deadbyte-mcp 0.15.50 → 0.15.51

package/SBOM.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r130:0.15.50",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r132:0.15.51",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.50"
+      "version": "0.15.51"
     }
   },
   "components": [
     {
       "type": "library",
       "name": "@modelcontextprotocol/client",
-      "version": "2.1.0"
+      "version": "2.3.1"
     },
     {
       "type": "library",
       "name": "@modelcontextprotocol/server",
-      "version": "2.1.0"
+      "version": "2.3.1"
     },
     {
       "type": "library",
@@ -60,6 +60,11 @@
         }
       ],
       "evidence_status": "CANDIDATE_BINARY_PIN_ONLY_NOT_DEPLOYED"
+    },
+    {
+      "type": "library",
+      "name": "@modelcontextprotocol/core",
+      "version": "2.3.1"
     }
   ]
 }

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.50",
-  "train": "R130",
+  "version": "0.15.51",
+  "train": "R132",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -34,6 +34,21 @@
       "id": "r71-owner-grant",
       "command": "Protected owner authentication and project scope",
       "expected": "BLOCK unless independently owner enrolled and scope verified"
+    },
+    {
+      "id": "r132-protected-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs on exact R132 protected fixture",
+      "expected": "Zero failures, historical skips recorded, manifest verify-installed pass"
+    },
+    {
+      "id": "r132-independent-rollback",
+      "command": "isolated activation -> rollback -> restore smoke on scratch state root",
+      "expected": "No production mutation; runtime predecessor preserved"
+    },
+    {
+      "id": "r132-artifact-parity",
+      "command": "node scripts/npm-release-r48.mjs --verify-only + fresh npm audit",
+      "expected": "Verified exact 0.15.51 tarball, SDK 2.3.1 and 0 vulnerabilities"
     }
   ],
   "observed_pre_release_evidence": {

package/docs/R132-MANIFEST-PORTABILITY.md

@@ -0,0 +1,23 @@
+# R132 / deadbyte-mcp@0.15.51 — manifest portability
+
+Status: ISOLATED RELEASE CANDIDATE (no npm publish or production activation).
+This release train follows published 0.15.50 and the independently tested R131 developer successor.
+
+## Defect reproduced
+npm v12.1.0 built a package manifest on the source checkout that included `node_modules/which/CHANGELOG.md`. After installing into a separate protected Windows filesystem, a fresh `npm pack --dry-run` omitted that file even though its SHA-256 and bytes remained unchanged. Consequently the old development-package comparison failed in an installed environment (R130: 1,699 pass, 1 failure, 49 skipped). This is NOT evidence of a runtime executable/hash mutation.
+
+## Surgical fix (R131)
+- Keep `release-manifest.mjs verify` unchanged for authors creating an npm tarball: full npm-pack list equality, no path exceptions.
+- Introduce `release-manifest.mjs verify-installed` for protected installations: independently verify SHA-256 of EVERY manifested file and reject extraneous regular files unless their path is exactly `.npmignore` or `package-lock.json`. No directory-level exclusions; symlinks, unexpected runtime files and mutated bytes still fail.
+- `npm-prepublish-contract-r74.mjs` source/installed mode is explicit; defaults to strict source verification. On protected Windows the test selects installed mode via `DEADBYTE_TEST_PROTECTED_MANIFEST=installed`. It still tests pinned native hashes, predecessor separation and private file leakage.
+- R131 protected Windows full native 1,705 PASS, 0 FAIL, 49 SKIP (1,754 tests); source manifest 2,371 files PASS.
+- R132 adds honest 0.15.51 release metadata, current 2.3.1 client/server/core SBOM, and new source-predecessor identity tests. R132 exact-byte gates must run independently; R131 results are not R132 results.
+
+## Immutable lineage
+- npm published 0.15.50 tarball SHA-256 `133b9f4adedee14a3e4f2fd1c9433f7ebf102742a73398161b238fd68eb42d84`.
+- npm 0.15.50 source manifest SHA-256 `98dd37c71adae980856adc17b9c59d58d167a01d46c61106055956d0f306fede`.
+- R131 predecessor candidate source manifest SHA-256 `3e5edb9987aa7c9004dda3164a278da70a60495c0c128e2602426075a5222c10`.
+- Production runtime predecessor remains v0.15.45; its pointer must not change during isolated gates.
+
+## Remaining release gates
+Full Windows native regression on exact R132 protected fixture; isolated activation/rollback/restore tests with scratch state; npm pack manifest and independent doctor; SBOM parity and npm audit; no production activation, grant changes or npm publish until the respective gates and explicit actions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.50",
+  "version": "0.15.51",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-prepublish-contract-r74.mjs

