deadbyte-mcp 0.15.43 → 0.15.45

package/scripts/npm-release-r48.mjs

@@ -1,7 +1,10 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { reconcileNpmPublication } from './npm-publication-r65.mjs';
-import { mkdtemp, readFile, rm, unlink, mkdir, rename } from 'node:fs/promises';
+import { mkdtemp, readFile, rm, unlink, mkdir } from 'node:fs/promises';
+import {preserveNpmTarball,assertVacantPackDestination} from './npm-preserve-artifact-r67.mjs';
+import {assertR67NpmPublishReady} from './npm-release-readiness-r67.mjs';
+import {assertR71NpmPublishReady} from './npm-release-readiness-r71.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -86,6 +89,8 @@ async function main() {
   if (provenance.version !== version) {
     throw new Error(`PROVENANCE.json version mismatch: package=${version} provenance=${provenance.version}`);
   }
+  if (!isVerifyOnly && version==='0.15.44') assertR67NpmPublishReady(release);
+  if (!isVerifyOnly && version==='0.15.45') assertR71NpmPublishReady(release);
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
@@ -113,6 +118,7 @@ async function main() {
   if(publicationDir)await mkdir(publicationDir,{recursive:true});
   if(resuming&&!existsSync(preservedTarball))throw new Error('immutable npm publication claim exists but exact local tarball is missing; manual artifact reconciliation required');
   if(!resuming&&preservedTarball&&existsSync(preservedTarball))throw new Error('unclaimed preserved npm tarball exists; inspect artifact evidence before another pack');
+  if(!resuming)await assertVacantPackDestination({root,filename:`deadbyte-mcp-${version}.tgz`});
   const packed=resuming?null:parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
   const packRecord=resuming?{filename:path.basename(preservedTarball)}:(Array.isArray(packed) ? packed[0] : packed?.[pkg.name]);
   const filename = packRecord?.filename;
@@ -196,7 +202,11 @@ async function main() {
       return;
     }
 
-    if(!resuming)await rename(tarball,preservedTarball);
+    if(!resuming){
+      const preserved=await preserveNpmTarball({source:tarball,destination:preservedTarball,
+        expectedIntegrity:packRecord.integrity,expectedShasum:packRecord.shasum});
+      console.log('Immutable cross-volume artifact preservation verified: '+JSON.stringify(preserved));
+    }
     const publishTarball=preservedTarball;
     const localBytes = await readFile(publishTarball);
     const localIntegrity=`sha512-${createHash('sha512').update(localBytes).digest('base64')}`;

package/scripts/npm-release-readiness-r67.mjs

@@ -0,0 +1,26 @@
+/**
+ * R67 npm publish fence. Does not prove Windows release readiness by itself:
+ * only the independent release verifier may change these metadata gates.
+ * The package publisher must never interpret focused or package-only PASS as
+ * authority to make an immutable public release.
+ */
+export function assertR67NpmPublishReady(release){
+ if(release?.version!=='0.15.44'||release?.train!=='R67')
+  throw new Error('PUBLISH_BLOCKED R67 release identity does not match candidate');
+ const state=release.r67_native_observation;
+ const gates={
+  status:'CANDIDATE_SEALED',
+  full_release_gate:'PASS',
+  current_source_full_shards:'PASS',
+  native_fault_injection:'PASS',
+  protocol_parity:'PASS',
+  isolated_activation_rollback_restore:'PASS',
+  independent_machine_observation:'PASS'
+ };
+ for(const [key,expected] of Object.entries(gates)){
+  if(state?.[key]!==expected)
+   throw new Error('PUBLISH_BLOCKED R67 '+key+' '+String(state?.[key]??'MISSING')+
+    '; require independently verified gate '+expected+' before npm publication');
+ }
+ return {status:'R67_METADATA_GATES_MATCH',policy:'PUBLISH_REQUIRES_INDEPENDENT_RELEASE_EVIDENCE'};
+}

package/scripts/npm-release-readiness-r71.mjs

@@ -0,0 +1,21 @@
+/** Publication fence for the exact R71 successor, not an execution receipt. */
+export function assertR71NpmPublishReady(release){
+  if(release?.version!=='0.15.45'||release?.train!=='R71'||
+     release?.parent?.release_id!=='v0.15.44-9f500af433df3e77'||
+     release?.parent?.manifest_sha256!=='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e'||
+     release?.parent?.generation_manifest_sha256!=='c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'){
+    throw new Error('PUBLISH_BLOCKED R71 release or sealed predecessor identity mismatch');
+  }
+  const state=release.r71_candidate;
+  const required={status:'CANDIDATE_SEALED',full_regression:'PASS',manifest:'PASS',
+    windows_gate:'PASS',hot_swap:'PASS',package_acceptance:'PASS',
+    local_coding_preview:'PASS_CODING_READ_ONLY_NO_AUTONOMOUS_APPLY',
+    public_catalog:'PASS_43_TOOLS',signed_public_mcp:'PASS',performance_l0:'PASS'};
+  for(const [field,expected] of Object.entries(required)){
+    if(state?.[field]!==expected) throw new Error(`PUBLISH_BLOCKED R71 ${field}=${String(state?.[field]??'MISSING')}; require ${expected}`);
+  }
+  if(!['PASS_OWNER_ENROLLED','DISABLED_FAIL_CLOSED_NO_OWNER_ENROLLMENT'].includes(state?.owner_independent_project_grant)){
+    throw new Error('PUBLISH_BLOCKED R71 owner project grant must be proven or explicitly fail-closed disabled');
+  }
+  return {status:'R71_METADATA_GATES_MATCH',policy:'PUBLISH_REQUIRES_INDEPENDENT_RELEASE_EVIDENCE'};
+}

