deadbyte-mcp 0.15.43 → 0.15.45

package/test/r60-release-contract.test.mjs

@@ -13,7 +13,7 @@ const PARENT=Object.freeze({
   generation_manifest_sha256:'6134f9f26b680e13ed545da4ab5f3020f411ea2569062fb9c154c8a7e036c9dc'
 });
 
-test('R60 identity is coherent and binds the exact production-accepted 0.15.36 predecessor',{skip:currentPackage.version!=='0.15.37'},async()=>{
+test('R60 identity is coherent and binds the exact production-accepted 0.15.36 predecessor',{skip:currentPackage.version!=='0.15.37' ? 'Historical R60 release contract requires 0.15.37; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,release,prov,matrix,sbom,version,bridgePkg,contract]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),
     json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),json('bridge/package.json'),
@@ -47,7 +47,7 @@ test('R60 identity is coherent and binds the exact production-accepted 0.15.36 p
   assert.match(contract,/0\.15\.37/);
 });
 
-test('R60 release contract exposes the proven remote truth semantics without widening dependencies',{skip:currentPackage.version!=='0.15.37'},async()=>{
+test('R60 release contract exposes the proven remote truth semantics without widening dependencies',{skip:currentPackage.version!=='0.15.37' ? 'Historical R60 release contract requires 0.15.37; current '+currentPackage.version : false},async()=>{
   const [pkg,release,matrix]=await Promise.all([json('package.json'),json('RELEASE.json'),json('TEST-MATRIX.json')]);
   assert.equal(Object.keys(pkg.dependencies??{}).length,4);
   assert.equal(release.r60_remote_hardening.authority_truth_coherence,true);
@@ -70,7 +70,7 @@ test('R60 release contract exposes the proven remote truth semantics without wid
   assert.equal(matrix.observed_pre_release_evidence.r60_package.status,'PASS_VERIFY_ONLY_PRE_FINAL_SEAL');
 });
 
-test('R60 package scripts bind the new focused, full-regression and Windows-gate entrypoints',{skip:currentPackage.version!=='0.15.37'},async()=>{
+test('R60 package scripts bind the new focused, full-regression and Windows-gate entrypoints',{skip:currentPackage.version!=='0.15.37' ? 'Historical R60 release contract requires 0.15.37; current '+currentPackage.version : false},async()=>{
   const [pkg,gate]=await Promise.all([json('package.json'),read('scripts/gate-windows-r60-prepublish.ps1')]);
   assert.match(pkg.scripts['r60:focused:test'],/r60-authority-coherence\.test\.mjs/);
   assert.match(pkg.scripts['r60:focused:test'],/r60-remote-call-recovery\.test\.mjs/);

package/test/r61-release-contract.test.mjs

@@ -11,7 +11,7 @@ const PARENT={
   generation_manifest_sha256:'54842021c75f01bf7ecbd5b10ab8a482ecf107765b45c46f9d39b12bab65eac4'
 };
 
-test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',{skip:currentPackage.version!=='0.15.38'},async()=>{
+test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',{skip:currentPackage.version!=='0.15.38' ? 'Historical R61 release contract requires 0.15.38; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r62-release-contract.test.mjs

@@ -12,7 +12,7 @@ const PARENT={
  generation_manifest_sha256:'9d320a8af1ba8e9e6a23552f35263da2670c00af1355464820552d849d9033c6'
 };
 
-test('R62 identity binds exact sealed 0.15.38 parent and transaction reconciliation scope',{skip:currentPackage.version!=='0.15.39'},async()=>{
+test('R62 identity binds exact sealed 0.15.38 parent and transaction reconciliation scope',{skip:currentPackage.version!=='0.15.39' ? 'Historical R62 release contract requires 0.15.39; current '+currentPackage.version : false},async()=>{
  const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
   json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
   json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r63-release-contract.test.mjs

@@ -12,7 +12,7 @@ const PARENT={
  generation_manifest_sha256:'f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab'
 };
 
