deadbyte-mcp 0.15.45 → 0.15.46

package/src/staging-input-isolation.mjs

@@ -0,0 +1,79 @@
+import {lstatSync} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const canonical = value => process.platform === 'win32' ? value.toLowerCase() : value;
+function within(parent,child){
+  const relative=path.relative(canonical(parent),canonical(child));
+  return relative===''||(!path.isAbsolute(relative)&&relative!=='..'&&!relative.startsWith('..'+path.sep));
+}
+function productionRoot(){return path.resolve(os.homedir(),'.deadbyte-mcp');}
+function isStage(stateRoot){
+  const state=path.resolve(stateRoot),production=productionRoot();
+  if(state===production||canonical(state)===canonical(production))return false;
+  if(within(production,state)||within(state,production))throw new Error('STAGING_STATE_OVERLAPS_PRODUCTION');
+  return true;
+}
+function noReparseComponents(file,label){
+  let current=file;
+  for(;;){
+    try {if(lstatSync(current).isSymbolicLink())throw new Error('STAGING_REPARSE_INPUT: '+label);}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+    const parent=path.dirname(current);
+    if(parent===current)break;
+    current=parent;
+  }
+}
+/** A stage never reads policy, token, executable or config bytes from a production state. */
+export function assertStageOwnedPath(file,stateRoot,label){
+  if(!isStage(stateRoot))return;
+  if(typeof file!=='string'||!path.isAbsolute(file)||file.includes('\0'))throw new Error('STAGING_ABSOLUTE_PATH_REQUIRED: '+label);
+  const state=path.resolve(stateRoot),target=path.resolve(file);
+  if(!within(state,target)||canonical(state)===canonical(target))throw new Error('STAGING_EXTERNAL_INPUT: '+label);
+  noReparseComponents(target,label);
+}
+export function assertStageNoProductionPath(file,stateRoot,label){
+  if(!isStage(stateRoot))return;
+  if(typeof file!=='string'||!path.isAbsolute(file)||file.includes('\0'))throw new Error('STAGING_ABSOLUTE_PATH_REQUIRED: '+label);
+  const target=path.resolve(file),production=productionRoot();
+  if(within(production,target))throw new Error('STAGING_PRODUCTION_INPUT: '+label);
+  noReparseComponents(target,label);
+}
+export function assertStagingBootstrapInputs({stateRoot,sourceRoot=null,bridgeBootstrap=null,cloudTransport=null,
+  processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,autonomousPolicyBootstrap=null,
+  ownerApprovalBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null}={}){
+  if(!isStage(stateRoot))return;
+  noReparseComponents(path.resolve(stateRoot),'state root');
+  if(sourceRoot!==null)assertStageOwnedPath(sourceRoot,stateRoot,'legacy source root');
+  if(bridgeBootstrap)assertStageOwnedPath(bridgeBootstrap.root,stateRoot,'bridge bootstrap root');
+  for(const [label,item] of Object.entries({processPolicyBootstrap,hostPolicyBootstrap,codingPolicyBootstrap,
+    autonomousPolicyBootstrap,ownerApprovalBootstrap,desktopPolicyBootstrap,semanticLspBootstrap})){
+    if(item)assertStageOwnedPath(item.path,stateRoot,label);
+  }
+  if(cloudTransport){
+    assertStageOwnedPath(cloudTransport.tokenFile?.path,stateRoot,'named tunnel token file');
+    assertStageOwnedPath(cloudTransport.childWorkingDirectory,stateRoot,'named tunnel child directory');
+    assertStageNoProductionPath(cloudTransport.cloudflared?.path,stateRoot,'named tunnel executable');
+  }
+}
+export function assertStagingControlConfig(config,stateRoot,{configPath}={}){
+  if(!isStage(stateRoot))return;
+  assertStageOwnedPath(configPath,stateRoot,'controller config file');
+  const owned=['CoreRoot','WorkspaceRoot','CodingPolicyFile','AutonomousPolicyFile','HostPolicyFile',
+    'ProcessPolicyFile','DesktopPolicyFile','SemanticLspConfigFile','McpPathFile','McpUrlFile'];
+  for(const key of owned)if(config[key]!==undefined&&config[key]!==null&&config[key]!=='')
+    assertStageOwnedPath(config[key],stateRoot,key);
+  if(!config.CodingPolicyFile||!config.AutonomousPolicyFile)throw new Error('STAGING_REQUIRED_POLICIES_MISSING');
+  for(const [name,component] of [['Bridge',config.Bridge],['Cloud',config.Cloud]]){
+    if(!component||typeof component!=='object')throw new Error('STAGING_COMPONENT_MISSING: '+name);
+    // A hash-pinned executable (e.g. system Node) may be shared. Its script,
+    // cwd, policy inputs and secrets may not be shared with production.
+    if(component.FilePath)assertStageNoProductionPath(component.FilePath,stateRoot,name+'.FilePath');
+    for(const key of ['WorkingDirectory','ScriptPath'])if(component[key])
+      assertStageOwnedPath(component[key],stateRoot,name+'.'+key);
+    if(Array.isArray(component.Dependencies))for(const dep of component.Dependencies){
+      if(dep?.Name==='cloudflared'&&name==='Cloud')assertStageNoProductionPath(dep.Path,stateRoot,'Cloud.cloudflared');
+      else assertStageOwnedPath(dep?.Path,stateRoot,name+'.dependency.'+String(dep?.Name??''));
+    }
+  }
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.45';
+export const DEADBYTE_VERSION = '0.15.46';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/deferred-slot-operation-behavior.test.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 test('R33 deferred worker survives scheduler exit and stays bound to explicit state root',
-  { skip: process.platform !== 'win32', timeout:15000 }, async()=>{
+  { skip: process.platform !== 'win32', timeout:30000 }, async()=>{
     const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-deferred-'));
     try {
       const child=spawn(process.execPath,['scripts/deferred-slot-operation.mjs','activate','0'.repeat(64)],{
@@ -22,7 +22,7 @@ test('R33 deferred worker survives scheduler exit and stays bound to explicit st
       assert.equal(scheduled.status,'scheduled');
       assert.ok(path.resolve(scheduled.state_path).startsWith(path.resolve(state)+path.sep));
       let record;
-      for(let i=0;i<30;i++){
+      for(let i=0;i<60;i++){
         await sleep(300);
         record=JSON.parse(await readFile(scheduled.state_path,'utf8'));
         if(record.state==='failed'||record.state==='passed') break;

