deadbyte-mcp 0.15.48 → 0.15.49

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r74:0.15.47",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r128:0.15.49",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.47"
+      "version": "0.15.49"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.48",
-  "train": "R74",
+  "version": "0.15.49",
+  "train": "R128",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",

package/bench/r121-epoch-readhead.mjs

@@ -0,0 +1,54 @@
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {mkdtemp, mkdir, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const oldSource = process.env.DEADBYTE_R121_BASELINE_EPOCH_MODULE;
+const writerSource = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE;
+if(!oldSource||!writerSource)throw new Error('R121 benchmark requires exact baseline and protected writer modules');
+const currentSource = new URL('../src/authority-continuity-r65.mjs', import.meta.url).href;
+const [baseline,current,writer] = await Promise.all([
+  import(pathToFileURL(oldSource).href), import(currentSource), import(pathToFileURL(writerSource).href)
+]);
+const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r121-readhead-bench-'));
+const quantile=(values,p)=>{
+  const sorted=[...values].sort((a,b)=>a-b);
+  return Number(sorted[Math.min(sorted.length-1,Math.floor(p*(sorted.length-1)))].toFixed(4));
+};
+try{
+  const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+  await mkdir(runtimeDir);await mkdir(trust);
+  const keys=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+  await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+  const nonce=randomBytes(32).toString('hex');
+  const grant=Buffer.from(JSON.stringify({instance_nonce:nonce,fixture:'R121 benchmark'}));
+  await writer.createAuthorityEpochStore({runtimeDir}).append({plane:'process',action:'grant',
+    grantBytes:grant,grantInstanceNonce:nonce});
+  const stores={baseline:baseline.createAuthorityEpochStore({runtimeDir}),
+    candidate:current.createAuthorityEpochStore({runtimeDir})};
+  for(let i=0;i<100;i++){
+    await stores.baseline.readHead({plane:'process'});
+    await stores.candidate.readHead({plane:'process'});
+  }
+  const durations={baseline:[],candidate:[]};
+  const rssBefore=process.memoryUsage().rss;
+  for(let i=0;i<600;i++){
+    const order=i%2?['candidate','baseline']:['baseline','candidate'];
+    for(const name of order){
+      const start=process.hrtime.bigint();
+      const head=await stores[name].readHead({plane:'process'});
+      if(head.action!=='grant')throw new Error('R121 benchmark head changed');
+      durations[name].push(Number(process.hrtime.bigint()-start)/1e6);
+    }
+  }
+  const result={schema:'deadbyte.r121-epoch-readhead-benchmark.v1',samples_per_variant:600,
+    workload:'read-only signed head and predecessor verification, one grant event',
+    baseline:{p50_ms:quantile(durations.baseline,.5),p95_ms:quantile(durations.baseline,.95),
+      max_ms:quantile(durations.baseline,1)},
+    candidate:{p50_ms:quantile(durations.candidate,.5),p95_ms:quantile(durations.candidate,.95),
+      max_ms:quantile(durations.candidate,1)},
+    rss_delta_bytes:process.memoryUsage().rss-rssBefore};
+  process.stdout.write(JSON.stringify(result)+'\n');
+}finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:100});}

