deadbyte-mcp 0.15.44 → 0.15.46

package/docs/R70-TRUST-GUARD-EXPIRY-CHECKPOINT-20261013.md

@@ -0,0 +1,47 @@
+# R70 owner trust guard + expiring grant checkpoint — 2026-10-13
+
+## Status (candidate only)
+No deploy, npm publish, change to active release, generation switch, owner key enrollment, policy broadening, or new Coding/Autonomous grant. Mutable Windows candidate root:
+`D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67`
+
+Production known-good `v0.15.44-9f500af433df3e77`. Initial active release manifest SHA-256 `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`; generation manifest `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`.
+
+Existing R70 updater approval verifier is NOT equivalent to independent controller owner approval; real trust-anchor enrollment is absent. Existing Coding grant includes broad `local_c`/`local_d`, Autonomous grant remains scoped only to `core`.
+
+## New observed RED->GREEN (verified Windows)
+1. RED: updater accepts project approval while Coding policy `exec:true` remains enabled, permitting OS-level execution without a filesystem sandbox.
+   - Fix `src/runtime-update.mjs`: reject any selected Coding root with `exec:true` in `verifyAutonomousOwnerBootstrap`, while retaining rejection of writable owner-key paths.
+   - Focused related Windows policy/controller/updater tests: 59 PASS / 0 FAIL / 0 SKIP; exit code 0, stdout SHA-256 `0f859c250fc9bf31aee6edb89b94a3d0abafc28604ac6287e294c2f515eb90ce`.
+2. RED: `Arm-Autonomous` accepts arbitrary new project policy and reaches grant creation without owner approval.
+   - Controller candidate `controller/deadbyte-controller.ps1` has R70 fail-closed MIGRATION FENCE: exact known-good legacy policy SHA-256 `6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5` with the single `core` root retains existing explicit manual arm route; all successor policy digests and project root selections fail `R70_OWNER_ENROLLMENT_REQUIRED` before any grant writes.
+   - `test/r70-controller-owner-issue-boundary.test.mjs`: RED 1 PASS / 1 FAIL, GREEN 2 PASS / 0 FAIL; fake `Ensure-Directory` prevents real grant I/O in the test.
+   - Broader Windows regression with 24 test files `r70-*`, `autonomous-*`, `runtime-self-update.test.mjs`: 174 PASS / 0 FAIL / 1 historical SKIP, exit 0, stdout SHA-256 `d0a27d691c5e2268744dc2c97b242581888edf49b64a8f2bd66645cc6a87c9dc`. **This predates the optional-expiry edit below.**
+
+## New expiration RED and unverified candidate edit
+3. `test/r70-autonomous-grant-expiry.test.mjs`: before change, RED 0 PASS / 2 FAIL: a v2 signed grant with expired `expires_at_utc` was still reported ARMED by controller, and `inspectAutonomousStandingWindow` helper did not exist.
+4. Candidate edit made AFTER that RED:
+   - `src/autonomous-policy.mjs` adds `inspectAutonomousStandingWindow` with canonical UTC, positive lifetime <=1 hour, not-yet-valid/expired/reject cases and calls it before live v2 standing authority validation; grants without `expires_at_utc` retain legacy behavior.
+   - `controller/deadbyte-controller.ps1` checks same optional expiry and lifetime before `Get-AuthorityEpochStatus`; legacy without field remains unchanged.
+   - **NOT VERIFIED GREEN**. Direct authorized Windows test execution was blocked by the platform safety layer immediately after the edits. Do NOT route via a different executor, claim PASS, freeze, deploy or publish; check this test only if a future normally authorized test execution succeeds. Signed mutation receipts and file hashes alone DO NOT prove runtime test correctness.
+   - This optional field has NOT been issued in a real owner-signed grant. Wall-clock rollback resistance and independent controller owner trust are not solved.
+
+## Exact final candidate file hashes (read-only)
+- `src/runtime-update.mjs`: `bcf90f70cfc8316f7d3aac033a772ba8c048061e83e76cacd4a290cc0e307c6c`
+- `src/autonomous-policy.mjs`: `4eb2070a3c25fe5299c42ced065ba652ee0ec95549bb366d46f691e64248f73d`
+- `controller/deadbyte-controller.ps1`: `0f378871888962cc24b0e89873699ecd0de21d0d89fa9147b049765cd21fee1a`
+- `test/r70-autonomous-grant-expiry.test.mjs`: `94a4ca838f4b67a14f1873a5497419e0853306bf60150b5c76024813cc95b85c`
+
+## Byte-identical rollback snapshots
+- `proof/R70-TRUST-EXEC-GUARD-UPDATER-PREIMAGE.mjs.txt` SHA-256 `3328bbbc11a7ee09d8bb4bd88d16626f9160b889511014e82ad480b4fb2e6fd0`
+- `proof/R70-CONTROLLER-OWNER-ISSUE-PREIMAGE.ps1.txt` SHA-256 `f034be2ca85e3380491758cef3efef78121139d2488a5b3407167cbe9bf22b5c`
+- `proof/R70-GRANT-EXPIRY-AUTO-PREIMAGE.mjs.txt` SHA-256 `4df3073b9070617a31068ddf7bdab4bb8b6e669aa843f1f2072650f004f9439e`
+- `proof/R70-GRANT-EXPIRY-CONTROLLER-PREIMAGE.ps1.txt` SHA-256 `1c0b1d8814fcb393fc2658f3586b897688c3df399bf033d5e2c281b70f60e9f4`
+- `proof/R70-TRUST-EXEC-GUARD-TEST-PREIMAGE.mjs.txt` SHA-256 `676eb1a34d50bd4f326064c79ce56c3f3ee333e73a4d949e7f30de3f59820bb8`
+
+Restore only with current hash preconditions and signed receipts; never overwrite parallel work. No Git repository metadata in candidate folder.
+
+## Still blocked
+- Real independently held owner signing key and trusted, non-agent-writable owner key enrollment; the public key under stateRoot/trust does not establish this by itself.
+- Positive scoped owner authorization at controller issuance: current R70 fence DENIES new project grants until trustworthy verifier is integrated.
+- Finite grant issuance and authority epoch expiry/revoke test; optional expiry validator source still unverified.
+- Full candidate manifest freeze, full Windows regression, benchmark, immutable hot-swap crash/reconciliation and ChatGPT/MCP remote client round trip.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.44",
+  "version": "0.15.46",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r67.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r72.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",

