deadbyte-mcp 0.15.61 → 0.15.63

package/test/r156-supervisor-pacing.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {startAutonomousSupervisor} from '../src/autonomous-supervisor.mjs';
+
+const goalId='a'.repeat(64);
+async function fixture(run,status={state:'pending'},backend='openai_compatible'){
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r156-supervisor-'));
+  await mkdir(path.join(dir,'goals',goalId),{recursive:true});
+  const policy={planner:{backend},evidence_dir:dir};
+  let statusCalls=0;
+  const runtime={policy,status:async()=>{statusCalls++;return status;},run};
+  const supervisor=startAutonomousSupervisor({runtime,policy,continuous:false,
+    idleDelayMs:750,maxCycles:3,logger:{warn(){},error(){}}});
+  return {supervisor,get statusCalls(){return statusCalls;},dispose:async()=>{await supervisor.stop();await rm(dir,{recursive:true,force:true});}};
+}
+
+test('R156 a goal waiting for retry does not count as runnable work',async()=>{
+  let calls=0;
+  const f=await fixture(async()=>{calls++;throw new Error('provider disconnected');});
+  try{
+    assert.equal(await f.supervisor.scanNow(),1,'initial work was attempted');
+    assert.equal(calls,1);
+    assert.ok(f.supervisor.failures.get(goalId)?.retry_at>Date.now(),'retry deadline recorded');
+    assert.equal(await f.supervisor.scanNow(),0,'backoff goal is not actionable');
+    assert.equal(calls,1,'provider not invoked during backoff');
+    assert.equal(f.statusCalls,1,'backoff must not issue a redundant goal-status read');
+  }finally{await f.dispose();}
+});
+
+test('R156 provider-backed Codex app server is dispatched by the outer loop',async()=>{
+  let calls=0;
+  const f=await fixture(async()=>{calls++;return {status:'succeeded'};},{state:'pending'},'codex_app_server');
+  try{
+    assert.equal(await f.supervisor.scanNow(),1);
+    assert.equal(calls,1);
+  }finally{await f.dispose();}
+});
+
+test('R156 client sampling cannot run unattended without a connected model',async()=>{
+  let calls=0;
+  const f=await fixture(async()=>{calls++;return {status:'succeeded'};},{state:'pending'},'client_sampling');
+  try{
+    assert.equal(await f.supervisor.scanNow(),0);
+    assert.equal(calls,0);
+  }finally{await f.dispose();}
+});
+
+test('R156 the supervisor never runs a paused goal that requires owner action',async()=>{
+  let calls=0;
+  const f=await fixture(async()=>{calls++;throw new Error('must not invoke');},{state:'paused',reason:'owner_approval_required'});
+  try{
+    assert.equal(await f.supervisor.scanNow(),0);
+    assert.equal(calls,0);
+    assert.equal(f.supervisor.failures.size,0);
+  }finally{await f.dispose();}
+});

package/test/r157-architecture-map.mjs

@@ -0,0 +1,61 @@
+import {readdir,readFile,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+const root='D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r157-reference-convergence';
+const dir=path.join(root,'src');
+const all=(await readdir(dir,{withFileTypes:true})).filter(x=>x.isFile()&&x.name.endsWith('.mjs')).map(x=>x.name).sort();
+const known=new Set(all);
+const links=new Map(),externals=new Map(),incoming=new Map(all.map(name=>[name,0]));
+for(const f of all){
+ const contents=await readFile(path.join(dir,f),'utf8');
+ const rx=/\b(?:import\s*(?:[^'"()]*?\sfrom\s*)?|export\s+[^'"()]*?\sfrom\s*|import\s*\()\s*['"]([^'"]+)['"]/g;
+ const local=new Set(),external=new Set();let match;
+ while((match=rx.exec(contents))){
+  const target=match[1];
+  if(target.startsWith('./')){
+    const base=path.posix.normalize(path.posix.join(path.posix.dirname(f),target));
+    if(known.has(base))local.add(base);
+  }else if(!target.startsWith('../'))external.add(target.split('/')[0]);
+ }
+ links.set(f,[...local].sort());
+ externals.set(f,[...external].sort());
+ for(const v of local)incoming.set(v,(incoming.get(v)||0)+1);
+}
+const starts=['mcp-server.mjs','deadbyte-cli.mjs','remote-live-log.mjs','autonomous-supervisor-host.mjs','autonomous-runtime.mjs','autonomous-supervisor.mjs'];
+function traverse(start){
+ const seen=new Set(),stack=[start];
+ while(stack.length){const f=stack.pop();if(!known.has(f)||seen.has(f))continue;seen.add(f);stack.push(...(links.get(f)||[]));}