-test('R63 identity binds exact active 0.15.39 parent and one-shot runtime coherence repair',{skip:currentPackage.version!=='0.15.40'},async()=>{
+test('R63 identity binds exact active 0.15.39 parent and one-shot runtime coherence repair',{skip:currentPackage.version!=='0.15.40' ? 'Historical R63 release contract requires 0.15.40; current '+currentPackage.version : false},async()=>{
  const pkg=await json('package.json');
  assert.equal(pkg.version,'0.15.40');
  assert.match(pkg.scripts['r63:focused:test'],/r63-one-shot-coherence\.test\.mjs/);

package/test/r64-release-contract.test.mjs

@@ -12,7 +12,7 @@ const runtime={
   generation_manifest_sha256:'f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab'
 };
 
-test('R64 release identity distinguishes unsealed source predecessor from active runtime predecessor',{skip:currentPackage.version!=='0.15.41'},async()=>{
+test('R64 release identity distinguishes unsealed source predecessor from active runtime predecessor',{skip:currentPackage.version!=='0.15.41' ? 'Historical R64 release contract requires 0.15.41; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,scope,gaps,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),json('docs/R64-SCOPE.json'),

package/test/r65-authority-runtime-epoch.test.mjs

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {mkdtemp,mkdir,rm,writeFile,readFile} from 'node:fs/promises';
-import {createHash} from 'node:crypto';
+import {createHash,generateKeyPairSync} from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import {loadCodingPolicy,codingSessionStatus} from '../src/coding-plane.mjs';
@@ -37,6 +37,14 @@ test('R65 standing Coding grant is disarmed until the durable epoch binds the ex
     assert.equal(trusted.armed,true);
     assert.equal(trusted.reason,'standing-grant');
     assert.equal(trusted.instance_nonce,grant.instance_nonce);
+    const publicPath=path.join(root,'trust','ed25519-public.pem');
+    const originalPublic=await readFile(publicPath);
+    const rotated=generateKeyPairSync('ed25519').publicKey.export({format:'pem',type:'spki'});
+    await writeFile(publicPath,rotated);
+    const denied=await codingSessionStatus(policy);
+    assert.equal(denied.armed,false,'changed trust bytes must not reuse the cached parsed key');
+    await writeFile(publicPath,originalPublic);
+    assert.equal((await codingSessionStatus(policy)).armed,true);
   }finally{
     await rm(root,{recursive:true,force:true});
   }

package/test/r65-epoch-native-activation-integration.test.mjs

@@ -16,7 +16,7 @@ const dummy={coding:'2'.repeat(64),autonomous:'3'.repeat(64),desktop:'4'.repeat(
 
 async function optional(file){try{return await readFile(file);}catch(error){if(error?.code==='ENOENT')return null;throw error;}}
 
-test('epoch-native orchestrator uses transaction continuity engine instead of generic authority commands',async()=>{
+test('epoch-native orchestrator handles BOM-encoded process grant with transaction continuity engine',async()=>{
   const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-activation-'));
   try{
     const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policies=path.join(root,'policies');
@@ -33,7 +33,7 @@ test('epoch-native orchestrator uses transaction continuity engine instead of ge
     await writeFile(beforePath,policyBytes);await writeFile(afterPath,policyBytes);
     const oldGrant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(policyBytes),instance_nonce:'8'.repeat(64),
       profile_ids:['safe'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
-    const oldBytes=Buffer.from(JSON.stringify(oldGrant));await writeFile(grantFile,oldBytes);
+    const oldBytes=Buffer.concat([Buffer.from([0xef,0xbb,0xbf]),Buffer.from(JSON.stringify(oldGrant))]);await writeFile(grantFile,oldBytes);
     const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes});
     await store.append({plane:'process',action:'grant',grantBytes:oldBytes,grantInstanceNonce:oldGrant.instance_nonce});
     let switched=false;
@@ -41,7 +41,7 @@ test('epoch-native orchestrator uses transaction continuity engine instead of ge
       const bytes=await optional(grantFile),head=await store.readHead({plane:'process'});
       let armed=false;
       if(bytes){
-        const grant=JSON.parse(bytes);
+        const grant=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
         armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
       }
       return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
@@ -104,7 +104,7 @@ test('epoch-native explicit user revoke after transaction revoke wins over orche
       const bytes=await optional(grantFile),head=await store.readHead({plane:'process'});
       let armed=false;
       if(bytes){
-        const grant=JSON.parse(bytes);
+        const grant=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
         armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
       }
       return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{

package/test/r65-release-contract.test.mjs

@@ -12,7 +12,7 @@ const PARENT={
   generation_manifest_sha256:'19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'
 };
 
