deadbyte-mcp 0.15.45 → 0.15.47

package/test/r72-publication-output-integrity.test.mjs

@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rm,symlink,rename} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {assertR72NpmPublishReady} from '../scripts/npm-release-readiness-r72.mjs';
+
+const sha = bytes=>createHash('sha256').update(bytes).digest('hex');
+const gates = ['full_regression','windows_lifecycle','package_acceptance','independent_judge'];
+const parent = {
+  version:'0.15.45',release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'
+};
+const release={version:'0.15.46',name:'deadbyte-mcp',train:'R72',parent,runtime_predecessor:parent,r72_hotfix:{
+  status:'CANDIDATE_SEALED',windows_regression:'PASS',package_acceptance:'PASS',manifest:'PASS',
+  remote_lifecycle:'PASS',security_gate:'PASS',independent_judge:'PASS'
+}};
+
+async function fixture(){
+  const root=await mkdtemp(path.join(tmpdir(),'r72-fence-integrity-'));
+  const evidence=path.join(root,'testing','r72-release-evidence');
+  const outputs=path.join(evidence,'outputs');
+  await mkdir(outputs,{recursive:true});
+  const manifest=Buffer.from('synthetic test-only manifest, not a real release\n');
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  const index={schema:'deadbyte.r72-release-evidence-index.v1',version:'0.15.46',parent,
+    manifest_sha256:sha(manifest),gate_sha256:{}};
+  const outputPaths={};
+  for(const gate of gates){
+    const output=Buffer.from(`SYNTHETIC-TEST-ONLY\nGATE=${gate}\nEXIT=0\n`);
+    const outputPath=path.join(outputs,`${gate}.log`);
+    outputPaths[gate]=outputPath;
+    await writeFile(outputPath,output);
+    const receipt={schema:'deadbyte.r72-gate-result.v1',gate,version:'0.15.46',
+      manifest_sha256:index.manifest_sha256,status:'PASS',exit_code:0,
+      output_file:`outputs/${gate}.log`,output_sha256:sha(output),
+      ...(gate==='full_regression'?{pass_count:1,fail_count:0}:{}),
+      ...(gate==='windows_lifecycle'?{safe_default_arm_count:0,operator_owner_consent_enforced:true,
+       stale_owner_recovery_verified:true,signed_epoch_fail_closed:true}:{}),
+      ...(gate==='independent_judge'?{independent_verification:'PASS'}:{})};
+    const bytes=Buffer.from(JSON.stringify(receipt)+'\n');
+    index.gate_sha256[gate]=sha(bytes);
+    await writeFile(path.join(evidence,`${gate}.json`),bytes);
+  }
+  await writeFile(path.join(evidence,'ready.json'),JSON.stringify(index)+'\n');
+  return {root,evidence,outputPaths,dispose:()=>rm(root,{recursive:true,force:true})};
+}
+
+test('synthetic complete fixture validates receipt/output bytes linkage (not real release evidence)',async()=>{
+ const f=await fixture();try{
+   const result=await assertR72NpmPublishReady(release,{root:f.root});
+   assert.equal(result.status,'R72_RELEASE_READY_EVIDENCE_BOUND');
+ } finally {await f.dispose();}
+});
+
+test('mutating full regression output, without changing receipt, rejects',async()=>{
+ const f=await fixture();try{
+   await writeFile(f.outputPaths.full_regression,'tampered output\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(mismatch|tamper|hash)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing Windows lifecycle output rejects even with intact receipt',async()=>{
+ const f=await fixture();try{
+   await rm(f.outputPaths.windows_lifecycle);
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(missing|invalid|unavailable)/i);
+ } finally {await f.dispose();}
+});
+
+test('receipt pointing to other output file rejects even with recomputed index SHA',async()=>{
+ const f=await fixture();try{
+   const gate='package_acceptance',receiptPath=path.join(f.evidence,`${gate}.json`);
+   const receipt=JSON.parse(await readFile(receiptPath,'utf8'));
+   receipt.output_file='outputs/full_regression.log';
+   const content=Buffer.from(JSON.stringify(receipt)+'\n');
+   await writeFile(receiptPath,content);
+   const indexPath=path.join(f.evidence,'ready.json');
+   const index=JSON.parse(await readFile(indexPath,'utf8'));
+   index.gate_sha256[gate]=sha(content);
+   await writeFile(indexPath,JSON.stringify(index)+'\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*path/i);
+ } finally {await f.dispose();}
+});
+
+test('symlinked evidence output or junction directory must not be trusted',async()=>{
+ const f=await fixture();try{
+   const target=f.outputPaths.independent_judge,other=path.join(f.root,'external.log');
+   await writeFile(other,await readFile(target));
+   await rm(target);
+   try {await symlink(other,target,'file');}
+   catch(e){
+     if(!['EPERM','EACCES','ENOTSUP'].includes(e.code))throw e;
+     // Windows can deny file symlinks while permitting unprivileged directory junctions.
