deadbyte-mcp 0.15.47 → 0.15.49

package/test/r125-restore-binding-types.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash, generateKeyPairSync, randomBytes, sign} from 'node:crypto';
+import {mkdtemp, mkdir, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const domain = Buffer.from('DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1\0');
+const eventName = (seq, hash) => `${String(seq).padStart(16, '0')}-${hash}.json`;
+
+test('R125 hot read rejects signed restore predecessor with array-valued SHA binding', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r125-binding-'));
+  try {
+    const runtimeDir = path.join(root, 'runtime');
+    const trust = path.join(root, 'trust');
+    const dir = path.join(runtimeDir, 'authority-epochs', 'process');
+    await mkdir(path.join(dir, 'events'), {recursive:true});
+    await mkdir(trust);
+    const keys = generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}));
+    const keyId = sha(keys.publicKey.export({type:'spki', format:'der'}));
+    const signEvent = body => {
+      const signature = sign(null, Buffer.concat([domain, Buffer.from(canonicalJson(body))]), keys.privateKey);
+      const event = {...body, attestation:{algorithm:'ed25519', domain:'DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1', key_id:keyId, signature_base64:signature.toString('base64')}};
+      const bytes = Buffer.from(canonicalJson(event));
+      return {bytes, hash:sha(bytes), event};
+    };
+    const nonce1 = randomBytes(32).toString('hex');
+    const nonce2 = randomBytes(32).toString('hex');
+    const nonce3 = randomBytes(32).toString('hex');
+    const oldGrant = sha(Buffer.from('old'));
+    const restoredGrant = sha(Buffer.from('restored'));
+    const currentGrantBytes = Buffer.from('current');
+    const common = {schema:'deadbyte.authority-epoch-event.r65.v1', plane:'process', recorded_at_utc:new Date().toISOString()};
+    const one = signEvent({...common, seq:1, action:'grant', update_id:null,
+      grant_sha256:oldGrant, grant_instance_nonce:nonce1, restore_binding:null, previous_event_sha256:null});
+    const two = signEvent({...common, seq:2, action:'transaction_revoke', update_id:'r125-update',
+      grant_sha256:oldGrant, grant_instance_nonce:nonce1, restore_binding:null, previous_event_sha256:one.hash});
+    const binding = {prior_grant_sha256:[oldGrant], prior_grant_instance_nonce:nonce1,
+      predecessor_policy_envelope_sha256:'1'.repeat(64), successor_policy_envelope_sha256:'2'.repeat(64),
+      candidate_manifest_sha256:'3'.repeat(64), continuity_subject_sha256:'4'.repeat(64)};
+    const three = signEvent({...common, seq:3, action:'transaction_restore', update_id:'r125-update',
+      grant_sha256:restoredGrant, grant_instance_nonce:nonce2, restore_binding:binding, previous_event_sha256:two.hash});
+    const fourBody = {...common, seq:4, action:'grant', update_id:null,
+      grant_sha256:sha(currentGrantBytes), grant_instance_nonce:nonce3, restore_binding:null,
+      previous_event_sha256:three.hash};
+    const four = signEvent(fourBody);
+    for (const [seq, signed] of [[1,one],[2,two],[3,three],[4,four]])
+      await writeFile(path.join(dir, 'events', eventName(seq, signed.hash)), signed.bytes);
+    await writeFile(path.join(dir, 'head.json'), Buffer.from(canonicalJson({
+      schema:'deadbyte.authority-epoch-head.r65.v1', plane:'process', seq:4, action:'grant', update_id:null,
+      grant_sha256:fourBody.grant_sha256, grant_instance_nonce:nonce3, restore_binding:null,
+      previous_event_sha256:three.hash, event_sha256:four.hash, event_file:eventName(4,four.hash)})));
+    const store = createAuthorityEpochStore({runtimeDir});
+    await assert.rejects(store.readHead({plane:'process'}), /authority epoch transaction restore binding invalid/);
+    assert.equal((await store.verifyGrant({plane:'process', grantBytes:currentGrantBytes, grantInstanceNonce:nonce3})).trusted, false);
+  } finally {
+    await rm(root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+  }
+});