-test('R65 release identity binds exact production R64 parent and durable authority-continuity train',{skip:currentPackage.version!=='0.15.42'},async()=>{
+test('R65 release identity binds exact production R64 parent and durable authority-continuity train',{skip:currentPackage.version!=='0.15.42' ? 'Historical R65 release contract requires 0.15.42; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate,gaps,design]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r66-release-contract.test.mjs

@@ -4,6 +4,7 @@ import {readFile} from 'node:fs/promises';
 
 const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
 const json=async rel=>JSON.parse((await read(rel)).replace(/^\uFEFF/,''));
+const currentPackage=await json('package.json');
 const PARENT={
   version:'0.15.42',
   release_id:'v0.15.42-1b4754103dd4ca43',
@@ -11,7 +12,7 @@ const PARENT={
   generation_manifest_sha256:'62dc68be55ad627f8d872b8be8c1369ecca0edf08fdedc8336c9ccee2d2809fb'
 };
 
-test('R66 identity is an exact prepublish doctor hotfix of sealed R65',async()=>{
+test('R66 identity is an exact prepublish doctor hotfix of sealed R65',{skip:currentPackage.version!=='0.15.43' ? 'Historical R66 release contract requires 0.15.43; current '+currentPackage.version : false},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r67-cli-integration.test.mjs

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {nativeInspectArgs} from '../src/native-inspector-r67.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const cli=path.join(root,'src','deadbyte-cli.mjs');
+const exe=path.join(root,'bin','deadbyte-native-inspect-r67.exe');
+function invoke(...args){
+ const r=spawnSync(process.execPath,[cli,'inspect',...args],{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:30000,maxBuffer:2097152});
+ assert.equal(r.error,undefined,r.error?.message);return {r,value:JSON.parse(r.stdout.trim())};
+}
+test('R67 CLI inspect exposes native process snapshot without MCP tool additions',()=>{
+ const {r,value}=invoke('process','4');
+ assert.equal(r.status,0,r.stderr);assert.equal(value.status,'ok');assert.equal(value.operation,'process');assert.ok(value.data.processes.length<=4);
+});
+test('R67 CLI inspect memory self is metadata-only and PE uses actual bytes',()=>{
+ const m=invoke('memory','self','4');
+ assert.equal(m.r.status,0,m.r.stderr);assert.equal(m.value.status,'ok');assert.ok(m.value.data.regions.length<=4);
+ const p=invoke('pe',exe);
+ assert.equal(p.r.status,0,p.r.stderr);assert.equal(p.value.status,'ok');assert.match(p.value.data.file_sha256,/^[a-f0-9]{64}$/);
+});
+test('R67 CLI typed input rejects invalid selectors before spawning native process',()=>{
+ for(const selector of [['process','0'],['process','999999'],['memory','0'],['memory','self','9999'],['memory','4148'],['identity'],['identity','0'],['memory','4148','0'],['memory','4148','18446744073709551616'],['pe'],['unknown']]){
+  assert.throws(()=>nativeInspectArgs(selector));
+ }
+ const error=spawnSync(process.execPath,[cli,'inspect','memory','0'],{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:30000});
+ assert.equal(error.status,1);assert.match(error.stderr,/invalid positive limit|limit out of range|creation_filetime/);
+});
+test('R67 CLI preserves raw Windows error instead of fabricating data',()=>{
+ const {r,value}=invoke('memory','4294967295','1','4');
+ assert.equal(r.status,2);assert.equal(value.status,'failed');assert.match(value.error,/win32|PID/);
+});
+
+test('R67 CLI rejects stale PID identity before successful region inspection',()=>{
+ const {r,value}=invoke('memory',String(process.pid),'1','4');
+ assert.equal(r.status,2);
+ assert.equal(value.error_code,'PROCESS_IDENTITY_MISMATCH');
+ assert.equal(value.win32_error,0);
+});