package/test/r58-cleanup-retention.test.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
 
-test('R58 foreground cleanup failure retains ownership evidence for recovery', {timeout:30000}, async () => {
+test('R58 foreground cleanup failure retains ownership evidence for recovery', {timeout:60000}, async () => {
   const base='D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';
   await mkdir(base,{recursive:true});
   const root=await mkdtemp(path.join(base,'cleanup-'));
@@ -29,12 +29,12 @@ switch ($Command) {
 }
 exit 0
 `);
-  const child=spawn(process.execPath,[fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url)),'remote'],{env:{...process.env,DEADBYTE_STATE_ROOT:root},windowsHide:true,stdio:['pipe','pipe','pipe']});
+  const child=spawn(process.execPath,[fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url)),'remote','--operator'],{env:{...process.env,DEADBYTE_STATE_ROOT:root},windowsHide:true,stdio:['pipe','pipe','pipe']});
   let stdout='',stderr='';
   child.stdout.on('data',b=>{stdout+=b;});child.stderr.on('data',b=>{stderr+=b;});
   const closed=new Promise(resolve=>child.once('close',code=>resolve(code)));
   try {
-    const deadline=Date.now()+12000;
+    const deadline=Date.now()+50000;
     while(!stdout.includes('[READY]')&&child.exitCode===null&&Date.now()<deadline) await delay(50);
     assert.match(stdout,/\[READY\]/,stderr);
     assert.match(stdout,/\[AUTH\] process ARMED \| coding ARMED \| autonomous ARMED \| desktop DISARMED \| host DISARMED/,stderr);

package/test/r58-concurrent-recovery.test.mjs

@@ -6,7 +6,7 @@ import {fileURLToPath} from 'node:url';
 import {spawn} from 'node:child_process';
 import {setTimeout as delay} from 'node:timers/promises';
 
