deadbyte-mcp 0.15.63 → 0.15.65

package/scripts/gate-windows-r166.ps1

@@ -0,0 +1,57 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param([ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight')
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.61-055d1ff0aa99e60b'
+$parentSha='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf'
+$parentGen='f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    if($null -eq $nodeArgs -or $nodeArgs.Count -lt 1){throw "R166_${label}_NO_NODE_ARGUMENTS"}
+    Write-Output "R166_STAGE_START=$label"
+    Write-Output "R166_STAGE_ARGS=$($nodeArgs.Count)"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R166_${label}_FAILED exit=$exit"}
+    Write-Output "R166_STAGE_PASS=$label"
+}
+Push-Location $repo
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    if($pkg.version -ne '0.15.64' -or $release.version -ne '0.15.64' -or $release.train -ne 'R166'){throw 'R166_CANDIDATE_VERSION_DRIFT'}
+    if($release.runtime_predecessor.release_id -ne $parentId -or $release.runtime_predecessor.manifest_sha256 -ne $parentSha -or $release.runtime_predecessor.generation_manifest_sha256 -ne $parentGen){throw 'R166_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'}
+    $active=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+    if($active.version -ne '0.15.61' -or $active.release_id -ne $parentId -or $active.manifest_sha256 -ne $parentSha -or $active.generation_manifest_sha256 -ne $parentGen){throw 'R166_ACTIVE_RUNTIME_DRIFT'}
+    if((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -ne $parentSha){throw 'R166_ACTIVE_MANIFEST_MISMATCH'}
+    Write-Output 'R166_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        Run-Node -label 'focused' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=1','test/r89-privileged-install-boundary.test.mjs','test/r92-acl-ace-applicability.test.mjs','test/r153-clean-activation-recovery.test.mjs','test/r155-commander-live-log.test.mjs','test/r155-default-live-log.test.mjs','test/r156-supervisor-pacing.test.mjs','test/r157-supervisor-singleflight.test.mjs','test/r158-epoch-bootstrap.test.mjs','test/r159-legacy-marker-evidence.test.mjs','test/r160-marker-proof.test.mjs','test/r160-package-decision-manifest.test.mjs','test/r160-stable-launcher.test.mjs','test/r160-release-contract.test.mjs','test/r59-tool-surface-compat.test.mjs')
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previous=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r160-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{[IO.Directory]::CreateDirectory($isolated)|Out-Null;$env:DEADBYTE_STATE_ROOT=$isolated;Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')}
+        finally{$env:DEADBYTE_STATE_ROOT=$previous;Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+    Write-Output 'R166_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{Pop-Location}

package/scripts/gate-windows-r167.ps1

@@ -0,0 +1,75 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight',
+    [string]$ExpectedDevelopmentRoot
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+if([string]::IsNullOrWhiteSpace($ExpectedDevelopmentRoot)){$ExpectedDevelopmentRoot=$repo}
+$ExpectedDevelopmentRoot=[IO.Path]::GetFullPath($ExpectedDevelopmentRoot)
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.61-055d1ff0aa99e60b'
+$parentSha='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf'
+$parentGen='f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
+$sourceManifest='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    if($null -eq $nodeArgs -or $nodeArgs.Count -lt 1){throw "R167_${label}_NO_NODE_ARGUMENTS"}
+    Write-Output "R167_STAGE_START=$label"
+    Write-Output "R167_STAGE_ARGS=$($nodeArgs.Count)"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R167_${label}_FAILED exit=$exit"}
+    Write-Output "R167_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$ExpectedDevelopmentRoot
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    if($pkg.version -ne '0.15.65' -or $release.version -ne '0.15.65' -or $release.train -ne 'R167'){throw 'R167_CANDIDATE_VERSION_DRIFT'}
+    if($release.source_predecessor.version -ne '0.15.64' -or $release.source_predecessor.train -ne 'R166' -or $release.r167.source_predecessor_manifest_sha256 -ne $sourceManifest){throw 'R167_SOURCE_PREDECESSOR_IDENTITY_DRIFT'}
+    if($release.runtime_predecessor.release_id -ne $parentId -or $release.runtime_predecessor.manifest_sha256 -ne $parentSha -or $release.runtime_predecessor.generation_manifest_sha256 -ne $parentGen){throw 'R167_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'}
+    $active=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+    if($active.version -ne '0.15.61' -or $active.release_id -ne $parentId -or $active.manifest_sha256 -ne $parentSha -or $active.generation_manifest_sha256 -ne $parentGen){throw 'R167_ACTIVE_RUNTIME_DRIFT'}
+    if((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -ne $parentSha){throw 'R167_ACTIVE_MANIFEST_MISMATCH'}
+    Write-Output 'R167_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        Run-Node -label 'focused' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=1','test/r167-activation-path.test.mjs','test/r167-release-contract.test.mjs','test/r160-release-contract.test.mjs','test/r158-epoch-bootstrap.test.mjs','test/r65-activation-orchestration.test.mjs','test/r89-privileged-install-boundary.test.mjs','test/r119-recovery-crash-after-commit.test.mjs','test/r59-tool-surface-compat.test.mjs')
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        if(-not (Test-Path -LiteralPath $scratchDrive -PathType Container)){throw 'R167_CROSS_VOLUME_DRIVE_UNAVAILABLE'}
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R167-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previous=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r167-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{[IO.Directory]::CreateDirectory($isolated)|Out-Null;$env:DEADBYTE_STATE_ROOT=$isolated;Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')}
+        finally{$env:DEADBYTE_STATE_ROOT=$previous;Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+    Write-Output 'R167_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot;Pop-Location}