package/test/r67-diagnostics-cli.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const cli=path.join(root,'src','deadbyte-cli.mjs');
+test('R67 offline diagnostic CLI exports without activating remote, uploading or revealing raw log bytes',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-diagnostic-cli-'));
+ try{
+  const state=path.join(folder,'state');
+  const output=path.join(folder,'report.zip');
+  await mkdir(path.join(state,'runtime','logs'),{recursive:true});
+  await writeFile(path.join(state,'active-release.json'),JSON.stringify({release_id:'v0.15.43-'+'a'.repeat(16),manifest_sha256:'a'.repeat(64)}));
+  await writeFile(path.join(state,'runtime','logs','controller-start.stderr.log'),'WARN reconnect win32=109 SECRET_CANARY_52917\n');
+  const run=spawnSync(process.execPath,[cli,'diagnostics','export','--output',output],{
+   cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:state},encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(run.status,0,run.stderr);
+  const result=JSON.parse(run.stdout);
+  assert.equal(result.status,'written_local_only');
+  assert.equal(result.uploaded,false);
+  const b=await readFile(output);
+  assert.equal(b.includes(Buffer.from('SECRET_CANARY_52917')),false);
+  assert.equal(b.readUInt32LE(0),0x04034b50);
+  const reject=spawnSync(process.execPath,[cli,'diagnostics','export','--output',path.join(folder,'second.zip'),'--upload'],{
+   cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:state},encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(reject.status,1);
+  assert.match(reject.stderr,/upload|syntax|diagnostics/i);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+
+test('R67 diagnostic CLI verify checks local ZIP without starting remote session',async()=>{
+ const {makeOfflineDiagnosticBundle}=await import('../src/r67-diagnostic-export.mjs');
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-diagnostic-verify-cli-'));
+ try{
+  const file=path.join(folder,'report.zip');
+  const bundle=makeOfflineDiagnosticBundle({
+   releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:'a'.repeat(64),logs:[]
+  });
+  await writeFile(file,bundle.zip);
+  const r=spawnSync(process.execPath,[cli,'diagnostics','verify','--input',file],{
+   cwd:root,encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(r.status,0,r.stderr);
+  const result=JSON.parse(r.stdout);
+  assert.equal(result.status,'VERIFIED_LOCAL_STRUCTURE');
+  assert.equal(result.archive_sha256,bundle.archive_sha256);
+  const broken=Buffer.from(bundle.zip);broken[50]^=1;
+  const brokenPath=path.join(folder,'corrupt.zip');await writeFile(brokenPath,broken);
+  const denial=spawnSync(process.execPath,[cli,'diagnostics','verify','--input',brokenPath],{
+   cwd:root,encoding:'utf8',shell:false,windowsHide:true,timeout:20000
+  });
+  assert.equal(denial.status,1);
+  assert.match(denial.stderr,/integrity|ZIP|unsafe/i);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});

