deadbyte-mcp 0.15.47 → 0.15.49

package/bench/r121-epoch-readhead.mjs

@@ -0,0 +1,54 @@
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {mkdtemp, mkdir, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const oldSource = process.env.DEADBYTE_R121_BASELINE_EPOCH_MODULE;
+const writerSource = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE;
+if(!oldSource||!writerSource)throw new Error('R121 benchmark requires exact baseline and protected writer modules');
+const currentSource = new URL('../src/authority-continuity-r65.mjs', import.meta.url).href;
+const [baseline,current,writer] = await Promise.all([
+  import(pathToFileURL(oldSource).href), import(currentSource), import(pathToFileURL(writerSource).href)
+]);
+const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r121-readhead-bench-'));
+const quantile=(values,p)=>{
+  const sorted=[...values].sort((a,b)=>a-b);
+  return Number(sorted[Math.min(sorted.length-1,Math.floor(p*(sorted.length-1)))].toFixed(4));
+};
+try{
+  const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+  await mkdir(runtimeDir);await mkdir(trust);
+  const keys=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+  await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+  const nonce=randomBytes(32).toString('hex');
+  const grant=Buffer.from(JSON.stringify({instance_nonce:nonce,fixture:'R121 benchmark'}));
+  await writer.createAuthorityEpochStore({runtimeDir}).append({plane:'process',action:'grant',
+    grantBytes:grant,grantInstanceNonce:nonce});
+  const stores={baseline:baseline.createAuthorityEpochStore({runtimeDir}),
+    candidate:current.createAuthorityEpochStore({runtimeDir})};
+  for(let i=0;i<100;i++){
+    await stores.baseline.readHead({plane:'process'});
+    await stores.candidate.readHead({plane:'process'});
+  }
+  const durations={baseline:[],candidate:[]};
+  const rssBefore=process.memoryUsage().rss;
+  for(let i=0;i<600;i++){
+    const order=i%2?['candidate','baseline']:['baseline','candidate'];
+    for(const name of order){
+      const start=process.hrtime.bigint();
+      const head=await stores[name].readHead({plane:'process'});
+      if(head.action!=='grant')throw new Error('R121 benchmark head changed');
+      durations[name].push(Number(process.hrtime.bigint()-start)/1e6);
+    }
+  }
+  const result={schema:'deadbyte.r121-epoch-readhead-benchmark.v1',samples_per_variant:600,
+    workload:'read-only signed head and predecessor verification, one grant event',
+    baseline:{p50_ms:quantile(durations.baseline,.5),p95_ms:quantile(durations.baseline,.95),
+      max_ms:quantile(durations.baseline,1)},
+    candidate:{p50_ms:quantile(durations.candidate,.5),p95_ms:quantile(durations.candidate,.95),
+      max_ms:quantile(durations.candidate,1)},
+    rss_delta_bytes:process.memoryUsage().rss-rssBefore};
+  process.stdout.write(JSON.stringify(result)+'\n');
+}finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:100});}

package/bench/r124-epoch-predecessor.mjs

@@ -0,0 +1,53 @@
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {mkdtemp, mkdir, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const oldSource = process.env.DEADBYTE_R124_BASELINE_EPOCH_MODULE;
+const writerSource = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE;
+if (!oldSource || !writerSource) throw new Error('R124 benchmark requires exact R123 baseline and protected writer modules');
+const [baseline, current, writer] = await Promise.all([
+  import(pathToFileURL(oldSource).href),
+  import(new URL('../src/authority-continuity-r65.mjs', import.meta.url).href),
+  import(pathToFileURL(writerSource).href),
+]);
+const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r124-bench-'));
+const percentile = (values, p) => {
+  const sorted = [...values].sort((a, b) => a - b);
+  return Number(sorted[Math.min(sorted.length - 1, Math.floor(p * (sorted.length - 1)))].toFixed(4));
+};
+try {
+  const runtimeDir = path.join(root, 'runtime');
+  const trust = path.join(root, 'trust');
+  await mkdir(runtimeDir); await mkdir(trust);
+  const keys = generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust, 'ed25519-private.pem'), keys.privateKey.export({type:'pkcs8', format:'pem'}), {flag:'wx'});
+  await writeFile(path.join(trust, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}), {flag:'wx'});
+  const store = writer.createAuthorityEpochStore({runtimeDir});
+  for (let i = 0; i < 2; i++) {
+    const nonce = randomBytes(32).toString('hex');
+    await store.append({plane:'process', action:'grant', grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce, fixture:`r124-${i}`})), grantInstanceNonce:nonce});
+  }
+  const stores = {baseline:baseline.createAuthorityEpochStore({runtimeDir}), candidate:current.createAuthorityEpochStore({runtimeDir})};
+  for (let i = 0; i < 100; i++) {
+    await stores.baseline.readHead({plane:'process'});
+    await stores.candidate.readHead({plane:'process'});
+  }
+  const samples = {baseline:[], candidate:[]};
+  for (let i = 0; i < 600; i++) {
+    const order = i % 2 ? ['candidate', 'baseline'] : ['baseline', 'candidate'];
+    for (const name of order) {
+      const start = process.hrtime.bigint();
+      const head = await stores[name].readHead({plane:'process'});
+      if (head.seq !== 2) throw new Error('R124 benchmark head changed');
+      samples[name].push(Number(process.hrtime.bigint() - start) / 1e6);
+    }
+  }
+  console.log(JSON.stringify({schema:'deadbyte.r124-epoch-predecessor-benchmark.v1', samples_per_variant:600,
+    workload:'read-only signed two-event head with predecessor verification',
+    baseline:{p50_ms:percentile(samples.baseline,.5), p95_ms:percentile(samples.baseline,.95), max_ms:percentile(samples.baseline,1)},
+    candidate:{p50_ms:percentile(samples.candidate,.5), p95_ms:percentile(samples.candidate,.95), max_ms:percentile(samples.candidate,1)}}));
+} finally {
+  await rm(root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+}