package/test/r126-restore-policy-envelope.test.mjs

@@ -0,0 +1,89 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash, generateKeyPairSync, randomBytes, sign} from 'node:crypto';
+import {mkdtemp, mkdir, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const domain = Buffer.from('DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1\0');
+const eventName = (seq, hash) => `${String(seq).padStart(16, '0')}-${hash}.json`;
+
+async function signedRestoreFixture(bindingOverride) {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r126-envelope-'));
+  const runtimeDir = path.join(root, 'runtime');
+  const trustDir = path.join(root, 'trust');
+  const eventDir = path.join(runtimeDir, 'authority-epochs', 'process', 'events');
+  await mkdir(eventDir, {recursive:true});
+  await mkdir(trustDir);
+  const keys = generateKeyPairSync('ed25519');
+  await writeFile(path.join(trustDir, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}));
+  const keyId = sha(keys.publicKey.export({type:'spki', format:'der'}));
+  const signEvent = body => {
+    const signature = sign(null, Buffer.concat([domain, Buffer.from(canonicalJson(body))]), keys.privateKey);
+    const event = {...body, attestation:{algorithm:'ed25519', domain:'DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1', key_id:keyId, signature_base64:signature.toString('base64')}};
+    const bytes = Buffer.from(canonicalJson(event));
+    return {bytes, hash:sha(bytes)};
+  };
+  const oldNonce = randomBytes(32).toString('hex');
+  const newNonce = randomBytes(32).toString('hex');
+  const oldGrantSha = sha(Buffer.from('old-grant'));
+  const newGrantBytes = Buffer.from('new-grant');
+  const priorEnvelope = '1'.repeat(64);
+  const nextEnvelope = '2'.repeat(64);
+  const common = {schema:'deadbyte.authority-epoch-event.r65.v1', plane:'process', recorded_at_utc:new Date().toISOString()};
+  const one = signEvent({...common, seq:1, action:'grant', update_id:null, grant_sha256:oldGrantSha,
+    grant_instance_nonce:oldNonce, restore_binding:null, previous_event_sha256:null,
+    policy_sha256:'a'.repeat(64), policy_envelope_sha256:priorEnvelope});
+  const two = signEvent({...common, seq:2, action:'transaction_revoke', update_id:'r126-update',
+    grant_sha256:oldGrantSha, grant_instance_nonce:oldNonce, restore_binding:null,
+    previous_event_sha256:one.hash, policy_sha256:'a'.repeat(64), policy_envelope_sha256:priorEnvelope});
+  const restoreBinding = {prior_grant_sha256:oldGrantSha, prior_grant_instance_nonce:oldNonce,
+    predecessor_policy_envelope_sha256:priorEnvelope, successor_policy_envelope_sha256:nextEnvelope,
+    candidate_manifest_sha256:'3'.repeat(64), continuity_subject_sha256:'4'.repeat(64),
+    ...bindingOverride};
+  const threeBody = {...common, seq:3, action:'transaction_restore', update_id:'r126-update',
+    grant_sha256:sha(newGrantBytes), grant_instance_nonce:newNonce, restore_binding:restoreBinding,
+    previous_event_sha256:two.hash, policy_sha256:'b'.repeat(64), policy_envelope_sha256:nextEnvelope};
+  const three = signEvent(threeBody);
+  for (const [seq, signed] of [[1,one],[2,two],[3,three]])
+    await writeFile(path.join(eventDir, eventName(seq, signed.hash)), signed.bytes);
+  await writeFile(path.join(runtimeDir, 'authority-epochs', 'process', 'head.json'), Buffer.from(canonicalJson({
+    schema:'deadbyte.authority-epoch-head.r65.v1', plane:'process', seq:3,
+    action:threeBody.action, update_id:threeBody.update_id,
+    grant_sha256:threeBody.grant_sha256, grant_instance_nonce:newNonce,
+    restore_binding:restoreBinding, previous_event_sha256:two.hash,
+    policy_sha256:threeBody.policy_sha256, policy_envelope_sha256:nextEnvelope,
+    event_sha256:three.hash, event_file:eventName(3,three.hash)
+  })));
+  return {root, runtimeDir, newGrantBytes, newNonce};
+}
+
+for (const [name, override] of [
+  ['predecessor policy envelope', {predecessor_policy_envelope_sha256:'f'.repeat(64)}],
+  ['successor policy envelope', {successor_policy_envelope_sha256:'e'.repeat(64)}]
+]) test(`R126 signed restore rejects wrong ${name} despite valid signature`, async () => {
+  const fixture = await signedRestoreFixture(override);
+  try {
+    const store = createAuthorityEpochStore({runtimeDir:fixture.runtimeDir});
+    await assert.rejects(store.readHead({plane:'process'}), /authority epoch transition invalid/);
+    assert.equal((await store.verifyGrant({plane:'process', grantBytes:fixture.newGrantBytes,
+      grantInstanceNonce:fixture.newNonce})).trusted, false);
+  } finally {
+    await rm(fixture.root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+  }
+});
+
+test('R126 correctly bound signed restore stays readable', async () => {
+  const fixture = await signedRestoreFixture({});
+  try {
+    const store = createAuthorityEpochStore({runtimeDir:fixture.runtimeDir});
+    assert.equal((await store.readHead({plane:'process'})).action, 'transaction_restore');
+    assert.equal((await store.verifyGrant({plane:'process', grantBytes:fixture.newGrantBytes,
+      grantInstanceNonce:fixture.newNonce})).trusted, true);
+  } finally {
+    await rm(fixture.root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+  }
+});