package/test/r67-diagnostics-verify.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {makeOfflineDiagnosticBundle} from '../src/r67-diagnostic-export.mjs';
+import {verifyOfflineDiagnosticsZip} from '../src/r67-diagnostics-verify.mjs';
+const sha='a'.repeat(64);
+const archive=()=>makeOfflineDiagnosticBundle({releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:sha,
+ logs:[{source:'controller-start.stderr.log',content:'2026-10-11T03:04:05.000Z WARN reconnect win32=109 PASSWORD_CANARY_91020'}]}).zip;
+test('R67 offline diagnostic independently verifies ZIP CRC, bounded entries and fixed schemas',()=>{
+ const v=verifyOfflineDiagnosticsZip(archive());
+ assert.equal(v.status,'VERIFIED_LOCAL_STRUCTURE');
+ assert.equal(v.uploaded,false);
+ assert.equal(v.entry_count,2);
+ assert.equal(v.summary.redaction,'FIXED_FIELDS_ONLY');
+ assert.equal(v.summary.network_upload,'NEVER');
+ assert.match(v.archive_sha256,/^[a-f0-9]{64}$/);
+ assert.equal(v.summary.raw_log_lines_exported,0);
+});
+test('R67 verifier rejects byte tampering without an updated CRC',()=>{
+ const corrupted=Buffer.from(archive());
+ const phrase=Buffer.from('FIXED_FIELDS_ONLY');
+ const offset=corrupted.indexOf(phrase);
+ assert.ok(offset>0);
+ corrupted[offset]^=1;
+ assert.throws(()=>verifyOfflineDiagnosticsZip(corrupted),/CRC|hash|corrupt/i);
+});
+test('R67 verifier rejects trailing junk, extra archive entries and invalid size bounds',()=>{
+ const good=archive();
+ assert.throws(()=>verifyOfflineDiagnosticsZip(Buffer.concat([good,Buffer.alloc(20)])),/trailing|eocd|boundary|ZIP/i);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(good.subarray(0,good.length-5)),/truncated|eocd|boundary|ZIP/i);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(Buffer.alloc(4*1024*1024+1)),/size|large/i);
+});
+test('R67 verify rejects semantic tampering even when attacker recomputes all ZIP CRCs',()=>{
+ const buf=Buffer.from(archive());
+ const find=Buffer.from('FIXED_FIELDS_ONLY');
+ const at=buf.indexOf(find);
+ assert.ok(at>0);
+ buf.write('ALLOW_RAW_LOGS___',at,'utf8');
+ const dataStart=30+buf.readUInt16LE(26),dataLength=buf.readUInt32LE(18);
+ let crc=0xffffffff;
+ for(const byte of buf.subarray(dataStart,dataStart+dataLength)){
+  crc^=byte;
+  for(let j=0;j<8;j++)crc=(crc>>>1)^((crc&1)?0xedb88320:0);
+ }
+ crc=(crc^0xffffffff)>>>0;
+ const dir=buf.readUInt32LE(buf.length-22+16);
+ buf.writeUInt32LE(crc,14);
+ buf.writeUInt32LE(crc,dir+16);
+ assert.throws(()=>verifyOfflineDiagnosticsZip(buf),/unsafe diagnostic summary/i);
+});

package/test/r67-diagnostics-zip-oracle.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {makeOfflineDiagnosticBundle} from '../src/r67-diagnostic-export.mjs';
+test('R67 ZIP interoperates with independent Windows .NET ZipArchive reader',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-dotnet-zip-'));
+ try{
+  const file=path.join(folder,'diag.zip');
+  const x=makeOfflineDiagnosticBundle({releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:'a'.repeat(64),logs:[
+   {source:'controller-start.stderr.log',content:'2026-10-11T01:02:03.000Z ERROR timeout win32=109 TOKEN_CANARY_7841'}
+  ]});
+  await writeFile(file,x.zip);
+  const escaped=file.replaceAll("'","''");
+  const ps=[
+    '$ErrorActionPreference="Stop"',
+    'Add-Type -AssemblyName System.IO.Compression.FileSystem',
+    "$zip=[System.IO.Compression.ZipFile]::OpenRead('"+escaped+"')",
+    "try{",
+    "  $entries=@($zip.Entries|ForEach-Object {$_.FullName})",
+    "  if($entries.Count -ne 2 -or $entries[0] -ne 'diagnostics.json' -or $entries[1] -ne 'redacted-events.json'){throw 'ZIP_ENTRY_MISMATCH'}",
+    "  foreach($entry in $zip.Entries){",
+    "    $reader=New-Object System.IO.StreamReader($entry.Open())",
+    "    try{$body=$reader.ReadToEnd();$parsed=ConvertFrom-Json -InputObject $body;if(!$parsed){throw 'INVALID_JSON'}}finally{$reader.Dispose()}",
+    "    if($body.Contains('TOKEN_CANARY_7841')){throw 'SECRET_LEAK'}",
+    "  }",
+    "  Write-Output 'ZIP_ORACLE_PASS'",
+    "}finally{$zip.Dispose()}"
+  ].join(';');
+  const r=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',ps],
+   {windowsHide:true,shell:false,encoding:'utf8',timeout:20000,maxBuffer:1024*1024});
+  assert.equal(r.error,undefined,r.error?.message);
+  assert.equal(r.status,0,r.stderr);
+  assert.match(r.stdout,/ZIP_ORACLE_PASS/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});