+     const outputs=path.join(f.evidence,'outputs');
+     const externalOutputs=path.join(f.root,'external-outputs');
+     await rename(outputs,externalOutputs);
+     await symlink(externalOutputs,outputs,'junction');
+   }
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/(output.*(regular|symlink)|evidence\/output directory is not a real directory)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing status seal cannot be bypassed by synthetic receipts',async()=>{
+ const f=await fixture();try{
+   const uns={...release,r72_hotfix:{...release.r72_hotfix,status:'CANDIDATE_UNSEALED'}};
+   await assert.rejects(assertR72NpmPublishReady(uns,{root:f.root}),/CANDIDATE_SEALED/);
+ } finally {await f.dispose();}
+});

package/test/r72-remote-safe-contract.test.mjs

@@ -0,0 +1,101 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,rm,writeFile,access} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {authorityVector} from '../src/remote-authority.mjs';
+
+const controllerPath=new URL('../controller/deadbyte-controller.ps1',import.meta.url);
+const quote=value=>`'${String(value).replaceAll("'","''")}'`;
+const winTest=process.platform==='win32'?test:test.skip;
+
+// The legacy elevated contract is still available, but must be explicitly selected.
+test('R72 default remote asks for no standing authority',()=>{
+  assert.deepEqual(authorityVector('default'),{
+    process:false,coding:false,autonomous:false,desktop:false,host:false
+  });
+});
+test('R72 operator retains explicit process/coding/autonomous and no host/desktop',()=>{
+  assert.deepEqual(authorityVector('operator'),{
+    process:true,coding:true,autonomous:true,desktop:false,host:false
+  });
+});
+test('R72 desktop/host/full remain explicit elevated choices',()=>{
+  for(const [mode,desktop,host] of [['desktop',true,false],['host',false,true],['full',true,true]]){
+    assert.deepEqual(authorityVector(mode),{
+      process:true,coding:true,autonomous:true,desktop,host
+    });
+  }
+  assert.throws(()=>authorityVector('invalid'),/mode invalid/);
+});
+
+async function controllerScenario({grant=false,escape=false,epochFails=false}={}){
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r72-revocation-'));
+  const runtime=path.join(temp,'runtime');
+  const file=path.join(temp,'autonomous.json');
+  const grantFile=path.join(escape?temp:runtime,'autonomous-grant.json');
+  const epochTrace=path.join(temp,'epoch-trace.txt');
+  await mkdir(runtime,{recursive:true});
+  await writeFile(file,JSON.stringify({
+    schema:'deadbyte.autonomous-policy.v1',enabled:true,
+    lease_file:grantFile,coding_policy_sha256:'a'.repeat(64),root_ids:['core']
+  }));
+  if(grant)await writeFile(grantFile,'fixture-grant');
+  const source=await readFile(controllerPath,'utf8');
+  const begin=source.indexOf('function Get-AutonomousRevocationLeaseFile(');
+  const end=source.indexOf('function Show-AutonomousStatus(',begin);
+  const readBegin=source.indexOf('function Read-ControllerPolicySnapshot(');
+  const readEnd=source.indexOf('function Get-CodingPolicyMetadata(',readBegin);
+  assert.ok(begin>=0&&end>begin&&readBegin>=0&&readEnd>readBegin);
+  const script=`$ErrorActionPreference='Stop';
+$RuntimeDir=${quote(runtime)};
+function Fail([string]$m){throw $m};
+function Get-AutonomousPolicyMetadata($Cfg){throw 'ISSUANCE_PATH_MUST_NOT_RUN'};
+function Invoke-AuthorityEpochCommand($Cfg,[string]$Plane,[string]$Action,[string]$GrantFile){
+  [IO.File]::AppendAllText(${quote(epochTrace)},("$Plane/$Action"+[Environment]::NewLine));
+  ${epochFails?"throw 'FIXTURE_EPOCH_FAILED'":"return 'FIXTURE_SIGNED_REVOKE'"}
+};
+${source.slice(readBegin,readEnd)};
+${source.slice(begin,end)};
+try { Disarm-Autonomous @{AutonomousPolicyFile=${quote(file)}};Write-Output 'REVOKE_OK' }
+catch {Write-Output ('REVOKE_FAILED: '+$_.Exception.Message);exit 7}
+`;
+  const result=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',script],{
+    encoding:'utf8',timeout:15000,maxBuffer:1024*1024
+  });