package/test/r127-restore-append-policy-boundary.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+test('R127 wrong signed successor policy envelope fails before native lock or event write',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r127-binding-'));
+  try{
+    const policy=Buffer.from(JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:false}));
+    const nonce='a'.repeat(64);
+    const grant=Buffer.from(JSON.stringify({instance_nonce:nonce,policy_sha256:sha(policy)}));
+    const binding={prior_grant_sha256:sha(grant),prior_grant_instance_nonce:'b'.repeat(64),
+      predecessor_policy_envelope_sha256:'c'.repeat(64),
+      successor_policy_envelope_sha256:'d'.repeat(64),
+      candidate_manifest_sha256:'e'.repeat(64),continuity_subject_sha256:'f'.repeat(64)};
+    const store=createAuthorityEpochStore({runtimeDir:path.join(root,'runtime'),policyBytes:policy});
+    await assert.rejects(store.append({plane:'coding',action:'transaction_restore',grantBytes:grant,
+      grantInstanceNonce:nonce,updateId:'r127',expectedHeadSha256:'1'.repeat(64),restoreBinding:binding}),
+      /successor policy envelope mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r33-closeout-regression.test.mjs

@@ -4,13 +4,14 @@ import { createHash } from 'node:crypto';
 import { mkdtemp, mkdir, readFile, rm, writeFile, readdir } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import {fileURLToPath} from 'node:url';
 import { spawn } from 'node:child_process';
 import * as parity from '../scripts/release-parity-r39.mjs';
 import { createToolAudit } from '../src/tool-audit.mjs';
 import { verifyAuditChain } from '../src/audit-verify.mjs';
 import { generateTrustKeypair } from '../src/trust.mjs';
 
-const root = path.resolve(new URL('../', import.meta.url).pathname.replace(/^\/(?:([A-Za-z]:))/,'$1'));
+const root = path.resolve(fileURLToPath(new URL('../', import.meta.url)));
 const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
 const temp = prefix => mkdtemp(path.join(os.tmpdir(), prefix));
 const run = (command,args,options={}) => new Promise((resolve,reject)=>{

package/test/r54-offline-predecessor-self-exclusion.test.mjs

@@ -1,11 +1,11 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath,pathToFileURL } from 'node:url';
 import path from 'node:path';
 
 const target=process.env.R54_RUNTIME_UPDATE_PATH
   ? path.resolve(process.env.R54_RUNTIME_UPDATE_PATH)
-  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+  : fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url));
 const runtimeUpdate=await import(pathToFileURL(target).href+'?r54='+Date.now());
 
 test('R54 exposes behavior-testable offline recovery blocker selection',()=>{

package/test/r55-offline-predecessor-guardian-family.test.mjs

@@ -1,11 +1,11 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath,pathToFileURL } from 'node:url';
 import path from 'node:path';
 
 const target=process.env.R55_RUNTIME_UPDATE_PATH
   ? path.resolve(process.env.R55_RUNTIME_UPDATE_PATH)
-  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+  : fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url));
 const runtimeUpdate=await import(pathToFileURL(target).href+'?r55='+Date.now());
 const nonce='a'.repeat(64);
 

package/test/r56-rollback-launcher-restore.test.mjs

@@ -2,13 +2,13 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath,pathToFileURL } from 'node:url';
 import os from 'node:os';
 import path from 'node:path';
 
 const target=process.env.R56_RUNTIME_UPDATE_PATH
   ? path.resolve(process.env.R56_RUNTIME_UPDATE_PATH)
-  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+  : fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url));
 const runtimeUpdate=await import(pathToFileURL(target).href+'?r56='+Date.now());
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const stateRoot=path.resolve(process.env.R56_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));

package/test/r57-core-startup-race.test.mjs

@@ -1,12 +1,12 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath,pathToFileURL } from 'node:url';
 import path from 'node:path';
 
 const target=process.env.R57_RUNTIME_UPDATE_PATH
   ? path.resolve(process.env.R57_RUNTIME_UPDATE_PATH)
-  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+  : fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url));
 const runtimeUpdate=await import(pathToFileURL(target).href+'?r57='+Date.now());
 const coreRoot='C:\\slot\\core';
 const bridge={pid:20396,component:'bridge',script_path:'C:\\slot\\bridge\\src\\bridge.mjs',script_sha256:'a'.repeat(64)};

package/test/r58-concurrent-recovery.test.mjs

@@ -6,7 +6,7 @@ import {fileURLToPath} from 'node:url';
 import {spawn} from 'node:child_process';
 import {setTimeout as delay} from 'node:timers/promises';
 