package/test/r67-diagnostics.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {redactDiagnosticLine,makeOfflineDiagnosticBundle,exportOfflineDiagnostics} from '../src/r67-diagnostic-export.mjs';
+const secret='SENTINEL_SECRET_CANARY_984031';
+const token='sk-proj-FAKE_DIAGNOSTIC_SECRET';
+const sha='a'.repeat(64);
+test('R67 local diagnostics use irreversible token-free allowlist, not regex-redacted raw log',()=>{
+ const line='2026-10-11T05:44:03.000Z ERROR reconnect win32=109 Authorization: Bearer '+secret+' '+token+' C:\\Users\\DEADBYTE\\passwords.txt';
+ const output=redactDiagnosticLine(line);
+ assert.deepEqual(output,{timestamp:'2026-10-11T05:44:03.000Z',level:'ERROR',event:'reconnect',win32_error:109});
+ assert.ok(!JSON.stringify(output).includes('FAKE'));
+ const unknown=redactDiagnosticLine('password='+secret+' '+token+' cwd=/private/location');
+ assert.equal(unknown,null,'unknown free-form lines must be dropped');
+});
+test('R67 offline ZIP contains only fixed names, derived summaries, no raw secrets or network URL',()=>{
+ const bundle=makeOfflineDiagnosticBundle({
+  releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:sha,
+  logs:[{source:'controller-start.stderr.log',content:'ERROR reconnect win32=109 Bearer '+secret+'\nINFO ready '+token+'\npassword='+secret+'\n'}]
+ });
+ assert.ok(Buffer.isBuffer(bundle.zip));
+ assert.equal(bundle.zip.readUInt32LE(0),0x04034b50,'ZIP local file header');
+ assert.ok(bundle.zip.includes(Buffer.from('diagnostics.json')));
+ assert.ok(bundle.zip.includes(Buffer.from('redacted-events.json')));
+ for(const value of [secret,token,'password=','Bearer','C:\\Users\\','https://'])
+  assert.equal(bundle.zip.includes(Buffer.from(value)),false,'raw or sensitive text leaked');
+ assert.equal(bundle.summary.schema,'deadbyte.r67-offline-diagnostics.v1');
+ assert.equal(bundle.summary.network_upload,'NEVER');
+ assert.equal(bundle.summary.source_count,1);
+ assert.equal(bundle.summary.redacted_event_count,2);
+ assert.match(bundle.archive_sha256,/^[a-f0-9]{64}$/);
+});
+test('R67 exports only to owner-selected local path, absent target and no arbitrary logs',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-diagnostic-test-'));
+ try{
+  const stateRoot=path.join(folder,'state');
+  await mkdir(path.join(stateRoot,'runtime','logs'),{recursive:true});
+  await writeFile(path.join(stateRoot,'active-release.json'),JSON.stringify({release_id:'v0.15.43-'+'a'.repeat(16),manifest_sha256:sha}));
+  await writeFile(path.join(stateRoot,'runtime','logs','controller-start.stderr.log'),'ERROR timeout Authorization: Bearer '+secret+'\nINFO connected '+token+'\n');
+  await writeFile(path.join(stateRoot,'runtime','logs','arbitrary.log'),'ERROR THIS MUST NOT BE INCLUDED '+secret+'\n');
+  const output=path.join(folder,'owner-approved.zip');
+  const result=await exportOfflineDiagnostics({stateRoot,outputPath:output});
+  assert.equal(result.status,'written_local_only');
+  assert.equal(result.uploaded,false);
+  const actual=await readFile(output);
+  assert.equal(actual.readUInt32LE(0),0x04034b50);
+  assert.equal(actual.includes(Buffer.from(secret)),false);
+  assert.equal(actual.includes(Buffer.from(token)),false);
+  assert.equal(actual.includes(Buffer.from('arbitrary.log')),false);
+  const info=await lstat(output);
+  assert.ok(info.isFile()&&!info.isSymbolicLink());
+  await assert.rejects(()=>exportOfflineDiagnostics({stateRoot,outputPath:output}),/EEXIST|already exists/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+test('R67 without output path fails before read and upload option is always forbidden',async()=>{
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a'}),/outputPath/);
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a',outputPath:'X',upload:true}),/upload.*disabled|no network/i);
+});