+ return [...seen].sort();
+}
+const groups={
+ transport:['mcp-server.mjs','deadbyte-cli.mjs','remote-bridge.mjs','remote-live-log.mjs','machine-identity.mjs','machine-ping.mjs'],
+ lifecycle:['foreground-marker-cas-win32.mjs','foreground-process-identity.mjs','remote-session-guardian.mjs','process-runtime.mjs','autonomous-local-supervisor.mjs'],
+ authority:['authority-continuity-r65.mjs','privileged-install-trust-r89.mjs','epoch-lock-r85.mjs','coding-plane.mjs','autonomous-policy.mjs'],
+ mutations:['native-diff.mjs','atomic-mutation.mjs','coding-plane.mjs','runtime-update.mjs','release-generation.mjs'],
+ automation:['autonomous-supervisor.mjs','autonomous-runtime.mjs','autonomous-progress.mjs','autonomous-loop-state.mjs','autonomous-planner.mjs'],
+ visibility:['remote-live-log.mjs','audit.mjs','observation.mjs','evidence-verify.mjs'],
+ release:['release-generation.mjs','runtime-update.mjs','doctor-installation-r58.mjs','clean-activation-recovery-r153.mjs']
+};
+const graph={schema:'deadbyte.r157-dependency-graph.v1',method:'regex static relative ESM import/export graph; not runtime reachability; excludes dynamic constructed imports and nested folders',module_count:all.length,edges:[...links].reduce((n,[,v])=>n+v.length,0),entrypoints:starts.map(s=>({name:s,present:known.has(s),reachable:traverse(s).length})),topIncoming:[...incoming].sort((a,b)=>b[1]-a[1]).slice(0,25).map(([name,count])=>({name,count})),groups:Object.fromEntries(Object.entries(groups).map(([k,files])=>[k,files.map(name=>({name,exists:known.has(name),imports:links.get(name)??[],referencedBy:incoming.get(name)||0}))])),files:Object.fromEntries([...links].map(([name,deps])=>[name,{deps,externals:externals.get(name)}]))};
+await writeFile(path.join(root,'docs','R157-ARCHITECTURE-GRAPH.json'),JSON.stringify(graph,null,2)+'\n');
+const text=['# DEADBYTE MCP R157 static dependency map','','Not a runtime reachability guarantee. Graph parses literal top-level relative ESM imports only.','',
+'| Boundary | Runtime entry / related source | Security / compatibility rule |',
+'|---|---|---|',
+'| Public MCP and remote | mcp-server.mjs / deadbyte-cli.mjs / remote-live-log.mjs | machine identity and live request/result pairing |',
+'| Session ownership | foreground-marker-cas-win32.mjs / remote-session-guardian.mjs | file identity, PID+creation identity, explicit revoke |',
+'| Privileged epoch | authority-continuity-r65.mjs / privileged-install-trust-r89.mjs | owner-approved OS-owned root, deny untrusted ACL writes |',
+'| Coding and native diffs | coding-plane.mjs / native-diff.mjs / atomic-mutation.mjs | bounded roots and exact SHA-256 preconditions |',
+'| Autonomous engine | autonomous-supervisor.mjs / autonomous-runtime.mjs / autonomous-progress.mjs | bounded retries, receipts, owner approval and durable goals |',
+'| Release generation | runtime-update.mjs / release-generation.mjs | signed exact promotion, rollback, manifest match |',
+'','## Entrypoint reachability from literal imports'];
+for(const e of graph.entrypoints)text.push('- '+e.name+': present='+e.present+', static reachable files='+e.reachable);
+text.push('','## Most referenced modules within src/');
+for(const e of graph.topIncoming)text.push('- '+e.name+' <- '+e.count+' static imports');
+text.push('','## Explicit integration work','',
+'- R89 protected source routing is candidate-only. Actual install provision / owner consent / revoke remains unverified.',
+'- R155 default LiveLogs focused checks pass, but full Windows regression and startup reconciliation are not closed.',
+'- R156/R157 autonomous supervisor is test-backed; release identity has not changed.',
+'- A code source import does not prove an IPC, host process, or cloud boundary. Prove via isolated end-to-end test.',
+'','## Rebuild','',
+'node test/r157-architecture-map.mjs');
+await writeFile(path.join(root,'docs','R157-ARCHITECTURE-DEPENDENCIES.md'),text.join('\n')+'\n');
+console.log(JSON.stringify({status:'ok',modules:graph.module_count,edges:graph.edges,entrypoints:graph.entrypoints,output:'docs/R157-ARCHITECTURE-DEPENDENCIES.md'}));

package/test/r157-reference-survey.mjs