package/scripts/r67-acquire-alpha-reference.mjs

@@ -0,0 +1,95 @@
+import https from 'node:https';
+import {createHash} from 'node:crypto';
+import {gunzipSync} from 'node:zlib';
+import {mkdir,open,writeFile,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const ref=path.resolve(root,'..','..','references','desktop-commander-0.3.1-alpha.2');
+const version='0.3.1-alpha.2';
+const packageName='@wonderwhy-er/desktop-commander';
+const url='https://registry.npmjs.org/@wonderwhy-er%2fdesktop-commander/'+version;
+const hash=(b,algo='sha256')=>createHash(algo).update(b).digest('hex');
+async function fetchBounded(url,maxSize){
+ const parsed=new URL(url);
+ if(parsed.protocol!=='https:'||parsed.hostname!=='registry.npmjs.org'||parsed.username||parsed.password||parsed.port)throw new Error('untrusted npm endpoint');
+ return await new Promise((resolve,reject)=>{
+  const req=https.get(parsed,{timeout:20000,headers:{'Accept':'application/json','User-Agent':'deadbyte-reference-verifier/1.0'}},res=>{
+   if(res.statusCode!==200){res.resume();reject(new Error('npm GET HTTP '+res.statusCode));return;}
+   const parts=[];let size=0;
+   res.on('data',b=>{size+=b.length;if(size>maxSize){req.destroy(new Error('download exceeded declared safety cap'));return;}parts.push(b);});
+   res.on('end',()=>resolve(Buffer.concat(parts)));
+   res.on('error',reject);
+  });
+  req.on('timeout',()=>req.destroy(new Error('npm request timeout')));
+  req.on('error',reject);
+ });
+}
+async function saveNew(file,data){
+ const h=await open(file,'wx',0o600);
+ try{await h.writeFile(data);await h.sync();}finally{await h.close();}
+}
+const metadata=JSON.parse((await fetchBounded(url,1024*1024)).toString('utf8'));
+if(metadata.name!==packageName||metadata.version!==version)throw new Error('npm metadata identity mismatch');
+const tarball=metadata.dist?.tarball;
+const expected='https://registry.npmjs.org/@wonderwhy-er/desktop-commander/-/desktop-commander-'+version+'.tgz';
+if(tarball!==expected)throw new Error('registry tarball URL is not exact pinned package');
+if(!/^sha512-[A-Za-z0-9+/]+=*$/.test(metadata.dist.integrity??''))throw new Error('missing registry SHA512 integrity');
+const tar=await fetchBounded(tarball,32*1024*1024);
+const integrity='sha512-'+createHash('sha512').update(tar).digest('base64');
+if(integrity!==metadata.dist.integrity)throw new Error('npm SHA512 integrity mismatch');
+if(metadata.dist.shasum&&hash(tar,'sha1')!==metadata.dist.shasum)throw new Error('npm SHA1 mismatch');
+const expanded=gunzipSync(tar,{maxOutputLength:128*1024*1024});
+const files=[];let offset=0,total=0;
+const selected=[];
+const names=new Set();
+function cstr(b){return b.toString('utf8').split('\0')[0];}
+while(offset+512<=expanded.length){
+ const header=expanded.subarray(offset,offset+512);
+ if(header.every(v=>v===0))break;
+ const filename=cstr(header.subarray(0,100));
+ const prefix=cstr(header.subarray(345,500));
+ const name=prefix?prefix+'/'+filename:filename;
+ const szText=cstr(header.subarray(124,136)).trim();
+ if(!/^[0-7]*$/.test(szText))throw new Error('non-octal tar entry size');
+ const size=parseInt(szText||'0',8);
+ const type=header[156];
+ if(!Number.isSafeInteger(size)||size<0||offset+512+size>expanded.length)throw new Error('corrupt archive boundary');
+ if(type===50||type===49)throw new Error('tar link entry denied');
+ if(type===0||type===48){
+  if(!name.startsWith('package/')||name.includes('\\')||name.includes(':')||
+    name.split('/').some(c=>!c||c==='.'||c==='..')||names.has(name))throw new Error('unsafe tar entry '+name);
+  names.add(name);files.push({path:name,size});total+=size;
+  if(files.length>1000||total>128*1024*1024)throw new Error('tar inventory budget exceeded');
+  const rel=name.slice('package/'.length);
+  if(/^(?:package\.json|README\.md|LICENSE|LICENCE|dist\/[a-zA-Z0-9_./-]+\.(?:js|mjs|cjs|json|map))$/.test(rel)&&size<=8*1024*1024)
+   selected.push({rel,content:Buffer.from(expanded.subarray(offset+512,offset+512+size))});
+ }else if(![53,120,103].includes(type))throw new Error('unsupported tar type '+type+' for '+name);
+ offset+=512+Math.ceil(size/512)*512;
+}
+const packageEntry=selected.find(e=>e.rel==='package.json');
+if(!packageEntry)throw new Error('tarball has no package.json');
+const packaged=JSON.parse(packageEntry.content.toString('utf8'));
+if(packaged.name!==packageName||packaged.version!==version)throw new Error('tarball package version disagrees with registry metadata');
+await mkdir(path.join(ref,'static'),{recursive:true});
+const archivePath=path.join(ref,'desktop-commander-'+version+'.tgz');
+await saveNew(archivePath,tar);
+let selectedBytes=0;
+for(const e of selected){
+ const target=path.join(ref,'static',...e.rel.split('/'));
+ await mkdir(path.dirname(target),{recursive:true});
+ await saveNew(target,e.content);selectedBytes+=e.content.length;
+}
+const receipt={
+ schema:'deadbyte.competitor-reference-acquisition.v1',status:'VERIFIED_STATIC_ONLY',
+ package:packageName,version,metadata_source:url,
+ source_archive:archivePath,archive_bytes:tar.length,archive_sha256:hash(tar),
+ archive_sha512_integrity:integrity,registry_shasum_sha1:metadata.dist.shasum??null,
+ files_total:files.length,files_size_bytes:total,files_selected: selected.length,selected_bytes:selectedBytes,
+ has_lifecycle_scripts:Boolean(packaged.scripts&&(packaged.scripts.preinstall||packaged.scripts.install||packaged.scripts.postinstall)),
+ lifecycle_scripts_executed:false,dependencies_installed:false,remote_started:false,network_action:'registry_https_download_only',
+ selected_files_sha256:selected.map(e=>({path:e.rel,sha256:hash(e.content)})),
+ full_archive_inventory_sha256:hash(Buffer.from(JSON.stringify(files)))
+};
+await saveNew(path.join(ref,'ACQUISITION.json'),JSON.stringify(receipt,null,2)+'\n');
+console.log(JSON.stringify({status:receipt.status,version,archive_sha256:receipt.archive_sha256,archive_bytes:tar.length,files_total:files.length,files_selected:selected.length,lifecycle_scripts_executed:false,reference_path:ref,source:metadata.dist.tarball},null,2));