package/test/r67-evidence-reconcile.test.mjs

@@ -0,0 +1,186 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createR67ShardPlan,r67RegressionTreeHash,r67ShardTimeoutMs} from '../src/r67-regression-shards.mjs';
+import {reconcileR67Evidence} from '../src/r67-evidence-reconcile.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const op='r67-e2e-fixture-contract';
+async function fixture(){
+ const parent=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-e2e-'));
+ const root=path.join(parent,'candidate'),evidenceRoot=path.join(parent,'evidence');
+ await mkdir(path.join(root,'test'),{recursive:true});
+ await mkdir(path.join(root,'src'));
+ await mkdir(evidenceRoot);
+ await writeFile(path.join(root,'package.json'),'{}\n');
+ await writeFile(path.join(root,'src','core.mjs'),'export const r67 = true;\n');
+ const names=Array.from({length:32},(_,i)=>'test/fixture-'+String(i).padStart(2,'0')+'.test.mjs');
+ for(const name of names)await writeFile(path.join(root,name),'import test from "node:test"; test("fixture",()=>{});\n');
+ const plan=createR67ShardPlan(names,32);
+ const hashes=await Promise.all(names.map(async name=>[name,sha(await readFile(path.join(root,name)))]));
+ const testTree=sha(Buffer.from(JSON.stringify(hashes)));
+ const opts={roots:['src','test'],topLevel:['package.json'],extra:[]};
+ const tree=await r67RegressionTreeHash(root,opts);
+ async function writeShard(index,{kind='valid',signed=false}={}){
+  const shard=plan.shards[index],folder=path.join(evidenceRoot,op+'-shard-'+String(index).padStart(2,'0'));
+  await mkdir(folder,{recursive:true});
+  const intent={schema:'deadbyte.r67-shard-intent.v1',operation:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,started_at_utc:'2026-10-11T00:00:00.000Z',files:shard.files};
+  await writeFile(path.join(folder,'intent.json'),JSON.stringify(intent));
+  const status=kind==='unknown'?'OUTCOME_UNKNOWN':'PASS';
+  const result={schema:kind==='v1'?'deadbyte.r67-shard-result.v1':'deadbyte.r67-shard-result.v2',
+   operation_id:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,status,exit_code:status==='PASS'?0:null,
+   test_count:status==='PASS'?1:null,passed:status==='PASS'?1:null,failed:status==='PASS'?0:null,
+   skipped:status==='PASS'?0:null,cancelled:status==='PASS'?0:null,todo:status==='PASS'?0:null,
+   configured_timeout_ms:r67ShardTimeoutMs(shard),timed_out:false,failure_reason:null,elapsed_ms:1,
+   stdout_sha256:sha(Buffer.from('fixture output')),stderr_sha256:sha(Buffer.alloc(0))};
+  if(kind==='tampered')result.files_sha256='f'.repeat(64);
+  const receipt_sha256=sha(Buffer.from(JSON.stringify(result)));
+  await writeFile(path.join(folder,'result.json'),JSON.stringify({...result,receipt_sha256}));
+  return folder;
+ }
+ return {parent,root,evidenceRoot,plan,opts,writeShard,cleanup:()=>rm(parent,{recursive:true,force:true})};
+}
+test('R67 real reconciliation consumes 32 durable v2 receipts and reports PASS from fixture source bytes',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'PASS',JSON.stringify(r));
+  assert.equal(r.verified_receipts,32);
+  assert.equal(r.verdict.test_count,32);
+  assert.deepEqual(r.integrity_faults,[]);
+ }finally{await x.cleanup();}
+});
+test('R67 verified legacy v1 receipts cannot count toward a new full suite PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===5?'v1':'valid'});
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+  assert.deepEqual(r.stale_indices,[5]);
+  assert.equal(r.verified_receipts,31);
+ }finally{await x.cleanup();}
+});
+test('R67 rejects changed receipts before considering source staleness',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===7?'tampered':'valid'});
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const broken=JSON.parse(await readFile(file,'utf8'));broken.result_sha256='0'.repeat(64);
