(path.join(dir,'src','core.mjs'),'export const number = 2;');
+  const drift=await r67RegressionTreeHash(dir,opts);
+  assert.notEqual(drift.sha256,baseline.sha256,'changing only source must invalidate receipts');
+  try{await symlink(path.join(dir,'package.json'),path.join(dir,'src','backdoor.mjs'));}
+  catch(error){
+   if(process.platform!=='win32'||error?.code!=='EPERM')throw error;
+   const junctionTarget=path.join(dir,'junction-target');
+   await mkdir(junctionTarget);
+   await symlink(junctionTarget,path.join(dir,'src','backdoor'),'junction');
+  }
+  await assert.rejects(()=>r67RegressionTreeHash(dir,opts),/symlink/i);
+ }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('R67 terminal TAP summary enforces complete counts and rejects forged/truncated PASS',()=>{
+ const ok=['✔ fixture succeeded (1ms)','ℹ tests 5','ℹ suites 0','ℹ pass 4','ℹ fail 0','ℹ cancelled 0','ℹ skipped 1','ℹ todo 0'].join('\n');
+ const parsed=parseR67TapSummary(ok);
+ assert.deepEqual(parsed,{tests:5,pass:4,fail:0,cancelled:0,skipped:1,todo:0});
+ assert.equal(parseR67TapSummary('test does not carry terminal TAP'),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ tests 5','ℹ tests 6')),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ cancelled 0','ℹ cancelled 1')),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ todo 0','ℹ todo 1')),null);
+});
+
+test('R67 v2 shard receipt rejects inconsistent skip totals and cancelled outcomes',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const good=plan.shards.map(shard=>({schema:'deadbyte.r67-shard-result.v2',shard_index:shard.index,
+  plan_sha256:plan.plan_sha256,files_sha256:shard.files_sha256,status:'PASS',exit_code:0,
+  test_count:shard.files.length,passed:shard.files.length,failed:0,skipped:0,cancelled:0,todo:0}));
+ assert.equal(reconcileR67Shards(plan,good).status,'PASS');
+ const altered=structuredClone(good);altered[1].skipped=1;
+ assert.equal(reconcileR67Shards(plan,altered).status,'FAILED');
+ const cancelled=structuredClone(good);cancelled[1].passed-=1;cancelled[1].cancelled=1;
+ assert.equal(reconcileR67Shards(plan,cancelled).status,'FAILED');
+});
+
+test('R67 CLI reconciliation delegates to same independently tested v2 evaluator',async()=>{
+ const {readFile}=await import('node:fs/promises');
+ const {fileURLToPath}=await import('node:url');
+ const here=path.dirname(fileURLToPath(import.meta.url));
+ const runner=await readFile(path.join(here,'..','scripts','r67-regression-shard-run.mjs'),'utf8');
+ const cli=await readFile(path.join(here,'..','scripts','r67-regression-reconcile.mjs'),'utf8');
+ const core=await readFile(path.join(here,'..','src','r67-evidence-reconcile.mjs'),'utf8');
+ assert.ok(runner.includes("schema:'deadbyte.r67-shard-result.v2'"));
+ assert.ok(cli.includes("import {reconcileR67Evidence} from"));
+ assert.ok(core.includes("result.schema!=='deadbyte.r67-shard-result.v2'"));
+ assert.ok(cli.includes("if(result.status!=='PASS')process.exitCode=2;"));
+});
+
+test('R67 evidence reconciler fails closed on absent operation identity',async()=>{
+ const {reconcileR67Evidence}=await import('../src/r67-evidence-reconcile.mjs');
+ await assert.rejects(()=>reconcileR67Evidence({root:'X',evidenceRoot:'Y',operationId:'../escape'}),/bounded root|operation identity/);
+});
+
+test('R67 TAP nonpass ledger preserves test name and explicit SKIP reason, rejects unnamed skips',async()=>{
+ const {parseR67NonpassCases}=await import('../src/r67-regression-shards.mjs');