package/scripts/r67-audit-nonpass-source.mjs

@@ -0,0 +1,39 @@
+import {readFile,readdir,open,mkdir} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const evidence=path.resolve(root,'..','..','testing','0.15.44-r67','regression-shards');
+const operation='r67audit-20261011c';
+const cases=[];
+const files=(await readdir(path.join(root,'test'))).filter(n=>n.endsWith('.test.mjs'));
+const texts=new Map();for(const file of files)texts.set(file,(await readFile(path.join(root,'test',file),'utf8')).split(/\r?\n/));
+const fileSha=b=>createHash('sha256').update(b).digest('hex');
+for(let index=0;index<32;index++){
+ const p=path.join(evidence,operation+'-shard-'+String(index).padStart(2,'0'),'result.json');
+ const r=JSON.parse(await readFile(p,'utf8'));
+ for(const c of r.nonpass_cases??[]){
+  const name=c.name;
+  const matches=[];
+  for(const [file,lines] of texts){
+   for(let line=0;line<lines.length;line++){
+    const hay=lines[line];
+    const short=name.replace(/^R\d+ /,'').slice(0,40);
+    if(hay.includes(name)||hay.includes(short)){
+     matches.push({file,line:line+1,context:lines.slice(Math.max(0,line-3),Math.min(lines.length,line+4)).join(' ').slice(0,780)});
+     if(matches.length>=5)break;
+    }
+   }
+   if(matches.length>=5)break;
+  }
+  cases.push({shard:index,name,reason:c.reason,source_matches:matches});
+ }
+}
+const summary={schema:'deadbyte.r67-nonpass-source-audit.v1',operation,
+count:cases.length,with_reason:cases.filter(c=>c.reason).length,
+without_reason:cases.filter(c=>!c.reason).length,unmatched:cases.filter(c=>!c.source_matches.length).length,
+cases};
+const out=path.resolve(root,'..','..','testing','0.15.44-r67','R67-NONPASS-SOURCE-AUDIT-20261011.json');
+const h=await open(out,'wx',0o600);try{await h.writeFile(JSON.stringify(summary,null,2)+'\n');await h.sync();}finally{await h.close();}
+console.log(JSON.stringify({count:summary.count,with_reason:summary.with_reason,without_reason:summary.without_reason,
+unmatched:summary.unmatched,findings:cases.filter(c=>!c.reason).map(c=>({shard:c.shard,name:c.name,matches:c.source_matches}))},null,2));

package/scripts/r67-compare-desktop-alpha.mjs

@@ -0,0 +1,48 @@
+import {readdir,readFile,writeFile,mkdir,open} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','..','..');
+const refs=path.join(root,'references');
+const stable=path.join(refs,'desktop-commander','dist');
+const alpha=path.join(refs,'desktop-commander-0.3.1-alpha.2','static','dist');
+const output=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','docs','R67-ALPHA-STATIC-COMPARISON.json');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function inventory(dir,prefix=''){
+ const items=await readdir(path.join(dir,prefix),{withFileTypes:true});
+ const out=[];
+ for(const x of items){
+  const sub=[prefix,x.name].filter(Boolean).join('/');
+  if(x.isDirectory())out.push(...await inventory(dir,sub));
+  else if(x.isFile()&&/\.(?:js|mjs|cjs|json)$/.test(sub)){
+   const b=await readFile(path.join(dir,sub));
+   out.push({path:sub,sha256:sha(b),bytes:b.length});
+  }
+ }
+ return out;
+}
+const older=await inventory(stable),newer=await inventory(alpha);
+const map=new Map(older.map(f=>[f.path,f]));
+const changes=[];
+for(const f of newer){
+ const old=map.get(f.path);
+ changes.push({path:f.path,status:!old?'ADDED':old.sha256===f.sha256?'UNCHANGED':'CHANGED',
+  stable_sha256:old?.sha256??null,alpha_sha256:f.sha256,delta_bytes:old?f.bytes-old.bytes:null});
+}
+const relevant=changes.filter(x=>/diagnostic|remote-device|annotations|schema|mcp|pdf|process|reconnect|terminal/i.test(x.path));
+const report={
+ schema:'deadbyte.r67-competitor-static-compare.v1',
+ scope:'static npm archives only; do not execute or install competitor',
+ stable_version:'0.2.52',alpha_version:'0.3.1-alpha.2',
+ alpha_tarball_sha256:'faaf3f34f114589c0630ce4eaa7114ecc628ce2030822dfe67feac0e17fedc4b',
+ stable_compared_files:older.length,alpha_selected_compared_files:newer.length,
+ added:changes.filter(x=>x.status==='ADDED').length,
+ changed:changes.filter(x=>x.status==='CHANGED').length,
+ unchanged:changes.filter(x=>x.status==='UNCHANGED').length,
+ removed_from_selected_scope:0,
+ relevant_changes:relevant,
+ caveat:'Alpha was selectively extracted; do not treat missing alpha inventory as deleted without checking full archive.'
+};
+const handle=await open(output,'wx');
+try{await handle.writeFile(JSON.stringify(report,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+console.log(JSON.stringify({status:'STATIC_DIFFERENTIAL_PASS',stable_files:report.stable_compared_files,alpha_files:report.alpha_selected_compared_files,added:report.added,changed:report.changed,unchanged:report.unchanged,relevant:relevant.filter(x=>x.status!=='UNCHANGED').map(x=>({path:x.path,status:x.status,delta:x.delta_bytes})).slice(0,60)},null,2));