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.47-r74\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.47-r74\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.47-r74\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.47-r74",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/HARNESS2-ADAPTATION-20261020.md

@@ -0,0 +1,24 @@
+# Harness2 mechanism review — isolated development only
+
+Source: `D:/Projects/deadbyte-mcp/references/harness2-main` (Apache-2.0). This work uses behavior patterns only; no donor source bytes, Python dependencies, benchmark runner, or third-party assets were copied. Source parent: `D:/Projects/deadbyte-mcp/development/deadbyte-mcp-0.15.48-r108-remote-shell-dev`. The separate, unfinished 0.15.49 release candidate and production remain untouched.
+
+| Donor mechanism and source | DEADBYTE comparison | Decision |
+| --- | --- | --- |
+| Context tripwires in `harness2/core/context.py` reject answer-key paths and grader verdicts before a model sees them. | `src/agent-eval-r42.mjs` already constructs separate generator/judge inputs, but a nested secret or verdict object in `allowed_context` passed directly to the generator. | ADAPT: reject judge-only secret/token values and known judge-result structures before generator invocation. No public API or authority change. |
+| Completion mark bound to harness fingerprint in `harness2/core/runmark.py`; `tests/test_workflow.py` tests resume invalidation after harness drift. | `src/r67-regression-shards.mjs` and `test/r67-regression-shards.test.mjs` already bind regression evidence to source/test fingerprint; R42 evaluation evidence binds suite and subject manifest hashes. | KEEP-OURS: no second completion-marker format. |
+| Bounded rollout/session accounting and duplicate-label rejection in `harness2/core/ledger.py`. | `src/agent-runtime.mjs` already bounds retries; R67 shard planner/reconciler detects duplicate coverage and nonterminal outcomes. | KEEP-OURS: do not graft recursive rollout budget into runtime. |
+| Anonymized candidate selection and evidence-first comparison in `harness2/core/selection.py`; judge isolation in `harness2/core/judge.py`. | `src/agent-eval-r42.mjs` uses generator/judge separation and advisory judge triage; DEADBYTE's task flow does not require a recursive candidate tournament. | DEFER: evaluate only if a future bounded multi-candidate workflow is approved. |
+
+RED: `node --test test/harness2-eval-context-isolation.test.mjs` returned 1 pass, 1 fail. The missing rejection allowed a generator-visible context to carry a judge-only token; the generator ran and evaluation returned normally.
+
+GREEN after the first fix: focused R42/eval tests returned 9 pass, 0 fail, 0 skip. A later adversarial test proved a second RED: explicit judge-only secrets shorter than 16 characters still reached the generator (3 pass, 1 fail). The minimum-length exemption was removed; identical focused suite now returns 10 pass, 0 fail, 0 skip. Nested and short secrets, task/acceptance leakage and redacted errors are covered. Ordinary shared acceptance terms remain allowed.
+
+Adversarial RED 3: a nested `hidden_oracle`/judge-verdict object in `allowed_context` still reached generator dispatch (4 pass, 1 fail). The context-key tripwire rejects only known judge-only structures, not ordinary `expected`/task text. Identical focused suite is GREEN 11 pass, 0 fail, 0 skip.
+
+Full-regression attempt: `npm test` returned exit 1 in the ordinary D: development checkout. The observed failing native authority tests reported `EPOCH_NATIVE_SLOT_UNTRUSTED` / `UNTRUSTED_WRITE_ACE` from `src/privileged-install-trust-r89.mjs`; this checkout lacks the protected Windows installation ACL required by those tests. A UAC-approved protected isolated fixture subsequently verified its 2,342-file manifest and ran 1,627 pass / 0 fail / 48 skip / 1,675 total, TAP SHA-256 `41141fee766c5ae94893c869f5d7aa9767c1984827e13c06da30aae496ca0c0a`. That run predates the short-secret repair and is **not** final-byte full-regression proof. Its verify-only package gate passed (2,343 members, isolated doctor/version; transient tarball SHA-256 `2367c95380793ac48629ecfe8296b3d7436cb8672fa11f7b84c877b384fc8fbd`), also on pre-repair bytes.
+
+Changed source SHA-256: `src/agent-eval-r42.mjs` = `4e8e442497a15bce43b7d02ade497403d80b86e307473d26c172a0fba3a6d4ea`.
+New test SHA-256: `test/harness2-eval-context-isolation.test.mjs` = `32806f49cf8988bf0c6ff2059759cc7ed1b299ead68124140a68d9d91e52d3eb`.
+Candidate-only process policy root SHA-256: `ae29ee73d118538659aef60385065786ac238f4548d8aeb3ae13b9558761c51f`.
+
+This is not release evidence. The 0.15.49 publish path is paused at the user's request; no npm submission, production activation, production grant change, or sealed-slot edit is part of this adaptation.