-test('R58 simultaneous stale recovery cannot both revoke the shared authority', {timeout:90000},async()=>{
+test('R75 simultaneous owner-unverified recovery attempts both retain authority and marker', {timeout:30000},async()=>{
  const base='D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';await mkdir(base,{recursive:true});
  const root=await mkdtemp(path.join(base,'concurrent-recovery-'));await mkdir(path.join(root,'bin'));await mkdir(path.join(root,'runtime'));
  const trace=path.join(root,'trace.txt'),markerPath=path.join(root,'runtime','remote-session.json');
@@ -47,14 +47,17 @@ exit 0
    const c=spawn(process.execPath,[fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url)),'remote'],{env:{...process.env,DEADBYTE_STATE_ROOT:root},stdio:['pipe','pipe','pipe'],windowsHide:true});
    const o={stdout:'',stderr:''};c.stdout.on('data',b=>{o.stdout+=b;});c.stderr.on('data',b=>{o.stderr+=b;});o.exit=new Promise(resolve=>c.once('exit',resolve));children.push(c);outputs.push(o);
   }
-  const until=Date.now()+45000;let commands=[];
-  while(Date.now()<until){try{commands=(await readFile(trace,'utf8')).trim().split(/\r?\n/);}catch{}if(outputs.some(o=>o.stdout.includes('[READY]')))break;await delay(50);}
-  await writeFile(path.join(root,'observation.json'),JSON.stringify({commands,outputs:outputs.map(o=>({stdout:o.stdout,stderr:o.stderr})),simulation:'concurrent stale marker recovery with delayed second park'}),{flag:'wx'});
-  assert.ok(outputs.some(o=>o.stdout.includes('[READY]')),'a recovered foreground must become ready');
-  for(const cmd of ['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'])assert.equal(commands.filter(x=>x===cmd).length,1,`stale recovery must serialize ${cmd}`);
+  const exits=await Promise.race([Promise.all(outputs.map(o=>o.exit)),delay(15000,null,{ref:false}).then(()=>null)]);
+  assert.ok(exits,'both owner-unverified attempts must terminate');
+  const commands=await readFile(trace,'utf8').catch(error=>error.code==='ENOENT'?'':Promise.reject(error));
+  await writeFile(path.join(root,'observation.json'),JSON.stringify({commands,exits,outputs:outputs.map(o=>({stdout:o.stdout,stderr:o.stderr})),simulation:'concurrent owner-unverified stale marker'}),{flag:'wx'});
+  assert.ok(exits.every(code=>code!==0));
+  for(const output of outputs)assert.match(output.stderr,/ownership unverified.*marker retained|already claimed \(startup\/recovery lock\)/i);
+  assert.equal(commands,'','neither attempt may touch authority');
+  assert.equal(JSON.parse(await readFile(markerPath,'utf8')).pid,2147483000);
  }finally{
   for(const c of children)if(c.exitCode===null)c.stdin.end();
-  await Promise.race([Promise.all(outputs.map(o=>o.exit)),delay(30000)]);
+  await Promise.race([Promise.all(outputs.map(o=>o.exit)),delay(30000,null,{ref:false})]);
   for(const c of children)if(c.exitCode===null&&c.signalCode===null)c.kill();
  }
 });

package/test/r58-stale-owner.test.mjs

@@ -46,7 +46,7 @@ test('R58 live unrelated PID is not accepted as a remote foreground owner', {tim
  assert.notEqual(code,0);
 });
 
-test('R58 bound stale birth identity reconciles on the first invocation without killing a reused PID', {timeout:60000}, async()=>{
+test('R75 bound stale birth identity retains marker without touching a reused PID or authority', {timeout:60000}, async()=>{
  const base='D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';
  await mkdir(base,{recursive:true});const root=await mkdtemp(path.join(base,'stale-birth-'));
  await mkdir(path.join(root,'runtime'));await mkdir(path.join(root,'bin'));
@@ -61,11 +61,10 @@ test('R58 bound stale birth identity reconciles on the first invocation without
  let stdout='',stderr='';child.stdout.on('data',b=>{stdout+=b;});child.stderr.on('data',b=>{stderr+=b;});
  const code=await new Promise(resolve=>child.once('close',resolve));
  await writeFile(path.join(root,'observation.json'),JSON.stringify({code,stdout,stderr,simulation:'birth identity drift at a live unrelated numeric PID'}),{flag:'wx'});
- assert.match(stdout,/Stale remote session/);
- assert.doesNotMatch(stderr,/already active|ownership unverified/);
- assert.deepEqual((await readFile(trace,'utf8')).trim().split(/\r?\n/).slice(0,7),['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost','status','park']);
- assert.match(stderr,/without a verified ONLINE runtime/,'fixture deliberately has no real runtime; recovery must already have converged');
- await assert.rejects(readFile(markerPath),{code:'ENOENT'});
+ assert.notEqual(code,0);
+ assert.match(stderr,/owner identity mismatch; marker retained/i);
+ assert.equal(await readFile(trace,'utf8').catch(error=>error.code==='ENOENT'?'':Promise.reject(error)),'','identity drift must cause no authority commands');
+ assert.deepEqual(JSON.parse(await readFile(markerPath,'utf8')),marker);
  assert.equal(foregroundAlive(),true,'unrelated live process must not be killed');
  function foregroundAlive(){try{process.kill(process.pid,0);return true;}catch{return false;}}
 });