package/bench/r124-epoch-predecessor.mjs

@@ -0,0 +1,53 @@
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {mkdtemp, mkdir, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const oldSource = process.env.DEADBYTE_R124_BASELINE_EPOCH_MODULE;
+const writerSource = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE;
+if (!oldSource || !writerSource) throw new Error('R124 benchmark requires exact R123 baseline and protected writer modules');
+const [baseline, current, writer] = await Promise.all([
+  import(pathToFileURL(oldSource).href),
+  import(new URL('../src/authority-continuity-r65.mjs', import.meta.url).href),
+  import(pathToFileURL(writerSource).href),
+]);
+const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r124-bench-'));
+const percentile = (values, p) => {
+  const sorted = [...values].sort((a, b) => a - b);
+  return Number(sorted[Math.min(sorted.length - 1, Math.floor(p * (sorted.length - 1)))].toFixed(4));
+};
+try {
+  const runtimeDir = path.join(root, 'runtime');
+  const trust = path.join(root, 'trust');
+  await mkdir(runtimeDir); await mkdir(trust);
+  const keys = generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust, 'ed25519-private.pem'), keys.privateKey.export({type:'pkcs8', format:'pem'}), {flag:'wx'});
+  await writeFile(path.join(trust, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}), {flag:'wx'});
+  const store = writer.createAuthorityEpochStore({runtimeDir});
+  for (let i = 0; i < 2; i++) {
+    const nonce = randomBytes(32).toString('hex');
+    await store.append({plane:'process', action:'grant', grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce, fixture:`r124-${i}`})), grantInstanceNonce:nonce});
+  }
+  const stores = {baseline:baseline.createAuthorityEpochStore({runtimeDir}), candidate:current.createAuthorityEpochStore({runtimeDir})};
+  for (let i = 0; i < 100; i++) {
+    await stores.baseline.readHead({plane:'process'});
+    await stores.candidate.readHead({plane:'process'});
+  }
+  const samples = {baseline:[], candidate:[]};
+  for (let i = 0; i < 600; i++) {
+    const order = i % 2 ? ['candidate', 'baseline'] : ['baseline', 'candidate'];
+    for (const name of order) {
+      const start = process.hrtime.bigint();
+      const head = await stores[name].readHead({plane:'process'});
+      if (head.seq !== 2) throw new Error('R124 benchmark head changed');
+      samples[name].push(Number(process.hrtime.bigint() - start) / 1e6);
+    }
+  }
+  console.log(JSON.stringify({schema:'deadbyte.r124-epoch-predecessor-benchmark.v1', samples_per_variant:600,
+    workload:'read-only signed two-event head with predecessor verification',
+    baseline:{p50_ms:percentile(samples.baseline,.5), p95_ms:percentile(samples.baseline,.95), max_ms:percentile(samples.baseline,1)},
+    candidate:{p50_ms:percentile(samples.candidate,.5), p95_ms:percentile(samples.candidate,.95), max_ms:percentile(samples.candidate,1)}}));
+} finally {
+  await rm(root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+}

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.48-r108-release-dev\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.48-r108-release-dev\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.48-r108-release-dev\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.48-r108-release-dev",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/HARNESS2-ADAPTATION-20261020.md

@@ -0,0 +1,24 @@
+# Harness2 mechanism review — isolated development only
+
+Source: `D:/Projects/deadbyte-mcp/references/harness2-main` (Apache-2.0). This work uses behavior patterns only; no donor source bytes, Python dependencies, benchmark runner, or third-party assets were copied. Source parent: `D:/Projects/deadbyte-mcp/development/deadbyte-mcp-0.15.48-r108-remote-shell-dev`. The separate, unfinished 0.15.49 release candidate and production remain untouched.
+
+| Donor mechanism and source | DEADBYTE comparison | Decision |
+| --- | --- | --- |
+| Context tripwires in `harness2/core/context.py` reject answer-key paths and grader verdicts before a model sees them. | `src/agent-eval-r42.mjs` already constructs separate generator/judge inputs, but a nested secret or verdict object in `allowed_context` passed directly to the generator. | ADAPT: reject judge-only secret/token values and known judge-result structures before generator invocation. No public API or authority change. |
+| Completion mark bound to harness fingerprint in `harness2/core/runmark.py`; `tests/test_workflow.py` tests resume invalidation after harness drift. | `src/r67-regression-shards.mjs` and `test/r67-regression-shards.test.mjs` already bind regression evidence to source/test fingerprint; R42 evaluation evidence binds suite and subject manifest hashes. | KEEP-OURS: no second completion-marker format. |
+| Bounded rollout/session accounting and duplicate-label rejection in `harness2/core/ledger.py`. | `src/agent-runtime.mjs` already bounds retries; R67 shard planner/reconciler detects duplicate coverage and nonterminal outcomes. | KEEP-OURS: do not graft recursive rollout budget into runtime. |
+| Anonymized candidate selection and evidence-first comparison in `harness2/core/selection.py`; judge isolation in `harness2/core/judge.py`. | `src/agent-eval-r42.mjs` uses generator/judge separation and advisory judge triage; DEADBYTE's task flow does not require a recursive candidate tournament. | DEFER: evaluate only if a future bounded multi-candidate workflow is approved. |
+
+RED: `node --test test/harness2-eval-context-isolation.test.mjs` returned 1 pass, 1 fail. The missing rejection allowed a generator-visible context to carry a judge-only token; the generator ran and evaluation returned normally.
+
+GREEN after the first fix: focused R42/eval tests returned 9 pass, 0 fail, 0 skip. A later adversarial test proved a second RED: explicit judge-only secrets shorter than 16 characters still reached the generator (3 pass, 1 fail). The minimum-length exemption was removed; identical focused suite now returns 10 pass, 0 fail, 0 skip. Nested and short secrets, task/acceptance leakage and redacted errors are covered. Ordinary shared acceptance terms remain allowed.
+
+Adversarial RED 3: a nested `hidden_oracle`/judge-verdict object in `allowed_context` still reached generator dispatch (4 pass, 1 fail). The context-key tripwire rejects only known judge-only structures, not ordinary `expected`/task text. Identical focused suite is GREEN 11 pass, 0 fail, 0 skip.
+
+Full-regression attempt: `npm test` returned exit 1 in the ordinary D: development checkout. The observed failing native authority tests reported `EPOCH_NATIVE_SLOT_UNTRUSTED` / `UNTRUSTED_WRITE_ACE` from `src/privileged-install-trust-r89.mjs`; this checkout lacks the protected Windows installation ACL required by those tests. A UAC-approved protected isolated fixture subsequently verified its 2,342-file manifest and ran 1,627 pass / 0 fail / 48 skip / 1,675 total, TAP SHA-256 `41141fee766c5ae94893c869f5d7aa9767c1984827e13c06da30aae496ca0c0a`. That run predates the short-secret repair and is **not** final-byte full-regression proof. Its verify-only package gate passed (2,343 members, isolated doctor/version; transient tarball SHA-256 `2367c95380793ac48629ecfe8296b3d7436cb8672fa11f7b84c877b384fc8fbd`), also on pre-repair bytes.
+
+Changed source SHA-256: `src/agent-eval-r42.mjs` = `4e8e442497a15bce43b7d02ade497403d80b86e307473d26c172a0fba3a6d4ea`.
+New test SHA-256: `test/harness2-eval-context-isolation.test.mjs` = `32806f49cf8988bf0c6ff2059759cc7ed1b299ead68124140a68d9d91e52d3eb`.
+Candidate-only process policy root SHA-256: `ae29ee73d118538659aef60385065786ac238f4548d8aeb3ae13b9558761c51f`.
+
+This is not release evidence. The 0.15.49 publish path is paused at the user's request; no npm submission, production activation, production grant change, or sealed-slot edit is part of this adaptation.