@@ -0,0 +1,91 @@
+import {readdir,lstat,readFile,mkdir,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+const root='D:\\Projects\\deadbyte-mcp\\references';
+const output='D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r157-reference-convergence\\docs';
+const ignore=new Set(['.git','node_modules','vendor','.venv','venv','__pycache__','target','build','.next','.nuxt','coverage','.cache']);
+const source=/\.(mjs|cjs|js|jsx|ts|tsx|py|rs|go|cpp|h|c|cs|ps1|sh)$/i;
+const testing=/(^|\/)(test|tests|e2e|specs|fixtures|__tests__)(\/|$)|\.(test|spec)\./i;
+const manifest=/(^|\/)(package\.json|pyproject\.toml|Cargo\.toml|go\.mod|requirements[\w.-]*\.txt|LICENSE[\w.-]*|COPYING[\w.-]*)$/i;
+const patterns={
+ protocol:/\b(mcp|listTools|callTool|tools\/call|capabilities)\b/i,
+ sessions:/\b(session|foreground|reconnect|heartbeat|resume|ownership|handle)\b/i,
+ processes:/\b(spawn|execFile|subprocess|process\.kill|Start-Process|CreateProcess)\b/i,
+ filesystem:/\b(readFile|writeFile|edit_block|glob|directory|filesystem|file_search|path\.resolve)\b/i,
+ desktop:/\b(screenshot|uiautomation|SetCursorPos|mouse|keyboard|pyautogui|computer use|CUA)\b/i,
+ recovery:/\b(recover|rollback|retry|backoff|restart|idempotent|crash)\b/i,
+ logs:/\b(audit|logging|livelog|timeline|telemetry|trace|stream)\b/i,
+ authority:/\b(permission|authorization|grant|consent|ACL|approve|revoke)\b/i,
+ tests:/\b(assert|test\(|describe\(|pytest|unittest|benchmark|mock|fixture)\b/i,
+ agent_loop:/\b(planner|supervisor|agent.loop|critic|evaluate|goal|retry.policy)\b/i
+};
+const profiles=[];
+const tops=(await readdir(root,{withFileTypes:true})).filter(x=>x.isDirectory()).map(x=>x.name).sort();
+for(const name of tops){
+ const base=path.join(root,name);
+ const stack=[{dir:base,depth:0}],dirs=[],files=[],skips=[];
+ let truncated=false;
+ while(stack.length){
+  const {dir,depth}=stack.pop();
+  let ch;try{ch=await readdir(dir,{withFileTypes:true});}catch(e){skips.push({path:path.relative(base,dir),reason:e.code});continue;}
+  for(const x of ch){
+   const abs=path.join(dir,x.name),rel=path.relative(base,abs).replaceAll('\\','/');
+   if(x.isSymbolicLink()){skips.push({path:rel,reason:'symlink'});continue;}
+   if(x.isDirectory()){
+    dirs.push(rel);
+    if(ignore.has(x.name)){skips.push({path:rel,reason:'generated_or_dependencies'});continue;}
+    if(depth>27){truncated=true;continue;}
+    stack.push({dir:abs,depth:depth+1});
+   }else if(x.isFile()){
+    if(files.length>=55000){truncated=true;continue;}
+    try{const st=await lstat(abs);files.push({path:rel,size:st.size,source:source.test(rel),test:testing.test(rel),manifest:manifest.test(rel),ext:path.extname(rel).toLowerCase()});}catch{}
+   }
+  }
+ }
+ files.sort((a,b)=>a.path.localeCompare(b.path));
+ const found=Object.fromEntries(Object.keys(patterns).map(k=>[k,{count:0,paths:[]}]));
+ const manifests=[];
+ for(const f of files){
+  if(f.manifest&&manifests.length<100){
+    const m={path:f.path};
+    if(f.path.endsWith('package.json')&&f.size<200000){
+     try{const obj=JSON.parse(await readFile(path.join(base,f.path),'utf8'));m.name=obj.name;m.version=obj.version;m.license=obj.license;m.engines=obj.engines;m.dependencies=Object.keys(obj.dependencies||{}).slice(0,35);}catch{m.error='parse';}
+    }else if(/LICENSE|COPYING/i.test(path.basename(f.path))&&f.size<200000){
+     try{m.header=(await readFile(path.join(base,f.path),'utf8')).slice(0,320).replace(/\s+/g,' ').slice(0,180);}catch{}
+    }else if(f.size<100000){try{m.header=(await readFile(path.join(base,f.path),'utf8')).slice(0,800).replace(/\s+/g,' ').slice(0,170);}catch{}}
+    manifests.push(m);
+  }
+  if(!(f.source||f.test)||f.size>300000||f.size===0)continue;
+  let txt;try{txt=await readFile(path.join(base,f.path),'utf8');}catch{continue;}
+  for(const [key,rx] of Object.entries(patterns)){
+   if(rx.test(txt)){found[key].count++;if(found[key].paths.length<5)found[key].paths.push(f.path);}
+  }
+ }
+ const ext={};for(const f of files)if(f.source)ext[f.ext]=(ext[f.ext]||0)+1;
