deadbyte-mcp 0.15.48 → 0.15.49

package/scripts/npm-release-readiness-r108.mjs

@@ -1,134 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const defaultRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const sha256 = value => createHash('sha256').update(value).digest('hex');
-const evidenceName = 'r108-protected-publication-evidence.json';
-const norm = p => path.resolve(p).replace(/\\/g, '/').toLowerCase();
-const assert = (ok, message) => { if (!ok) throw new Error('R108_PUBLICATION_GATE: ' + message); };
-const json = async file => JSON.parse(await readFile(file, 'utf8'));
-
-function manifestEntries(input) {
-  const entries = new Map();
-  for (const line of input.split(/\r?\n/)) {
-    if (!line.trim()) continue;
-    const match = /^([a-f0-9]{64})\s+\*?(.+)$/i.exec(line);
-    assert(match !== null, 'unrecognized manifest line format');
-    const rel = match[2].replace(/\\/g, '/');
-    assert(!entries.has(rel), 'duplicate manifest entry ' + rel);
-    entries.set(rel, match[1].toLowerCase());
-  }
-  return entries;
-}
-
-function testCounts(output) {
-  const values = {};
-  for (const line of output.split(/\r?\n/)) {
-    const match = /^\s*(?:ℹ|#)\s*(tests|pass|fail|skipped)\s+(\d+)\s*$/.exec(line);
-    if (match) values[match[1]] = Number(match[2]);
-  }
-  assert(['tests','pass','fail','skipped'].every(k => Number.isSafeInteger(values[k])), 'missing complete Node test-runner footer');
-  assert(values.tests === values.pass + values.fail + values.skipped, 'inconsistent test totals');
-  assert(values.fail === 0, 'fresh full regression reported failures');
-  assert(values.pass >= 1621, 'full regression below R107 established pass baseline');
-  assert(values.skipped <= 48, 'new unexplained skips relative to R107');
-  return values;
-}
-
-async function slotParity(root, protectedRoot, expectedRootSha, expectedSlotSha) {
-  assert(path.isAbsolute(protectedRoot), 'protected slot must be absolute');
-  assert(norm(root) !== norm(protectedRoot), 'protected test slot must differ from source');
-  if (process.platform === 'win32') {
-    assert(norm(protectedRoot).startsWith('c:/program files/'), 'protected slot must be under Program Files');
-  }
-  const sourceBytes = await readFile(path.join(root,'MANIFEST.SHA256'));
-  const slotBytes = await readFile(path.join(protectedRoot,'MANIFEST.SHA256'));
-  assert(sha256(sourceBytes) === expectedRootSha, 'R108 source manifest hash changed after test');
-  assert(sha256(slotBytes) === expectedSlotSha, 'protected test manifest hash changed after test');
-  const source = manifestEntries(sourceBytes.toString('utf8'));
-  const slot = manifestEntries(slotBytes.toString('utf8'));
-  assert(source.size === slot.size, 'source/protected manifest surface differs');
-  const allowed = 'controller/deadbyte-process-policy.json';
-  for (const [p,h] of source) {
-    assert(slot.has(p), 'protected fixture missing source entry ' + p);
-    if (p !== allowed) assert(slot.get(p) === h, 'protected fixture changes tested source bytes at ' + p);
-  }
-  assert(source.has(allowed) && slot.has(allowed), 'required policy fixture missing from manifest');
-  for (const [label,dir] of [['source',root],['protected',protectedRoot]]) {
-    const policy = await json(path.join(dir, 'controller', 'deadbyte-process-policy.json'));
-    assert(norm(policy?.roots?.core?.path ?? '.') === norm(dir), label + ' process policy core root not bound to its own checkout');
-    assert(norm(policy?.native_host?.path ?? '.') === norm(path.join(dir,'bin','deadbyte-process-host.exe')), label + ' native host not self-bound');
-    assert(norm(policy?.grant_file ?? '.') === norm(path.join(dir,'controller','runtime','process-grant.json')), label + ' grant path not self-bound');
-    assert(norm(policy?.state_dir ?? '.') === norm(path.join(dir,'controller','runtime','process-state')), label + ' state path not self-bound');
-  }
-  return { sourceFiles: source.size, protectedFiles: slot.size };
-}
-
-export async function assertR108NpmPublishReady(release, {root = defaultRoot,provenance = null} = {}) {
-  const rootPath = path.resolve(root);
-  const pkg = await json(path.join(rootPath,'package.json'));
-  const prov = provenance ?? await json(path.join(rootPath,'PROVENANCE.json'));
-  const lock = await json(path.join(rootPath,'package-lock.json'));
-  assert(pkg.name === 'deadbyte-mcp', 'package name mismatch');