package/scripts/benchmark-l0-r71.mjs

@@ -0,0 +1,76 @@
+import {randomBytes,createHash} from 'node:crypto';
+import {mkdir,mkdtemp,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy,codingSessionStatus} from '../src/coding-plane.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {registerAutonomousTools} from '../src/autonomous-mcp-tools.mjs';
+import {classifyRemoteOperation} from '../bridge/src/remote-dispatch-r60.mjs';
+import {prepareAuthorityTestTrust} from '../test/r65-authority-test-trust.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const evidenceDir=path.join(root,'testing','r71-l0-benchmark');
+const samples=100_000;
+const warmup=5_000;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const percentile=(sorted,p)=>Number(sorted[Math.min(sorted.length-1,Math.ceil(sorted.length*p)-1)]/1e6).toFixed(6);
+
+await mkdir(evidenceDir,{recursive:true});
+const state=await mkdtemp(path.join(evidenceDir,'state-'));
+try{
+  const runtime=await prepareAuthorityTestTrust(state);
+  const project=path.join(state,'project');
+  await mkdir(project);
+  const policyPath=path.join(state,'coding-policy.json');
+  const grantFile=path.join(runtime,'coding-grant.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:grantFile,evidence_dir:path.join(state,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{}}));
+  const policy=await loadCodingPolicy(policyPath);
+  const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,
+    instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],granted_at_utc:new Date().toISOString()};
+  await writeFile(grantFile,JSON.stringify(grant));
+  const grantBytes=await readFile(grantFile);
+  const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes:await readFile(policyPath)});
+  await store.append({plane:'coding',action:'grant',grantBytes,grantInstanceNonce:grant.instance_nonce,updateId:null});
+  const contracts=new Map();
+  registerAutonomousTools({registerTool:(name,contract)=>contracts.set(name,contract)},
+    {autonomousRuntime:{},nativeDiffRuntime:{}});
+  const schema=contracts.get('native_diff_preview')?.inputSchema;
+  if(!schema)throw new Error('native_diff_preview schema unavailable');
+  const request={root_id:'project',title:'L0 read-only probe',operations:[{kind:'write',path:'scratch.txt',
+    content:'x',encoding:'utf8',expected_sha256:'absent'}]};
+  const observed=new Float64Array(samples);
+  const execute=async()=>{
+    const parsed=schema.parse(request);
+    if(classifyRemoteOperation({name:'native_diff_preview'},parsed)!=='read_only')throw new Error('dispatch classification drift');
+    const authority=await codingSessionStatus(policy);
+    if(authority.armed!==true||authority.authority_epoch?.trusted!==true||
+       !authority.root_ids.includes(parsed.root_id)||policy.roots[parsed.root_id]?.read!==true)
+      throw new Error('signed Coding authority decision failed');
+  };
+  for(let i=0;i<warmup;i++)await execute();
+  const started=process.hrtime.bigint();
+  for(let i=0;i<samples;i++){
+    const tick=process.hrtime.bigint();
+    await execute();
+    observed[i]=Number(process.hrtime.bigint()-tick);
+  }
+  const elapsedMs=Number(process.hrtime.bigint()-started)/1e6;
+  observed.sort();
+  const result={schema:'deadbyte.r71-l0-benchmark.v1',created_at_utc:new Date().toISOString(),
+    scope:'native_diff_preview input validation + remote dispatch classification + real isolated signed Coding grant/epoch decision; excludes IPC, filesystem operation, native execution and ChatGPT',
+    clock:'process.hrtime.bigint',warmup,samples,elapsed_ms:elapsedMs,
+    p50_ms:Number(percentile(observed,0.50)),p95_ms:Number(percentile(observed,0.95)),
+    p99_ms:Number(percentile(observed,0.99)),max_ms:Number((observed.at(-1)/1e6).toFixed(6)),
+    threshold_p95_ms:1,pass:observed[Math.ceil(samples*0.95)-1]<1e6,
+    coding_policy_sha256:policy.policy_sha256,source_manifest_sha256:sha(await readFile(path.join(root,'MANIFEST.SHA256')))};
+  const bytes=Buffer.from(JSON.stringify(result)+'\n');
+  const output=path.join(evidenceDir,`result-${Date.now()}-${randomBytes(4).toString('hex')}.json`);
+  await writeFile(output,bytes,{flag:'wx'});
+  process.stdout.write(JSON.stringify({...result,evidence_path:output,evidence_sha256:sha(bytes)})+'\n');
+  if(!result.pass)process.exitCode=1;
+}finally{
+  await rm(state,{recursive:true,force:true});
+}