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r65-activation-orchestration.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
 
 const parent={release_id:'v0.15.41-63a78ad159ad3003',version:'0.15.41',manifest_sha256:'63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e',generation_manifest_sha256:'19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'};
 const candidate={version:'0.15.42',manifest_sha256:'a'.repeat(64)};
@@ -19,7 +20,7 @@ function fixture(initial={}){
   let current={state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:authorityEntries(initialVector,initial.epochNative===true),policy_sha256:policies,
     active_release_id:parent.release_id,active_manifest_sha256:parent.manifest_sha256,active_generation_manifest_sha256:parent.generation_manifest_sha256,...initial};
   if(initial.authority)current={...current,authority:authorityEntries(initial.authority,initial.epochNative===true)};
-  return {calls,observe:async()=>current,command:async name=>{
+  return {calls,observe:async()=>withAuthorityProof(current),command:async name=>{
     calls.push(name);
     if(name.startsWith('disarm')){
       const plane=name.slice(6);

package/test/r65-activation-preflight.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {classifyActivationPreflight,authorityTransitionPlan} from '../src/activation-preflight-r65.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
 
 const parent={release_id:'v0.15.41-63a78ad159ad3003',version:'0.15.41',manifest_sha256:'63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e',generation_manifest_sha256:'19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'};
 const candidate={version:'0.15.42',manifest_sha256:'a'.repeat(64)};
@@ -8,7 +9,7 @@ const authority={process:true,coding:true,autonomous:true,desktop:false,host:fal
 const policies={process:'1'.repeat(64),coding:'2'.repeat(64),autonomous:'3'.repeat(64),desktop:'4'.repeat(64),host:'5'.repeat(64)};
 const online={state:'ONLINE',local_ready:true,bridge:{alive:true,reason:'verified',pid:10},core:{alive:true,reason:'verified',pid:11},cloud:{alive:true,reason:'verified',pid:12},supervisor:{running:true},authority,policy_sha256:policies,
   active_release_id:parent.release_id,active_manifest_sha256:parent.manifest_sha256,active_generation_manifest_sha256:parent.generation_manifest_sha256};
-const input={pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,observation:online};
+const input={pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,observation:withAuthorityProof(online)};
 
 test('preflight accepts exact online predecessor with full observed identity and authority vector',()=>{
   const result=classifyActivationPreflight(input);
@@ -19,7 +20,7 @@ test('preflight accepts exact online predecessor with full observed identity and
 
 test('host armed is not safe; plan only disarms Host and restores exact captured vector',()=>{
   const armed={...authority,host:true};
-  const result=classifyActivationPreflight({...input,observation:{...online,authority:armed}});
+  const result=classifyActivationPreflight({...input,observation:withAuthorityProof({...online,authority:armed})});
   assert.equal(result.state,'ONLINE_HOST_ARMED');assert.equal(result.safe_to_activate,false);
   const plan=authorityTransitionPlan(result.authority);
   assert.deepEqual(plan.before,['disarmhost']);
@@ -27,9 +28,9 @@ test('host armed is not safe; plan only disarms Host and restores exact captured
 });
 