package/docs/R128-RELEASE-CANDIDATE.md

@@ -0,0 +1,26 @@
+# DEADBYTE MCP 0.15.49 / R128 (isolated candidate)
+
+Status: **INCOMPLETE / NOT RELEASE READY** until independent protected-native Windows full gate, exact package acceptance, and npm authorization.
+
+Source lineage:
+- R125 (protected Windows development checkpoint, 1684 PASS / 0 FAIL / 49 historical SKIP, 54 PASS / 0 FAIL / 2 SKIP focused).
+- R126 RED reproduced for incorrectly bound predecessor/successor policy envelopes.
+- R127: read-path checks signed transaction_restore predecessor and successor envelope SHA-256 against present signed event policy envelopes; append rejects mismatched observed predecessor and successor policy envelopes before committing. Early successor mismatch preflight rejects before native lock or event creation.
+- Live Logs: merge of independently hash-checked R124 live-log implementation; missing audit outcomes do not imply success, stream reset warnings, bounded handle-pinned tail reads, partial UTF-8/UTF-16LE, and corrupted audit JSON rejection.
+- R128: version metadata update only in isolated staging for package 0.15.49. Production active pointer stays v0.15.45-34aa8d1241cfb8bf.
+
+Observed tests inherited from development only:
+- Live-log regressions 55 PASS / 0 FAIL / 0 SKIP.
+- R126 signed restore reader 3 PASS / 0 FAIL.
+- R127 wrong successor envelope prelock test PASS.
+- R120/R121/R122/R125/R126 focused subset 12 PASS / 0 FAIL. These are not a complete protected-native Windows suite for exact R128 bytes.
+
+Unresolved and blocking:
+- R128 must pass its own full protected-native Windows gate, preferably with hash-pinned installed test fixture and independent read-only review.
+- Historical fixtures without policy envelope SHA fields remain supported; they do not prove strict envelope matching.
+- R127 append predecessor check runs after native lock; no successful exact-R128 protected-native append/restore regression yet.
+- Full log rollover cross-gap detection, Windows directory durability, physical power loss and authority hot path performance acceptance remain open.
+- The npm CLI currently returned E401 Unauthorized from npm whoami; owner authentication is necessary before publishing.
+- No production deploy, activation, grant change, npm publish, or dist-tag mutation has been executed by this candidate setup.
+
+The previous protected R125 fixture and R125/R126/R127 parent trees must be kept unchanged. Package --verify-only success alone is not release proof.

package/docs/R75-RECOVERY-HANDOFF.md

@@ -0,0 +1,16 @@
+# R75 isolated authority recovery hardening
+
+- Source predecessor: `D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.48-r75`, non-Git, verified 2,304-file manifest SHA-256 `e70561e261610d451d33731a5f19b8439548d7062bed4bf109c4e90f1cd8cf38` before copy.
+- Published source identity remains `0.15.47`; active runtime predecessor observed read-only as `v0.15.45-34aa8d1241cfb8bf`, OFFLINE, with no plane armed. The Autonomous status reason was a broad Coding root, not verified clean-disarmed evidence.
+- This successor keeps `0.15.47/R74` package metadata during behavior verification. It is neither sealed nor release-ready. Production slots, grants, pointer, and historical evidence were not mutated.
+- RED: an `armed=false` Autonomous observation with an unverified reason was activation-safe; an object or Boolean observation without direct grant proof was activation-safe; a startup primary failure was hidden by cleanup failure; malformed ownership marker exited successfully. Each now has a matching focused GREEN test.
+- Authority proof reads each policy by digest, resolves its policy-bound grant location within the isolated runtime, checks grant presence, and requires stable regular-file identity across reads. Host policy v1/v2 remain accepted. The broad-root issuance validator is not used for revocation observation.
+- The existing R75 Autonomous revocation split and startup AggregateError were retained. The new CLI change addresses failure masking in the post-synchronization lifecycle and makes unverified marker cleanup terminal rather than success.
+- R72 isolated controller fixtures verify broad-root absent-grant revocation, signed epoch revocation attempt for a present grant, external-path denial and failed epoch handling. These tests do not operate the production predecessor.
+- Recovery boundary added after independent review: absent owner PID and PID reuse are not ownership evidence. A marker with no verified guardian/owner now remains in place and startup fails closed without touching authority. Identical behavioral RED 0/2 (stale marker proceeded, PID reuse passed), then GREEN 2/2; full remote-session CLI suite 30/30. The verified guardian cleanup path remains intact. This leaves manual reconciliation necessary for an orphan marker without a verified guardian; it does not authorize marker deletion.
+- Remaining proof before `R75_RECOVERY_VERIFIED`: rerun final-byte full regression, Windows gate, manifest, native/bin identity, package inspection, isolated install/doctor, and final independent review.
+- First full verifier run on an intermediate manifest produced 1,574 tests: 1,525 pass, 5 fail, 44 historical skips. The failures were isolated preflight fixture lacking the newly required runtime/policy proof; copied Process policy still pointed to R74; a CLI source-grep harness assumed LF only; and two frozen R72 identity tests asserted version 0.15.46 against current development 0.15.47. The first three fixtures/paths were corrected, and R72-only tests now carry explicit historical-version skip reasons. This first run is not final-byte PASS evidence.
+- A later full verifier on intermediate bytes produced 1,575 tests: 1,527 pass, 2 fail, 46 historical skips. Both failures were R58 tests expecting automatic stale-marker removal from an absent/reused PID. Their isolated fixtures now assert the safer R75 contract instead: no authority command, no marker removal, no foreground READY. Focused rerun 4/4 passed. This intermediate full run is not final-byte PASS evidence.
+- Final production-source gates: durable full verifier `1,575 tests / 1,529 pass / 0 fail / 46 historical/version-scoped skip`, stdout SHA-256 `740f30b8078ecc88142645b4197fcce65abfdc952f086457734769b77dd12a35`; Windows gate focused `56 / 54 pass / 0 fail / 2 historical skip`, repeated full `1,575 / 1,529 pass / 0 fail / 46 skip`, stdout SHA-256 `3b1878039f6b3f123dc2fd4d0bf58b97c51a54309dfa380c50508a35e026e9ba`. Isolated doctor PASS.
+- Exact development package before this handoff update: 2,310 tar members, 12,088,356 bytes, tarball SHA-256 `ee550022b468b998e9d34d2a01e61fb85af9fe89c7812fcffa70d08fca1dda28`, isolated npm install/doctor PASS and canonical npm release `--verify-only` PASS. Publication and activation were not run. Regenerate the development manifest/package after this documentation update before using an exact package claim.
+- Independent review: the owner-PID stale-marker deletion path is closed. Armed epoch validity is verified by the controller and composed with independent pinned grant-file observation, not reverified from signed epoch bytes by this module. `releaseRemoteSession` still has a read-identity then pathname-remove TOCTOU boundary; no production-only runtime or crash proof was performed. These limitations must not be described as proven away.