@@ -7,7 +7,8 @@ import {fileURLToPath} from 'node:url';
 const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 
-export async function verifyR74PrepublishContract({rootPath = root} = {}) {
+export async function verifyR74PrepublishContract({rootPath = root, manifestVerification = 'source'} = {}) {
+  if (!['source','installed'].includes(manifestVerification)) throw new Error('Unsupported prepublish manifest verification mode');
   const result = {
     schema: 'deadbyte.r74-prepublish-contract.v1',
     valid: false,
@@ -63,7 +64,11 @@ export async function verifyR74PrepublishContract({rootPath = root} = {}) {
   result.identities.manifest_sha256 = sha256Bytes(manifestBytes);
   result.checks.manifest_exists = true;
 
-  const manifestVerifyResult = spawnSync(process.execPath, [path.join(rootPath, 'scripts', 'release-manifest.mjs'), 'verify'], {
+  // Authoring/release packaging retains strict npm-pack manifest equality.
+  // Isolated protected installations instead validate every pinned byte and
+  // reject unlisted files except two fixed non-runtime packaging metadata files.
+  const manifestCommand = manifestVerification === 'installed' ? 'verify-installed' : 'verify';
+  const manifestVerifyResult = spawnSync(process.execPath, [path.join(rootPath, 'scripts', 'release-manifest.mjs'), manifestCommand], {
     cwd: rootPath,
     encoding: 'utf8',
     timeout: 60000,
@@ -73,6 +78,7 @@ export async function verifyR74PrepublishContract({rootPath = root} = {}) {
     throw new Error(`Prepublish contract failed: working tree manifest verification failed: ${manifestVerifyResult.stderr || manifestVerifyResult.stdout}`);
   }
   result.checks.manifest_verified = true;
+  result.checks.manifest_verification_mode = manifestVerification;
 
   // 4. Packaged files boundary (no leaks of private/testing trees)
   const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');

package/scripts/release-manifest.mjs

@@ -175,6 +175,19 @@ async function verifyTree() {
   console.log(`MANIFEST_VERIFY_TREE_OK files=${entries.size} sha256=${sha256(actual)}`);
 }
 
+// Installed-tree verification deliberately avoids regenerating the packlist
+// (npm pack has environment-sensitive inclusion behavior after installation).
+// Every manifested byte is still hash-checked; only precisely named
+// packaging metadata, excluded from npm payload, may appear additionally.
+async function verifyInstalled() {
+  const actual = await readFile(manifestPath);
+  const entries = parseSlotManifest(actual.toString('utf8'));
+  await verifyManifestTreeExact(root, entries, {
+    allowedExtraPaths:['.npmignore','package-lock.json']
+  });
+  console.log(`MANIFEST_VERIFY_INSTALLED_OK files=${entries.size} sha256=${sha256(actual)}`);
+}
+
 const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : '';
 if (invokedPath === fileURLToPath(import.meta.url)) {
   const command = process.argv[2] ?? 'verify';
@@ -182,7 +195,8 @@ if (invokedPath === fileURLToPath(import.meta.url)) {
     if (command === 'write') await writeManifest();
     else if (command === 'verify') await verifyManifest();
     else if (command === 'verify-tree') await verifyTree();
-    else throw new Error(`usage: node scripts/release-manifest.mjs [write|verify|verify-tree]`);
+    else if (command === 'verify-installed') await verifyInstalled();
+    else throw new Error(`usage: node scripts/release-manifest.mjs [write|verify|verify-tree|verify-installed]`);
   } catch (error) {
     console.error(`MANIFEST_${command.toUpperCase()}_FAIL ${error?.stack ?? error}`);
     process.exitCode = 1;

package/src/release-slot.mjs

@@ -79,13 +79,23 @@ async function listManifestTreeFiles(root){
   return files.sort((a,b)=>a.localeCompare(b,'en'));
 }
 