+  const remaining=await access(grantFile).then(()=>true,()=>false);
+  const epoch=await readFile(epochTrace,'utf8').catch(error=>{
+    if(error?.code==='ENOENT')return '';throw error;
+  });
+  await rm(temp,{recursive:true,force:true});
+  return {result,remaining,epoch};
+}
+
+winTest('R72 disarm with broad Coding roots and no Autonomous grant succeeds without grant issuance',async()=>{
+  const {result,remaining,epoch}=await controllerScenario();
+  assert.equal(result.status,0,result.stderr+'\n'+result.stdout);
+  assert.match(result.stdout,/REVOKE_OK/);
+  assert.equal(remaining,false);
+  assert.equal(epoch,'');
+});
+winTest('R72 present Autonomous grant is sent to epoch revoker before removal',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true});
+  assert.equal(result.status,0,result.stderr+'\n'+result.stdout);
+  assert.match(epoch,/autonomous\/user-revoke/);
+  assert.equal(remaining,false);
+});
+winTest('R72 external grant path is rejected without touching the file',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true,escape:true});
+  assert.notEqual(result.status,0);
+  assert.match(result.stdout,/must live under controller runtime directory/);
+  assert.equal(remaining,true);
+  assert.equal(epoch,'');
+});
+winTest('R72 epoch revocation error remains a failure even after file removal',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true,epochFails:true});
+  assert.notEqual(result.status,0);
+  assert.match(result.stdout,/FIXTURE_EPOCH_FAILED/);
+  assert.match(epoch,/autonomous\/user-revoke/);
+  assert.equal(remaining,false);
+});

package/test/r72-staging-input-isolation.test.mjs

@@ -0,0 +1,87 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile,symlink,readFile} from 'node:fs/promises';
+import {tmpdir,homedir} from 'node:os';
+import path from 'node:path';
+import {assertStageOwnedPath,assertStageNoProductionPath,assertStagingBootstrapInputs,assertStagingControlConfig} from '../src/staging-input-isolation.mjs';
+const usingStage=async fn=>{const dir=await mkdtemp(path.join(tmpdir(),'r72-g2-w2-'));try{const state=path.join(dir,'isolated-state');await mkdir(state);await fn({dir,state});}finally{await rm(dir,{recursive:true,force:true});}};
+const cfg=state=>({
+  CoreRoot:path.join(state,'releases','predecessor'),WorkspaceRoot:path.join(state,'workspaces'),
+  CodingPolicyFile:path.join(state,'policies','coding.json'),AutonomousPolicyFile:path.join(state,'policies','autonomous.json'),
+  HostPolicyFile:path.join(state,'policies','host.json'),ProcessPolicyFile:path.join(state,'policies','process.json'),
+  DesktopPolicyFile:path.join(state,'policies','desktop.json'),
+  Bridge:{FilePath:path.join(state,'bin','node.exe'),WorkingDirectory:path.join(state,'bridge'),ScriptPath:path.join(state,'bridge','src','bridge.mjs'),Dependencies:[{Name:'bridge-local',Path:path.join(state,'bridge','src','helper.mjs')}]},
+  Cloud:{FilePath:path.join(state,'bin','tunnel.exe'),WorkingDirectory:path.join(state,'releases','predecessor'),Dependencies:[{Name:'cloudflared',Path:path.join(path.parse(state).root,'opt','cloudflared.exe')},{Name:'tunnel-token',Path:path.join(state,'trust','cloud-token.txt')}]}
+});
+test('G2-W2 accepts stage-owned policy, Bridge and Cloud config paths',async()=>usingStage(async({state})=>{
+  assert.doesNotThrow(()=>assertStagingControlConfig(cfg(state),state,{configPath:path.join(state,'generations','config.psd1')}));
+}));
+test('G2-W2 rejects each external controller policy path before policy read',async()=>usingStage(async({dir,state})=>{
+  for(const key of ['CodingPolicyFile','AutonomousPolicyFile','HostPolicyFile','ProcessPolicyFile','DesktopPolicyFile']){
+    const c=cfg(state);c[key]=path.join(dir,'outside.json');
+    assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),new RegExp('STAGING_EXTERNAL_INPUT: '+key));
+  }
+}));
+test('G2-W2 rejects external controller config before PowerShell Import-PowerShellDataFile',async()=>usingStage(async({dir,state})=>{