package/docs/R85-EPOCH-LOCK-BINARY.json

@@ -0,0 +1,13 @@
+{
+  "schema": "deadbyte.r85-epoch-lock-binary.v1",
+  "status": "development-candidate",
+  "platform": "win32-x64",
+  "node_api_version": 8,
+  "source": "native/deadbyte-epoch-lock-r85.cpp",
+  "source_sha256": "c451c257467b6a141918400b61855bac0e466015c1f3901e8be56ce6d9c32c7f",
+  "addon": "bin/deadbyte-epoch-lock-r85.node",
+  "addon_sha256": "fb73007ca2303d66120940f192461aac2fa4c45dc4603d920f0878d77e65cfed",
+  "build_node_header_version": "25.9.0",
+  "build_node_api_header_sha256": "2d4560831e525b47b060ec8a0864ab73993df9e20215ce9f0fe7b24cd31af32a",
+  "build_node_import_lib_sha256": "e3577a5a4a772b21646fe05a24d53ce3727395bbbc412f326889ddf7129bc7a9"
+}

package/native/deadbyte-epoch-lock-r85.cpp

@@ -0,0 +1,241 @@
+#define WIN32_LEAN_AND_MEAN
+#define NOMINMAX
+#define NAPI_VERSION 8
+#include <windows.h>
+#include <node_api.h>
+#include <algorithm>
+#include <cstddef>
+#include <cstring>
+#include <memory>
+#include <string>
+#include <vector>
+
+namespace {
+struct Lease {
+  HANDLE leaf = INVALID_HANDLE_VALUE;
+  std::vector<HANDLE> ancestors;
+  bool renamed = false;
+  ~Lease() {
+    if (leaf != INVALID_HANDLE_VALUE) CloseHandle(leaf);
+    for (auto it = ancestors.rbegin(); it != ancestors.rend(); ++it) CloseHandle(*it);
+  }
+};
+
+void Throw(napi_env env, const char* message) { napi_throw_error(env, nullptr, message); }
+void ThrowWin32(napi_env env, const char* message, DWORD code) {
+  std::string detail = std::string(message) + " (win32=" + std::to_string(code) + ")";
+  Throw(env, detail.c_str());
+}
+bool Text(napi_env env, napi_value value, std::string& out) {
+  size_t size = 0;
+  if (napi_get_value_string_utf8(env, value, nullptr, 0, &size) != napi_ok || size > 32760) return false;
+  out.resize(size);
+  size_t actual = 0;
+  return napi_get_value_string_utf8(env, value, out.data(), size + 1, &actual) == napi_ok && actual == size &&
+    out.find('\0') == std::string::npos;
+}
+bool Wide(const std::string& input, std::wstring& output) {
+  if (input.empty()) return false;
+  int needed = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, input.data(), static_cast<int>(input.size()), nullptr, 0);
+  if (needed < 1) return false;
+  output.resize(needed);
+  return MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, input.data(), static_cast<int>(input.size()),
+    output.data(), needed) == needed;
+}
+bool LocalFullPath(const std::wstring& input, std::wstring& output) {
+  DWORD needed = GetFullPathNameW(input.c_str(), 0, nullptr, nullptr);
+  if (needed < 4 || needed > 32760) return false;
+  std::vector<wchar_t> chars(needed);
+  if (GetFullPathNameW(input.c_str(), needed, chars.data(), nullptr) != needed - 1) return false;
+  output.assign(chars.data());
+  if (output.size() < 4 || !((output[0] >= L'A' && output[0] <= L'Z') ||
+      (output[0] >= L'a' && output[0] <= L'z')) || output[1] != L':' || output[2] != L'\\' ||
+      output.find(L':', 2) != std::wstring::npos || output.back() == L'\\') return false;
+  return true;
+}
+bool PinDirectory(const std::wstring& directory, Lease& lease) {
+  HANDLE h = CreateFileW(directory.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ, nullptr, OPEN_EXISTING,
+    FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+  if (h == INVALID_HANDLE_VALUE) return false;
+  FILE_ATTRIBUTE_TAG_INFO info{};
+  if (!GetFileInformationByHandleEx(h, FileAttributeTagInfo, &info, sizeof(info)) ||
+      !(info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) || (info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+    CloseHandle(h); SetLastError(ERROR_REPARSE_TAG_INVALID); return false;
+  }
+  lease.ancestors.push_back(h);
+  return true;
+}
+bool PinAncestors(const std::wstring& full, Lease& lease) {
+  const size_t end = full.find_last_of(L'\\');
+  if (end == std::wstring::npos || end < 2) return false;
+  std::wstring current = full.substr(0, 3);
+  if (!PinDirectory(current, lease)) return false;
+  size_t at = 3;
+  while (at < end) {
+    size_t next = full.find(L'\\', at);
+    if (next == std::wstring::npos || next > end) next = end;
+    if (next == at) return false;
+    current += full.substr(at, next - at);
+    if (!PinDirectory(current, lease)) return false;
+    current += L'\\';
+    at = next + 1;
+  }
+  return true;
+}
+DWORD ClosePinnedAncestors(Lease& lease) {
+  DWORD firstError = ERROR_SUCCESS;
+  for (auto it = lease.ancestors.rbegin(); it != lease.ancestors.rend(); ++it) {
+    if (!CloseHandle(*it) && firstError == ERROR_SUCCESS) firstError = GetLastError();
+  }
+  lease.ancestors.clear();
+  return firstError;
+}
+DWORD DisposeHeldLeaf(Lease& lease) {
+  if (lease.leaf == INVALID_HANDLE_VALUE) return ERROR_INVALID_HANDLE;
+  FILE_DISPOSITION_INFO disposition{};
+  disposition.DeleteFile = TRUE;
+  if (!SetFileInformationByHandle(lease.leaf, FileDispositionInfo, &disposition, sizeof(disposition)))
+    return GetLastError();
+  return ERROR_SUCCESS;
+}
+void ThrowWin32WithCleanup(napi_env env, const char* message, DWORD primary, DWORD cleanup) {
+  std::string detail = std::string(message) + " (win32=" + std::to_string(primary);
+  if (cleanup != ERROR_SUCCESS) detail += ", cleanup_win32=" + std::to_string(cleanup);
+  detail += ")";
+  Throw(env, detail.c_str());
+}
+void Finalize(napi_env, void* data, void*) { delete static_cast<Lease*>(data); }
+
+napi_value Acquire(napi_env env, napi_callback_info info) {
+  size_t argc = 3;
+  napi_value argv[3];
+  if (napi_get_cb_info(env, info, &argc, argv, nullptr, nullptr) != napi_ok || argc != 3) {
+    Throw(env, "epoch native acquire arguments invalid"); return nullptr;
+  }
+  std::string pathUtf8, nonce;
+  void* content = nullptr;
+  size_t contentLength = 0;
+  bool buffer = false;
+  if (!Text(env, argv[0], pathUtf8) || napi_is_buffer(env, argv[1], &buffer) != napi_ok || !buffer ||
+      napi_get_buffer_info(env, argv[1], &content, &contentLength) != napi_ok ||
+      contentLength < 2 || contentLength > 16384 || !Text(env, argv[2], nonce) || nonce.size() != 32 ||