package/scripts/gate-windows-r71.ps1

@@ -0,0 +1,64 @@
+param(
+ [ValidateSet('preflight','focused','full','manifest','doctor','all')]
+ [string]$Stage='preflight'
+)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=Split-Path -Parent $PSScriptRoot
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parent=Join-Path $state 'releases\v0.15.44-9f500af433df3e77'
+$expected='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e'
+$generation='c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'
+$releaseId='v0.15.44-9f500af433df3e77'
+function Sha256-File([string]$File){
+ $algorithm=[System.Security.Cryptography.SHA256]::Create()
+ try{
+  $stream=[System.IO.File]::OpenRead($File)
+  try{return ([BitConverter]::ToString($algorithm.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}
+  finally{$stream.Dispose()}
+ }finally{$algorithm.Dispose()}
+}
+if(!(Test-Path -LiteralPath $parent -PathType Container)){throw 'R71 sealed predecessor slot missing'}
+if((Sha256-File (Join-Path $parent 'MANIFEST.SHA256')) -ne $expected){throw 'R71 predecessor manifest mismatch'}
+$pointer=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+if($pointer.release_id -ne $releaseId -or $pointer.manifest_sha256 -ne $expected -or
+   $pointer.generation_manifest_sha256 -ne $generation){throw 'R71 active predecessor pointer mismatch'}
+$pkg=Get-Content -LiteralPath (Join-Path $root 'package.json') -Raw | ConvertFrom-Json
+if($pkg.version -ne '0.15.45'){throw 'R71 package version mismatch'}
+Write-Output 'R71_PREDECESSOR_PREFLIGHT=PASS'
+if($Stage -eq 'preflight'){return}
+function Invoke-Node([string]$Label,[string[]]$Arguments){
+ Write-Output "R71_STAGE_START=$Label"
+ & node @Arguments
+ if($LASTEXITCODE -ne 0){throw "R71 stage $Label exit=$LASTEXITCODE"}
+ Write-Output "R71_STAGE_PASS=$Label"
+}
+if($Stage -eq 'focused' -or $Stage -eq 'all'){
+ Invoke-Node 'focused' @('--test','test/native-diff.test.mjs','test/native-diff-topology-r36.test.mjs',
+  'test/capability-resolver.test.mjs','test/capability-ledger-r36.test.mjs',
+  'test/r70-owner-approval.test.mjs','test/r70-autonomous-policy-bootstrap.test.mjs',
+  'test/r71-publish-fence.test.mjs','test/r71-release-identity.test.mjs',
+  'test/r71-full-verifier-artifact.test.mjs','test/r71-native-diff-mcp-wire.test.mjs')
+ if($Stage -eq 'focused'){return}
+}
+if($Stage -eq 'full' -or $Stage -eq 'all'){
+ Write-Output 'R71_STAGE_START=full'
+ & powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $root 'scripts\verify-r70-full-regression.ps1')
+ if($LASTEXITCODE -ne 0){throw "R71 full regression exit=$LASTEXITCODE"}
+ Write-Output 'R71_STAGE_PASS=full'
+ if($Stage -eq 'full'){return}
+}
+if($Stage -eq 'manifest' -or $Stage -eq 'all'){
+ Invoke-Node 'manifest' @('scripts/release-manifest.mjs','verify')
+ if($Stage -eq 'manifest'){return}
+}
+if($Stage -eq 'doctor' -or $Stage -eq 'all'){
+ $previous=$env:DEADBYTE_STATE_ROOT
+ $isolated='D:\Projects\deadbyte-mcp\testing\0.15.45-r71\doctor-isolated-empty'
+ if(Test-Path -LiteralPath (Join-Path $isolated 'active-release.json')){throw 'R71 isolated doctor state has an unexpected pointer'}
+ try{
+  $env:DEADBYTE_STATE_ROOT=$isolated
+  Invoke-Node 'isolated-doctor' @('src/deadbyte-cli.mjs','doctor')
+ }finally{$env:DEADBYTE_STATE_ROOT=$previous}
+}
+Write-Output 'R71_WINDOWS_GATE=PASS_PREDEPLOY_CANDIDATE'