+  assert.throws(()=>assertStageOwnedPath(path.join(dir,'production','config.psd1'),state,'controller config file'),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 rejects bridge and Cloud external working directories, dependencies and executables',async()=>usingStage(async({dir,state})=>{
+  for(const [component,key] of [['Bridge','WorkingDirectory'],['Bridge','ScriptPath'],['Cloud','WorkingDirectory']]){
+    const c=cfg(state);c[component][key]=path.join(dir,'foreign','escape.exe');
+    assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+  }
+  const c=cfg(state);c.Bridge.Dependencies[0].Path=path.join(dir,'foreign.js');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 permits a shared non-production executable but forbids a production-state executable',async()=>usingStage(async({dir,state})=>{
+  const c=cfg(state);c.Bridge.FilePath=path.join(dir,'system-node.exe');
+  assert.doesNotThrow(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}));
+  c.Bridge.FilePath=path.join(homedir(),'.deadbyte-mcp','bin','node.exe');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_PRODUCTION_INPUT/);
+}));
+test('G2-W2 rejects external cloud credential in existing config',async()=>usingStage(async({dir,state})=>{
+  const c=cfg(state);c.Cloud.Dependencies[1].Path=path.join(dir,'production','token.txt');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 rejects external policy override before state mutation',async()=>usingStage(async({dir,state})=>{
+  for(const key of ['codingPolicyBootstrap','autonomousPolicyBootstrap','hostPolicyBootstrap','processPolicyBootstrap','desktopPolicyBootstrap','ownerApprovalBootstrap','semanticLspBootstrap']){
+    assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,[key]:{path:path.join(dir,'outside.json'),sha256:'a'.repeat(64)}}),/STAGING_EXTERNAL_INPUT/);
+  }
+}));
+test('G2-W2 rejects production legacy --source-root and Bridge bootstrap before state mutation',async()=>usingStage(async({dir,state})=>{
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,sourceRoot:path.join(dir,'legacy-core')}),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,bridgeBootstrap:{root:path.join(dir,'bridge'),scriptSha256:'a'.repeat(64)}}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 requires named-tunnel token and working directory under stage state',async()=>usingStage(async({dir,state})=>{
+  const c={cloudflared:{path:path.join(dir,'nonprod-cloudflared.exe')},tokenFile:{path:path.join(state,'trust','token.txt')},childWorkingDirectory:path.join(state,'cloud')};
+  assert.doesNotThrow(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:c}));
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:{...c,tokenFile:{path:path.join(dir,'external-token.txt')}}}),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:{...c,childWorkingDirectory:path.join(dir,'foreign')}}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 prohibits production config, token and cloudflared even when explicitly pinned',async()=>usingStage(async({state})=>{
+  const prod=path.join(homedir(),'.deadbyte-mcp');
+  assert.throws(()=>assertStageOwnedPath(path.join(prod,'trust','update-key.json'),state,'production key'),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStageNoProductionPath(path.join(prod,'bin','cloudflared.exe'),state,'cloudflared'),/STAGING_PRODUCTION_INPUT/);
+}));
+test('G2-W2 rejects staging nested in production root',()=>{
+  const prod=path.join(homedir(),'.deadbyte-mcp');
+  assert.throws(()=>assertStageOwnedPath(path.join(prod,'stage','policies','coding.json'),path.join(prod,'stage'),'policy'),/STAGING_STATE_OVERLAPS_PRODUCTION/);
+});
+test('G2-W2 allows production legacy policy paths without modifying production data',async()=>usingStage(async({dir})=>{
+  const production=path.join(homedir(),'.deadbyte-mcp');
+  const c=cfg(path.join(dir,'separate-stage'));
+  assert.doesNotThrow(()=>assertStagingControlConfig(c,production,{configPath:path.join(dir,'external.psd1')}));