+      !std::all_of(nonce.begin(), nonce.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f');
+      })) {
+    Throw(env, "epoch native acquire arguments invalid"); return nullptr;
+  }
+  std::wstring widePath, full;
+  if (!Wide(pathUtf8, widePath) || !LocalFullPath(widePath, full)) {
+    Throw(env, "epoch native lock requires ordinary local-drive path"); return nullptr;
+  }
+  auto lease = std::make_unique<Lease>();
+  if (!PinAncestors(full, *lease)) {
+    ThrowWin32(env, "epoch native ancestor pin failed closed", GetLastError()); return nullptr;
+  }
+  DWORD existing = GetFileAttributesW(full.c_str());
+  if (existing != INVALID_FILE_ATTRIBUTES) {
+    napi_value result;
+    napi_get_null(env, &result);
+    return result;
+  }
+  DWORD existenceError = GetLastError();
+  if (existenceError != ERROR_FILE_NOT_FOUND && existenceError != ERROR_PATH_NOT_FOUND) {
+    ThrowWin32(env, "epoch native target existence uncertain", existenceError); return nullptr;
+  }
+  std::wstring nonceWide(nonce.begin(), nonce.end());
+  std::wstring temporary = full + L".r85-" + nonceWide + L".tmp";
+  lease->leaf = CreateFileW(temporary.c_str(), GENERIC_READ | GENERIC_WRITE | DELETE | FILE_READ_ATTRIBUTES,
+    0, nullptr, CREATE_NEW, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+  if (lease->leaf == INVALID_HANDLE_VALUE) {
+    ThrowWin32(env, "epoch native temp create failed closed", GetLastError()); return nullptr;
+  }
+  FILE_ATTRIBUTE_TAG_INFO tag{};
+  if (!GetFileInformationByHandleEx(lease->leaf, FileAttributeTagInfo, &tag, sizeof(tag)) ||
+      (tag.FileAttributes & (FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_REPARSE_POINT))) {
+    DWORD error = GetLastError(); DWORD cleanup = DisposeHeldLeaf(*lease);
+    ThrowWin32WithCleanup(env, "epoch native leaf identity failed closed", error, cleanup); return nullptr;
+  }
+  const auto* bytes = static_cast<const unsigned char*>(content);
+  size_t written = 0;
+  while (written < contentLength) {
+    DWORD part = 0;
+    if (!WriteFile(lease->leaf, bytes + written, static_cast<DWORD>(contentLength - written), &part, nullptr) || !part) {
+      DWORD error = GetLastError(); DWORD cleanup = DisposeHeldLeaf(*lease);
+      ThrowWin32WithCleanup(env, "epoch native lock write failed closed", error, cleanup); return nullptr;
+    }
+    written += part;
+  }
+  if (!FlushFileBuffers(lease->leaf)) {
+    DWORD error = GetLastError(); DWORD cleanup = DisposeHeldLeaf(*lease);
+    ThrowWin32WithCleanup(env, "epoch native lock flush failed closed", error, cleanup); return nullptr;
+  }
+  const size_t renameSize = offsetof(FILE_RENAME_INFO, FileName) + (full.size() + 1) * sizeof(wchar_t);
+  std::vector<unsigned char> renameBuffer(renameSize, 0);
+  auto* renameInfo = reinterpret_cast<FILE_RENAME_INFO*>(renameBuffer.data());
+  renameInfo->ReplaceIfExists = FALSE;
+  renameInfo->RootDirectory = nullptr;
+  renameInfo->FileNameLength = static_cast<DWORD>(full.size() * sizeof(wchar_t));
+  std::memcpy(renameInfo->FileName, full.data(), renameInfo->FileNameLength);
+  if (!SetFileInformationByHandle(lease->leaf, FileRenameInfo, renameInfo, static_cast<DWORD>(renameSize))) {
+    DWORD error = GetLastError(); DWORD cleanup = DisposeHeldLeaf(*lease);
+    if (cleanup == ERROR_SUCCESS && (error == ERROR_FILE_EXISTS || error == ERROR_ALREADY_EXISTS)) {
+      napi_value result;
+      napi_get_null(env, &result);
+      return result;
+    }
+    ThrowWin32WithCleanup(env, "epoch native lock rename failed closed", error, cleanup); return nullptr;
+  }
+  lease->renamed = true;
+  napi_value result;
+  if (napi_create_external(env, lease.get(), Finalize, nullptr, &result) != napi_ok) {
+    DWORD cleanup = DisposeHeldLeaf(*lease);
+    ThrowWin32WithCleanup(env, "epoch native handle publication failed closed", ERROR_NOT_ENOUGH_MEMORY, cleanup);
+    return nullptr;
+  }
+  lease.release();
+  return result;
+}
+
+napi_value Release(napi_env env, napi_callback_info info) {
+  size_t argc = 1;
+  napi_value argv[1];
+  void* raw = nullptr;
+  if (napi_get_cb_info(env, info, &argc, argv, nullptr, nullptr) != napi_ok || argc != 1 ||
+      napi_get_value_external(env, argv[0], &raw) != napi_ok || !raw) {
+    Throw(env, "epoch native release handle invalid"); return nullptr;
+  }
+  auto* lease = static_cast<Lease*>(raw);
+  if (lease->leaf == INVALID_HANDLE_VALUE || !lease->renamed) {
+    Throw(env, "epoch native lock already released"); return nullptr;
+  }
+  FILE_DISPOSITION_INFO disposition{};
+  disposition.DeleteFile = TRUE;
+  if (!SetFileInformationByHandle(lease->leaf, FileDispositionInfo, &disposition, sizeof(disposition))) {
+    ThrowWin32(env, "epoch native lock disposition failed closed", GetLastError()); return nullptr;
+  }
+  if (!CloseHandle(lease->leaf)) {
+    ThrowWin32(env, "epoch native lock close failed closed", GetLastError()); return nullptr;
+  }
+  lease->leaf = INVALID_HANDLE_VALUE;
+  lease->renamed = false;
+  DWORD ancestorCloseError = ClosePinnedAncestors(*lease);
+  if (ancestorCloseError != ERROR_SUCCESS) {
+    ThrowWin32(env, "epoch native ancestor close failed after lock release", ancestorCloseError);
+    return nullptr;
+  }
+  napi_value result;
+  napi_get_undefined(env, &result);
+  return result;
+}
+
+napi_value Init(napi_env env, napi_value exports) {
+  napi_value acquire, release;
+  if (napi_create_function(env, "acquire", NAPI_AUTO_LENGTH, Acquire, nullptr, &acquire) != napi_ok ||
+      napi_create_function(env, "release", NAPI_AUTO_LENGTH, Release, nullptr, &release) != napi_ok ||
+      napi_set_named_property(env, exports, "acquire", acquire) != napi_ok ||
+      napi_set_named_property(env, exports, "release", release) != napi_ok) return nullptr;
+  return exports;
+}
+}  // namespace
+
+NAPI_MODULE(NODE_GYP_MODULE_NAME, Init)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.47",
+  "version": "0.15.49",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/build-epoch-lock-r85.ps1