-export async function verifyManifestTreeExact(root,manifest){
+export async function verifyManifestTreeExact(root,manifest,{allowedExtraPaths=[]}={}){
+  // The only unmanifested files accepted in a protected test fixture are
+  // packaging inputs that npm intentionally excludes from published payloads.
+  // No subdirectory, wildcard, executable or mutable runtime state is exempt.
+  const allowedPackagingExtras=new Set(['.npmignore','package-lock.json']);
+  if(!Array.isArray(allowedExtraPaths)||allowedExtraPaths.some(rel=>!allowedPackagingExtras.has(rel))){
+    throw new Error('invalid allowed manifest extra');
+  }
+  const extras=new Set(allowedExtraPaths);
   await verifyManifestTree(root,manifest);
   const actual=await listManifestTreeFiles(root);
   const expected=[...manifest.keys()].sort((a,b)=>a.localeCompare(b,'en'));
-  for(const rel of actual) if(!manifest.has(rel)) throw new Error(`unexpected manifest-tree file: ${rel}`);
+  for(const rel of actual) if(!manifest.has(rel)&&!extras.has(rel)) throw new Error(`unexpected manifest-tree file: ${rel}`);
   for(const rel of expected) if(!actual.includes(rel)) throw new Error(`missing manifest-tree file: ${rel}`);
-  if(actual.length!==expected.length) throw new Error(`manifest-tree file count mismatch: expected=${expected.length} actual=${actual.length}`);
+  if(actual.length!==expected.length+actual.filter(rel=>extras.has(rel)&&!manifest.has(rel)).length){
+    throw new Error(`manifest-tree file count mismatch: expected=${expected.length} actual=${actual.length}`);
+  }
   return {files:manifest.size};
 }
 export async function copyManifestTree({source,destination,manifest}){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.50';
+export const DEADBYTE_VERSION = '0.15.51';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -13,14 +13,14 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.50');
-  assert.equal(release.train,'R130');
-  assert.equal(matrix.train,'R130');
-  assert.equal(release.source_predecessor.version,'0.15.49');
-  assert.match(release.source_predecessor.source_path,/0\.15\.49/);
+    assert.equal(actual,'0.15.51');
+  assert.equal(release.train,'R132');
+  assert.equal(matrix.train,'R132');
+  assert.equal(release.source_predecessor.version,'0.15.50');
+  assert.match(release.source_predecessor.source_path,/0\.15\.50/);
   assert.equal(release.runtime_predecessor.version,'0.15.45');
-  assert.equal(provenance.source_predecessor_version,'0.15.49');
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'0c614697756731ee348f77cb36f9b1780f3037b5846e6482dc9a4c4e48cf01b6');
+  assert.equal(provenance.source_predecessor_version,'0.15.50');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'98dd37c71adae980856adc17b9c59d58d167a01d46c61106055956d0f306fede');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');
   for(const dep of ['@modelcontextprotocol/client','@modelcontextprotocol/server'])

package/test/r131-installed-manifest-boundary.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, mkdir, rm, writeFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {verifyManifestTreeExact} from '../src/release-slot.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function fixture(run) {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r131-portable-manifest-'));
+  try {
+    await mkdir(path.join(root,'src'));
+    await writeFile(path.join(root,'src','payload.mjs'),'export const x=1;\n');
+    await writeFile(path.join(root,'.npmignore'),'# supplemental npm packaging data\n');
+    await writeFile(path.join(root,'package-lock.json'),'{"name":"fixture"}\n');
+    const manifest=new Map([['src/payload.mjs',sha(Buffer.from('export const x=1;\n'))]]);
+    return await run({root,manifest});
+  } finally {
+    await rm(root,{recursive:true,force:true});
+  }
+}
+
+test('R131 existing strict release-tree gate rejects any supplemental file', async()=>{
+  await fixture(async({root,manifest})=>{
+    await assert.rejects(verifyManifestTreeExact(root,manifest),/unexpected manifest-tree file/);
+  });
+});
+
+test('R131 protected-install gate verifies all manifest hashes but permits ONLY declared packaging extras',async()=>{
+  await fixture(async({root,manifest})=>{
+    const result=await verifyManifestTreeExact(root,manifest,{allowedExtraPaths:['.npmignore','package-lock.json']});
+    assert.deepEqual(result,{files:1});
+  });
+});
+
+test('R131 protected-install gate rejects unexpected executable file even with allowed packaging extras',async()=>{
+  await fixture(async({root,manifest})=>{
+    await writeFile(path.join(root,'src','rogue.mjs'),'export const privileged=true;\n');
+    await assert.rejects(
+      verifyManifestTreeExact(root,manifest,{allowedExtraPaths:['.npmignore','package-lock.json']}),
+      /unexpected manifest-tree file: src\/rogue\.mjs/
+    );
+  });
+});
+
+test('R131 protected-install gate rejects mutated manifested source bytes',async()=>{
+  await fixture(async({root,manifest})=>{
+    await writeFile(path.join(root,'src','payload.mjs'),'export const x=2;\n');
+    await assert.rejects(
+      verifyManifestTreeExact(root,manifest,{allowedExtraPaths:['.npmignore','package-lock.json']}),
+      /hash mismatch: src\/payload\.mjs/
+    );
+  });
+});
+
+test('R131 installed gate disallows broad directory exemptions',async()=>{
+  await fixture(async({root,manifest})=>{
+    await assert.rejects(
+      verifyManifestTreeExact(root,manifest,{allowedExtraPaths:['src/','.npmignore','package-lock.json']}),
+      /invalid allowed manifest extra/
+    );
+  });
+});