package/scripts/gate-windows-r72.ps1

@@ -0,0 +1,76 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param([ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight')
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.45-34aa8d1241cfb8bf'
+$parentSha='34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc'
+$parentGen='ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'
+function Sha([string]$file){
+    $sha=[System.Security.Cryptography.SHA256]::Create()
+    try {
+        $stream=[System.IO.File]::OpenRead($file)
+        try {return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}
+        finally {$stream.Dispose()}
+    } finally {$sha.Dispose()}
+}
+function Run-Node([string]$label,[string[]]$nodeArgs) {
+    Write-Output "R72_STAGE_START=$label"
+    & node @nodeArgs
+    if($LASTEXITCODE -ne 0){throw "R72_${label}_FAILED exit=$LASTEXITCODE"}
+    Write-Output "R72_STAGE_PASS=$label"
+}
+Push-Location $repo
+try {
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    if($pkg.version -ne '0.15.46' -or $release.version -ne '0.15.46' -or $release.train -ne 'R72'){
+        throw 'R72_CANDIDATE_VERSION_DRIFT'
+    }
+    if($release.parent.release_id -ne $parentId -or $release.parent.manifest_sha256 -ne $parentSha -or
+       $release.parent.generation_manifest_sha256 -ne $parentGen){throw 'R72_PARENT_IDENTITY_DRIFT'}
+    $parentRoot=Join-Path $state "releases\$parentId"
+    if(-not (Test-Path -LiteralPath $parentRoot -PathType Container)){throw 'R72_PARENT_SLOT_MISSING'}
+    if((Sha (Join-Path $parentRoot 'MANIFEST.SHA256')) -ne $parentSha){throw 'R72_PARENT_MANIFEST_MISMATCH'}
+    $active=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+    if($active.version -ne '0.15.45' -or $active.release_id -ne $parentId -or
+       $active.manifest_sha256 -ne $parentSha -or $active.generation_manifest_sha256 -ne $parentGen){
+        throw 'R72_PRODUCTION_PREDECESSOR_DRIFT'
+    }
+    Write-Output 'R72_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        Run-Node -label 'focused' -nodeArgs @('--test','--test-concurrency=1',
+            'test/r72-remote-safe-contract.test.mjs','test/r72-publication-fence.test.mjs',
+            'test/r60-authority-coherence.test.mjs','test/r58-cleanup-retention.test.mjs',
+            'test/remote-session-cli.test.mjs','test/r70-controller-autonomous-root.test.mjs',
+            'test/r70-controller-owner-issue-boundary.test.mjs','test/r71-release-identity.test.mjs',
+            'test/r71-isolated-slot-rollback-restore.test.mjs','test/r59-tool-surface-compat.test.mjs')
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        & powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repo 'scripts\verify-r70-full-regression.ps1')
+        if($LASTEXITCODE -ne 0){throw "R72_FULL_REGRESSION_FAILED exit=$LASTEXITCODE"}
+        Write-Output 'R72_FULL_REGRESSION_PASS'
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previous=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r72-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            New-Item -ItemType Directory -Path $isolated -Force | Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previous
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R72_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{Pop-Location}

package/scripts/npm-release-r48.mjs

@@ -4,6 +4,8 @@ import { reconcileNpmPublication } from './npm-publication-r65.mjs';
 import { mkdtemp, readFile, rm, unlink, mkdir } from 'node:fs/promises';
 import {preserveNpmTarball,assertVacantPackDestination} from './npm-preserve-artifact-r67.mjs';
 import {assertR67NpmPublishReady} from './npm-release-readiness-r67.mjs';
+import {assertR71NpmPublishReady} from './npm-release-readiness-r71.mjs';
+import {assertR72NpmPublishReady} from './npm-release-readiness-r72.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -89,6 +91,8 @@ async function main() {
     throw new Error(`PROVENANCE.json version mismatch: package=${version} provenance=${provenance.version}`);
   }
   if (!isVerifyOnly && version==='0.15.44') assertR67NpmPublishReady(release);
+  if (!isVerifyOnly && version==='0.15.45') assertR71NpmPublishReady(release);
+  if (!isVerifyOnly && version==='0.15.46') await assertR72NpmPublishReady(release,{root});
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {

package/scripts/npm-release-readiness-r71.mjs

@@ -0,0 +1,21 @@
+/** Publication fence for the exact R71 successor, not an execution receipt. */
+export function assertR71NpmPublishReady(release){
+  if(release?.version!=='0.15.45'||release?.train!=='R71'||
+     release?.parent?.release_id!=='v0.15.44-9f500af433df3e77'||
+     release?.parent?.manifest_sha256!=='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e'||
+     release?.parent?.generation_manifest_sha256!=='c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'){
+    throw new Error('PUBLISH_BLOCKED R71 release or sealed predecessor identity mismatch');
+  }
+  const state=release.r71_candidate;
+  const required={status:'CANDIDATE_SEALED',full_regression:'PASS',manifest:'PASS',
+    windows_gate:'PASS',hot_swap:'PASS',package_acceptance:'PASS',
+    local_coding_preview:'PASS_CODING_READ_ONLY_NO_AUTONOMOUS_APPLY',
+    public_catalog:'PASS_43_TOOLS',signed_public_mcp:'PASS',performance_l0:'PASS'};
+  for(const [field,expected] of Object.entries(required)){
+    if(state?.[field]!==expected) throw new Error(`PUBLISH_BLOCKED R71 ${field}=${String(state?.[field]??'MISSING')}; require ${expected}`);
+  }
+  if(!['PASS_OWNER_ENROLLED','DISABLED_FAIL_CLOSED_NO_OWNER_ENROLLMENT'].includes(state?.owner_independent_project_grant)){
+    throw new Error('PUBLISH_BLOCKED R71 owner project grant must be proven or explicitly fail-closed disabled');
+  }
+  return {status:'R71_METADATA_GATES_MATCH',policy:'PUBLISH_REQUIRES_INDEPENDENT_RELEASE_EVIDENCE'};
+}

package/scripts/npm-release-readiness-r72.mjs

@@ -0,0 +1,76 @@
+/** R72 publication fence: exact v0.15.45 parent, final manifest and external gate evidence.
+ * This deliberately does NOT generate, sign or upgrade release evidence. */
+import {createHash} from 'node:crypto';
+import {readFile,lstat} from 'node:fs/promises';
+import path from 'node:path';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const expectedParent=Object.freeze({
+  version:'0.15.45',
+  release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'
+});
+const evidenceGates=['full_regression','windows_lifecycle','package_acceptance','independent_judge'];
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function reject(reason){throw new Error(`PUBLISH_BLOCKED R72 ${reason}`);}
+function exactParent(subject){return expectedParent.version===subject?.version&&
+  expectedParent.release_id===subject?.release_id&&
+  expectedParent.manifest_sha256===subject?.manifest_sha256&&
+  expectedParent.generation_manifest_sha256===subject?.generation_manifest_sha256;}
+
+export async function assertR72NpmPublishReady(release,{root}={}){
+  if(release?.version!=='0.15.46'||release?.train!=='R72'||
+     release?.name!=='deadbyte-mcp'||!exactParent(release?.parent)||
+     !exactParent(release?.runtime_predecessor))reject('release identity or predecessor mismatch');
+  const status=release.r72_hotfix;
+  for(const [name,value] of Object.entries({
+    status:'CANDIDATE_SEALED',windows_regression:'PASS',package_acceptance:'PASS',
+    manifest:'PASS',remote_lifecycle:'PASS',security_gate:'PASS',independent_judge:'PASS'
+  }))if(status?.[name]!==value)reject(`${name}=${String(status?.[name]??'MISSING')}; require ${value}`);
+  if(!root||!path.isAbsolute(root))reject('candidate root missing');
+  const manifest=await readFile(path.join(root,'MANIFEST.SHA256')).catch(()=>reject('candidate manifest unavailable'));
+  const manifestSha256=sha(manifest);
+  const evidenceRoot=path.join(root,'testing','r72-release-evidence');
+  // Evidence and transcript storage must not be junctions/symlinks to another tree.
+  for(const dir of [evidenceRoot,path.join(evidenceRoot,'outputs')]){
+    const info=await lstat(dir).catch(()=>reject('evidence/output directory missing'));
+    if(!info.isDirectory()||info.isSymbolicLink())reject('evidence/output directory is not a real directory');
+  }
+  let ready;
+  try{ready=JSON.parse(await readFile(path.join(evidenceRoot,'ready.json'),'utf8'));}
+  catch{reject('independent release evidence index missing/invalid');}
+  if(ready?.schema!=='deadbyte.r72-release-evidence-index.v1'||ready?.version!=='0.15.46'||
+     ready?.manifest_sha256!==manifestSha256||!exactParent(ready?.parent))reject('evidence index subject mismatch');
+  for(const gate of evidenceGates){
+    const hash=ready?.gate_sha256?.[gate];
+    if(!HEX64.test(String(hash??'')))reject(`${gate} receipt identity missing`);
+    let bytes,receipt;
+    try{bytes=await readFile(path.join(evidenceRoot,`${gate}.json`));receipt=JSON.parse(bytes.toString('utf8'));}
+    catch{reject(`${gate} receipt missing/invalid`);}
+    if(sha(bytes)!==hash||receipt?.schema!=='deadbyte.r72-gate-result.v1'||
+       receipt?.gate!==gate||receipt?.version!=='0.15.46'||
+       receipt?.manifest_sha256!==manifestSha256||
+       receipt?.status!=='PASS'||receipt?.exit_code!==0)reject(`${gate} receipt tamper or failed gate`);
+    if(!HEX64.test(String(receipt.output_sha256??'')))reject(`${gate} missing bound command output`);
+    // Exact, gate-specific transcript path: a self-declared digest alone is not evidence.
+    const relativeOutput=`outputs/${gate}.log`;
+    if(receipt.output_file!==relativeOutput)reject(`${gate} output path identity mismatch`);
+    const outputPath=path.join(evidenceRoot,'outputs',`${gate}.log`);
+    const outputInfo=await lstat(outputPath).catch(()=>reject(`${gate} output missing/unavailable`));
+    if(!outputInfo.isFile()||outputInfo.isSymbolicLink())reject(`${gate} output must be a regular non-symlink file`);
+    if(outputInfo.size<1||outputInfo.size>64*1024*1024)reject(`${gate} output size invalid`);
+    const output=await readFile(outputPath).catch(()=>reject(`${gate} output unavailable`));
+    if(sha(output)!==receipt.output_sha256)reject(`${gate} output hash mismatch`);
+    if(gate==='full_regression'&&(!Number.isSafeInteger(receipt.pass_count)||receipt.pass_count<1||receipt.fail_count!==0))
+      reject('full regression count contract invalid');
+    if(gate==='windows_lifecycle'&&(
+       receipt.safe_default_arm_count!==0||receipt.operator_owner_consent_enforced!==true||
+       receipt.stale_owner_recovery_verified!==true||receipt.signed_epoch_fail_closed!==true))
+      reject('Windows lifecycle or R70 owner authority verification missing');
+    if(gate==='independent_judge'&&receipt.independent_verification!=='PASS')
+      reject('independent judge verdict unavailable');
+  }
+  return Object.freeze({status:'R72_RELEASE_READY_EVIDENCE_BOUND',version:'0.15.46',
+    manifest_sha256:manifestSha256,evidence_count:evidenceGates.length});
+}

