deadbyte-mcp 0.15.50 → 0.15.52

package/test/r139-process-start-preview.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createCommanderWireAdapter} from '../src/commander-wire-adapter-r47.mjs';
+
+function mock({output='hello from child\n',readThrows=false}={}){
+ const calls={reads:[],started:0};
+ const raw=Buffer.from(output,'utf8');
+ const runtime={
+  policy:{roots:{core:{real_path:'C:\\\\r139'}},profiles:{repl:{allow_raw_input:false}}},
+  async start(){calls.started++;return {child_pid:29139,session_id:'a'.repeat(64),state:'running'}},
+  async read(args){calls.reads.push(args);if(readThrows)throw new Error('read unavailable');
+   const at=args.offset??0;const chunk=raw.subarray(at,at+args.maxBytes);
+   return {offset:at,next_offset:at+chunk.length,earliest_offset:0,stream_head:raw.length,
+     state:'exited',exit_code:0,data_base64:chunk.toString('base64')};},
+ };
+ return {runtime,calls};
+}
+async function invoke(f){
+ const oldProfile=process.env.DEADBYTE_COMMANDER_COMPAT_PROFILE;
+ const oldRoot=process.env.DEADBYTE_COMMANDER_COMPAT_ROOT;
+ process.env.DEADBYTE_COMMANDER_COMPAT_PROFILE='repl';
+ process.env.DEADBYTE_COMMANDER_COMPAT_ROOT='core';
+ try{
+  const a=createCommanderWireAdapter({processRuntime:f.runtime});
+  return await a.handlers.start_process({command:'echo sample',timeout_ms:1000});
+ }finally{
+  if(oldProfile===undefined)delete process.env.DEADBYTE_COMMANDER_COMPAT_PROFILE;
+  else process.env.DEADBYTE_COMMANDER_COMPAT_PROFILE=oldProfile;
+  if(oldRoot===undefined)delete process.env.DEADBYTE_COMMANDER_COMPAT_ROOT;
+  else process.env.DEADBYTE_COMMANDER_COMPAT_ROOT=oldRoot;
+ }
+}
+test('R139 start_process returns already-ready output preview without waiting or consuming output cursor',async()=>{
+ const f=mock();const res=await invoke(f);
+ assert.equal(res.structuredContent.pid,29139);
+ assert.equal(res.structuredContent.initial_output,'hello from child\n');
+ assert.equal(res.structuredContent.initial_output_truncated,false);
+ assert.match(res.content[0].text,/hello from child/);
+ assert.equal(f.calls.reads.length,1);
+ assert.equal(f.calls.reads[0].waitMs,0);
+ assert.equal(f.calls.reads[0].offset,0);
+ assert.ok(f.calls.reads[0].maxBytes<=16384);
+});
+test('R139 start_process preserves started session if quick output probe fails',async()=>{
+ const f=mock({readThrows:true});const res=await invoke(f);
+ assert.equal(f.calls.started,1);
+ assert.equal(res.structuredContent.pid,29139);
+ assert.equal(res.structuredContent.initial_output,'');
+ assert.equal(res.structuredContent.output_preview_unavailable,true);
+});