package/scripts/r67-diagnose-failed-shard.mjs

@@ -0,0 +1,23 @@
+import {readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const op=process.argv[2],shard=process.argv[3];
+if(!/^[a-z0-9._-]{6,64}$/.test(op??'')||!/^(0|[1-9]\d?)$/.test(shard??''))throw new Error('operation and shard required');
+const file=path.resolve(root,'..','..','testing','0.15.44-r67','regression-shards',op+'-shard-'+String(shard).padStart(2,'0'),'intent.json');
+const intent=JSON.parse(await readFile(file,'utf8'));
+if(intent.operation!==op||intent.shard_index!==Number(shard))throw new Error('historical intent mismatch');
+const r=spawnSync(process.execPath,['--test','--test-reporter=tap','--test-concurrency=2',...intent.files],{
+ cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:60000,maxBuffer:8*1024*1024,
+ env:Object.fromEntries(Object.entries(process.env).filter(([k])=>k!=='NODE_TEST_CONTEXT'))
+});
+const output=String(r.stdout??'');
+const lines=output.split(/\r?\n/);
+const failures=[];
+for(let i=0;i<lines.length;i++){
+ if(/^(?:not ok |# (?:error|failure)|✖ )/.test(lines[i]))failures.push(lines.slice(Math.max(0,i-1),Math.min(lines.length,i+28)).join('\n').slice(0,4200));
+}
+console.log(JSON.stringify({schema:'deadbyte.r67-diagnostic-replay.v1',role:'NON_RELEASE_TEST_DIAGNOSIS_ONLY',
+ from_historical_operation:op,shard:Number(shard),exit_code:r.status,child_error:r.error?.code??null,
+ failures:failures.slice(0,20),tail:output.slice(-1800),stderr:String(r.stderr??'').slice(-1000)},null,2));

package/scripts/r67-durable-batch.mjs

@@ -0,0 +1,42 @@
+import {readdir,mkdir,open,readFile,rename} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const evidence=path.resolve(root,'../../testing/0.15.44-r67/full-batches');
+const tests=(await readdir(path.join(root,'test'))).filter(n=>n.endsWith('.test.mjs')).sort();
+const size=27;
+const indexRaw=process.argv[2];
+if(!/^(?:0|[1-9]\d*)$/.test(indexRaw??''))throw new Error('batch index required');
+const index=Number(indexRaw);
+const total=Math.ceil(tests.length/size);
+if(!Number.isInteger(index)||index<0||index>=total)throw new Error('batch index out of range');
+await mkdir(evidence,{recursive:true});
+const attempt=process.argv[3]??'initial';
+if(!/^[a-zA-Z0-9_-]{1,24}$/.test(attempt))throw new Error('invalid attempt label');
+const suffix=attempt==='initial'?'':'-'+attempt;
+const file=path.join(evidence,'batch-'+String(index).padStart(2,'0')+suffix+'.json');
+const start=new Date().toISOString();
+const mode=process.argv[4]??'all';
+if(!['all','core','remote'].includes(mode)||(mode!=='all'&&index!==10))throw new Error('invalid batch split mode');
+const window=tests.slice(index*size,(index+1)*size);
+const selected=mode==='core'?window.filter(n=>n!=='remote-session-cli.test.mjs'):mode==='remote'?window.filter(n=>n==='remote-session-cli.test.mjs'):window;
+if(selected.length===0)throw new Error('batch split is empty');
+const sha=s=>createHash('sha256').update(s).digest('hex');
+const identity={schema:'deadbyte.r67-durable-test-batch.v1',batch_index:index,batch_count:total,total_test_files:tests.length,test_files:selected,split_mode:mode,candidate_root:root,started_at_utc:start};
+const staged=await open(file,'wx',0o600);
+try{await staged.writeFile(JSON.stringify({...identity,status:'RUNNING'})+'\n');await staged.sync();}finally{await staged.close();}
+const cmd=['--test','--test-concurrency=4',...selected.map(f=>'test/'+f)];
+const result=spawnSync(process.execPath,cmd,{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:mode==='remote'?180000:90000,maxBuffer:24*1024*1024});
+const output=String(result.stdout??''),error=String(result.stderr??'');
+const count=k=>{const matches=[...output.matchAll(new RegExp('(?:^|\n)[#ℹ ]*'+k+'\\s+(\\d+(?:\\.\\d+)?)','g'))];return matches.length?Number(matches[matches.length-1][1]):null;};
+const testsCount=count('tests'),pass=count('pass'),fail=count('fail'),skip=count('skipped');
+const status=result.status===0&&result.error===undefined&&testsCount!==null&&pass!==null&&fail===0?'PASS':(result.error?.code==='ETIMEDOUT'?'TIMED_OUT':'FAIL');
+const completed={...identity,status,finished_at_utc:new Date().toISOString(),exit_code:result.status,timed_out:result.error?.code==='ETIMEDOUT',observed_test_count:testsCount,passed:pass,failed:fail,skipped:skip,stdout_sha256:sha(Buffer.from(output)),stderr_sha256:sha(Buffer.from(error)),...(status==='PASS'?{}:{failure_tail:(output+'\n'+error).slice(-3500)})};
+const tmp=file+'.finished-'+process.pid;
+const handle=await open(tmp,'wx',0o600);
+try{await handle.writeFile(JSON.stringify(completed,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+await rename(tmp,file);
+console.log(JSON.stringify({batch_index:index,batch_count:total,test_files:selected.length,status,passed:pass,failed:fail,skipped:skip,exit_code:result.status,evidence_path:file},null,2));
+if(status!=='PASS')process.exitCode=1;