@@ -0,0 +1,34 @@
+param(
+  [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$SourceSha256,
+  [string]$NodeHeaderRoot = (Join-Path $env:LOCALAPPDATA 'node-gyp\Cache\25.9.0')
+)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=Split-Path -Parent $PSScriptRoot
+$source=Join-Path $root 'native\deadbyte-epoch-lock-r85.cpp'
+$observed=(Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash.ToLowerInvariant()
+if($observed -ne $SourceSha256){throw 'R85 native source SHA mismatch; refusing build'}
+$header=Join-Path $NodeHeaderRoot 'include\node\node_api.h'
+$lib=Join-Path $NodeHeaderRoot 'x64\node.lib'
+if(!(Test-Path -LiteralPath $header -PathType Leaf) -or !(Test-Path -LiteralPath $lib -PathType Leaf)){
+  throw 'R85 pinned Node-API headers/import library unavailable; no download fallback'
+}
+$vswhere='C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe'
+if(!(Test-Path -LiteralPath $vswhere)){throw 'vswhere missing'}
+$install=(& $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath | Select-Object -First 1)
+if(!$install){throw 'MSVC x64 C++ toolchain missing'}
+$dev=Join-Path $install 'Common7\Tools\VsDevCmd.bat'
+$bin=Join-Path $root 'bin'
+New-Item -ItemType Directory -Path $bin -Force | Out-Null
+$output=Join-Path $bin 'deadbyte-epoch-lock-r85.node'
+$object=Join-Path $bin 'deadbyte-epoch-lock-r85.obj'
+$include=Join-Path $NodeHeaderRoot 'include\node'
+$common='/nologo /std:c++17 /permissive- /W4 /WX /O2 /MT /EHsc /guard:cf /diagnostics:caret /utf-8 /Brepro /DUNICODE /D_UNICODE /D_WIN32_WINNT=0x0A00 /DNODE_GYP_MODULE_NAME=deadbyte_epoch_lock_r85'
+$compile='cl {0} /LD /I"{1}" "{2}" /Fo:"{3}" /Fe:"{4}" /link /Brepro /INCREMENTAL:NO "{5}"' -f $common,$include,$source,$object,$output,$lib
+$command='call "{0}" -no_logo -arch=x64 -host_arch=x64 && {1}' -f $dev,$compile
+$cmd=if($env:ComSpec){$env:ComSpec}else{Join-Path $env:SystemRoot 'System32\cmd.exe'}
+& $cmd /d /s /c $command
+if($LASTEXITCODE -ne 0){throw "R85 native build failed exit=$LASTEXITCODE"}
+if(!(Test-Path -LiteralPath $output -PathType Leaf)){throw 'R85 native addon missing'}
+$hash=(Get-FileHash -LiteralPath $output -Algorithm SHA256).Hash.ToLowerInvariant()
+Write-Output "R85_NATIVE_BUILD_PASS source_sha256=$observed addon_sha256=$hash path=$output"