+ const tap=[
+ 'TAP version 13',
+ 'ok 1 - works',
+ 'ok 2 - Windows-only hook # SKIP unavailable on platform',
+ '    ok 1 - case without reason # SKIP',
+ 'ok 3 - not yet implemented # TODO waiting on API',
+ '# tests 4','# pass 1','# fail 0','# cancelled 0','# skipped 2','# todo 1'
+ ].join('\n');
+ const v=parseR67NonpassCases(tap);
+ assert.equal(v.cases.length,3);
+ assert.equal(v.cases[0].name,'Windows-only hook');
+ assert.equal(v.cases[0].reason,'unavailable on platform');
+ assert.equal(v.cases[1].reason,null);
+ assert.equal(v.cases[2].kind,'TODO');
+ assert.equal(v.fully_classified,false);
+ assert.equal(v.unclassified_count,1);
+});
+
+test('R67 preserves bounded case identity for a TAP FAILED leaf instead of empty nonpass evidence',async()=>{
+ const {parseR67FailedCases}=await import('../src/r67-regression-shards.mjs');
+ const tap=['TAP version 13','# Subtest: remote test','not ok 4 - remote owner cleanup is durable',
+ '  ---','  error: \'sensitive runtime stack omitted\'','  ...','# tests 26','# pass 25','# fail 1','# cancelled 0','# skipped 0','# todo 0'].join('\n');
+ const parsed=parseR67FailedCases(tap);
+ assert.equal(parsed.count,1);
+ assert.equal(parsed.cases[0].name,'remote owner cleanup is durable');
+ assert.match(parsed.cases[0].name_sha256,/^[a-f0-9]{64}$/);
+ assert.ok(!JSON.stringify(parsed).includes('sensitive runtime stack'));
+});
+test('R67 failed-case parser remains fail closed on missing TAP and secret-shaped titles',async()=>{
+ const {parseR67FailedCases}=await import('../src/r67-regression-shards.mjs');
+ const missing=parseR67FailedCases('TAP version 13\n# tests 2\n# pass 1\n# fail 1\n');
+ assert.equal(missing.complete,false);
+ const title='remote failed sk-proj-secret-token-value';
+ const guarded=parseR67FailedCases('not ok 1 - '+title+'\n# tests 1\n# pass 0\n# fail 1\n# cancelled 0\n# skipped 0\n# todo 0');
+ assert.equal(guarded.cases[0].name,'[redacted]');
+ assert.equal(guarded.count,1);
+});

package/test/r67-release-contract.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+const get=async rel=>JSON.parse(await readFile(new URL('../'+rel,import.meta.url),'utf8'));
+const parent={
+ release_id:'v0.15.43-4c4a64a4c8e9f5a6',
+ manifest_sha256:'4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33',
+ generation_manifest_sha256:'ef3b041e2a87c2e143d4733a98a52d9db80cd16ad7007e112fcb5202e70c77c3'
+};
+test('R67 release version, predecessor evidence, and observed prepublish seal are exact',async()=>{
+ const [pkg,lock,bridge,release,prov,matrix,sbom,version]=await Promise.all([
+  get('package.json'),get('package-lock.json'),get('bridge/package.json'),
+  get('RELEASE.json'),get('PROVENANCE.json'),get('TEST-MATRIX.json'),get('SBOM.cdx.json'),
+  readFile(new URL('../src/version.mjs',import.meta.url),'utf8')
+ ]);
+ assert.equal(pkg.version,'0.15.44');
+ assert.equal(lock.version,pkg.version);
+ assert.equal(lock.packages[''].version,pkg.version);
+ assert.equal(bridge.version,pkg.version);
+ assert.match(version,/DEADBYTE_VERSION = '0\.15\.44'/);
+ assert.equal(release.version,pkg.version);
+ assert.equal(release.train,'R67');
+ assert.equal(release.parent.version,'0.15.43');
+ assert.equal(release.parent.release_id,parent.release_id);
+ assert.equal(release.parent.manifest_sha256,parent.manifest_sha256);
+ assert.equal(release.parent.generation_manifest_sha256,parent.generation_manifest_sha256);
+ assert.deepEqual(release.runtime_predecessor,parent);