package/docs/R128-RELEASE-CANDIDATE.md

@@ -0,0 +1,26 @@
+# DEADBYTE MCP 0.15.49 / R128 (isolated candidate)
+
+Status: **INCOMPLETE / NOT RELEASE READY** until independent protected-native Windows full gate, exact package acceptance, and npm authorization.
+
+Source lineage:
+- R125 (protected Windows development checkpoint, 1684 PASS / 0 FAIL / 49 historical SKIP, 54 PASS / 0 FAIL / 2 SKIP focused).
+- R126 RED reproduced for incorrectly bound predecessor/successor policy envelopes.
+- R127: read-path checks signed transaction_restore predecessor and successor envelope SHA-256 against present signed event policy envelopes; append rejects mismatched observed predecessor and successor policy envelopes before committing. Early successor mismatch preflight rejects before native lock or event creation.
+- Live Logs: merge of independently hash-checked R124 live-log implementation; missing audit outcomes do not imply success, stream reset warnings, bounded handle-pinned tail reads, partial UTF-8/UTF-16LE, and corrupted audit JSON rejection.
+- R128: version metadata update only in isolated staging for package 0.15.49. Production active pointer stays v0.15.45-34aa8d1241cfb8bf.
+
+Observed tests inherited from development only:
+- Live-log regressions 55 PASS / 0 FAIL / 0 SKIP.
+- R126 signed restore reader 3 PASS / 0 FAIL.
+- R127 wrong successor envelope prelock test PASS.
+- R120/R121/R122/R125/R126 focused subset 12 PASS / 0 FAIL. These are not a complete protected-native Windows suite for exact R128 bytes.
+
+Unresolved and blocking:
+- R128 must pass its own full protected-native Windows gate, preferably with hash-pinned installed test fixture and independent read-only review.
+- Historical fixtures without policy envelope SHA fields remain supported; they do not prove strict envelope matching.
+- R127 append predecessor check runs after native lock; no successful exact-R128 protected-native append/restore regression yet.
+- Full log rollover cross-gap detection, Windows directory durability, physical power loss and authority hot path performance acceptance remain open.
+- The npm CLI currently returned E401 Unauthorized from npm whoami; owner authentication is necessary before publishing.
+- No production deploy, activation, grant change, npm publish, or dist-tag mutation has been executed by this candidate setup.
+
+The previous protected R125 fixture and R125/R126/R127 parent trees must be kept unchanged. Package --verify-only success alone is not release proof.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.48",
+  "version": "0.15.49",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-release-r48.mjs