package/scripts/r67-focused-gate.mjs

@@ -0,0 +1,58 @@
+import {createHash} from 'node:crypto';
+import {readFile,lstat} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const hash=b=>createHash('sha256').update(b).digest('hex');
+const manifest=JSON.parse(await readFile(path.join(root,'docs','R67-NATIVE-INSPECT-BINARY.json'),'utf8'));
+const binary=path.join(root,manifest.exe);
+const info=await lstat(binary);
+if(manifest.schema!=='deadbyte.r67-native-inspector-binary.v1'||!info.isFile()||info.isSymbolicLink()||hash(await readFile(binary))!==manifest.sha256)throw new Error('R67 native observer hash pin invalid');
+const specs=[
+ 'test/r67-native-inspector.test.mjs',
+ 'test/r67-signed-receipt.test.mjs',
+ 'test/r67-cli-integration.test.mjs',
+ 'test/r67-diagnostics.test.mjs',
+ 'test/r67-diagnostics-cli.test.mjs',
+ 'test/r67-diagnostics-zip-oracle.test.mjs',
+ 'test/r67-diagnostics-verify.test.mjs',
+ 'test/r67-regression-shards.test.mjs',
+ 'test/r67-evidence-reconcile.test.mjs',
+ 'test/r67-skip-rationale.test.mjs',
+ 'test/r67-runtime-observation-binding.test.mjs',
+ 'test/r67-native-observation-authority.test.mjs',
+ 'test/r67-server-observation-wiring.test.mjs',
+ 'test/r67-machine-fs-smoke-epoch.test.mjs',
+ 'test/r67-isolated-slot-rollback-restore.test.mjs',
+ 'test/r65-epoch-native-activation-integration.test.mjs',
+ 'test/machine-identity.test.mjs',
+ 'test/r67-tool-annotations.test.mjs',
+ 'test/remote-live-log-r36.test.mjs',
+ 'test/remote-live-log-r37.test.mjs',
+ 'test/r67-live-log-secret-canary.test.mjs',
+ 'test/r51-live-log-polling.test.mjs',
+ 'test/cli-entrypoint.test.mjs',
+ 'test/observation-runtime.test.mjs',
+ 'test/observation-mcp-tools.test.mjs',
+ 'test/windows-observation-r48.test.mjs',
+ 'test/r67-release-contract.test.mjs',
+ 'test/r67-npm-cross-volume.test.mjs',
+ 'test/r67-npm-publish-gate.test.mjs',
+ 'test/r65-npm-publication.test.mjs'
+];
+const args=['--test','--test-concurrency=1',...specs];
+const result=spawnSync(process.execPath,args,{cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:180000,maxBuffer:16*1024*1024});
+const stdout=String(result.stdout??'');
+const stderr=String(result.stderr??'');
+const tap=parseR67TapSummary(stdout);
+const counts=tap?{tests:tap.tests,pass:tap.pass,fail:tap.fail,skipped:tap.skipped,cancelled:tap.cancelled,todo:tap.todo}:null;
+const complete=Boolean(tap&&tap.tests>=specs.length&&tap.fail===0&&tap.skipped===0&&tap.cancelled===0&&tap.todo===0&&result.status===0&&!result.error);
+const receipt={schema:'deadbyte.r67-focused-gate.v1',status:complete?'pass':'fail',
+ candidate_version:'0.15.44-draft',predecessor_manifest_sha256:'4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33',
+ native_exe_sha256:manifest.sha256,tests:specs,summary:counts,exit_code:result.status,timed_out:result.error?.code==='ETIMEDOUT',
+ stdout_sha256:hash(Buffer.from(stdout,'utf8')),stderr_sha256:hash(Buffer.from(stderr,'utf8'))};
+console.log(JSON.stringify(receipt,null,2));
+if(result.status!==0){console.error('TEST_OUTPUT_TAIL\n'+stdout.slice(-15000));console.error('TEST_ERROR_TAIL\n'+stderr.slice(-4000));}
+if(!complete)process.exitCode=1;