 test('parked dirty, generation drift and identity loss fail closed without an activation command',()=>{
-  assert.equal(classifyActivationPreflight({...input,observation:{...online,state:'PARKED'}}).state,'PARKED_DIRTY');
+  assert.equal(classifyActivationPreflight({...input,observation:withAuthorityProof({...online,state:'PARKED'})}).state,'PARKED_DIRTY');
   assert.equal(classifyActivationPreflight({...input,pointer:{...parent,generation_manifest_sha256:'b'.repeat(64)}}).state,'POINTER_DRIFT');
-  assert.equal(classifyActivationPreflight({...input,observation:{...online,active_release_id:'wrong'}}).state,'POINTER_DRIFT');
-  assert.equal(classifyActivationPreflight({...input,observation:{...online,policy_sha256:{...policies,host:null}}}).state,'UNKNOWN');
-  assert.equal(classifyActivationPreflight({...input,observation:{...online,cloud:{alive:false,reason:'missing'}}}).state,'RUNTIME_DRIFT');
+  assert.equal(classifyActivationPreflight({...input,observation:withAuthorityProof({...online,active_release_id:'wrong'})}).state,'POINTER_DRIFT');
+  assert.equal(classifyActivationPreflight({...input,observation:withAuthorityProof({...online,policy_sha256:{...policies,host:null}})}).state,'UNKNOWN');
+  assert.equal(classifyActivationPreflight({...input,observation:withAuthorityProof({...online,cloud:{alive:false,reason:'missing'}})}).state,'RUNTIME_DRIFT');
 });

package/test/r65-authority-epoch-recovery.test.mjs

@@ -19,7 +19,9 @@ test('dead-owner epoch lock is recovered but a live-owner lock is never stolen',
     const runtime=await prepareAuthorityTestTrust(root);
     const dir=path.join(runtime,'authority-epochs','coding');
     await mkdir(dir,{recursive:true});
-    await writeFile(path.join(dir,'.lock'),JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:2147483647,token:'dead',created_at_utc:'2026-10-06T00:00:00Z'}));
+    await writeFile(path.join(dir,'.lock'),JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:2147483647,token:'dead',created_at_utc:'2026-10-06T00:00:00Z',
+      owner_identity:{schema:'deadbyte.foreground-process.v1',pid:2147483647,parent_pid:0,creation_utc:'2026-01-01T00:00:00Z',
+        executable_path:process.execPath,command_line_sha256:'0'.repeat(64)}}));
     const store=createAuthorityEpochStore({runtimeDir:runtime});
     const nonce='1'.repeat(64),grant=grantBytes(nonce);
     const head=await store.append({plane:'coding',action:'grant',grantBytes:grant,grantInstanceNonce:nonce,updateId:null});

package/test/r65-authority-epoch-store.test.mjs

@@ -4,7 +4,7 @@ import {createHash} from 'node:crypto';
 import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {createAuthorityEpochStore,deriveSecurityEnvelope} from '../src/authority-continuity-r65.mjs';
 import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
 
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -32,9 +32,12 @@ async function fixture(run){
   }finally{await rm(root,{recursive:true,force:true});}
 }
 
-function restoreBinding(oldGrant,oldNonce){
+function restoreBinding(oldGrant,oldNonce,policyBytes){
+  // A successful restore must describe the real signed policy envelope.
+  // This fixture keeps the same policy on both sides of the transaction.
+  const envelope=deriveSecurityEnvelope('process',JSON.parse(policyBytes)).sha256;
   return {prior_grant_sha256:sha(oldGrant),prior_grant_instance_nonce:oldNonce,
-    predecessor_policy_envelope_sha256:'1'.repeat(64),successor_policy_envelope_sha256:'2'.repeat(64),
+    predecessor_policy_envelope_sha256:envelope,successor_policy_envelope_sha256:envelope,
     candidate_manifest_sha256:'3'.repeat(64),continuity_subject_sha256:'4'.repeat(64)};
 }
 
@@ -63,7 +66,7 @@ test('stale transaction CAS cannot overwrite a later user revoke',()=>fixture(as
   const nextNonce='e'.repeat(64),nextGrant=Buffer.from(JSON.stringify({...f.grant,instance_nonce:nextNonce}));
   await assert.rejects(()=>f.store.append({plane:'process',action:'transaction_restore',grantBytes:nextGrant,
     grantInstanceNonce:nextNonce,updateId:'r65-store-test',expectedHeadSha256:tx.event_sha256,
-    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)}),/compare-and-swap conflict/);
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce,f.policyBytes)}),/compare-and-swap conflict/);
 }));
 
 test('replaying an older signed head fails closed when a later event remains',()=>fixture(async f=>{
@@ -83,11 +86,11 @@ test('transaction restore requires a fresh nonce and becomes the trusted head',(
     grantInstanceNonce:f.grant.instance_nonce,updateId,expectedHeadSha256:granted.event_sha256});
   await assert.rejects(()=>f.store.append({plane:'process',action:'transaction_restore',grantBytes:f.grantBytes,
     grantInstanceNonce:f.grant.instance_nonce,updateId,expectedHeadSha256:revoked.event_sha256,
-    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)}),/fresh nonce|resurrect/i);
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce,f.policyBytes)}),/fresh nonce|resurrect/i);
   const newNonce='f'.repeat(64),newGrant=Buffer.from(JSON.stringify({...f.grant,instance_nonce:newNonce}));
   const restored=await f.store.append({plane:'process',action:'transaction_restore',grantBytes:newGrant,
     grantInstanceNonce:newNonce,updateId,expectedHeadSha256:revoked.event_sha256,
-    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)});
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce,f.policyBytes)});
   const verified=await f.store.verifyGrant({plane:'process',grantBytes:newGrant,grantInstanceNonce:newNonce,policyBytes:f.policyBytes});
   assert.equal(verified.trusted,true);
   assert.equal(verified.event_sha256,restored.event_sha256);