+ const p={name,files:files.length,directories:dirs.length,source_count:files.filter(f=>f.source).length,test_count:files.filter(f=>f.test).length,manifest_count:manifests.length,top_dirs:[...new Set(dirs.map(x=>x.split('/')[0]))].sort(),ext,manifests,found,truncated,skipped_count:skips.length,skips:skips.slice(0,85),candidate_files:files.filter(f=>f.test||/README|SECURITY|CHANGELOG|POLICY/i.test(f.path)).slice(0,100).map(f=>f.path)};
+ profiles.push(p);
+ console.log('SURVEY '+name+' files='+p.files+' source='+p.source_count+' tests='+p.test_count+' dirs='+p.directories+' skips='+p.skipped_count);
+}
+await mkdir(output,{recursive:true});
+const inventory={schema:'deadbyte.reference-survey.r157.v1',root,generated_at_utc:new Date().toISOString(),method:'Read-only recursive scan of all reference subdirs except declared generated/dependency exclusions; token signals are NOT feature proof',dirs:tops,profiles};
+await writeFile(path.join(output,'R157-REFERENCE-INVENTORY.json'),JSON.stringify(inventory,null,2)+'\n');
+const md=['# R157 reference matrix','','Source/token inventory only, not proof of runtime behavior. No reference code was executed or imported.','',
+'| Repository | Files | Sources | Tests | License or manifest evidence | Source signals |',
+'|---|---:|---:|---:|---|---|'];
+for(const p of profiles){
+ const licenses=p.manifests.filter(m=>m.license||/LICENSE|COPYING/i.test(m.path)).slice(0,3).map(m=>m.license?m.path+': '+m.license:m.path);
+ const features=Object.entries(p.found).filter(v=>v[1].count).sort((a,b)=>b[1].count-a[1].count).slice(0,5).map(v=>v[0]+'='+v[1].count);
+ md.push('| '+p.name.replaceAll('|','/')+' | '+p.files+' | '+p.source_count+' | '+p.test_count+' | '+(licenses.join('; ')||'NOT FOUND')+' | '+features.join('; ')+' |');
+}
+md.push('','## Per-repository source and test evidence');
+for(const p of profiles){
+ md.push('','### '+p.name,'','Top directories: '+(p.top_dirs.join(', ')||'(none)')+'.','Scan truncated: '+p.truncated+'. Skipped '+p.skipped_count+' symlink/generated locations.');
+ md.push('Manifests: '+p.manifests.slice(0,18).map(m=>m.path+(m.license?' ['+m.license+']':'')).join(' ; '));
+ for(const [key,v] of Object.entries(p.found))if(v.count)md.push('- '+key+' matched '+v.count+' sources, examples: '+v.paths.join(' ; '));
+ if(!p.manifests.some(m=>m.license||/LICENSE|COPYING/i.test(m.path)))md.push('- LICENSE UNVERIFIED: do not reuse source code without separate review.');
+}
+md.push('','## Triage and boundary','',
+'Inspect matched source plus tests before asserting any capability. Prefer algorithm redesign and benchmarked adaptation to bulk code copying.',
+'Preserve DEADBYTE machine identity, explicit authority, native diff, signed receipts, existing tool count and rollback. No third-party runtime imports until security and license review.',
+'R89/R155 release blockers still precede new features. Next: inspect concrete Desktop Commander implementation paths; test one candidate improvement on an isolated R157 fixture.');
+await writeFile(path.join(output,'R157-REFERENCE-CAPABILITY-MATRIX.md'),md.join('\n')+'\n');
+console.log('REFERENCE_SCAN_DONE repositories='+profiles.length+' total_source='+profiles.reduce((n,p)=>n+p.source_count,0)+' total_test='+profiles.reduce((n,p)=>n+p.test_count,0));

package/test/r157-supervisor-singleflight.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import {mkdtemp,mkdir,rm} from 'node:fs/promises';
+import {startAutonomousSupervisor} from '../src/autonomous-supervisor.mjs';
+const goal='b'.repeat(64);
+
+test('R157 simultaneous supervisor scans share one real dispatch',async()=>{
+ const tmp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r157-singleflight-'));
+ let calls=0,statusCalls=0,release;
+ try{
+  await mkdir(path.join(tmp,'goals',goal),{recursive:true});
+  const gate=new Promise(resolve=>{release=resolve;});
+  const policy={planner:{backend:'openai_compatible'},evidence_dir:tmp};
+  const runtime={policy,
+   status:async()=>{statusCalls++;return {state:'pending'};},
+   run:async()=>{calls++;await gate;return {status:'succeeded'};}
+  };
+  const s=startAutonomousSupervisor({runtime,policy,continuous:false,logger:{warn(){},error(){}}});
+  try{
+    const first=s.scanNow(),second=s.scanNow();
+    // Allow both async scans to reach their run call.