+ assert.equal(prov.version,pkg.version);
+ assert.equal(prov.parent_release_id,parent.release_id);
+ assert.equal(prov.parent_manifest_sha256,parent.manifest_sha256);
+ assert.equal(prov.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
+ assert.equal(matrix.version,pkg.version);
+ assert.equal(matrix.train,'R67');
+ assert.equal(sbom.metadata.component.version,pkg.version);
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r67:0.15.44');
+ assert.equal(release.r67_native_observation.status,'CANDIDATE_SEALED');
+ assert.equal(release.r67_native_observation.new_public_tools,0);
+ assert.equal(release.r67_native_observation.full_release_gate,'PASS');
+ assert.equal(release.r67_native_observation.current_source_full_shards,'PASS');
+ assert.equal(release.r67_native_observation.isolated_activation_rollback_restore,'PASS');
+ assert.ok(matrix.required.some(x=>x.id==='r67-sharded-full'));
+ assert.match(pkg.scripts['gate:windows'],/gate-windows-r67\.ps1/);
+ assert.match(pkg.scripts['r67:focused:test'],/r67-focused-gate\.mjs/);
+});

package/test/r67-runtime-observation-binding.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createMachineRuntime} from '../src/machine-identity.mjs';
+import {independentlyVerifyR67RuntimeObservation} from '../scripts/r67-independent-runtime-observation-verify.mjs';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const POLICY='a'.repeat(64),GRANT='r67-fixture-grant-1';
+async function fixture(callback){
+ const stateRoot=await mkdtemp(path.join(os.tmpdir(),'r67-owned-observation-'));
+ const release=path.join(stateRoot,'releases','r67'),generation=path.join(stateRoot,'generations','r67');
+ await mkdir(release,{recursive:true});await mkdir(generation,{recursive:true});
+ const releaseBytes=Buffer.from('candidate-r67-release\n'),generationBytes=Buffer.from('candidate-r67-generation\n');
+ await writeFile(path.join(release,'MANIFEST.SHA256'),releaseBytes);
+ await writeFile(path.join(generation,'GENERATION.SHA256'),generationBytes);
+ const releaseHash=sha(releaseBytes),generationHash=sha(generationBytes);
+ const pointer={
+  schema:'deadbyte.active-release.v1',release_id:'v0.15.43-'+releaseHash.slice(0,16),version:'0.15.43',
+  manifest_sha256:releaseHash,release_root:release,generation_root:generation,
+  generation_manifest_sha256:generationHash,launcher_sha256:'1'.repeat(64),
+  config_path:path.join(generation,'controller-config.psd1')
+ };
+ const activePointerPath=path.join(stateRoot,'active-release.json');
+ await writeFile(activePointerPath,JSON.stringify(pointer)+'\n');
+ const runtime=await createMachineRuntime({stateRoot,activePointerPath,assertObservationAuthority:callback});
+ return {runtime,stateRoot,cleanup:()=>rm(stateRoot,{recursive:true,force:true})};
+}
+const grant=()=>({grant_id:GRANT,policy_sha256:POLICY,scope:'native-observe-readonly',authority_generation:4});
+test('R67 isolated machine-owned observation signs actual Windows native process data with generation and scoped standing-grant',async()=>{
+ const phases=[];
+ const x=await fixture(async({phase,operation})=>{phases.push(phase);assert.equal(operation,'process');return grant();});
+ try{
+  const before=await x.runtime.status();
+  const output=await x.runtime.observeNative({args:['process','4']});
+  assert.equal(output.result.status,'ok');
+  assert.equal(output.receipt.machine_id,before.machine_id);
+  assert.equal(output.receipt.generation_manifest_sha256,before.generation_manifest_sha256);