package/test/r65-authority-restored-safe.test.mjs

@@ -7,6 +7,7 @@ import path from 'node:path';
 import {orchestrateActivation} from '../src/activation-preflight-r65.mjs';
 import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
 import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
 
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'a'.repeat(64),generation_manifest_sha256:'b'.repeat(64)};
@@ -26,7 +27,7 @@ test('orchestrator reports RESTORED_SAFE when all restored authority is safe but
       return {authority_outcomes:{process:'RESTORED_SAFE',coding:'NOT_APPLICABLE',autonomous:'NOT_APPLICABLE',desktop:'NOT_APPLICABLE',host:'NOT_APPLICABLE'},restored_nonces:{process:'8'.repeat(64)},reauth_planes:[]};}
   };
   const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,
-    observe:async()=>current,command:async()=>{throw new Error('generic command forbidden');},
+    observe:async()=>withAuthorityProof(current),command:async()=>{throw new Error('generic command forbidden');},
     activate:async()=>({verified:true,release_id:'v0.15.42-candidate'}),continuityEngine});
   assert.equal(result.state,'ACTIVATED');
   assert.equal(result.authority_continuity,'RESTORED_SAFE');

package/test/r65-deploy-preflight.test.mjs

@@ -11,8 +11,9 @@ const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 test('deploy dry preflight observes isolated authority without opening an update transaction', {skip:process.platform!=='win32'},async()=>{
   const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-deploy-preflight-'));
   try{
-    const state=path.join(isolated,'state'),bin=path.join(state,'bin');
+    const state=path.join(isolated,'state'),bin=path.join(state,'bin'),runtime=path.join(state,'runtime');
     await mkdir(bin,{recursive:true});
+    await mkdir(runtime,{recursive:true});
     const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
     const parent=release.parent;
     const generationRoot=path.join(state,'generations',`${parent.release_id}-fixture`);
@@ -20,9 +21,11 @@ test('deploy dry preflight observes isolated authority without opening an update
     await mkdir(generationRoot,{recursive:true});await mkdir(policyRoot,{recursive:true});
     const fields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
     const policyLines=[];
+    const grantField={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
     for(const [plane,key] of Object.entries(fields)){
       const file=path.join(policyRoot,`${plane}.json`);
-      await writeFile(file,JSON.stringify({schema:`fixture.${plane}`,enabled:true}));
+      await writeFile(file,JSON.stringify({schema:`deadbyte.${plane}-policy.v${plane==='host'?2:1}`,enabled:true,
+        [grantField[plane]]:path.join(runtime,`${plane}-grant.json`)}));
       policyLines.push(`${key} = '${file.replaceAll("'","''")}'`);
     }
     await writeFile(path.join(generationRoot,'controller-config.psd1'),`@{ ${policyLines.join('; ')} }\n`);
@@ -30,26 +33,22 @@ test('deploy dry preflight observes isolated authority without opening an update
       release_root:path.join(state,'releases',parent.release_id),generation_root:generationRoot,
       launcher_sha256:'a'.repeat(64),config_path:path.join(generationRoot,'controller-config.psd1')}));
     const ps1=`param([string]$Command,[switch]$Json)\nif($Command -ne 'status' -or -not $Json){throw 'unexpected mutating command'}\n@{schema='deadbyte.controller-observation.v1';state='ONLINE';local_ready=$true;bridge=@{alive=$true;reason='verified';pid=10};core=@{alive=$true;reason='verified';pid=11};cloud=@{alive=$true;reason='verified';pid=12};supervisor=@{running=$true};authority=@{process=@{armed=$true;configured=$true;reason='fixture'};coding=@{armed=$true;configured=$true;reason='fixture'};autonomous=@{armed=$true;configured=$true;reason='fixture'};desktop=@{armed=$false;configured=$true;reason='fixture'};host=@{armed=$false;configured=$true;reason='fixture'}}} | ConvertTo-Json -Depth 6 -Compress\n`;
-    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),ps1);
+    const cleanPs1=ps1.replaceAll('armed=$true','armed=$false').replaceAll("reason='fixture'","reason='disarmed'");
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),cleanPs1);
     const run=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),'--preflight'],{
       env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:20000,windowsHide:true});
     assert.equal(run.status,0,run.stderr);
     const result=JSON.parse(run.stdout.trim());
     assert.equal(result.state,'ONLINE_READY');
-    assert.equal(result.authority_continuity,'REAUTH_REQUIRED');
-    assert.deepEqual(result.reauth_planes,['process','coding','autonomous']);
-    const hostOnly=ps1.replace('process=@{armed=$true','process=@{armed=$false')
-      .replace('coding=@{armed=$true','coding=@{armed=$false')
-      .replace('autonomous=@{armed=$true','autonomous=@{armed=$false')
-      .replace('host=@{armed=$false','host=@{armed=$true');
-    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),hostOnly);
+    assert.equal(result.authority_continuity,'NOT_APPLICABLE');
+    assert.deepEqual(result.reauth_planes,[]);
+    const unverified=cleanPs1.replace("host=@{armed=$false;configured=$true;reason='disarmed'", "host=@{armed=$false;configured=$true;reason='unverified'");
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),unverified);
     const hostRun=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),'--preflight'],{
       env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:20000,windowsHide:true});
     assert.equal(hostRun.status,0,hostRun.stderr);
     const hostResult=JSON.parse(hostRun.stdout.trim());
-    assert.equal(hostResult.state,'ONLINE_HOST_ARMED');
-    assert.equal(hostResult.authority_continuity,'REAUTH_REQUIRED');
-    assert.deepEqual(hostResult.reauth_planes,['host']);
-    assert.deepEqual((await readdir(state)).sort(),['active-release.json','bin','generations','policies']);
+    assert.equal(hostResult.state,'AUTHORITY_UNVERIFIED');
+    assert.deepEqual((await readdir(state)).sort(),['active-release.json','bin','generations','policies','runtime']);
   }finally{await rm(isolated,{recursive:true,force:true});}
 });