+    await new Promise(resolve=>setTimeout(resolve,35));
+    assert.equal(calls,1,'overlapping scans must not launch two goal runs');
+    release();
+    const results=await Promise.all([first,second]);
+    assert.deepEqual(results,[1,1]);
+    assert.equal(statusCalls,1,'no redundant status read during in-flight scan');
+  }finally{release();await s.stop();}
+ }finally{await rm(tmp,{recursive:true,force:true});}
+});

package/test/r158-epoch-bootstrap.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import {readFile} from 'node:fs/promises';
+import assert from 'node:assert/strict';
+import {parseUpdateArgs} from '../src/runtime-update.mjs';
+import {verifyTrustedEpochRelease} from '../src/trusted-epoch-bootstrap-r158.mjs';
+const base=['--stage','stage','--development-root','dev','--expected-version','0.15.62','--expected-manifest','a'.repeat(64)];
+test('R158 explicit protected Epoch root CLI rejects relative/UNC/drive-relative/empty and duplicate requests',()=>{
+  const valid='C:\\Program Files\\DEADBYTE-Epoch-Exact';
+  assert.equal(parseUpdateArgs([...base,'--authority-epoch-root',valid]).authorityEpochRoot,valid);
+  assert.equal(parseUpdateArgs(base).authorityEpochRoot,null);
+  for(const invalid of ['relative\\epoch','\\\\server\\share\\epoch','C:relative']){
+    assert.throws(()=>parseUpdateArgs([...base,'--authority-epoch-root',invalid]),/epoch root.*drive-absolute/i);
+  }
+  assert.throws(()=>parseUpdateArgs([...base,'--authority-epoch-root',valid,'--authority-epoch-root',valid]),/duplicate/i);
+});
+test('R158 root verification requires independently protected exact-release code',async t=>{
+  if(process.platform!=='win32'){t.skip('Windows trusted ACL');return;}
+  const fake='C:\\Users\\Public\\R158-untrusted-epoch';
+  await assert.rejects(verifyTrustedEpochRelease({epochRoot:fake,releaseRoot:fake,nodeExecutable:process.execPath}),/trusted|protected|ACL|root/i);
+});
+test('R158 optional live read-only protected 0.15.61 root preflight',async t=>{
+  const epochRoot=process.env.DEADBYTE_R158_TRUST_ROOT;
+  const releaseRoot=process.env.DEADBYTE_R158_RELEASE_ROOT;
+  if(!epochRoot||!releaseRoot){t.skip('requires explicit protected and release roots');return;}
+  const d=await verifyTrustedEpochRelease({epochRoot,releaseRoot,nodeExecutable:process.execPath});
+  assert.equal(d.root,epochRoot);
+  assert.ok(d.checked_files>=10);
+});
+test('R158 protected path flows from CLI to preflight and cannot bypass OS ACL verification',async()=>{
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/authorityEpochRoot:args\.authorityEpochRoot/);
+  assert.match(source,/verifyTrustedEpochRelease\(/);
+  assert.match(source,/control\.config\.AuthorityEpochRoot=proof\.root/);
+});

package/test/r159-legacy-marker-evidence.test.mjs

@@ -0,0 +1,103 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {selectLegacyMarkerEvidence} from '../src/legacy-marker-evidence-r159.mjs';
+const sha=x=>createHash('sha256').update(x).digest('hex');
+const id=c=>c.repeat(64);
+const old={release_id:'v0.15.45-OLD',version:'0.15.45',manifest_sha256:id('1'),generation_manifest_sha256:id('2')};
+const current={release_id:'v0.15.61-CURRENT',version:'0.15.61',manifest_sha256:id('3'),generation_manifest_sha256:id('4')};
+async function fixture(t){
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r159-locator-'));
+ const evidenceDir=path.join(root,'legacy-migration');await mkdir(evidenceDir);
+ t.after(()=>rm(root,{recursive:true,force:true}));
+ async function record(marker,predecessor,opts={}){
+   const body={schema:'deadbyte.r153-marker-reconciliation-intent.v1',state:'RECONCILIATION_CLAIMED',marker_sha256:marker,predecessor,subject_sha256:id('5')};
+   const intent=path.join(evidenceDir,'marker-'+marker+'.intent.json');
+   const intentBytes=Buffer.from(JSON.stringify(body)+'\n');
+   await writeFile(intent,intentBytes);
+   let terminalFile=null;
+   if(opts.terminal!==false){
+     terminalFile=path.join(evidenceDir,'marker-'+marker+'.terminal.json');