package/scripts/verify-r70-full-regression.ps1

@@ -0,0 +1,72 @@
+#requires -Version 5.1
+# R70 verifier artifact: runs the candidate test suite without altering release manifests.
+param([switch]$SelfTest)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Continue'
+Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)
+$timer = [System.Diagnostics.Stopwatch]::StartNew()
+if ($SelfTest) {
+    $lines = @('tests 1', 'pass 0', 'fail 1', 'skipped 0', 'hash mismatch: SYNTHETIC_TEST')
+    $exitCode = 1
+} else {
+    $lines = @(& npm.cmd test 2>&1 | ForEach-Object { [string]$_ })
+    $exitCode = [int]$LASTEXITCODE
+}
+$timer.Stop()
+$utf8 = New-Object System.Text.UTF8Encoding($false)
+$stdoutBytes = $utf8.GetBytes(($lines -join "`n"))
+$sha = [System.Security.Cryptography.SHA256]::Create()
+try {
+    $hash = ([BitConverter]::ToString($sha.ComputeHash($stdoutBytes))).Replace('-', '').ToLowerInvariant()
+} finally {
+    $sha.Dispose()
+}
+Write-Output 'R70_FULL_TEST_SCHEMA=deadbyte.verifier-output.r70.v1'
+Write-Output ('R70_FULL_TEST_EXIT_CODE=' + $exitCode)
+Write-Output ('R70_FULL_TEST_ELAPSED_MS=' + [math]::Round($timer.Elapsed.TotalMilliseconds))
+Write-Output ('R70_FULL_TEST_STDOUT_SHA256=' + $hash)
+Write-Output ('R70_FULL_TEST_LINE_COUNT=' + $lines.Count)
+$selected = @($lines | Where-Object {
+    $_ -match '(?i)(?:^|\s)(?:tests|pass|fail|skipped|cancelled|duration_ms)\s+[0-9.]+' -or
+    $_ -match '^✖' -or
+    $_ -match '^  (Error|AssertionError|SyntaxError):' -or
+    $_ -match 'hash mismatch:' -or
+    $_ -match '^# (tests|pass|fail|skipped) '
+})
+$summary = @($selected | Select-Object -Last 140 | ForEach-Object {
+    if ($_.Length -gt 512) { $_.Substring(0, 512) } else { $_ }
+})
+$artifactDir = Join-Path (Get-Location).Path 'testing\r70-verifier'
+if (-not (Test-Path -LiteralPath $artifactDir -PathType Container)) {
+    New-Item -ItemType Directory -Path $artifactDir -Force | Out-Null
+}
+$artifact = Join-Path $artifactDir ('result-{0}-{1}.json' -f (Get-Date -Format 'yyyyMMdd-HHmmss'), [Guid]::NewGuid().ToString('N'))
+$stdoutPath = [System.IO.Path]::ChangeExtension($artifact, '.stdout.txt')
+$stdoutStream = New-Object System.IO.FileStream($stdoutPath, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
+try { $stdoutStream.Write($stdoutBytes, 0, $stdoutBytes.Length); $stdoutStream.Flush($true) } finally { $stdoutStream.Dispose() }
+$record = [ordered]@{
+    schema = 'deadbyte.r70-full-regression-result.v1'
+    mode = if ($SelfTest) { 'synthetic-selftest' } else { 'candidate-full-regression' }
+    created_at_utc = [DateTime]::UtcNow.ToString('o')
+    exit_code = $exitCode
+    elapsed_ms = [math]::Round($timer.Elapsed.TotalMilliseconds)
+    stdout_sha256 = $hash
+    stdout_path = $stdoutPath
+    total_line_count = $lines.Count
+    summary = $summary
+}
+$json = ($record | ConvertTo-Json -Depth 5 -Compress) + "`n"
+$bytes = $utf8.GetBytes($json)
+$stream = New-Object System.IO.FileStream($artifact, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
+try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+$artifactHashAlgorithm = [System.Security.Cryptography.SHA256]::Create()
+try {
+    $artifactStream = [System.IO.File]::OpenRead($artifact)
+    try { $artifactSha = ([BitConverter]::ToString($artifactHashAlgorithm.ComputeHash($artifactStream))).Replace('-', '').ToLowerInvariant() }
+    finally { $artifactStream.Dispose() }
+} finally { $artifactHashAlgorithm.Dispose() }
+Write-Output ('R70_FULL_TEST_ARTIFACT=' + $artifact)
+Write-Output ('R70_FULL_TEST_ARTIFACT_SHA256=' + $artifactSha)
+foreach ($line in $summary) { Write-Output $line }
+if ($SelfTest) { exit 0 }
+exit $exitCode