+  assert.doesNotThrow(()=>assertStagingBootstrapInputs({stateRoot:production,sourceRoot:dir,cloudTransport:{tokenFile:{path:dir}}}));
+}));
+test('G2-W2 rejects a symlink path component in an otherwise owned policy path',async t=>usingStage(async({dir,state})=>{
+  const external=path.join(dir,'external');await mkdir(external);
+  try{await symlink(external,path.join(state,'linked'),process.platform==='win32'?'junction':'dir');}
+  catch(error){if(['EPERM','EACCES','ENOSYS'].includes(error.code)){t.diagnostic('symlink privilege not present');return;}throw error;}
+  const c=cfg(state);c.CodingPolicyFile=path.join(state,'linked','coding.json');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_REPARSE_INPUT/);
+}));
+test('G2-W2 rejection never modifies foreign source bytes',async()=>usingStage(async({dir,state})=>{
+  const foreign=path.join(dir,'foreign.json');await writeFile(foreign,'private-boundary-marker');
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,codingPolicyBootstrap:{path:foreign}}),/STAGING_EXTERNAL_INPUT/);
+  assert.equal(await readFile(foreign,'utf8'),'private-boundary-marker');
+}));

package/test/r72-staging-workspace-isolation.test.mjs

@@ -0,0 +1,114 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,symlink} from 'node:fs/promises';
+import {tmpdir,homedir} from 'node:os';
+import {existsSync, lstatSync} from 'node:fs';
+import path from 'node:path';
+import {workspacePlan} from '../src/runtime-update.mjs';
+
+const stage = async fn => {
+  const dir=await mkdtemp(path.join(tmpdir(),'r72-g2-workspace-'));
+  try {await fn(dir,path.join(dir,'stage-state'));}
+  finally {await rm(dir,{recursive:true,force:true});}
+};
+
+test('staging rejects external existing workspace before any rename can be planned', async()=>{
+  await stage(async(base,state)=>{
+    const foreign=path.join(base,'production-workspaces');
+    await mkdir(foreign);
+    await assert.rejects(workspacePlan(foreign,state), /STAGING_WORKSPACE_OUTSIDE_STATE/);
+  });
+});
+
+test('staging rejects production-managed workspace path even if not present', async()=>{
+  await stage(async(base,state)=>{
+    const prod=path.join(homedir(),'.deadbyte-mcp','workspaces');
+    await assert.rejects(workspacePlan(prod,state), /STAGING_WORKSPACE_OUTSIDE_STATE/);
+  });
+});
+
+test('staging permits a stage-owned legacy workspace and preserves plan-only semantics', async()=>{
+  await stage(async(base,state)=>{
+    const old=path.join(state,'legacy-workspaces');
+    await mkdir(old,{recursive:true});
+    const planned=await workspacePlan(old,state);
+    assert.equal(planned.mode,'rename');
+    assert.equal(planned.target,path.join(state,'workspaces'));
+    assert.equal(planned.moved,false);
+  });
+});
+
+test('staging rejects a workspace equal to state root', async()=>{
+  await stage(async(base,state)=>{
+    await mkdir(state);
+    await assert.rejects(workspacePlan(state,state), /STAGING_WORKSPACE_STATE_ROOT/);
+  });
+});
+
+test('production keeps its established external-workspace migration behavior', async()=>{
+  await stage(async(base)=>{
+    const prod=path.join(homedir(),'.deadbyte-mcp');
+    const stable=path.join(prod,'workspaces');
+    const external=path.join(base,'legacy-workspaces');
+    await mkdir(external);
+    // Observe real target state read-only: production might already contain workspaces.
+    if(existsSync(stable)){
+      const info=lstatSync(stable);
+      if(!info.isDirectory()||info.isSymbolicLink()){
+        await assert.rejects(workspacePlan(external,prod),/stable workspace root must be a real directory/);
+      }else{
+        await assert.rejects(workspacePlan(external,prod),/workspace migration conflict: both source and stable target exist/);
+      }
+    }else{
+      const result=await workspacePlan(external,prod);
+      assert.equal(result.source,external);
+      assert.equal(result.target,stable);
+      assert.equal(result.mode,'rename');
+      assert.equal(result.moved,false);
+    }
+    // Planning must never rename or remove the legacy source.