-test('R58 simultaneous stale recovery cannot both revoke the shared authority', {timeout:25000},async()=>{
+test('R58 simultaneous stale recovery cannot both revoke the shared authority', {timeout:90000},async()=>{
  const base='D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';await mkdir(base,{recursive:true});
  const root=await mkdtemp(path.join(base,'concurrent-recovery-'));await mkdir(path.join(root,'bin'));await mkdir(path.join(root,'runtime'));
  const trace=path.join(root,'trace.txt'),markerPath=path.join(root,'runtime','remote-session.json');
@@ -47,14 +47,14 @@ exit 0
    const c=spawn(process.execPath,[fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url)),'remote'],{env:{...process.env,DEADBYTE_STATE_ROOT:root},stdio:['pipe','pipe','pipe'],windowsHide:true});
    const o={stdout:'',stderr:''};c.stdout.on('data',b=>{o.stdout+=b;});c.stderr.on('data',b=>{o.stderr+=b;});o.exit=new Promise(resolve=>c.once('exit',resolve));children.push(c);outputs.push(o);
   }
-  const until=Date.now()+12000;let commands=[];
+  const until=Date.now()+45000;let commands=[];
   while(Date.now()<until){try{commands=(await readFile(trace,'utf8')).trim().split(/\r?\n/);}catch{}if(outputs.some(o=>o.stdout.includes('[READY]')))break;await delay(50);}
   await writeFile(path.join(root,'observation.json'),JSON.stringify({commands,outputs:outputs.map(o=>({stdout:o.stdout,stderr:o.stderr})),simulation:'concurrent stale marker recovery with delayed second park'}),{flag:'wx'});
   assert.ok(outputs.some(o=>o.stdout.includes('[READY]')),'a recovered foreground must become ready');
   for(const cmd of ['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'])assert.equal(commands.filter(x=>x===cmd).length,1,`stale recovery must serialize ${cmd}`);
  }finally{
   for(const c of children)if(c.exitCode===null)c.stdin.end();
-  await Promise.race([Promise.all(outputs.map(o=>o.exit)),delay(7000)]);
+  await Promise.race([Promise.all(outputs.map(o=>o.exit)),delay(30000)]);
   for(const c of children)if(c.exitCode===null&&c.signalCode===null)c.kill();
  }
 });

package/test/r58-stale-owner.test.mjs

@@ -46,7 +46,7 @@ test('R58 live unrelated PID is not accepted as a remote foreground owner', {tim
  assert.notEqual(code,0);
 });
 
-test('R58 bound stale birth identity reconciles on the first invocation without killing a reused PID', {timeout:20000}, async()=>{
+test('R58 bound stale birth identity reconciles on the first invocation without killing a reused PID', {timeout:60000}, async()=>{
  const base='D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';
  await mkdir(base,{recursive:true});const root=await mkdtemp(path.join(base,'stale-birth-'));
  await mkdir(path.join(root,'runtime'));await mkdir(path.join(root,'bin'));

package/test/r59-tool-surface-compat.test.mjs

@@ -71,7 +71,7 @@ async function captureCurrentSurface(){
   }
 }
 
-test('R71 compact baseline permits only R64 read offset and authorized coding-only preview output',async()=>{
+test('R72 compact baseline permits only R64 read offset and authorized coding-only preview output',async()=>{
   const raw=JSON.parse(await readFile(fixturePath,'utf8'));
   assert.equal(raw.schema,'deadbyte.tool-surface-baseline.v1');
   assert.equal(raw.release_id,'v0.15.35-1b5715b276facbc0');
@@ -83,7 +83,7 @@ test('R71 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r60-authority-coherence.test.mjs

@@ -10,7 +10,8 @@ const observed = (armed={}) => ({
 });
 
 test('remote modes have exact non-widening authority vectors',()=>{
-  assert.deepEqual(authorityVector('default'),{process:true,coding:true,autonomous:true,desktop:false,host:false});
+  assert.deepEqual(authorityVector('default'),{process:false,coding:false,autonomous:false,desktop:false,host:false});
+  assert.deepEqual(authorityVector('operator'),{process:true,coding:true,autonomous:true,desktop:false,host:false});
   assert.deepEqual(authorityVector('desktop'),{process:true,coding:true,autonomous:true,desktop:true,host:false});
   assert.deepEqual(authorityVector('host'),{process:true,coding:true,autonomous:true,desktop:false,host:true});
   assert.deepEqual(authorityVector('full'),{process:true,coding:true,autonomous:true,desktop:true,host:true});
@@ -18,7 +19,7 @@ test('remote modes have exact non-widening authority vectors',()=>{
 
 test('observed standing Host grant rejects bounded READY',()=>{
   const snapshot=parseAuthorityObservation(JSON.stringify(observed({process:true,coding:true,autonomous:true,host:true})));
-  assert.throws(()=>assertAuthorityVector(snapshot,authorityVector('default')),/host.*expected DISARMED/);
+  assert.throws(()=>assertAuthorityVector(snapshot,authorityVector('operator')),/host.*expected DISARMED/);
 });
 