package/scripts/r67-full-regression.mjs

@@ -0,0 +1,28 @@
+import {readdir,mkdir,open,rename,lstat} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const operationId=process.argv[2];
+if(!/^[a-z0-9][a-z0-9._-]{4,63}$/.test(operationId??''))throw new Error('unique operation ID required');
+const evidence=path.resolve(root,'..','..','testing','0.15.44-r67','regression');
+await mkdir(evidence,{recursive:true});
+const finalFile=path.join(evidence,operationId+'.json');
+try{await lstat(finalFile);throw new Error('operation already completed; reconcile receipt, never rerun');}
+catch(e){if(e.code!=='ENOENT')throw e;}
+const names=(await readdir(path.join(root,'test'))).filter(s=>s.endsWith('.test.mjs')).sort();
+const args=['--test','--test-concurrency=4',...names.map(n=>'test/'+n)];
+const started=Date.now();
+const r=spawnSync(process.execPath,args,{cwd:root,shell:false,windowsHide:true,encoding:'utf8',maxBuffer:32*1024*1024,timeout:220000});
+const out=String(r.stdout??''),err=String(r.stderr??'');
+const parse=k=>{const m=[...out.matchAll(new RegExp('(?:^|\n)[#ℹ ]*'+k+'\\s+(\\d+(?:\\.\\d+)?)','g'))];return m.length?Number(m[m.length-1][1]):null};
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const body={schema:'deadbyte.r67-full-source-regression.v1',status:r.status===0&&!r.error?'passed':'failed',tests_files:names.length,test_count:parse('tests'),passed:parse('pass'),failed:parse('fail'),skipped:parse('skipped'),exit_code:r.status,timed_out:r.error?.code==='ETIMEDOUT',elapsed_ms:Date.now()-started,stdout_sha256:sha(Buffer.from(out)),stderr_sha256:sha(Buffer.from(err))};
+const receipt={...body,operation_id:operationId,started_at_utc:new Date(started).toISOString(),finished_at_utc:new Date().toISOString(),test_names_sha256:sha(Buffer.from(JSON.stringify(names)))};
+const tmp=path.join(evidence,operationId+'.tmp-'+process.pid);
+const handle=await open(tmp,'wx');
+try{await handle.writeFile(JSON.stringify(receipt,null,2)+'\\n');await handle.sync();}finally{await handle.close();}
+await rename(tmp,finalFile);
+console.log(JSON.stringify({receipt,receipt_path:finalFile},null,2));
+if(body.status!=='passed'){console.error('FULL_TEST_OUTPUT_TAIL\n'+out.slice(-18000));console.error('FULL_TEST_ERROR_TAIL\n'+err.slice(-4000));process.exitCode=1;}

package/scripts/r67-independent-observation-verify.mjs

@@ -0,0 +1,36 @@
+import {createHash,createPublicKey,verify as edVerify} from 'node:crypto';
+const h=b=>createHash('sha256').update(b).digest('hex');
+function stable(v){
+ if(v===null||typeof v!=='object')return JSON.stringify(v);
+ if(Array.isArray(v))return '['+v.map(stable).join(',')+']';
+ return '{'+Object.keys(v).sort().map(k=>JSON.stringify(k)+':'+stable(v[k])).join(',')+'}';
+}
+const hex=x=>typeof x==='string'&&/^[a-f0-9]{64}$/.test(x);
+const canonicalHash=v=>h(Buffer.from(stable(v),'utf8'));
+export function independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs,expectedExecutableSha256}){
+ try{
+  if(!receipt||receipt.schema!=='deadbyte.native-observation-receipt.r67.v1')return {ok:false,reason:'invalid receipt schema'};
+  if(typeof trustedPublicSpkiBase64!=='string')return {ok:false,reason:'trusted public key required'};
+  const spki=Buffer.from(trustedPublicSpkiBase64,'base64');
+  if(spki.toString('base64')!==trustedPublicSpkiBase64)return {ok:false,reason:'bad base64 public key'};
+  const trust=h(spki);
+  if(receipt.signer_key_id!==trust||receipt.attestation?.key_id!==trust||receipt.attestation.algorithm!=='ed25519')return {ok:false,reason:'signer is not trusted'};
+  if(!hex(receipt.request_sha256)||!hex(receipt.executable_sha256)||!hex(receipt.result_sha256)||!hex(receipt.receipt_sha256))return {ok:false,reason:'binding malformed'};
+  if(!['process','identity','map','pe'].includes(receipt.operation))return {ok:false,reason:'invalid operation'};
+  if(!Array.isArray(requestArgs)||requestArgs.some(x=>typeof x!=='string')||receipt.request_sha256!==h(Buffer.from(JSON.stringify(requestArgs),'utf8')))return {ok:false,reason:'request args mismatch'};
+  if(!hex(expectedExecutableSha256)||receipt.executable_sha256!==expectedExecutableSha256)return {ok:false,reason:'trusted executable mismatch'};
+  if(!['ok','failed'].includes(receipt.result_status)||receipt.result_status!==result?.status)return {ok:false,reason:'result status mismatch'};
+  if(result.schema!=='deadbyte.native-inspect.r67.v1'||(result.status==='ok'&&(result.operation!==receipt.operation||result.data_sha256!==h(Buffer.from(JSON.stringify(result.data),'utf8')))))return {ok:false,reason:'result invalid'};
+  if(receipt.result_sha256!==canonicalHash(result))return {ok:false,reason:'result SHA mismatch'};
+  const {attestation,...signed}=receipt;
+  const {receipt_sha256,...body}=signed;
+  if(canonicalHash(body)!==receipt_sha256)return {ok:false,reason:'receipt SHA mismatch'};
+  const signature=Buffer.from(attestation.signature_base64,'base64');
+  if(signature.length!==64||signature.toString('base64')!==attestation.signature_base64)return {ok:false,reason:'signature encoding invalid'};
+  const pub=createPublicKey({key:spki,format:'der',type:'spki'});
+  if(pub.asymmetricKeyType!=='ed25519')return {ok:false,reason:'not Ed25519'};
+  const message=Buffer.concat([Buffer.from('DEADBYTE-R67-OBSERVATION-V1\0','utf8'),Buffer.from(stable(signed),'utf8')]);
+  if(!edVerify(null,message,pub,signature))return {ok:false,reason:'signature invalid'};
+  return {ok:true,signature_valid:true,receipt_sha256,result_sha256:receipt.result_sha256,signer_key_id:trust};
+ }catch(error){return {ok:false,reason:String(error?.message||error)};}
+}