package/scripts/deploy-r48.mjs

@@ -10,6 +10,7 @@ import {parseAuthorityObservation} from '../src/remote-authority.mjs';
 import {classifyActivationPreflight,classifyAuthorityContinuity,orchestrateActivation} from '../src/activation-preflight-r65.mjs';
 import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
 import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+import {observeAuthorityEvidence} from '../src/activation-authority-proof-r75.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
@@ -57,7 +58,8 @@ async function observeController(){
     if(!info.isFile()||info.isSymbolicLink())throw new Error(`activation ${plane} policy must be a regular file`);
     policySha256[plane]=await sha(file);
   }
-  return {...observed,policy_sha256:policySha256,policy_paths:policyPaths,active_release_id:active.release_id,active_manifest_sha256:active.manifest_sha256,
+  const authorityProof=await observeAuthorityEvidence({stateRoot:state,policyPaths,policySha256,authority:observed.authority});
+  return {...observed,authority_proof:authorityProof,policy_sha256:policySha256,policy_paths:policyPaths,active_release_id:active.release_id,active_manifest_sha256:active.manifest_sha256,
     active_generation_manifest_sha256:active.generation_manifest_sha256};
 }
 

package/scripts/npm-release-r48.mjs

@@ -109,6 +109,7 @@ async function main() {
 
   if (isAlreadyPublished) console.log(`Notice: deadbyte-mcp@${version} exists on registry (${existingText}); exact-byte reconciliation is required.`);
 