package/test/r139-search-partial.test.mjs

@@ -0,0 +1,42 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createCommanderWireAdapter} from '../src/commander-wire-adapter-r47.mjs';
+
+const root='D:\\R139-SEARCH';
+const mockFs={policy:{roots:{core:{real_path:root}}}};
+const pause=()=>new Promise(resolve=>setImmediate(resolve));
+
+test('R139 search returns the completed first page while later pages are still running',async()=>{
+ let resume,entered=false,calls=0;
+ const block=new Promise(r=>resume=r);
+ const adapter=createCommanderWireAdapter({machineFsRuntime:mockFs,searchRuntime:async args=>{
+   calls++;
+   if(calls===1)return {matches:[{path:'one.txt',line:1,preview:'alpha'}],next_cursor:'page-2'};
+   entered=true;await block;
+   return {matches:[{path:'two.txt',line:2,preview:'alpha'}],next_cursor:null};
+ }});
+ const started=await adapter.handlers.start_search({path:root,pattern:'alpha',searchType:'content',ignoreCase:true});
+ try{
+  for(let i=0;i<20&&!entered;i++)await pause();
+  assert.equal(entered,true);
+  const partial=await adapter.handlers.get_more_search_results({sessionId:started.sessionId,offset:0,length:10});
+  assert.deepEqual(partial.results.map(x=>x.file),['one.txt']);
+  assert.equal(partial.isComplete,false);
+  assert.equal(partial.totalResults,1);
+  assert.equal(partial.hasMoreResults,true);
+  resume();
+  for(let i=0;i<20;i++){await pause();const done=await adapter.handlers.get_more_search_results({sessionId:started.sessionId,offset:0,length:10});if(done.isComplete){assert.deepEqual(done.results.map(x=>x.file),['one.txt','two.txt']);return;}}
+  assert.fail('search did not complete after second page released');
+ }finally{resume();}
+});
+
+test('R139 completed search returns cached page immediately without another runtime search',async()=>{
+ let calls=0;
+ const adapter=createCommanderWireAdapter({machineFsRuntime:mockFs,searchRuntime:async()=>{calls++;return {matches:[{path:'matched.txt',line:1,preview:'ok'}],next_cursor:null};}});
+ const start=await adapter.handlers.start_search({path:root,pattern:'matched',searchType:'files'});
+ let done;
+ for(let i=0;i<20;i++){await pause();done=await adapter.handlers.get_more_search_results({sessionId:start.sessionId,offset:0,length:10});if(done.isComplete)break;}
+ assert.equal(done.isComplete,true);
+ assert.equal(done.results[0].file,'matched.txt');
+ assert.equal(calls,1);
+});

package/test/r140-large-text-integrity.test.mjs

@@ -0,0 +1,68 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readCommanderLargeText } from '../src/commander-large-text-r139.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const source = Buffer.from(('line-000000: '+'.'.repeat(85)+'\r\n').repeat(60000), 'utf8');
+
+function native(initial, mutate = null) {
+  let bytes = Buffer.from(initial), reads = 0, fullHashes = 0;
+  return {
+    policy: {max_read_bytes: 256*1024},
+    get counts() { return {reads, fullHashes}; },
+    async read({offset, maxBytes, hashFile}) {
+      reads++;
+      if(mutate) bytes = mutate(bytes, reads) ?? bytes;
+      const part = bytes.subarray(offset, offset + maxBytes);
+      if(hashFile) fullHashes++;
+      return {offset, next_offset: offset + part.length,
+        data_base64:part.toString('base64'), eof:offset + part.length >= bytes.length,
+        file_size:bytes.length, file_sha256:hashFile ? sha(bytes) : null};
+    }
+  };
+}
+
+test('R140 large file hashes once, checks whole delivered stream, and preserves page semantics', async () => {
+  assert.ok(source.length > 4*1024*1024);
+  const runtime = native(source);
+  const result = await readCommanderLargeText({runtime, rootId:'core',
+    relativePath:'large.txt', offset:59997, length:3});
+  assert.equal(result.fileSha256, sha(source));
+  assert.equal(result.totalLines, 60001);
+  assert.equal(result.lineOffset, 59997);
+  assert.equal(result.lineCount, 3);
+  assert.equal(result.content, ('line-000000: '+'.'.repeat(85)+'\n').repeat(3));
+  assert.equal(runtime.counts.fullHashes, 1, 'must not rehash whole file per chunk');
+  assert.ok(runtime.counts.reads > 2);
+});
+
+test('R140 detects same-length mutation of bytes already delivered across page boundary', async () => {
+  const runtime = native(source, (bytes, readNumber) => {
+    if(readNumber === 3) { const changed=Buffer.from(bytes); changed[40]^=1; return changed; }
+  });
+  await assert.rejects(readCommanderLargeText({runtime,rootId:'core',
+    relativePath:'large.txt',offset:59000,length:2}), /changed during paged read|identity mismatch/);
+  assert.equal(runtime.counts.fullHashes,1);
+});
+
+test('R140 detects same-length mutation immediately before closing hash', async () => {
+  const expectedChunks = Math.ceil(source.length / (256*1024));
+  const runtime = native(source, (bytes, readNumber) => {
+    if(readNumber === expectedChunks+1) { const changed=Buffer.from(bytes); changed[2]^=1; return changed; }
+  });
+  await assert.rejects(readCommanderLargeText({runtime,rootId:'core',
+    relativePath:'large.txt',offset:59999,length:1}), /changed during paged read|identity mismatch/);
+});
+
+test('R140 rejects untrusted or absent closing SHA-256 identity', async () => {
+  const runtime = native(source);
+  const original=runtime.read.bind(runtime);
+  runtime.read = async args => {
+    const result=await original(args);
+    if(args.hashFile) result.file_sha256=null;
+    return result;
+  };
+  await assert.rejects(readCommanderLargeText({runtime,rootId:'core',
+    relativePath:'large.txt',offset:1,length:1}), /identity missing/);
+});