package/test/r65-epoch-native-activation-integration.test.mjs

@@ -7,6 +7,7 @@ import path from 'node:path';
 import {orchestrateActivation} from '../src/activation-preflight-r65.mjs';
 import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
 import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
 
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'a'.repeat(64),generation_manifest_sha256:'b'.repeat(64)};
@@ -44,7 +45,7 @@ test('epoch-native orchestrator handles BOM-encoded process grant with transacti
         const grant=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
         armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
       }
-      return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
+      return withAuthorityProof({state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
         process:{configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:armed?head.seq:null,epoch_sha256:armed?head.event_sha256:null},
         coding:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
         autonomous:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
@@ -53,7 +54,7 @@ test('epoch-native orchestrator handles BOM-encoded process grant with transacti
       },policy_sha256:{process:sha(policyBytes),...dummy},
       active_release_id:switched?'v0.15.42-candidate':parent.release_id,
       active_manifest_sha256:switched?candidate.manifest_sha256:parent.manifest_sha256,
-      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256};
+      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256});
     };
     const engine=createEpochNativeContinuityEngine({stateRoot:state,
       predecessorPolicyPaths:{process:beforePath,coding:null,autonomous:null,desktop:null,host:null},
@@ -107,7 +108,7 @@ test('epoch-native explicit user revoke after transaction revoke wins over orche
         const grant=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
         armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
       }
-      return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
+      return withAuthorityProof({state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
         process:{configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:armed?head.seq:null,epoch_sha256:armed?head.event_sha256:null},
         coding:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
         autonomous:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
@@ -116,7 +117,7 @@ test('epoch-native explicit user revoke after transaction revoke wins over orche
       },policy_sha256:{process:sha(policyBytes),...dummy},
       active_release_id:switched?'v0.15.42-candidate':parent.release_id,
       active_manifest_sha256:switched?candidate.manifest_sha256:parent.manifest_sha256,
-      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256};
+      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256});
     };
     const engine=createEpochNativeContinuityEngine({stateRoot:state,
       predecessorPolicyPaths:{process:beforePath,coding:null,autonomous:null,desktop:null,host:null},

package/test/r65-legacy-authority-migration.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {classifyAuthorityContinuity,orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
 
 const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'1'.repeat(64),generation_manifest_sha256:'2'.repeat(64)};
 const candidate={version:'0.15.42',manifest_sha256:'3'.repeat(64)};
@@ -15,7 +16,7 @@ function fixture(vector){
     authority:Object.fromEntries(Object.entries(vector).map(([plane,armed])=>[plane,legacyEntry(armed)]))};
   return {
     calls,
-    observe:async()=>observation,
+    observe:async()=>withAuthorityProof(observation),
     command:async command=>{
       calls.push(command);
       if(command.startsWith('disarm')){