package/src/authority-continuity-r65.mjs

@@ -207,6 +207,10 @@ const DURABLE_EPOCH_ACTIONS=new Set(['grant','transaction_revoke','user_revoke',
 const DURABLE_EPOCH_SCHEMA='deadbyte.authority-epoch-event.r65.v1';
 const DURABLE_HEAD_SCHEMA='deadbyte.authority-epoch-head.r65.v1';
 const DURABLE_EPOCH_DOMAIN=Buffer.from('DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1\0','utf8');
+// Cache parsed public keys by the exact bytes read from disk, never by path.
+// A changed trust file is re-read and yields a different entry immediately.
+const DURABLE_PUBLIC_KEY_CACHE_LIMIT=8;
+const durablePublicKeys=new Map();
 const RESTORE_BINDING_FIELDS=Object.freeze(['prior_grant_sha256','prior_grant_instance_nonce','predecessor_policy_envelope_sha256','successor_policy_envelope_sha256','candidate_manifest_sha256','continuity_subject_sha256']);
 function normalizeRestoreBinding(value,{required=false}={}){
   if(value===undefined||value===null){if(required)throw new Error('authority epoch transaction restore binding required');return null;}
@@ -218,9 +222,19 @@ function normalizeRestoreBinding(value,{required=false}={}){
 