package/test/r141-commander-tail-utf8.test.mjs

@@ -0,0 +1,55 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createCommanderWireAdapter} from '../src/commander-wire-adapter-r47.mjs';
+
+const PATH='D:\\R141-TAIL\\log.txt';
+function fixture(data,{maxRead=64,tailFileOffset=null}={}){
+ const bytes=Buffer.from(data); let reads=0;
+ const fs={
+   policy:{roots:{core:{real_path:'D:\\R141-TAIL'}},max_read_bytes:maxRead},
+   async read({offset=0,maxBytes,hashFile=false}){
+     reads++;
+     const at=offset<0?Math.max(0,bytes.length+offset):offset;
+     const part=bytes.subarray(at,at+maxBytes);
+     return {status:'ok',offset:at,next_offset:at+part.length,
+       file_size:bytes.length,eof:at+part.length>=bytes.length,
+       file_sha256:null,data_base64:part.toString('base64')};
+   }
+ };
+ return {fs,reads:()=>reads};
+}
+test('R141 negative tail rejects invalid UTF-8 instead of silently introducing replacement characters', async()=>{
+ const runtime=fixture(Buffer.concat([Buffer.from('ok\ninvalid '),Buffer.from([0xc3,0x28]),Buffer.from('\n')]));
+ const api=createCommanderWireAdapter({machineFsRuntime:runtime.fs});
+ await assert.rejects(api.handlers.read_file({path:PATH,offset:-1}),/valid UTF-8|UTF-8/);
+});
+test('R141 negative tail rejects embedded NUL just like positive text detection',async()=>{
+ const runtime=fixture(Buffer.from('ok\ntail\0broken\n'));
+ const api=createCommanderWireAdapter({machineFsRuntime:runtime.fs});
+ await assert.rejects(api.handlers.read_file({path:PATH,offset:-1}),/NUL|binary/);
+});
+test('R141 negative tail does not decode the leading partial UTF-8 line',async()=>{
+ const prefix=Buffer.from('prefix '+('x'.repeat(18))+'é-not-selected\n');
+ const bytes=Buffer.concat([prefix,Buffer.from('valid-一\nlast-€\n')]);
+ const tailLen=bytes.length-(prefix.indexOf(Buffer.from('é'))+1);
+ const runtime=fixture(bytes,{maxRead:tailLen});
+ const api=createCommanderWireAdapter({machineFsRuntime:runtime.fs});
+ const result=await api.handlers.read_file({path:PATH,offset:-2});
+ assert.equal(result.content[0].text,'valid-一\nlast-€');
+ assert.equal(result.structuredContent.tailByteOffset,bytes.length-tailLen);
+});
+test('R141 tail decodes intact multibyte UTF-8 CRLF lines',async()=>{
+ const runtime=fixture(Buffer.from('old\r\n漢字\r\nterminus €\r\n'));
+ const api=createCommanderWireAdapter({machineFsRuntime:runtime.fs});
+ const result=await api.handlers.read_file({path:PATH,offset:-2});
+ assert.equal(result.content[0].text,'漢字\nterminus €');
+ assert.equal(result.structuredContent.lineCount,2);
+});
+
+test('R141 keeps a complete first line when the bounded tail begins exactly at a line boundary',async()=>{
+ const source=Buffer.from('header!\nlast-1\nlast-2\n');
+ const runtime=fixture(source,{maxRead:14});
+ const api=createCommanderWireAdapter({machineFsRuntime:runtime.fs});
+ const result=await api.handlers.read_file({path:PATH,offset:-2});
+ assert.equal(result.content[0].text,'last-1\nlast-2');
+});