 test('malformed or incomplete controller observation fails closed',()=>{
@@ -34,3 +35,10 @@ test('readiness requires verified Bridge Core Cloud and local MCP, not just ONLI
   assert.throws(()=>assertRuntimeReadyObservation({...value,core:{alive:false,reason:'wrong-core-generation'}}),/core/);
   assert.throws(()=>assertRuntimeReadyObservation({...value,core_root:'D:\\wrong'} ,{coreRoot:'D:\\exact-release'}),/core root/);
 });
+
+test('safe default rejects a pre-existing grant in any plane, not only Host',()=>{
+  for(const plane of ['process','coding','autonomous','desktop','host']){
+    const snapshot=parseAuthorityObservation(JSON.stringify(observed({[plane]:true})));
+    assert.throws(()=>assertAuthorityVector(snapshot,authorityVector('default')),new RegExp(`${plane}.*expected DISARMED`));
+  }
+});

package/test/r71-isolated-slot-rollback-restore.test.mjs

@@ -8,8 +8,8 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.44-9f500af433df3e77');
-const parentManifestSha='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e';
+const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.45-34aa8d1241cfb8bf');
+const parentManifestSha='34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 
 async function generation(state,label){
@@ -22,34 +22,34 @@ async function generation(state,label){
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
 
-test('R71 isolated immutable slot activates, rolls back exact sealed R70, and restores same R71 bytes with no authority',async()=>{
-  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r71-slot-parity-'));
+test('R72 isolated immutable slot activates, rolls back exact active R71, and restores same R72 bytes with no authority',async()=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r72-slot-parity-'));
   const state=path.join(base,'state');
   try{
     const parentManifest=await readFile(path.join(parent,'MANIFEST.SHA256'));
     const candidateManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
     assert.equal(sha(parentManifest),parentManifestSha);
     const candidateManifestSha=sha(candidateManifest);
-    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.44',manifestSha256:parentManifestSha});
-    const candidateSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version:'0.15.45',manifestSha256:candidateManifestSha});
-    const parentGeneration=await generation(state,'r70-parent');
-    const candidateGeneration=await generation(state,'r71-candidate');
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.45',manifestSha256:parentManifestSha});
+    const candidateSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version:'0.15.46',manifestSha256:candidateManifestSha});
+    const parentGeneration=await generation(state,'r71-parent');
+    const candidateGeneration=await generation(state,'r72-candidate');
     const launcherSha=sha(Buffer.from(renderStableLauncherPs1(),'utf8'));
     const pointerPath=path.join(state,'active-release.json');
     const pointer=(slot,version,g)=>({schema:'deadbyte.active-release.v1',release_id:slot.release_id,version,
       manifest_sha256:slot.manifest_sha256,release_root:slot.release_root,generation_root:g.root,
       generation_manifest_sha256:g.manifest_sha256,launcher_sha256:launcherSha,config_path:g.config_path});
 
-    const activated=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.45',candidateGeneration));
+    const activated=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.46',candidateGeneration));
     assert.equal(activated.release_id,candidateSlot.release_id);
     await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
 
-    const rolledBack=await atomicWriteActivePointer(pointerPath,pointer(parentSlot,'0.15.44',parentGeneration));
+    const rolledBack=await atomicWriteActivePointer(pointerPath,pointer(parentSlot,'0.15.45',parentGeneration));
     assert.equal(rolledBack.release_id,parentSlot.release_id);
     assert.equal(rolledBack.manifest_sha256,parentManifestSha);
     await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));
 
-    const restored=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.45',candidateGeneration));
+    const restored=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.46',candidateGeneration));
     assert.deepEqual(restored,activated);
     assert.deepEqual(parseActivePointer(await readFile(pointerPath,'utf8')),activated);
     await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));

package/test/r71-release-identity.test.mjs

@@ -3,23 +3,23 @@ import assert from 'node:assert/strict';
 import {readFile} from 'node:fs/promises';
 
 const json=async rel=>JSON.parse(await readFile(new URL('../'+rel,import.meta.url),'utf8'));
-const parent={release_id:'v0.15.44-9f500af433df3e77',
-  manifest_sha256:'9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e',
-  generation_manifest_sha256:'c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'};
+const parent={version:'0.15.45',release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'};
 