+  run(node, [path.join(root, 'scripts', 'r75-npm-bin-integrity-gate.mjs')]);
   console.log('[2/7] Pre-pack gates: verifying working tree manifest and doctor...');
   run(node, [path.join(root, 'scripts', 'release-manifest.mjs'), 'verify']);
   const doctorState=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-release-doctor-'));
@@ -135,7 +136,8 @@ async function main() {
   try {
     console.log('[4/7] Verifying packed artifact file surface against MANIFEST.SHA256 and packaging contract...');
     const manifestText = await readFile(path.join(root, 'MANIFEST.SHA256'), 'utf8');
-    const manifestSha256=createHash('sha256').update(manifestText).digest('hex');
+    const claimData = resuming ? JSON.parse(await readFile(path.join(publicationDir, 'claim.json'), 'utf8')) : null;
+    const manifestSha256 = resuming ? claimData.manifest_sha256 : createHash('sha256').update(manifestText).digest('hex');
     const manifestEntries = new Set();
     for (const line of manifestText.split(/\r?\n/)) {
       if (!line) continue;
@@ -223,12 +225,24 @@ async function main() {
       lookup:async()=>{
         try{
           const viewed=parseJson(runNpm(['view',`deadbyte-mcp@${version}`,'version','dist.integrity','dist.shasum','dist.tarball','--json'],{timeout:120000}));
-          return Array.isArray(viewed)?viewed[0]:viewed;
+          const item = Array.isArray(viewed)?viewed[0]:viewed;
+          if (item && !item.dist && item['dist.tarball']) {
+            item.dist = {
+              tarball: item['dist.tarball'],
+              shasum: item['dist.shasum'],
+              integrity: item['dist.integrity']
+            };
+          }
+          return item;
         }catch(error){if(/E404|404 Not Found/.test(String(error?.message)))return null;throw error;}
       },
-      tags:async()=>parseJson(runNpm(['view','deadbyte-mcp','dist-tags','--json'],{timeout:120000})),
+      tags:async()=>{
+        const parsed=parseJson(runNpm(['view','deadbyte-mcp','dist-tags','--json'],{timeout:120000}));
+        return Array.isArray(parsed)?parsed[0]:parsed;
+      },
       fetchTarball:async published=>{
-        const response=await fetch(published?.dist?.tarball,{signal:AbortSignal.timeout(120000)});
+        const url = published?.dist?.tarball ?? published?.['dist.tarball'];
+        const response=await fetch(url,{signal:AbortSignal.timeout(120000)});
         if(!response.ok)throw Object.assign(new Error(`registry tarball fetch failed status=${response.status}`),{status:response.status});
         return Buffer.from(await response.arrayBuffer());
       }});

package/scripts/r75-npm-bin-integrity-gate.mjs

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
+const bin = typeof pkg.bin === 'string' ? { [pkg.name]: pkg.bin } : pkg.bin;
+if (!bin || typeof bin !== 'object' || Array.isArray(bin) || !Object.keys(bin).length)
+  throw new Error('BIN_INTEGRITY: package.json.bin missing or invalid');
+const lines = readFileSync(path.join(root, 'MANIFEST.SHA256'), 'utf8').split(/\r?\n/).filter(Boolean);
+const entries = new Map();
+for (const line of lines) {
+  const m = /^([0-9a-f]{64})  (.+)$/.exec(line);
+  if (!m || entries.has(m[2])) throw new Error('BIN_INTEGRITY: invalid or duplicate manifest entry');
+  entries.set(m[2], m[1]);
+}
+for (const [name, relRaw] of Object.entries(bin)) {
+  if (typeof relRaw !== 'string' || !relRaw || relRaw.includes('\\'))
+    throw new Error(`BIN_INTEGRITY: invalid bin path for ${name}`);
+  const rel = relRaw.replace(/^\.\//, '');
+  const full = path.resolve(root, rel);
+  if (!full.startsWith(root + path.sep) || !entries.has(rel))
+    throw new Error(`BIN_INTEGRITY: unmanifested or escaping bin '${name}'`);
+  const bytes = readFileSync(full);
+  const firstLf = bytes.indexOf(0x0a);
+  if (firstLf < 2 || bytes[0] !== 0x23 || bytes[1] !== 0x21 || bytes[firstLf - 1] === 0x0d)
+    throw new Error(`BIN_INTEGRITY: bin '${name}' must begin with shebang LF (no CRLF)`);
+  const sha = createHash('sha256').update(bytes).digest('hex');
+  if (sha !== entries.get(rel))
+    throw new Error(`BIN_INTEGRITY: manifest and bin bytes differ for '${name}'`);
+  process.stdout.write(`BIN_INTEGRITY_PASS ${name} ${rel} ${sha}\n`);
+}

package/scripts/release-manifest.mjs

@@ -18,7 +18,7 @@ const requiredNativePayload = [
   'bin/bootstrap-kernel32.exe', 'bin/bootstrap-advapi32.exe',
   'bin/appcontainer-stage.exe', 'bin/bootstrap-exitcode.exe',
   'bin/child-control-stage.exe', 'bin/child-control-probe.exe',
-  'bin/deadbyte-exec.exe', 'bin/contained-transform-worker.exe',
+  'bin/deadbyte-exec.exe', 'bin/deadbyte-epoch-lock-r85.node', 'bin/contained-transform-worker.exe',
   'bin/contained-reverse-worker.exe', 'bin/deadbyte-tunnel-host.exe', 'bin/WORKER-REGISTRY.txt'
 ];
 const requiredBundledDependencyRoots = [