package/test/r141-real-windows-disk.test.mjs

@@ -0,0 +1,71 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,readFile,writeFile,open,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {readCommanderLargeText} from '../src/commander-large-text-r139.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const source=Buffer.from(('deadbyte-0123456789-'+'.'.repeat(87)+'\r\n').repeat(52000));
+assert.ok(source.length > 5*1024*1024);
+
+async function withFixture(fn){
+ const dir=await mkdtemp(join(tmpdir(),'deadbyte-r141-real-io-'));
+ const file=join(dir,'test.log');
+ await writeFile(file,source);
+ try { await fn(file); } finally { await rm(dir,{recursive:true,force:true}); }
+}
+function diskRuntime(file,{mutateAt=Infinity}={}){
+ let reads=0,hashed=0;
+ return {
+  policy:{max_read_bytes:256*1024},
+  get calls(){return {reads,hashed};},
+  async read({offset,maxBytes,hashFile=false}){
+   reads++;
+   if(reads===mutateAt){
+    const command='const fs=require("fs");const f=process.argv[1];const fd=fs.openSync(f,"r+");const b=Buffer.from([0x58]);fs.writeSync(fd,b,0,1,3);fs.fsyncSync(fd);fs.closeSync(fd)';
+    const child=spawnSync(process.execPath,['-e',command,file],{windowsHide:true});
+    assert.equal(child.status,0,child.stderr?.toString());
+   }
+   const h=await open(file,'r');
+   let n=0,part=Buffer.alloc(maxBytes);
+   try { ({bytesRead:n}=await h.read(part,0,maxBytes,offset)); } finally {await h.close();}
+   part=part.subarray(0,n);
+   const current=await readFile(file);
+   let fileSha256=null;
+   if(hashFile){hashed++;fileSha256=sha(current);}
+   return {offset,next_offset:offset+n,file_size:current.length,
+    eof:offset+n>=current.length,data_base64:part.toString('base64'),file_sha256:fileSha256};
+  }
+ };
+}
+test('R141 5MiB+ physical Windows filesystem read matches independent file digest',async()=>{
+ await withFixture(async file=>{
+  const runtime=diskRuntime(file);
+  const result=await readCommanderLargeText({runtime,rootId:'core',relativePath:file,offset:51998,length:2});
+  assert.equal(result.fileSha256,sha(await readFile(file)));
+  assert.equal(result.totalLines,52001);
+  assert.equal(result.lineCount,2);
+  assert.equal(runtime.calls.hashed,1);
+  assert.ok(runtime.calls.reads>20);
+ });
+});
+test('R141 cross-process same-size on-disk mutation between pages fails closed',async()=>{
+ await withFixture(async file=>{
+  const before=sha(await readFile(file));
+  const runtime=diskRuntime(file,{mutateAt:4});
+  await assert.rejects(readCommanderLargeText({runtime,rootId:'core',relativePath:file,offset:51998,length:2}),/identity mismatch/);
+  assert.notEqual(sha(await readFile(file)),before);
+  assert.equal(runtime.calls.hashed,1);
+ });
+});
+test('R141 cross-process late mutation before native closing hash fails closed',async()=>{
+ await withFixture(async file=>{
+  const pages=Math.ceil(source.length/(256*1024));
+  const runtime=diskRuntime(file,{mutateAt:pages+1});
+  await assert.rejects(readCommanderLargeText({runtime,rootId:'core',relativePath:file,offset:51998,length:2}),/identity mismatch/);
+  assert.equal(runtime.calls.hashed,1);
+ });
+});