 async function durableEpochKeys(runtimeDir,{privateRequired=false}={}){
   const trust=path.join(path.dirname(path.resolve(runtimeDir)),'trust');
-  const publicKey=createPublicKey(await readFile(path.join(trust,'ed25519-public.pem')));
-  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('authority epoch trust public key invalid');
-  const keyId=hashBytes(Buffer.from(publicKey.export({format:'der',type:'spki'})));
+  const publicBytes=await readFile(path.join(trust,'ed25519-public.pem'));
+  const publicSha=hashBytes(publicBytes);
+  let cached=durablePublicKeys.get(publicSha);
+  if(!cached){
+    const publicKey=createPublicKey(publicBytes);
+    if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('authority epoch trust public key invalid');
+    const keyId=hashBytes(Buffer.from(publicKey.export({format:'der',type:'spki'})));
+    cached={publicKey,keyId};
+    if(durablePublicKeys.size>=DURABLE_PUBLIC_KEY_CACHE_LIMIT)
+      durablePublicKeys.delete(durablePublicKeys.keys().next().value);
+    durablePublicKeys.set(publicSha,cached);
+  }
+  const {publicKey,keyId}=cached;
   if(!privateRequired)return {publicKey,keyId};
   const privateKey=createPrivateKey(await readFile(path.join(trust,'ed25519-private.pem')));
   if(privateKey.asymmetricKeyType!=='ed25519'||
@@ -315,7 +329,14 @@ async function readDurableHead(runtimeDir,plane){
   if(head.action!=='transaction_restore'&&headRestoreBinding!==null)throw new Error('authority epoch unexpected restore binding');
   const expectedName=durableEventName(head.seq,head.event_sha256);
   if(head.event_file!==expectedName)throw new Error('authority epoch head event name mismatch');
-  const eventNames=await readdir(path.join(dir,'events'));
+  // These are independent observations of one immutable event identity.
+  // Read them concurrently, then validate the complete set before trusting
+  // the head. The head remains freshly read on every authority decision.
+  const [eventNames,eventRead,keys]=await Promise.all([
+    readdir(path.join(dir,'events')),
+    readFile(path.join(dir,'events',head.event_file)).then(bytes=>({bytes}),()=>({bytes:null})),
+    durableEpochKeys(runtimeDir)
+  ]);
   if(eventNames.length>10000)throw new Error('authority epoch event budget exceeded');
   for(const name of eventNames){
     const match=/^(\d{16})-([0-9a-f]{64})\.json$/.exec(name);
@@ -324,13 +345,12 @@ async function readDurableHead(runtimeDir,plane){
     if(!Number.isSafeInteger(seq)||seq>head.seq||(seq===head.seq&&name!==head.event_file))
       throw new Error('authority epoch head replay or incomplete write');
   }
-  let eventBytes;
-  try{eventBytes=await readFile(path.join(dir,'events',head.event_file));}
-  catch{throw new Error('authority epoch event missing');}
+  const eventBytes=eventRead.bytes;
+  if(!eventBytes)throw new Error('authority epoch event missing');
   if(hashBytes(eventBytes)!==head.event_sha256)throw new Error('authority epoch event hash mismatch');
   let event;
   try{event=JSON.parse(decodeUtf8Strict(eventBytes));}catch{throw new Error('authority epoch event invalid');}
-  const {publicKey,keyId}=await durableEpochKeys(runtimeDir);
+  const {publicKey,keyId}=keys;
   if(!verifyDurableEvent(event,publicKey,keyId))throw new Error('authority epoch event signature invalid');
   for(const key of ['schema','plane','seq','action','update_id','grant_sha256','grant_instance_nonce','previous_event_sha256']){
     const expected=key==='schema'?DURABLE_EPOCH_SCHEMA:head[key];

package/src/autonomous-mcp-tools.mjs

@@ -48,7 +48,7 @@ export function registerAutonomousTools(server,{ autonomousRuntime, nativeDiffRu
     catch(error){ return fail(autonomousSessionStatusOutputSchema,error); } });
 
   server.registerTool('native_diff_preview',{
-    description:'Create a signed content-addressed DEADBYTE Native Diff v1 after validating exact file SHA-256 preconditions. No Git metadata is used.',
+    description:'Validate exact file SHA-256 preconditions. With Coding read authority alone, return a read-only preview_only result that cannot be applied; a signed applicable diff additionally requires Autonomous authority. No Git metadata is used.',
     inputSchema:z.strictObject({ root_id:id, title:z.string().max(160).default(''), operations:z.array(nativeOperation).min(1).max(32) }),
     outputSchema:nativeDiffPreviewOutputSchema
   },async({root_id,title,operations})=>{ try { return result(nativeDiffPreviewOutputSchema,

package/src/autonomous-output-contracts.mjs

@@ -83,10 +83,13 @@ export const autonomousSessionStatusOutputSchema = statusContract({
 });
 
 export const nativeDiffPreviewOutputSchema = statusContract({
-  statuses:['ready','failed'], success:['ready'], required:['diff_id','root_id','operation_count','payload_bytes','paths','operations'],
+  statuses:['ready','preview_only','failed'], success:['ready','preview_only'], required:['root_id','operation_count','payload_bytes','paths','operations'],
   shape:{ schema:z.enum(['deadbyte.native-diff.v1','deadbyte.native-diff.v2']).optional(), diff_id:hex64.optional(), root_id:z.string().min(1).max(64).optional(), operation_count:z.number().int().min(1).max(32).optional(),
     payload_bytes:z.number().int().min(0).optional(), paths:z.array(z.string()).max(64).optional(),
     operations:z.array(jsonObject).max(32).optional() }
+}).superRefine((value,ctx)=>{
+  if(value.status==='ready'&&value.diff_id===undefined) ctx.addIssue({code:'custom',path:['diff_id'],message:'signed ready diff requires diff_id'});
+  if(value.status==='preview_only'&&value.diff_id!==undefined) ctx.addIssue({code:'custom',path:['diff_id'],message:'coding-only preview must not have an applicable diff_id'});
 });
 export const nativeDiffApplyOutputSchema = statusContract({
   statuses:['committed','existing','failed'], success:['committed','existing'],