@@ -95,10 +95,6 @@ async function main() {
   if (!isVerifyOnly && version==='0.15.45') assertR71NpmPublishReady(release);
   if (!isVerifyOnly && version==='0.15.46') await assertR72NpmPublishReady(release,{root});
   if (!isVerifyOnly && version==='0.15.47') await assertR74NpmPublishReady(release,{root});
-  if (version==='0.15.48') {
-    const {assertR108NpmPublishReady} = await import('./npm-release-readiness-r108.mjs');
-    await assertR108NpmPublishReady(release,{root,provenance});
-  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {

package/scripts/verify-authority-epoch-history.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import {lstat} from 'node:fs/promises';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const planes = new Set(['process', 'coding', 'autonomous', 'desktop', 'host']);
+const sha256 = /^[0-9a-f]{64}$/;
+
+function parse(argv) {
+  if(argv.length!==6)throw new Error('expected --runtime-dir, --plane, and --expected-head');
+  const args = {};
+  for(let i=0;i<argv.length;i+=2){
+    const flag=argv[i],value=argv[i+1];
+    if(!['--runtime-dir','--plane','--expected-head'].includes(flag)||
+        Object.hasOwn(args,flag)||typeof value!=='string'||value.length===0)
+      throw new Error('authority history audit arguments invalid');
+    args[flag]=value;
+  }
+  const runtimeDir=args['--runtime-dir'],plane=args['--plane'],expectedHead=args['--expected-head'];
+  if(!path.isAbsolute(runtimeDir)||!planes.has(plane)||!sha256.test(expectedHead))
+    throw new Error('authority history audit subject invalid');
+  return {runtimeDir,plane,expectedHead};
+}
+
+async function main() {
+  const {runtimeDir,plane,expectedHead}=parse(process.argv.slice(2));
+  const stat=await lstat(runtimeDir);
+  if(!stat.isDirectory()||stat.isSymbolicLink())throw new Error('authority history audit runtime root invalid');
+  const result=await createAuthorityEpochStore({runtimeDir}).auditHistory({plane});
+  if(result.status!=='PASS'||result.event_sha256!==expectedHead)
+    throw new Error('authority history audit expected head mismatch');
+  process.stdout.write(JSON.stringify(result)+'\n');
+}
+
+main().catch(error=>{
+  process.stderr.write(`AUTHORITY_HISTORY_AUDIT_FAIL ${String(error?.message??error)}\n`);
+  process.exitCode=1;
+});

package/src/activation-continuity-engine-r65.mjs

@@ -1,5 +1,5 @@
 import {createHash,randomBytes} from 'node:crypto';
-import {open,readFile,rm} from 'node:fs/promises';
+import {open,readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {canonicalJson} from './canonical-json.mjs';
 import {decodeUtf8Strict} from './text-policy.mjs';
@@ -44,20 +44,12 @@ async function writeExclusive(file,bytes){
 async function removeIfExact(file,expectedSha256){
   // The Windows native disposition pins a single handle from read/hash through deletion.
   // Never use a pathname removal after confirming only a previous snapshot.
-  if(process.platform==='win32'){
-    const verdict=deletePinnedRemoteMarker(file,expectedSha256);
-    if(verdict==='REMOVED')return {removed:true,reason:'matched'};
-    if(verdict==='MISSING')return {removed:false,reason:'absent'};
-    if(verdict==='CHANGED')return {removed:false,reason:'replacement'};
-    throw new Error('authority grant native deletion verdict invalid');
-  }
-  // Legacy non-Windows behavior is retained for source/test compatibility.
-  // It is NOT a cross-platform pinned-deletion security guarantee.
-  const current=await readOptional(file);
-  if(current===null)return {removed:false,reason:'absent'};
-  if(sha(current)!==expectedSha256)return {removed:false,reason:'replacement'};
-  await rm(file,{force:true});
-  return {removed:true,reason:'matched'};
+  if(process.platform!=='win32')throw new Error('authority grant POSIX disposition unsupported');
+  const verdict=deletePinnedRemoteMarker(file,expectedSha256);
+  if(verdict==='REMOVED')return {removed:true,reason:'matched'};
+  if(verdict==='MISSING')return {removed:false,reason:'absent'};
+  if(verdict==='CHANGED')return {removed:false,reason:'replacement'};
+  throw new Error('authority grant native deletion verdict invalid');
 }
 function validateCapture(capture){
   if(!plain(capture)||typeof capture.update_id!=='string'||!Array.isArray(capture.planes)||!plain(capture.records))throw new Error('authority continuity capture invalid');
@@ -100,6 +92,8 @@ function classifyConflict(head,record,updateId){
 }
 