-test('R71 current source, package, bridge, provenance and Windows gate bind exact predecessor',async()=>{
+test('R72 current source, package, bridge, provenance and Windows gate bind exact predecessor',async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),
     readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
   for(const observed of [pkg.version,lock.version,lock.packages[''].version,bridge.version,
     release.version,provenance.version,matrix.version,sbom.metadata.component.version]){
-    assert.equal(observed,'0.15.45');
+    assert.equal(observed,'0.15.46');
   }
-  assert.match(version,/DEADBYTE_VERSION = '0\.15\.45'/);
-  assert.equal(release.train,'R71');
-  assert.equal(matrix.train,'R71');
-  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r71:0.15.45');
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.46'/);
+  assert.equal(release.train,'R72');
+  assert.equal(matrix.train,'R72');
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r72:0.15.46');
   assert.deepEqual(release.runtime_predecessor,parent);
   assert.equal(release.parent.release_id,parent.release_id);
   assert.equal(release.parent.manifest_sha256,parent.manifest_sha256);
@@ -27,5 +27,7 @@ test('R71 current source, package, bridge, provenance and Windows gate bind exac
   assert.equal(provenance.parent_release_id,parent.release_id);
   assert.equal(provenance.parent_manifest_sha256,parent.manifest_sha256);
   assert.equal(provenance.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
-  assert.match(pkg.scripts['gate:windows'],/gate-windows-r71\.ps1/);
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r72\.ps1/);
+  assert.equal(provenance.source_predecessor_version,'0.15.45');
+  assert.ok(['CANDIDATE_UNSEALED','CANDIDATE_SEALED'].includes(release.r72_hotfix.status), 'R72 release status must be explicit');
 });