+  assert.equal(output.receipt.authority.grant_id,GRANT);
+  assert.deepEqual(phases,['pre','post']);
+  const check=independentlyVerifyR67RuntimeObservation({
+   receipt:output.receipt,result:output.result,requestArgs:['process','4'],
+   machinePublicSpkiBase64:before.public_key_spki_base64,
+   expectedMachineStatus:before,expectedPolicySha256:POLICY,expectedGrantId:GRANT
+  });
+  assert.equal(check.ok,true,check.reason);
+  assert.equal(check.signature_valid,true);
+ }finally{await x.cleanup();}
+});
+test('R67 runtime observer denies missing authority, changing lease and revoked grant before signing',async()=>{
+ const noAuthority=await fixture(null);
+ try{await assert.rejects(()=>noAuthority.runtime.observeNative({args:['process','4']}),/authority/i);}
+ finally{await noAuthority.cleanup();}
+ let armed=true,rotate=false;
+ const x=await fixture(async({phase})=>{
+  if(phase==='post'&&rotate)armed=false;
+  if(!armed)throw new Error('LOCAL_AUTHORITY_REVOKED');
+  return grant();
+ });
+ try{
+  rotate=true;
+  await assert.rejects(()=>x.runtime.observeNative({args:['process','4']}),/LOCAL_AUTHORITY_REVOKED/);
+  assert.equal(armed,false);
+ }finally{await x.cleanup();}
+});
+test('R67 runtime observation verifier rejects changed result, request, generation, grant and signature',async()=>{
+ const x=await fixture(async()=>grant());
+ try{
+  const before=await x.runtime.status();
+  const xResult=await x.runtime.observeNative({args:['process','4']});
+  const verify=(receipt,result,args=['process','4'],status=before)=>independentlyVerifyR67RuntimeObservation({
+   receipt,result,requestArgs:args,machinePublicSpkiBase64:before.public_key_spki_base64,
+   expectedMachineStatus:status,expectedPolicySha256:POLICY,expectedGrantId:GRANT
+  }).ok;
+  assert.equal(verify(xResult.receipt,xResult.result),true);
+  const corrupt=structuredClone(xResult.result);corrupt.data.processes[0].name+='INJECTED';
+  assert.equal(verify(xResult.receipt,corrupt),false);
+  assert.equal(verify(xResult.receipt,xResult.result,['process','8']),false);
+  assert.equal(verify({...xResult.receipt,generation_manifest_sha256:'0'.repeat(64)},xResult.result),false);
+  assert.equal(verify({...xResult.receipt,authority:{...xResult.receipt.authority,grant_id:'wrong'}},xResult.result),false);
+  assert.equal(verify({...xResult.receipt,attestation:{...xResult.receipt.attestation,signature_base64:'AA=='}},xResult.result),false);
+  const after={...before,identity_generation:before.identity_generation+1};
+  assert.equal(verify(xResult.receipt,xResult.result,['process','4'],after),false);
+ }finally{await x.cleanup();}
+});

package/test/r67-server-observation-wiring.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+test('R67 server-owned Native Observer is wired to live Coding standing epoch and explicitly opted in',async()=>{
+ const source=await readFile(new URL('../src/mcp-server.mjs',import.meta.url),'utf8');
+ assert.match(source,/import \{ createR67NativeObservationAuthority \} from '\.\/r67-native-observation-authority\.mjs'/);
+ assert.match(source,/let codingPolicy=null;/);
+ assert.match(source,/DEADBYTE_R67_NATIVE_OBSERVE \?\? '0'/);
+ assert.match(source,/getCodingPolicy:\(\)=>codingPolicy,enabled:nativeObserveMode==='1'/);
+ assert.match(source,/createMachineRuntime\(\{stateRoot:runtimeStateRoot,assertObservationAuthority:assertNativeObservationAuthority\}\)/);
+ assert.equal((source.match(/let codingPolicy=null;/g)??[]).length,1);
+});