 export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPaths,successorPolicyPaths,updateId}={}){
+  if(process.platform!=='win32')
+    throw new Error('authority continuity POSIX mutation unsupported: native disposition unavailable');
   const state=path.resolve(String(stateRoot??''));
   if(!stateRoot||!plain(predecessorPolicyPaths)||typeof successorPolicyPaths!=='function'||
       typeof updateId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(updateId))

package/src/agent-eval-r42.mjs

@@ -4,6 +4,11 @@ import { canonicalJson } from './canonical-json.mjs';
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,96}$/;
 const SEVERITY=new Set(['info','low','medium','high','critical']);
+const JUDGE_ONLY_KEY=/(?:secret|token|password|answer[_-]?key|ground[_-]?truth)/i;
+const JUDGE_ONLY_CONTEXT_KEYS=new Set([
+  'hidden_oracle','judge_result','grader_verdict','deterministic_eval_result',
+  'deterministic_eval_summary','judge_scope_and_deterministic_status'
+]);
 const sha=value=>createHash('sha256').update(Buffer.from(canonicalJson(value),'utf8')).digest('hex');
 function object(value,label){if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} invalid`);return value;}
 function keys(value,allowed,label){const extra=Object.keys(value).filter(key=>!allowed.includes(key));if(extra.length)throw new Error(`${label} unknown field '${extra[0]}'`);}
@@ -11,6 +16,30 @@ function id(value,label){if(typeof value!=='string'||!ID.test(value))throw new E
 function text(value,label,max=8192){if(typeof value!=='string'||value.length<1||value.length>max||value.includes('\0'))throw new Error(`${label} invalid`);return value;}
 function textList(value,label,maxItems=32,maxLength=1024){if(!Array.isArray(value)||value.length>maxItems||value.some(item=>typeof item!=='string'||item.length<1||item.length>maxLength))throw new Error(`${label} invalid`);return [...value];}
 
+function assertNoJudgeOnlyContextLeak(core){
+  const checkKeys=(value,depth=0)=>{
+    if(depth>32)throw new Error('eval visible context nesting exceeds safe limit');
+    if(Array.isArray(value)){for(const item of value)checkKeys(item,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value)){
+      if(JUDGE_ONLY_CONTEXT_KEYS.has(key.toLowerCase()))throw new Error('judge-only result leaked into generator context');
+      checkKeys(item,depth+1);
+    }
+  };
+  checkKeys(core.allowed_context);
+  const visible=canonicalJson({task:core.task,allowed_context:core.allowed_context,acceptance:core.acceptance});
+  const visit=(value,secretKey=false,depth=0)=>{
+    if(depth>32)throw new Error('eval hidden oracle nesting exceeds safe limit');
+    if(typeof value==='string'){
+      if(secretKey&&value.length>0&&visible.includes(JSON.stringify(value).slice(1,-1)))
+        throw new Error('judge-only oracle value leaked into generator context');
+      return;
+    }
+    if(Array.isArray(value)){for(const item of value)visit(item,secretKey,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value))visit(item,secretKey||JUDGE_ONLY_KEY.test(key),depth+1);
+  };
+  visit(core.hidden_oracle);
+}
+
 function normalizeCase(raw){
   const value=object(raw,'agent eval case');keys(value,['schema','case_id','task','allowed_context','hidden_oracle','acceptance'],'agent eval case');
   if(value.schema!=='deadbyte.agent-eval-case.v1')throw new Error('agent eval case schema invalid');
@@ -18,6 +47,7 @@ function normalizeCase(raw){
     allowed_context:structuredClone(object(value.allowed_context,'eval allowed_context')),
     hidden_oracle:structuredClone(object(value.hidden_oracle,'eval hidden_oracle')),
     acceptance:textList(value.acceptance,'eval acceptance')};
+  assertNoJudgeOnlyContextLeak(core);
   return Object.freeze({...core,case_sha256:sha(core)});
 }