package/test/r72-launcher-isolation.test.mjs

@@ -0,0 +1,99 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, mkdir, symlink, rm} from 'node:fs/promises';
+import {tmpdir, homedir} from 'node:os';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {
+  canonicalLauncherPaths, assertCanonicalLaunchers, renderStateBoundLauncherCmd
+} from '../src/launcher-isolation.mjs';
+import {rollbackLauncherPlanFromHandoff} from '../src/runtime-update.mjs';
+
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+const ptr=(version,manifest,launcherSha)=>({
+  schema:'deadbyte.active-release.v1',version,release_id:`v${version}-${manifest.slice(0,16)}`,
+  manifest_sha256:manifest,generation_manifest_sha256:'c'.repeat(64),launcher_sha256:launcherSha,
+  release_root:'/fixture/releases/'+version,generation_root:'/fixture/generations/'+version,config_path:'/fixture/config/'+version
+});
+function handoff(state,prior,active,top){
+  const newBytes=Buffer.from('synthetic new PowerShell launcher');
+  const priorBytes=Buffer.from('synthetic old PowerShell launcher');
+  assert.equal(prior.launcher_sha256,hash(priorBytes));
+  assert.equal(active.launcher_sha256,hash(newBytes));
+  const p=canonicalLauncherPaths(state);
+  return {
+    prior_pointer:prior,new_pointer:active,
+    launchers:{ps1:p.ps1,cmd:p.cmd,top:top??p.top,
+      launcher_sha256:active.launcher_sha256,
+      ps1_bytes:newBytes.toString('base64'),cmd_bytes:Buffer.from('cmd').toString('base64'),
+      snapshots:{
+        ps1:{exists:true,sha256:hash(priorBytes),bytes_base64:priorBytes.toString('base64')},
+        cmd:{exists:false,sha256:null,bytes_base64:null},top:{exists:false,sha256:null,bytes_base64:null}
+      }
+    }
+  };
+}
+
+test('production compatibility retains historical Downloads launcher',()=>{
+ const prod=path.join(homedir(),'.deadbyte-mcp');
+ const plan=canonicalLauncherPaths(prod);
+ assert.equal(plan.production,true);
+ assert.equal(plan.top,path.join(homedir(),'Downloads','DEADBYTE-MCP.cmd'));
+ assert.equal(plan.ps1,path.join(prod,'bin','DEADBYTE-MCP.ps1'));
+});
+
+test('staging launcher routes into its own state, not Downloads',async()=>{
+ const base=await mkdtemp(path.join(tmpdir(),'r72-launcher-stage-'));
+ try{
+  const stage=path.join(base,'state');
+  const plan=canonicalLauncherPaths(stage);
+  assert.equal(plan.production,false);
+  assert.equal(plan.top,path.join(stage,'launchers','DEADBYTE-MCP.cmd'));
+  assert.equal(plan.cmd,path.join(stage,'bin','DEADBYTE-MCP.cmd'));
+  assert.doesNotMatch(plan.top,/Downloads[\\/]DEADBYTE-MCP\.cmd/);
+  const text=renderStateBoundLauncherCmd();
+  assert.match(text,/set "DEADBYTE_STATE_ROOT=%~dp0\.\."/);
+  assert.match(text,/%DEADBYTE_STATE_ROOT%\\bin\\DEADBYTE-MCP\.ps1/);
+  assert.doesNotMatch(text,/USERPROFILE/);
+  assert.doesNotMatch(text,/\\\.deadbyte-mcp/);
+ }finally{await rm(base,{recursive:true,force:true});}
+});
+
+test('staging cannot reuse production top launcher even through signed handoff',async()=>{
+ const base=await mkdtemp(path.join(tmpdir(),'r72-launcher-signed-'));
+ try{
+  const stage=path.join(base,'state');
+  const prior=ptr('0.15.45','a'.repeat(64),hash(Buffer.from('synthetic old PowerShell launcher')));
+  const active=ptr('0.15.46','b'.repeat(64),hash(Buffer.from('synthetic new PowerShell launcher')));
+  const proper=handoff(stage,prior,active);
+  const plan=rollbackLauncherPlanFromHandoff(proper,prior,active,stage);
+  assert.equal(plan.top,canonicalLauncherPaths(stage).top);
+  assert.equal(plan.stateRoot,path.resolve(stage));
+  const foreign=handoff(stage,prior,active,path.join(homedir(),'Downloads','DEADBYTE-MCP.cmd'));
+  assert.throws(()=>rollbackLauncherPlanFromHandoff(foreign,prior,active,stage),/not canonical/);
+  const missing=handoff(stage,prior,active); delete missing.launchers.top;
+  assert.throws(()=>rollbackLauncherPlanFromHandoff(missing,prior,active,stage),/not canonical/);
+  const wrongBin=handoff(stage,prior,active);wrongBin.launchers.cmd=path.join(base,'escape.cmd');
+  assert.throws(()=>rollbackLauncherPlanFromHandoff(wrongBin,prior,active,stage),/not canonical/);
+ }finally{await rm(base,{recursive:true,force:true});}
+});
+
+test('staging nested in production state is forbidden',()=>{
+ assert.throws(()=>canonicalLauncherPaths(path.join(homedir(),'.deadbyte-mcp','staging')),/overlaps production/);
+});
+
+test('staging path through existing symlink or junction is rejected',async t=>{
+ const base=await mkdtemp(path.join(tmpdir(),'r72-launcher-alias-'));
+ try{
+  const real=path.join(base,'real'); await mkdir(real);
+  const alias=path.join(base,'alias');
+  try{await symlink(real,alias,process.platform==='win32'?'junction':'dir');}
+  catch(error){if(['EPERM','EACCES','ENOSYS'].includes(error.code)){t.diagnostic('OS disallows symlink/junction fixture');return;}throw error;}
+  assert.throws(()=>canonicalLauncherPaths(path.join(alias,'staging')),/reparse\/symlink/);
+  const root=path.join(base,'state');await mkdir(root);
+  const dir=path.join(root,'launchers');
+  try{await symlink(real,dir,process.platform==='win32'?'junction':'dir');}
+  catch(error){if(['EPERM','EACCES','ENOSYS'].includes(error.code)){t.diagnostic('OS disallows symlink/junction fixture');return;}throw error;}
+  assert.throws(()=>canonicalLauncherPaths(root),/reparse\/symlink/);
+ }finally{await rm(base,{recursive:true,force:true});}
+});