+     await writeFile(terminalFile,JSON.stringify({schema:'deadbyte.r153-marker-reconciliation.v1',state:'MARKER_RECONCILED',marker_sha256:marker,predecessor,intent_sha256:sha(intentBytes),subject_sha256:id('6')})+'\n');
+   }
+   return {intent,terminal:terminalFile};
+ }
+ async function locator(marker,receipt){
+   await writeFile(path.join(evidenceDir,'r153-pending-migration.json'),
+     JSON.stringify({schema:'deadbyte.r153-pending-migration.v1',marker_sha256:marker,receipt_path:receipt,receipt_sha256:sha(await readFile(receipt))})+'\n');
+ }
+ return {root,evidenceDir,record,locator};
+}
+test('R159 stale singleton locator does not hide current release terminal',async t=>{
+ const f=await fixture(t),o=await f.record(id('a'),old),n=await f.record(id('b'),current);
+ await f.locator(id('a'),o.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'completed');assert.equal(v.pending.markerSha256,id('b'));assert.equal(v.pending.terminal,n.terminal);
+});
+test('R159 current pending intent not masked by historic locator',async t=>{
+ const f=await fixture(t),o=await f.record(id('a'),old),n=await f.record(id('b'),current,{terminal:false});
+ await f.locator(id('a'),o.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'pending');assert.equal(v.pending.intent,n.intent);
+});
+test('R159 two matching pending intents fail closed',async t=>{
+ const f=await fixture(t);await f.record(id('a'),current,{terminal:false});await f.record(id('b'),current,{terminal:false});
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/multiple.*pending|ambiguous/i);
+});
+test('R159 current locator accepted after hash and subject',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);await f.locator(id('b'),c.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'located');assert.equal(v.receiptPath,c.terminal);assert.match(v.receiptSha256,/^[a-f0-9]{64}$/);
+});
+test('R159 tampered locator fails closed',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);await f.locator(id('b'),c.terminal);await writeFile(c.terminal,'{}\n');
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/hash|invalid|mismatch/i);
+});
+test('R159 no evidence on clean start',async t=>{
+ const f=await fixture(t);const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});assert.equal(v.kind,'none');
+});
+test('R159 forged terminal with wrong intent hash fails closed',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);
+ const forged=JSON.parse(await readFile(c.terminal,'utf8'));
+ forged.intent_sha256=id('0');
+ await writeFile(c.terminal,JSON.stringify(forged)+'\n');
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/intent|mismatch/i);
+});
+test('R159 two unlocated completed current receipts remain ambiguous',async t=>{
+ const f=await fixture(t);await f.record(id('a'),current);await f.record(id('b'),current);
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/multiple|ambiguous/i);
+});
+test('R159 remote foreground code routes historical locators through subject selection',async()=>{
+ const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+ assert.match(cli,/selectLegacyMarkerEvidence\(\{evidenceDir,activePointer,\s*allowCompletedHistory:historyAllowed\|\|onlinePredecessorReady\}\)/);
+ assert.match(cli,/assertRuntimeReadyObservation\(runtime,\{coreRoot:activePointer\.release_root\}\)/);
+ assert.match(cli,/R164 predecessor changed during completed-history classification/);
+ assert.match(cli,/assertRuntimeReadyObservation\(observedAuthority\(ctx\),\{coreRoot:readback\.release_root\}\)/);
+ assert.match(cli,/R159 active release changed during marker recovery/);
+ assert.match(cli,/marker-'\+reconciled\.marker_sha256\+'\.locator\.json'/);
+ assert.doesNotMatch(cli,/publishExclusiveJson\(locatorPath,locator\)/);
+});
+
+// R159 case discovered from production: multiple independently completed
+// terminals should not force selection of an arbitrary recovery proof.
+test('R159 completed history requires explicit exact-release permission',async t=>{
+ const f=await fixture(t);
+ await f.record(id('a'),current);
+ await f.record(id('b'),current);
+ // Existing default must remain fail closed, even when no intents are pending.