package/scripts/r67-independent-runtime-observation-verify.mjs

@@ -0,0 +1,63 @@
+import {createHash,createPublicKey,verify as ed25519Verify} from 'node:crypto';
+import {nativeInspectArgs} from '../src/native-inspector-r67.mjs';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const hex64=x=>typeof x==='string'&&/^[a-f0-9]{64}$/.test(x);
+const domain=Buffer.from('DEADBYTE-R67-MACHINE-OBSERVATION-V1\0','utf8');
+function serialize(v){
+ const canon=value=>Array.isArray(value)?value.map(canon):
+  value!==null&&typeof value==='object'?Object.fromEntries(Object.keys(value).sort().map(k=>[k,canon(value[k])])):value;
+ return JSON.stringify(canon(v));
+}
+export function independentlyVerifyR67RuntimeObservation({
+ receipt,result,requestArgs,machinePublicSpkiBase64,expectedMachineStatus,
+ expectedPolicySha256,expectedGrantId
+}={}){
+ try{
+  if(!receipt||!result||!Array.isArray(requestArgs)||!expectedMachineStatus)return {ok:false,reason:'missing binding'};
+  if(receipt.schema!=='deadbyte.native-observation-runtime-r67.v1')return {ok:false,reason:'schema'};
+  if(!hex64(receipt.machine_id)||!hex64(receipt.request_sha256)||!hex64(receipt.result_sha256)||
+   !hex64(receipt.executable_sha256)||!hex64(receipt.generation_manifest_sha256)||
+   !hex64(receipt.release_manifest_sha256)||!hex64(receipt.online_epoch))return {ok:false,reason:'digest or generation'};
+  if(!Number.isInteger(receipt.identity_generation)||receipt.identity_generation<1||
+    !Number.isFinite(new Date(receipt.observed_at_utc).getTime())||
+    new Date(receipt.observed_at_utc).toISOString()!==receipt.observed_at_utc)return {ok:false,reason:'identity generation or timestamp'};
+  if(typeof machinePublicSpkiBase64!=='string'||Buffer.from(machinePublicSpkiBase64,'base64').toString('base64')!==machinePublicSpkiBase64)
+    return {ok:false,reason:'public key encoding'};
+  const der=Buffer.from(machinePublicSpkiBase64,'base64');
+  const key=createPublicKey({key:der,format:'der',type:'spki'});
+  if(key.asymmetricKeyType!=='ed25519'||sha(der)!==receipt.machine_id)return {ok:false,reason:'wrong machine key'};
+  for(const field of ['machine_id','identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256'])
+   if(receipt[field]!==expectedMachineStatus[field])return {ok:false,reason:'runtime identity, release or generation changed'};
+  if(expectedMachineStatus.public_key_spki_base64!==machinePublicSpkiBase64)return {ok:false,reason:'status key changed'};
+  if(!hex64(expectedPolicySha256)||receipt.authority?.policy_sha256!==expectedPolicySha256||
+   receipt.authority?.grant_id!==expectedGrantId||
+   receipt.authority?.scope!=='native-observe-readonly'||
+   !Number.isSafeInteger(receipt.authority?.authority_generation)||
+   receipt.authority.authority_generation<1)return {ok:false,reason:'authority'};
+  if(Object.keys(receipt.authority).sort().join('|')!==['authority_generation','grant_id','policy_sha256','scope'].sort().join('|'))
+   return {ok:false,reason:'unexpected authority fields'};
+  const nativeArgs=nativeInspectArgs(requestArgs);
+  if(receipt.operation!==nativeArgs[0]||receipt.request_sha256!==sha(Buffer.from(JSON.stringify(nativeArgs),'utf8')))
+   return {ok:false,reason:'wrong native request'};
+  if(result.schema!=='deadbyte.native-inspect.r67.v1'||!['ok','failed'].includes(result.status)||
+   receipt.result_status!==result.status||receipt.result_sha256!==sha(Buffer.from(serialize(result),'utf8')))
+   return {ok:false,reason:'native result hash'};
+  if(result.status==='ok'&&(result.operation!==nativeArgs[0]||!result.data||
+     result.data_sha256!==sha(Buffer.from(JSON.stringify(result.data),'utf8'))))
+   return {ok:false,reason:'invalid native data digest'};
+  const att=receipt.attestation;
+  if(att?.algorithm!=='ed25519'||att.key_id!==receipt.machine_id||
+    typeof att.signature_base64!=='string')return {ok:false,reason:'attestation'};
+  const signature=Buffer.from(att.signature_base64,'base64');
+  if(signature.length!==64||signature.toString('base64')!==att.signature_base64)return {ok:false,reason:'signature encoding'};
+  const {attestation,...body}=receipt;
+  const keys=['schema','observed_at_utc','machine_id','identity_generation','online_epoch','release_id',
+   'release_manifest_sha256','generation_manifest_sha256','authority','operation','request_sha256',
+   'executable_sha256','result_status','result_sha256'];
+  if(Object.keys(body).sort().join('|')!==keys.sort().join('|'))return {ok:false,reason:'unexpected body fields'};
+  const valid=ed25519Verify(null,Buffer.concat([domain,Buffer.from(serialize(body),'utf8')]),key,signature);
+  if(!valid)return {ok:false,reason:'signature invalid'};
+  return {ok:true,signature_valid:true,signer_key_id:receipt.machine_id,
+   release_id:receipt.release_id,generation_manifest_sha256:receipt.generation_manifest_sha256};
+ }catch(e){return {ok:false,reason:'verification failed: '+String(e?.message||e)};}
+}