+    assert.equal(existsSync(external),true);
+  });
+});
+
+test('staging refuses workspace path through symlink or junction', async(t)=>{
+  await stage(async(base,state)=>{
+    const real=path.join(base,'foreign');await mkdir(real);
+    const link=path.join(state,'link');await mkdir(state);
+    try{await symlink(real,link,process.platform==='win32'?'junction':'dir');}
+    catch(e){if(['EPERM','EACCES','ENOSYS'].includes(e.code)){t.diagnostic('symlink creation not permitted');return;}throw e;}
+    await assert.rejects(workspacePlan(link,state), /STAGING_WORKSPACE_REPARSE/);
+  });
+});
+
+test('staging refuses reserved trust, release and runtime trees as workspace sources',async()=>{
+ await stage(async(base,state)=>{
+  for(const child of ['trust','releases','runtime','bin','evidence']){
+   const source=path.join(state,child,'workspace');
+   await assert.rejects(workspacePlan(source,state),/STAGING_WORKSPACE_RESERVED_STATE/);
+  }
+ });
+});
+
+test('workspace apply rejects a newly introduced target junction/symlink',async(t)=>{
+ await stage(async(base,state)=>{
+  const old=path.join(state,'old-workspaces');await mkdir(old,{recursive:true});
+  const plan=await workspacePlan(old,state);
+  const external=path.join(base,'foreign');await mkdir(external);
+  try{await symlink(external,path.join(state,'workspaces'),process.platform==='win32'?'junction':'dir');}
+  catch(e){if(['EPERM','EACCES','ENOSYS'].includes(e.code)){t.diagnostic('symlink creation not permitted');return;}throw e;}
+  const {applyWorkspacePlan}=await import('../src/runtime-update.mjs');
+  await assert.rejects(applyWorkspacePlan(plan),/STAGING_WORKSPACE_REPARSE/);
+  assert.equal((await import('node:fs')).existsSync(old),true);
+ });
+});
+
+test('workspace rollback rejects a foreign workspace source without touching it',async()=>{
+ await stage(async(base,state)=>{
+  const foreign=path.join(base,'foreign');await mkdir(foreign);
+  const {rollbackWorkspacePlan}=await import('../src/runtime-update.mjs');
+  const fake={source:foreign,target:path.join(state,'workspaces'),mode:'rename',moved:true};
+  await assert.rejects(rollbackWorkspacePlan(fake),/STAGING_WORKSPACE_OUTSIDE_STATE/);
+  assert.equal((await import('node:fs')).existsSync(foreign),true);
+ });
+});

package/test/r73-package-boundary.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const npmCli=process.env.npm_execpath || path.join(path.dirname(process.execPath),'node_modules','npm','bin','npm-cli.js');
+
+test('R73 npm dry-run package excludes generated test evidence and reference trees',()=>{
+  const result=spawnSync(process.execPath,[npmCli,'pack','--dry-run','--json'],{
+    cwd:root,encoding:'utf8',timeout:120000,windowsHide:true,env:{...process.env,npm_config_audit:'false'}
+  });
+  assert.equal(result.error,undefined,String(result.error));
+  assert.equal(result.status,0,result.stderr||result.stdout);
+  const parsed=JSON.parse(result.stdout);
+  const record=Array.isArray(parsed)?parsed[0]:parsed['deadbyte-mcp'];
+  assert.ok(record&&Array.isArray(record.files),'npm file inventory missing');
+  const leaked=record.files.map(row=>row.path).filter(name=>
+    /^(?:testing|references|\.git)(?:\/|$)|(?:^|\/)\.env(?:\.|$)/i.test(name));
+  assert.deepEqual(leaked,[],'generated evidence or private trees must not enter npm package');
+});

package/test/r74-kernel-lock.test.mjs

@@ -0,0 +1,150 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {acquireKernelExclusiveLock, verifyKernelLockBinary} from '../src/kernel-lock-r74.mjs';
+
+async function safeRm(dir) {
+  for (let i = 0; i < 15; i++) {
+    try {
+      await rm(dir, {recursive: true, force: true});
+      return;
+    } catch (err) {
+      if (err.code !== 'EBUSY' && err.code !== 'EPERM') throw err;
+      await new Promise(r => setTimeout(r, 40));
+    }
+  }
+  await rm(dir, {recursive: true, force: true});
+}
+
+test('kernel lock binary is verified and hash-pinned', async () => {
+  const verified = await verifyKernelLockBinary();
+  assert.equal(verified.ok, true, verified.reason);
+  assert.ok(/^[0-9a-f]{64}$/.test(verified.sha256));
+});
+
+test('kernel exclusive lock can be acquired and released normally', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-basic-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const release = await acquireKernelExclusiveLock(lock);