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/ambiguous/i);
+ const allowed=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current,allowCompletedHistory:true});
+ assert.equal(allowed.kind,'completed_history_ambiguous');
+ assert.equal(allowed.count,2);
+});
+test('R159 CLI requires exact package identity before skipping completed history',async()=>{
+ const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+ assert.match(source,/activePointer\?\.version===DEADBYTE_VERSION/);
+ assert.match(source,/activePointer\?\.manifest_sha256===currentManifestSha256/);
+ assert.match(source,/activePointer\?\.release_id===/);
+ assert.match(source,/allowCompletedHistory:historyAllowed/);
+ assert.match(source,/selected\.kind==='completed_history_ambiguous'/);
+});

package/test/r159-legacy-marker-evidence.test.mjs.before-assertion-fix-20261025-120246.bak

@@ -0,0 +1,100 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {selectLegacyMarkerEvidence} from '../src/legacy-marker-evidence-r159.mjs';
+const sha=x=>createHash('sha256').update(x).digest('hex');
+const id=c=>c.repeat(64);
+const old={release_id:'v0.15.45-OLD',version:'0.15.45',manifest_sha256:id('1'),generation_manifest_sha256:id('2')};
+const current={release_id:'v0.15.61-CURRENT',version:'0.15.61',manifest_sha256:id('3'),generation_manifest_sha256:id('4')};
+async function fixture(t){
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r159-locator-'));
+ const evidenceDir=path.join(root,'legacy-migration');await mkdir(evidenceDir);
+ t.after(()=>rm(root,{recursive:true,force:true}));
+ async function record(marker,predecessor,opts={}){
+   const body={schema:'deadbyte.r153-marker-reconciliation-intent.v1',state:'RECONCILIATION_CLAIMED',marker_sha256:marker,predecessor,subject_sha256:id('5')};
+   const intent=path.join(evidenceDir,'marker-'+marker+'.intent.json');
+   const intentBytes=Buffer.from(JSON.stringify(body)+'\n');
+   await writeFile(intent,intentBytes);
+   let terminalFile=null;
+   if(opts.terminal!==false){
+     terminalFile=path.join(evidenceDir,'marker-'+marker+'.terminal.json');
+     await writeFile(terminalFile,JSON.stringify({schema:'deadbyte.r153-marker-reconciliation.v1',state:'MARKER_RECONCILED',marker_sha256:marker,predecessor,intent_sha256:sha(intentBytes),subject_sha256:id('6')})+'\n');
+   }
+   return {intent,terminal:terminalFile};
+ }
+ async function locator(marker,receipt){
+   await writeFile(path.join(evidenceDir,'r153-pending-migration.json'),
+     JSON.stringify({schema:'deadbyte.r153-pending-migration.v1',marker_sha256:marker,receipt_path:receipt,receipt_sha256:sha(await readFile(receipt))})+'\n');
+ }
+ return {root,evidenceDir,record,locator};
+}
+test('R159 stale singleton locator does not hide current release terminal',async t=>{
+ const f=await fixture(t),o=await f.record(id('a'),old),n=await f.record(id('b'),current);
+ await f.locator(id('a'),o.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'completed');assert.equal(v.pending.markerSha256,id('b'));assert.equal(v.pending.terminal,n.terminal);
+});
+test('R159 current pending intent not masked by historic locator',async t=>{
+ const f=await fixture(t),o=await f.record(id('a'),old),n=await f.record(id('b'),current,{terminal:false});
+ await f.locator(id('a'),o.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'pending');assert.equal(v.pending.intent,n.intent);
+});
+test('R159 two matching pending intents fail closed',async t=>{
+ const f=await fixture(t);await f.record(id('a'),current,{terminal:false});await f.record(id('b'),current,{terminal:false});
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/multiple.*pending|ambiguous/i);
+});
+test('R159 current locator accepted after hash and subject',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);await f.locator(id('b'),c.terminal);
+ const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});
+ assert.equal(v.kind,'located');assert.equal(v.receiptPath,c.terminal);assert.match(v.receiptSha256,/^[a-f0-9]{64}$/);
+});
+test('R159 tampered locator fails closed',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);await f.locator(id('b'),c.terminal);await writeFile(c.terminal,'{}\n');
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/hash|invalid|mismatch/i);
+});
+test('R159 no evidence on clean start',async t=>{
+ const f=await fixture(t);const v=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current});assert.equal(v.kind,'none');
+});
+test('R159 forged terminal with wrong intent hash fails closed',async t=>{
+ const f=await fixture(t),c=await f.record(id('b'),current);
+ const forged=JSON.parse(await readFile(c.terminal,'utf8'));
+ forged.intent_sha256=id('0');
+ await writeFile(c.terminal,JSON.stringify(forged)+'\n');
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/intent|mismatch/i);
+});
+test('R159 two unlocated completed current receipts remain ambiguous',async t=>{
+ const f=await fixture(t);await f.record(id('a'),current);await f.record(id('b'),current);
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/multiple|ambiguous/i);
+});
+test('R159 remote foreground code routes historical locators through subject selection',async()=>{
+ const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+ assert.match(cli,/selectLegacyMarkerEvidence\(\{evidenceDir,activePointer\}\)/);
+ assert.match(cli,/R159 active release changed during marker recovery/);
+ assert.match(cli,/marker-'\+reconciled\.marker_sha256\+'\.locator\.json'/);
+ assert.doesNotMatch(cli,/publishExclusiveJson\(locatorPath,locator\)/);
+});
+
+// R159 case discovered from production: multiple independently completed
+// terminals should not force selection of an arbitrary recovery proof.
+test('R159 completed history requires explicit exact-release permission',async t=>{
+ const f=await fixture(t);
+ await f.record(id('a'),current);
+ await f.record(id('b'),current);
+ // Existing default must remain fail closed, even when no intents are pending.