+  await writeFile(file,JSON.stringify(broken));
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(e=>e.index===7));
+ }finally{await x.cleanup();}
+});
+test('R67 source mutation, missing shard and unknown outcome never produce PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<31;i++)await x.writeShard(i);
+  let r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED');
+  await x.writeShard(31,{kind:'unknown'});
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'OUTCOME_UNKNOWN');
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+ }finally{await x.cleanup();}
+});
+
+test('R67 changed test plan makes authentic historical v1 receipts STALE, not integrity failures',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:'v1'});
+  await writeFile(path.join(x.root,'test','fixture-added.test.mjs'),'import test from "node:test"; test("new",()=>{});\\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE',JSON.stringify(r.integrity_faults));
+  assert.deepEqual(r.integrity_faults,[]);
+  assert.equal(r.stale_indices.length,32);
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 PASS cannot coexist with timed_out=true even if receipt SHA is recomputed',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-08','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.timed_out=true;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(v=>v.index===8));
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 skips cannot silently produce a full regression PASS without classification',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.passed=0;result.skipped=1;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED_NONPASS_CLASSIFICATION');
+  assert.deepEqual(r.unclassified_nonpass,[{index:9,skipped:1,todo:0,cancelled:0}]);
+ }finally{await x.cleanup();}
+});
+
+test('R67 case-level SKIP evidence stays visible and forged case counts fail integrity',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const report=JSON.parse(await readFile(file,'utf8'));
+  report.passed=0;report.skipped=1;
+  report.nonpass_cases=[{kind:'SKIP',name:'offline fixture',reason:'unsupported platform'}];
+  report.nonpass_fully_classified=true;
+  const seal=async()=>{
+    const {receipt_sha256,...body}=report;report.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+    await writeFile(file,JSON.stringify(report));
+  };
+  await seal();
+  const observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'PASS','Fully reasoned skips must be honestly recorded but should not fabricate test failures');
+  assert.deepEqual(observed.classified_nonpass[0].cases,report.nonpass_cases);
+  assert.equal(observed.verdict.passed,31);
+  assert.equal(observed.verdict.test_count,32);
+  report.nonpass_cases.push({kind:'SKIP',name:'forged',reason:'unsupported platform'});
+  await seal();
+  const broken=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(broken.status,'FAILED_INTEGRITY');
+ }finally{await x.cleanup();}
+});
+
+
+test('R67 v2 FAILED result must bind a complete named failure case ledger, not an empty passing-shaped ledger',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));
+  const name='remote ownership race';
+  result.status='FAILED';result.exit_code=1;result.failed=1;result.passed=0;
+  result.failure_cases=[{name,name_sha256:sha(Buffer.from(name,'utf8'))}];
+  result.failure_cases_complete=true;
+  const seal=async()=>{const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));await writeFile(file,JSON.stringify(result));};
+  await seal();
+  let observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED');
+  assert.deepEqual(observed.integrity_faults,[]);
+  result.failure_cases=[];result.failure_cases_complete=true;await seal();
+  observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED_INTEGRITY');
+  assert.ok(observed.integrity_faults.some(v=>v.index===7));
+ }finally{await x.cleanup();}
+});