+    assert.equal(typeof release, 'function');
+    assert.ok(Number.isSafeInteger(release.pid));
+    await release();
+    const content = await readFile(lock, 'utf8');
+    assert.match(content, /^deadbyte\.kernel-lock\.r74:pid=\d+/);
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('concurrent writer is blocked while lock is held by another process', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-contention-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const release = await acquireKernelExclusiveLock(lock);
+    let error = null;
+    try {
+      await acquireKernelExclusiveLock(lock, {timeoutMs: 100, pollMs: 15});
+    } catch (err) {
+      error = err;
+    }
+    assert.ok(error, 'second writer should have been blocked');
+    assert.match(error.message, /atomic mutation lock timed out/);
+    await release();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('crash-safe recovery: killed owner releases handle via OS, successor acquires without deleting lock pathname', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-crash-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const releaseFirst = await acquireKernelExclusiveLock(lock);
+    const lockPid = releaseFirst.pid;
+    assert.ok(Number.isSafeInteger(lockPid));
+
+    // Abrupt termination (simulating crash)
+    process.kill(lockPid, 'SIGKILL');
+
+    // Wait a brief moment for Windows kernel to close the handle
+    await new Promise(r => setTimeout(r, 60));
+
+    // Successor MUST be able to acquire the lock immediately WITHOUT deleting the lock file!
+    const releaseSecond = await acquireKernelExclusiveLock(lock, {timeoutMs: 1000});
+    assert.equal(typeof releaseSecond, 'function');
+
+    // Clean release
+    await releaseSecond();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('dead PID or stale on-disk marker does not block new acquisition when no handle is held', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-pidreuse-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    // Write a stale/foreign PID into the lock file
+    await writeFile(lock, 'deadbyte.kernel-lock.r74:pid=999999999\n');
+
+    // Because no live kernel handle holds the file, acquisition must succeed immediately
+    const release = await acquireKernelExclusiveLock(lock, {timeoutMs: 500});
+    assert.equal(typeof release, 'function');
+    await release();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('concurrent recovery: exactly one worker acquires lock, others are serialized', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-concurrent-'));
+  const lock = path.join(root, 'target.lock');
+  const sequence = [];
+  try {
+    const runWorker = async (id) => {
+      const release = await acquireKernelExclusiveLock(lock, {timeoutMs: 5000, pollMs: 10});
+      sequence.push(`enter_${id}`);
+      await new Promise(r => setTimeout(r, 20));
+      sequence.push(`exit_${id}`);
+      await release();
+    };
+
+    // Run 3 workers concurrently
+    await Promise.all([runWorker(1), runWorker(2), runWorker(3)]);
+
+    assert.equal(sequence.length, 6);
+    // Every enter must be followed by its matching exit before next enter
+    for (let i = 0; i < sequence.length; i += 2) {
+      const enter = sequence[i];
+      const exit = sequence[i + 1];
+      const id = enter.split('_')[1];
+      assert.equal(exit, `exit_${id}`, `non-exclusive execution detected: ${enter} followed by ${exit}`);
+    }
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('replaced binary negative: tampered executable fails closed with recovery blocked', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-tampered-'));
+  const lock = path.join(root, 'target.lock');
+  // Temporarily override docs/R74-KERNEL-LOCK-BINARY.json hash
+  const metaPath = path.resolve('docs/R74-KERNEL-LOCK-BINARY.json');
+  const originalMeta = await readFile(metaPath, 'utf8');
+  try {
+    const tampered = JSON.parse(originalMeta);
+    tampered.sha256 = '0'.repeat(64);
+    await writeFile(metaPath, JSON.stringify(tampered, null, 2) + '\n');
+
+    await assert.rejects(
+      acquireKernelExclusiveLock(lock, {timeoutMs: 200}),
+      /atomic mutation lock recovery blocked: native exclusive locking unavailable/
+    );
+  } finally {
+    await writeFile(metaPath, originalMeta);
+    await safeRm(root);
+  }
+});