package/test/r72-publication-fence.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {assertR72NpmPublishReady} from '../scripts/npm-release-readiness-r72.mjs';
+const sha=x=>createHash('sha256').update(x).digest('hex');
+const parent={version:'0.15.45',release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'};
+const readyRelease=()=>({name:'deadbyte-mcp',version:'0.15.46',train:'R72',parent,
+  runtime_predecessor:parent,r72_hotfix:{status:'CANDIDATE_SEALED',windows_regression:'PASS',
+    package_acceptance:'PASS',manifest:'PASS',remote_lifecycle:'PASS',security_gate:'PASS',independent_judge:'PASS'}});
+const gates=['full_regression','windows_lifecycle','package_acceptance','independent_judge'];
+async function fixture(){
+ const root=await mkdtemp(path.join(os.tmpdir(),'r72-fence-'));
+ const dir=path.join(root,'testing','r72-release-evidence');await mkdir(path.join(dir,'outputs'),{recursive:true});
+ const manifest=Buffer.from('fixture-manifest\n');await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+ const manifestSha=sha(manifest),hashes={};
+ for(const gate of gates){
+  // Synthetic bytes are fixture data only, never real release evidence.
+  const output=Buffer.from(`SYNTHETIC-R72-FIXTURE gate=${gate}\n`);
+  await writeFile(path.join(dir,'outputs',`${gate}.log`),output);
+  const record={schema:'deadbyte.r72-gate-result.v1',gate,version:'0.15.46',manifest_sha256:manifestSha,
+    status:'PASS',exit_code:0,output_file:`outputs/${gate}.log`,output_sha256:sha(output),
+    ...(gate==='full_regression'?{pass_count:1500,fail_count:0}:{}),
+    ...(gate==='windows_lifecycle'?{safe_default_arm_count:0,operator_owner_consent_enforced:true,
+      stale_owner_recovery_verified:true,signed_epoch_fail_closed:true}:{}),
+    ...(gate==='independent_judge'?{independent_verification:'PASS'}:{})};
+  const bytes=Buffer.from(JSON.stringify(record));await writeFile(path.join(dir,`${gate}.json`),bytes);hashes[gate]=sha(bytes);
+ }
+ await writeFile(path.join(dir,'ready.json'),JSON.stringify({schema:'deadbyte.r72-release-evidence-index.v1',
+   version:'0.15.46',manifest_sha256:manifestSha,parent,gate_sha256:hashes}));
+ return {root,dir};
+}
+test('R72 publish path checks successor evidence before packing',async()=>{
+ const source=await readFile(new URL('../scripts/npm-release-r48.mjs',import.meta.url),'utf8');
+ const guard=source.indexOf('await assertR72NpmPublishReady(release,{root})');
+ assert.ok(guard>=0&&guard<source.indexOf("'pack', '--json'")&&guard<source.indexOf("'publish',publishTarball"));
+});
+test('R72 pending candidate cannot publish even when a local manifest exists',async()=>{
+ const release=readyRelease();release.r72_hotfix.status='CANDIDATE_UNSEALED';
+ await assert.rejects(assertR72NpmPublishReady(release,{root:path.resolve('.')}),/PUBLISH_BLOCKED R72/);
+});
+test('R72 readiness is bound to sealed predecessor, bytes, Windows authority gates and independent judge',async()=>{
+ const f=await fixture();try{
+  const candidate=readyRelease();
+  assert.equal((await assertR72NpmPublishReady(candidate,{root:f.root})).evidence_count,4);
+  const drift=structuredClone(candidate);drift.parent.release_id='v0.15.44-tampered';
+  await assert.rejects(assertR72NpmPublishReady(drift,{root:f.root}),/PUBLISH_BLOCKED/);
+  const lifecycle=path.join(f.dir,'windows_lifecycle.json');
+  await writeFile(lifecycle,'{"status":"PASS","forge":true}');
+  await assert.rejects(assertR72NpmPublishReady(candidate,{root:f.root}),/PUBLISH_BLOCKED.*windows_lifecycle/);
+ }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/r72-publication-output-integrity.test.mjs