package/test/r142-native-machinefs-authority.test.mjs

@@ -0,0 +1,127 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../src/machine-fs.mjs';
+import { writeBoundStandingGrant } from './r65-authority-fixture.mjs';
+import { readCommanderLargeText } from '../src/commander-large-text-r139.mjs';
+
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+const line = 'R142-EVIDENCE:' + '.'.repeat(95) + '\r\n';
+const bytes = Buffer.from(line.repeat(50000));
+assert.ok(bytes.length > 5 * 1024 * 1024);
+
+async function isolatedFixture({grant=true,read=true}={}) {
+  const state = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r142-authority-'));
+  const project = path.join(state,'project');
+  await mkdir(project);
+  const file = path.join(project,'large.log');
+  await writeFile(file,bytes);
+  const policyFile = path.join(state,'coding-policy.json');
+  const leaseFile = path.join(state,'runtime','coding-grant.json');
+  await writeFile(policyFile, JSON.stringify({
+    schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:leaseFile,evidence_dir:path.join(state,'evidence'),
+    roots:{project:{path:project,read,write:false,exec:false,deny_paths:[]}},
+    commands:{},max_read_bytes:262144,max_write_bytes:65536
+  }));
+  const policy = await loadCodingPolicy(policyFile);
+  if(grant) await writeBoundStandingGrant('coding', leaseFile, {
+    schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,
+    instance_nonce:'c'.repeat(64),root_ids:['project'],granted_at_utc:new Date().toISOString()
+  });
+  const keys = await generateTrustKeypair({
+    privateKeyPath:path.join(state,'private.pem'),publicKeyPath:path.join(state,'public.pem')
+  });
+  return {state,file,policy,keys,runtime:createMachineFsRuntime({
+    policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath
+  })};
+}
+
+function modifyViaOtherProcess(file) {
+  const script = 'const fs=require("node:fs");const fd=fs.openSync(process.argv[1],"r+");' +
+    'const n=Buffer.from("X");fs.writeSync(fd,n,0,1,14);fs.fsyncSync(fd);fs.closeSync(fd)';
+  const child = spawnSync(process.execPath,['-e',script,file],{
+    windowsHide:true,encoding:'utf8',timeout:15000
+  });
+  assert.equal(child.status,0,child.stderr || String(child.error));
+}
+
+function instrument(real,file,{mutateCall=Infinity}={}) {
+  let reads=0,hashRequests=0;
+  return {
+    policy:real.policy,
+    counters:()=>({reads,hashRequests}),
+    async read(args){
+      reads++;
+      if(reads===mutateCall) modifyViaOtherProcess(file);
+      if(args.hashFile) hashRequests++;
+      return real.read(args);
+    }
+  };
+}
+
+test('R142 real MachineFS signed isolated read authority, native pages and final SHA',async()=>{
+  const f=await isolatedFixture();
+  try {
+    const runtime=instrument(f.runtime,f.file);
+    const result=await readCommanderLargeText({
+      runtime,rootId:'project',relativePath:'large.log',offset:49998,length:2
+    });
+    assert.equal(result.fileSha256,digest(await readFile(f.file)));
+    assert.equal(result.bytesScanned,bytes.length);
+    assert.equal(result.totalLines,50001);
+    assert.equal(result.lineCount,2);
+    assert.equal(runtime.counters().hashRequests,1);
+    assert.ok(runtime.counters().reads>20);
+  } finally {await rm(f.state,{recursive:true,force:true});}
+});
+
+test('R142 real MachineFS detects same-size concurrent child writer before an intermediate page',async()=>{
+  const f=await isolatedFixture();
+  try {
+    const runtime=instrument(f.runtime,f.file,{mutateCall:4});
+    await assert.rejects(readCommanderLargeText({
+      runtime,rootId:'project',relativePath:'large.log',offset:49998,length:2
+    }),/large text file changed during paged read: identity mismatch/);
+    assert.notEqual(digest(await readFile(f.file)),digest(bytes));
+    assert.equal(runtime.counters().hashRequests,1);
+  } finally {await rm(f.state,{recursive:true,force:true});}
+});
+
+test('R142 real MachineFS detects same-size child writer just before closing hash',async()=>{
+  const f=await isolatedFixture();
+  try {
+    const chunks=Math.ceil(bytes.length/262144);
+    const runtime=instrument(f.runtime,f.file,{mutateCall:chunks+1});
+    await assert.rejects(readCommanderLargeText({
+      runtime,rootId:'project',relativePath:'large.log',offset:49998,length:2
+    }),/large text file changed during paged read: identity mismatch/);
+    assert.equal(runtime.counters().hashRequests,1);
+  } finally {await rm(f.state,{recursive:true,force:true});}
+});
+
+test('R142 real MachineFS rejects reads denied by isolated root policy even when disarmed',async()=>{
+  const f=await isolatedFixture({grant:false,read:false});
+  try {
+    await assert.rejects(readCommanderLargeText({
+      runtime:f.runtime,rootId:'project',relativePath:'large.log',offset:0,length:1
+    }),/does not allow read/i);
+  } finally {await rm(f.state,{recursive:true,force:true});}
+});
+
+test('R142 disarmed MachineFS permits explicitly policy-authorized read-only access',async()=>{
+  const f=await isolatedFixture({grant:false,read:true});
+  try {
+    const one=await f.runtime.read({rootId:'project',relativePath:'large.log',offset:0,maxBytes:64,hashFile:false});
+    assert.equal(Buffer.from(one.data_base64,'base64').toString('utf8'),bytes.subarray(0,64).toString('utf8'));
+    await assert.rejects(f.runtime.write({
+      rootId:'project',relativePath:'no-write.txt',content:'x',expectedSha256:'absent'
+    }),/disarmed|does not allow write|authority/i);
+  } finally {await rm(f.state,{recursive:true,force:true});}
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r74-prepublish-contract.test.mjs