-  assert([pkg.version,lock.version,lock.packages?.['']?.version,release.version,prov.version].every(v => v === '0.15.48'), 'package/release/provenance identity mismatch');
-  assert(release.train === 'R108', 'release train is not R108');
-  assert(release.r108_candidate?.status === 'CANDIDATE_UNSEALED', 'R108 pending-state metadata missing');
-  assert(release.source_predecessor?.version === '0.15.47' && prov.source_predecessor_version === '0.15.47', 'published source predecessor mismatch');
-  assert(release.parent?.version === '0.15.45' && release.runtime_predecessor?.version === '0.15.45', 'runtime predecessor mismatch');
-  for (const key of ['release_id','manifest_sha256','generation_manifest_sha256']) {
-    assert(release.parent?.[key] === prov['parent_'+key], 'sealed parent lineage mismatch at ' + key);
-    assert(release.runtime_predecessor?.[key] === release.parent?.[key], 'runtime predecessor drift at ' + key);
-    assert(prov.runtime_predecessor?.[key] === release.parent?.[key], 'provenance runtime predecessor drift at ' + key);
-  }
-  const proof = await json(path.join(rootPath,'testing',evidenceName));
-  assert(proof.schema === 'deadbyte.r108-protected-publication-evidence.v1', 'missing/fake R108 proof schema');
-  assert(proof.version === '0.15.48', 'proof version mismatch');
-  assert(norm(proof.candidate_root ?? '.') === norm(rootPath), 'proof candidate root changed');
-  assert(proof.test_exit_code === 0, 'test process did not finish with exit 0');
-  const testLog = await readFile(path.join(rootPath,'testing','r108-protected-full.tap'));
-  assert(sha256(testLog) === proof.test_log_sha256, 'test log bytes drifted');
-  const actualCounts = testCounts(testLog.toString('utf8'));
-  for (const key of ['tests','pass','fail','skipped']) assert(actualCounts[key] === proof.counts?.[key], 'proof disagrees with test log at '+key);
-  const parity = await slotParity(rootPath, proof.protected_root, proof.source_manifest_sha256, proof.protected_manifest_sha256);
-  assert(parity.sourceFiles >= 2339, 'manifest file count smaller than R107 baseline');
-  console.log('R108_PREPUBLISH_GATE_PASS '+JSON.stringify({version:'0.15.48',manifest_sha256:proof.source_manifest_sha256,test_log_sha256:proof.test_log_sha256,counts:actualCounts,source_files:parity.sourceFiles,protected_files:parity.protectedFiles}));
-  return true;
-}
-
-const invoked = process.argv[1] && norm(process.argv[1]) === norm(fileURLToPath(import.meta.url));
-if (invoked) {
-  try {
-    const command = process.argv[2] ?? 'verify';
-    if (command === 'record') {
-      const [rootArg,protectedArg,exitCodeArg] = process.argv.slice(3);
-      assert(rootArg && protectedArg && exitCodeArg !== undefined, 'usage: node scripts/npm-release-readiness-r108.mjs record ROOT PROTECTED_ROOT TEST_EXIT');
-      const root = path.resolve(rootArg), protectedRoot = path.resolve(protectedArg);
-      assert(Number(exitCodeArg) === 0, 'test exit code not zero');
-      const testLog = await readFile(path.join(root,'testing','r108-protected-full.tap'));
-      const counts = testCounts(testLog.toString('utf8'));
-      const sourceManifest = sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
-      const protectedManifest = sha256(await readFile(path.join(protectedRoot,'MANIFEST.SHA256')));
-      await slotParity(root,protectedRoot,sourceManifest,protectedManifest);
-      const receipt = {
-        schema:'deadbyte.r108-protected-publication-evidence.v1',
-        version:'0.15.48',candidate_root:root,protected_root:protectedRoot,
-        source_manifest_sha256:sourceManifest,protected_manifest_sha256:protectedManifest,
-        test_log_sha256:sha256(testLog),test_exit_code:0,counts,
-        limitations:'Locally hashed regression and source/protected manifest parity; not a hardware attestation or independent signature.'
-      };
-      const proofPath=path.join(root,'testing',evidenceName);
-      await mkdir(path.dirname(proofPath),{recursive:true});
-      await writeFile(proofPath,JSON.stringify(receipt,null,2)+'\n',{flag:'wx'});
-      console.log('R108_PROOF_WRITTEN '+JSON.stringify({path:proofPath,...receipt}));
-    } else if (command === 'verify') {
-      const root = path.resolve(process.argv[3] ?? defaultRoot);
-      const release = await json(path.join(root,'RELEASE.json'));
-      await assertR108NpmPublishReady(release,{root});
-    } else throw new Error('unknown command '+command);
-  } catch(error) {
-    console.error(error?.stack || String(error));
-    process.exitCode=1;
-  }
-}