+ await assert.rejects(selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current}),/ambiguous/i);
+ const allowed=await selectLegacyMarkerEvidence({evidenceDir:f.evidenceDir,activePointer:current,allowCompletedHistory:true});
+ assert.equal(allowed.kind,'completed_history_ambiguous');
+ assert.equal(allowed.count,2);
+});
+test('R159 CLI requires exact package identity before skipping completed history',async()=>{
+ const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+ assert.match(source,/activePointer\?\.version===DEADBYTE_VERSION/);
+ assert.match(source,/activePointer\?\.manifest_sha256===currentManifestSha256/);
+ assert.match(source,/activePointer\?\.release_id===/);
+ assert.match(source,/allowCompletedHistory:historyAllowed/);
+ assert.match(source,/selected\.kind==='completed_history_ambiguous'/);
+});

package/test/r160-marker-proof.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {
+  selectLegacyMarkerEvidence,
+  verifyLocatedLegacyMarkerReceipt
+} from '../src/legacy-marker-evidence-r159.mjs';
+import {createMarkerReconciliationReceipt} from '../src/clean-activation-recovery-r153.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const id=value=>value.repeat(64);
+const pointer=Object.freeze({
+  release_id:'v0.15.61-CURRENT',version:'0.15.61',
+  manifest_sha256:id('1'),generation_manifest_sha256:id('2')
+});
+const policySha256=Object.freeze({
+  process:id('3'),coding:id('4'),autonomous:id('5'),desktop:id('6'),host:id('7')
+});
+const authority=Object.freeze({process:false,coding:false,autonomous:false,desktop:false,host:false});
+const proofFor=(markerSha256,policies=policySha256)=>digest(Buffer.from(canonicalJson({
+  pointer,policy_sha256:policies,marker_sha256:markerSha256,authority
+}),'utf8'));
+
+async function locatedFixture(t,{tamper}={}){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r160-located-'));
+  const evidenceDir=path.join(root,'legacy-migration');
+  await mkdir(evidenceDir);
+  t.after(()=>rm(root,{recursive:true,force:true}));
+  const markerSha256=id('a'),intentSha256=id('b');
+  const receipt=createMarkerReconciliationReceipt({
+    pointer,policySha256,markerSha256,
+    proofSha256:proofFor(markerSha256),
+    observedAtUtc:'2026-10-25T00:00:00.000Z',intentSha256
+  });
+  const terminal=tamper?tamper({...receipt}):receipt;
+  const terminalPath=path.join(evidenceDir,`marker-${markerSha256}.terminal.json`);
+  const terminalBytes=Buffer.from(`${JSON.stringify(terminal)}\n`,'utf8');
+  await writeFile(terminalPath,terminalBytes);
+  await writeFile(path.join(evidenceDir,'r153-pending-migration.json'),`${JSON.stringify({
+    schema:'deadbyte.r153-pending-migration.v1',marker_sha256:markerSha256,
+    receipt_path:terminalPath,receipt_sha256:digest(terminalBytes)
+  })}\n`);
+  return {evidenceDir,terminalPath};
+}
+
+test('R160 located receipt is accepted only after R153 proof binding verification',async t=>{
+  const fixture=await locatedFixture(t);
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  const verified=await verifyLocatedLegacyMarkerReceipt({located:selected,pointer,policySha256});
+  assert.equal(verified.state,'MARKER_RECONCILED');
+  assert.equal(verified.receipt_path,fixture.terminalPath);
+  assert.match(verified.receipt_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('R160 consistent locator and terminal hashes cannot hide a wrong proof subject',async t=>{
+  const fixture=await locatedFixture(t,{tamper:receipt=>({...receipt,proof_sha256:id('f')})});
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  assert.equal(selected.kind,'located','R159 selector alone accepts the internally consistent bytes');
+  await assert.rejects(
+    verifyLocatedLegacyMarkerReceipt({located:selected,pointer,policySha256}),
+    /proof binding mismatch|subject mismatch|predecessor drift/i
+  );
+});
+
+test('R160 located receipt verification rejects policy drift after selection',async t=>{
+  const fixture=await locatedFixture(t);
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  await assert.rejects(
+    verifyLocatedLegacyMarkerReceipt({
+      located:selected,pointer,policySha256:{...policySha256,coding:id('c')}
+    }),
+    /proof binding mismatch|predecessor drift/i
+  );
+});
+
+test('R160 CLI rechecks active pointer after located proof verification',async()=>{
+  const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  assert.match(source,/R160 active release changed after located marker verification/);
+  const verifyAt=source.indexOf('verifyLocatedLegacyMarkerReceipt({located:selected,pointer:readback,policySha256})');
+  const finalReadAt=source.indexOf('await readActiveRuntimeBinding(ctx.root)',verifyAt);
+  assert.ok(verifyAt>0&&finalReadAt>verifyAt,'final pointer read-back must follow proof verification');
+});
+