package/test/r132-release-identity.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
+
+test('R132 candidate identities and published source predecessor are consistent',async()=>{
+  const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
+    read('package.json'),read('package-lock.json'),read('RELEASE.json'),
+    read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
+  for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
+    assert.equal(value,'0.15.51');
+  }
+  assert.equal(release.train,'R132');
+  assert.equal(matrix.train,'R132');
+  assert.equal(release.source_predecessor.version,'0.15.50');
+  assert.match(release.source_predecessor.source_path,/0\.15\.50/);
+  assert.equal(prov.source_predecessor_version,'0.15.50');
+  assert.equal(prov.source_predecessor_manifest_file_sha256,'98dd37c71adae980856adc17b9c59d58d167a01d46c61106055956d0f306fede');
+  assert.equal(prov.parent_tarball_sha256,'133b9f4adedee14a3e4f2fd1c9433f7ebf102742a73398161b238fd68eb42d84');
+  assert.equal(release.runtime_predecessor.version,'0.15.45');
+  assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
+  assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
+  assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);
+  assert.equal(release.r132.manifest_portability,'R131_PROTECTED_FULL_GREEN');
+  assert.equal(release.r132.production_activation,'NOT_RUN');
+  assert.equal(prov.r132.source_lineage_manifest_sha256,'3e5edb9987aa7c9004dda3164a278da70a60495c0c128e2602426075a5222c10');
+  assert.equal(matrix.required.some(t=>t.id==='r132-protected-full'),true);
+});
+
+test('R132 shipped SBOM matches the actual audited bundled MCP SDK',async()=>{
+  const [pkg,bom,lock]=await Promise.all([read('package.json'),read('SBOM.cdx.json'),read('package-lock.json')]);
+  for(const name of ['@modelcontextprotocol/client','@modelcontextprotocol/server','@modelcontextprotocol/core']){
+    const entry=bom.components.find(v=>v.name===name);
+    assert.ok(entry,'missing SBOM component: '+name);
+    assert.equal(entry.version,'2.3.1',name+' SBOM stale');
+    assert.equal(lock.packages['node_modules/'+name].version,'2.3.1',name+' lockfile stale');
+    if(name!=='@modelcontextprotocol/core')assert.equal(pkg.dependencies[name],'2.3.1');
+  }
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r74-prepublish-contract.test.mjs

@@ -9,7 +9,9 @@ import {verifyR74PrepublishContract} from '../scripts/npm-prepublish-contract-r7
 const repoRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 
 test('R74 prepublish contract: positive path succeeds and verifies identities', async () => {
-  const result = await verifyR74PrepublishContract({rootPath: repoRoot});
+  const manifestVerification = process.env.DEADBYTE_TEST_PROTECTED_MANIFEST === 'installed' ? 'installed' : 'source';
+  const result = await verifyR74PrepublishContract({rootPath: repoRoot, manifestVerification});
+  assert.equal(result.checks.manifest_verification_mode, manifestVerification);
   assert.equal(result.schema, 'deadbyte.r74-prepublish-contract.v1');
   assert.equal(result.valid, true);
   assert.equal(result.checks.predecessors_distinct, true);
@@ -19,8 +21,8 @@ test('R74 prepublish contract: positive path succeeds and verifies identities',
   assert.equal(result.checks.no_self_referential_tarball_hash, true);
   assert.equal(result.identities.package_name, 'deadbyte-mcp');
   // This R74 component contract remains scoped to train R74, even when
-  // the containing npm package is the R130 0.15.50 security candidate.
-  assert.equal(result.identities.package_version, '0.15.50');
+  // the containing npm package is the R132 0.15.51 candidate.
+  assert.equal(result.identities.package_version, '0.15.51');
   assert.equal(result.identities.target_train, 'R74');
   assert.equal(result.identities.published_source_predecessor, '0.15.46');
   assert.notEqual(result.identities.published_source_predecessor, result.identities.runtime_predecessor);