package/scripts/r67-nonpass-adjudicate.mjs

@@ -0,0 +1,20 @@
+import {readFile,writeFile,mkdir} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const base=process.cwd();
+const source=path.resolve(base,'..','..','testing','0.15.44-r67','R67-NONPASS-SOURCE-AUDIT-20261011.json');
+const output=path.resolve(base,'..','..','testing','0.15.44-r67','R67-NONPASS-ADJUDICATION-CANDIDATE.json');
+const x=JSON.parse(await readFile(source,'utf8'));
+if(x.schema!=='deadbyte.r67-nonpass-source-audit.v1'||x.count!==42||x.cases.length!==42)throw Error('Unexpected source audit');
+const rows=x.cases.map((item,index)=>{
+ const candidates=(item.source_matches??[]).filter(m=>typeof m.context==='string');
+ const conditions=candidates.map(m=>({file:m.file,line:m.line,version_guard:/skip:\s*currentPackage\.version\s*!==\s*['"]([0-9.]+)['"]/.exec(m.context)?.[1]??null,explicit_skip:/\btest\.skip\s*\(/.test(m.context),historical_skip:/skipHistorical\s*\(/.test(m.context)}));
+ const reason=item.reason?{kind:'SOURCE_REPORTED',text:item.reason}:{kind:'UNCLASSIFIED',text:null};
+ return {index,shard:item.shard,name:item.name,source_reported_reason:reason,source_matches:conditions,
+  evidence_level:item.reason?'SOURCE_LOG_REASON_ONLY':'NO_PER_CASE_REASON',
+  release_gate:'BLOCKED_UNTIL_CASE_LEVEL_PROVENANCE'};
+});
+const counts={cases:rows.length,source_reported_reasons:rows.filter(r=>r.source_reported_reason.kind==='SOURCE_REPORTED').length,unclassified:rows.filter(r=>r.source_reported_reason.kind==='UNCLASSIFIED').length,version_guard_candidates:rows.filter(r=>r.source_matches.some(m=>m.version_guard)).length,explicit_skip_candidates:rows.filter(r=>r.source_matches.some(m=>m.explicit_skip)).length};
+const data={schema:'deadbyte.r67-nonpass-adjudication.v1',status:'BLOCKED_NONPASS_CLASSIFICATION',source_audit_sha256:createHash('sha256').update(await readFile(source)).digest('hex'),counts,rows};
+await writeFile(output,JSON.stringify(data,null,2)+'\n',{flag:'wx'});
+console.log(JSON.stringify({status:data.status,counts,output}));

package/scripts/r67-publish-boundary-audit.mjs

@@ -0,0 +1,32 @@
+import {createHash} from 'node:crypto';
+import {readFile,lstat} from 'node:fs/promises';
+import {resolveStateRoot} from '../src/state-root.mjs';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const version=JSON.parse(await readFile(path.join(root,'package.json'),'utf8')).version;
+const basename='deadbyte-mcp-'+version+'.tgz';
+const pubDir=path.join(resolveStateRoot(),'evidence','npm-publication',version);
+const paths={
+ source:path.join(root,basename),
+ preserved:path.join(pubDir,basename),
+ claim:path.join(pubDir,'claim.json')
+};
+const outputs={};
+for(const [kind,p] of Object.entries(paths)){
+ try{
+  const s=await lstat(p);
+  if(!s.isFile()||s.isSymbolicLink()){outputs[kind]={state:'NON_REGULAR_OR_LINK'};continue;}
+  const bytes=await readFile(p);
+  outputs[kind]={state:'EXISTS',bytes:bytes.length,sha256:createHash('sha256').update(bytes).digest('hex')};
+  if(kind==='claim'){
+   try{const j=JSON.parse(bytes.toString('utf8'));outputs[kind].schema=j.schema;outputs[kind].version=j.version;outputs[kind].manifest_sha256=j.manifest_sha256;outputs[kind].tarball_sha256=j.tarball_sha256;}
+   catch{outputs[kind].parse_error=true;}
+  }
+ }catch(e){if(e?.code==='ENOENT')outputs[kind]={state:'ABSENT'};else throw e;}
+}
+console.log(JSON.stringify({schema:'deadbyte.r67-publication-boundary-audit.v1',
+ version,production_mutation:false,network_access:false,publication_dispatch:false,
+ artifacts:outputs,conclusion:outputs.claim.state==='EXISTS'?'CLAIM_EXISTS_RECONCILE_BEFORE_ANY_DISPATCH':
+ 'NO_LOCAL_CLAIM_OBSERVED_DO_NOT_ASSUME_REGISTRY_STATE'},null,2));

package/scripts/r67-regression-reconcile.mjs

@@ -0,0 +1,10 @@
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {reconcileR67Evidence} from '../src/r67-evidence-reconcile.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const operationId=process.argv[2];
+const evidenceRoot=path.resolve(root,'..','..','testing','0.15.44-r67','regression-shards');
+const result=await reconcileR67Evidence({root,evidenceRoot,operationId});
+console.log(JSON.stringify(result,null,2));
+if(result.status!=='PASS')process.exitCode=2;