@@ -9,7 +9,9 @@ import {verifyR74PrepublishContract} from '../scripts/npm-prepublish-contract-r7
 const repoRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 
 test('R74 prepublish contract: positive path succeeds and verifies identities', async () => {
-  const result = await verifyR74PrepublishContract({rootPath: repoRoot});
+  const manifestVerification = process.env.DEADBYTE_TEST_PROTECTED_MANIFEST === 'installed' ? 'installed' : 'source';
+  const result = await verifyR74PrepublishContract({rootPath: repoRoot, manifestVerification});
+  assert.equal(result.checks.manifest_verification_mode, manifestVerification);
   assert.equal(result.schema, 'deadbyte.r74-prepublish-contract.v1');
   assert.equal(result.valid, true);
   assert.equal(result.checks.predecessors_distinct, true);
@@ -18,9 +20,9 @@ test('R74 prepublish contract: positive path succeeds and verifies identities',
   assert.equal(result.checks.package_leak_check.ok, true);
   assert.equal(result.checks.no_self_referential_tarball_hash, true);
   assert.equal(result.identities.package_name, 'deadbyte-mcp');
-  // This R74 component contract remains scoped to train R74, even when
-  // the containing npm package is the R130 0.15.50 security candidate.
-  assert.equal(result.identities.package_version, '0.15.50');
+  // R74 component contract retains its train-specific source and predecessor assertions;
+  // the containing R143 package must report its actual immutable package version.
+  assert.equal(result.identities.package_version, '0.15.52');
   assert.equal(result.identities.target_train, 'R74');
   assert.equal(result.identities.published_source_predecessor, '0.15.46');
   assert.notEqual(result.identities.published_source_predecessor, result.identities.runtime_predecessor);