@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rm,symlink,rename} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {assertR72NpmPublishReady} from '../scripts/npm-release-readiness-r72.mjs';
+
+const sha = bytes=>createHash('sha256').update(bytes).digest('hex');
+const gates = ['full_regression','windows_lifecycle','package_acceptance','independent_judge'];
+const parent = {
+  version:'0.15.45',release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'
+};
+const release={version:'0.15.46',name:'deadbyte-mcp',train:'R72',parent,runtime_predecessor:parent,r72_hotfix:{
+  status:'CANDIDATE_SEALED',windows_regression:'PASS',package_acceptance:'PASS',manifest:'PASS',
+  remote_lifecycle:'PASS',security_gate:'PASS',independent_judge:'PASS'
+}};
+
+async function fixture(){
+  const root=await mkdtemp(path.join(tmpdir(),'r72-fence-integrity-'));
+  const evidence=path.join(root,'testing','r72-release-evidence');
+  const outputs=path.join(evidence,'outputs');
+  await mkdir(outputs,{recursive:true});
+  const manifest=Buffer.from('synthetic test-only manifest, not a real release\n');
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  const index={schema:'deadbyte.r72-release-evidence-index.v1',version:'0.15.46',parent,
+    manifest_sha256:sha(manifest),gate_sha256:{}};
+  const outputPaths={};
+  for(const gate of gates){
+    const output=Buffer.from(`SYNTHETIC-TEST-ONLY\nGATE=${gate}\nEXIT=0\n`);
+    const outputPath=path.join(outputs,`${gate}.log`);
+    outputPaths[gate]=outputPath;
+    await writeFile(outputPath,output);
+    const receipt={schema:'deadbyte.r72-gate-result.v1',gate,version:'0.15.46',
+      manifest_sha256:index.manifest_sha256,status:'PASS',exit_code:0,
+      output_file:`outputs/${gate}.log`,output_sha256:sha(output),
+      ...(gate==='full_regression'?{pass_count:1,fail_count:0}:{}),
+      ...(gate==='windows_lifecycle'?{safe_default_arm_count:0,operator_owner_consent_enforced:true,
+       stale_owner_recovery_verified:true,signed_epoch_fail_closed:true}:{}),
+      ...(gate==='independent_judge'?{independent_verification:'PASS'}:{})};
+    const bytes=Buffer.from(JSON.stringify(receipt)+'\n');
+    index.gate_sha256[gate]=sha(bytes);
+    await writeFile(path.join(evidence,`${gate}.json`),bytes);
+  }
+  await writeFile(path.join(evidence,'ready.json'),JSON.stringify(index)+'\n');
+  return {root,evidence,outputPaths,dispose:()=>rm(root,{recursive:true,force:true})};
+}
+
+test('synthetic complete fixture validates receipt/output bytes linkage (not real release evidence)',async()=>{
+ const f=await fixture();try{
+   const result=await assertR72NpmPublishReady(release,{root:f.root});
+   assert.equal(result.status,'R72_RELEASE_READY_EVIDENCE_BOUND');
+ } finally {await f.dispose();}
+});
+
+test('mutating full regression output, without changing receipt, rejects',async()=>{
+ const f=await fixture();try{
+   await writeFile(f.outputPaths.full_regression,'tampered output\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(mismatch|tamper|hash)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing Windows lifecycle output rejects even with intact receipt',async()=>{
+ const f=await fixture();try{
+   await rm(f.outputPaths.windows_lifecycle);
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(missing|invalid|unavailable)/i);
+ } finally {await f.dispose();}
+});
+
+test('receipt pointing to other output file rejects even with recomputed index SHA',async()=>{
+ const f=await fixture();try{
+   const gate='package_acceptance',receiptPath=path.join(f.evidence,`${gate}.json`);
+   const receipt=JSON.parse(await readFile(receiptPath,'utf8'));
+   receipt.output_file='outputs/full_regression.log';
+   const content=Buffer.from(JSON.stringify(receipt)+'\n');
+   await writeFile(receiptPath,content);
+   const indexPath=path.join(f.evidence,'ready.json');
+   const index=JSON.parse(await readFile(indexPath,'utf8'));
+   index.gate_sha256[gate]=sha(content);
+   await writeFile(indexPath,JSON.stringify(index)+'\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*path/i);
+ } finally {await f.dispose();}
+});
+
+test('symlinked evidence output or junction directory must not be trusted',async()=>{
+ const f=await fixture();try{
+   const target=f.outputPaths.independent_judge,other=path.join(f.root,'external.log');
+   await writeFile(other,await readFile(target));
+   await rm(target);
+   try {await symlink(other,target,'file');}
+   catch(e){
+     if(!['EPERM','EACCES','ENOTSUP'].includes(e.code))throw e;
+     // Windows can deny file symlinks while permitting unprivileged directory junctions.
+     const outputs=path.join(f.evidence,'outputs');
+     const externalOutputs=path.join(f.root,'external-outputs');
+     await rename(outputs,externalOutputs);
+     await symlink(externalOutputs,outputs,'junction');
+   }
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/(output.*(regular|symlink)|evidence\/output directory is not a real directory)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing status seal cannot be bypassed by synthetic receipts',async()=>{
+ const f=await fixture();try{
+   const uns={...release,r72_hotfix:{...release.r72_hotfix,status:'CANDIDATE_UNSEALED'}};
+   await assert.rejects(assertR72NpmPublishReady(uns,{root:f.root}),/CANDIDATE_SEALED/);
+ } finally {await f.dispose();}
+});