package/scripts/npm-release-r48.mjs

@@ -9,6 +9,8 @@ import {assertR72NpmPublishReady} from './npm-release-readiness-r72.mjs';
 import {assertR74NpmPublishReady} from './npm-release-readiness-r74.mjs';
 import {assertR163NpmPublishReady} from './npm-release-readiness-r163.mjs';
 import {assertR165NpmPublishReady} from './npm-release-readiness-r165.mjs';
+import {assertR166NpmPublishReady} from './npm-release-readiness-r166.mjs';
+import {assertR167NpmPublishReady,assertR167PackedIdentity} from './npm-release-readiness-r167.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -105,6 +107,15 @@ async function main() {
     if (!publishOnly) throw new Error('PUBLISH_BLOCKED R165 0.15.63 requires --publish-only; production activation is a separate authority boundary');
     await assertR165NpmPublishReady(release,{root});
   }
+  if (!isVerifyOnly && version==='0.15.64') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R166 requires --publish-only; activation is separate');
+    await assertR166NpmPublishReady(release,{root});
+  }
+  let r167Readiness=null;
+  if (!isVerifyOnly && version==='0.15.65') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R167 requires --publish-only; activation is separate');
+    r167Readiness=await assertR167NpmPublishReady(release,{root});
+  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
@@ -227,6 +238,10 @@ async function main() {
     const localBytes = await readFile(publishTarball);
     const localIntegrity=`sha512-${createHash('sha512').update(localBytes).digest('base64')}`;
     if(packRecord.integrity&&packRecord.integrity!==localIntegrity)throw new Error('npm packed artifact integrity changed before publication');
+    if(r167Readiness)assertR167PackedIdentity({
+      ...r167Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
 
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;

package/scripts/npm-release-readiness-r166.mjs

@@ -0,0 +1,37 @@
+import {readFile,lstat} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const required=(v,m)=>{if(!v)throw new Error('PUBLISH_BLOCKED R166 '+m)};
+const hex=s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s);
+async function checkedFile(f,expected){
+  required(hex(expected),'missing log hash');
+  const s=await lstat(f);
+  required(s.isFile()&&!s.isSymbolicLink()&&s.size>0&&s.size<32*1024*1024,'invalid log');
+  const b=await readFile(f);required(sha(b)===expected,'log digest differs');return b.toString('utf8');
+}
+export async function assertR166NpmPublishReady(release,{root}={}){
+  required(release?.version==='0.15.64'&&release?.train==='R166'&&release?.r166?.scope==='WINDOWS_GATE_AND_SIGNED_PRECONDITION_RECOVERY_HOTFIX','candidate metadata invalid');
+  required(release?.parent?.release_id==='v0.15.61-055d1ff0aa99e60b'&&release?.source_predecessor?.version==='0.15.63','lineage mismatch');
+  const evidence=process.env.DEADBYTE_R166_CLOSURE_ROOT;
+  required(root&&path.isAbsolute(root)&&evidence&&path.isAbsolute(evidence),'closure root absent');
+  const allowed=path.resolve(root,'..','..','testing','r166-final-gate');
+  required(path.resolve(evidence).toLowerCase()===allowed.toLowerCase(),'closure root not in scoped testing folder');
+  const data=JSON.parse(await readFile(path.join(evidence,'closure.json'),'utf8'));
+  required(data?.schema==='deadbyte.r166-release-closure.v1'&&data.status==='PASS'&&data.version==='0.15.64','closure status mismatch');
+  required(data?.production_release_id===release.parent.release_id&&hex(data.manifest_sha256),'predecessor or manifest invalid');
+  required(data.manifest_sha256===sha(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  const gate=await checkedFile(path.join(evidence,'windows-gate.protected.stdout.log'),data.gate_stdout_sha256);
+  const verify=await checkedFile(path.join(evidence,'npm-verify.stdout.log'),data.verify_stdout_sha256);
+  required(gate.includes('R166_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION')&&gate.includes('MANIFEST_VERIFY_OK')&&gate.includes('R166_STAGE_PASS=full'),'Windows full gate transcript incomplete');
+  const matches=[...gate.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(matches.length>0,'full TAP summary absent');
+  const full=matches.at(-1);
+  const tests=Number(full[1]),passes=Number(full[3]),fails=Number(full[4]),skips=Number(full[6]);
+  required(tests>=1960&&passes>=1908&&fails===0&&skips<=55&&passes+skips===tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),'exact npm tarball gate missing');
+  const tar=verify.split(/\r?\n/).find(x=>x.startsWith('VERIFIED_TARBALL '));
+  let identity;try{identity=JSON.parse(tar.slice('VERIFIED_TARBALL '.length));}catch{required(false,'tarball evidence malformed');}
+  required(identity.filename==='deadbyte-mcp-0.15.64.tgz'&&hex(identity.sha256)&&identity.bytes>0,'tarball subject invalid');
+  return Object.freeze({status:'R166_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:data.manifest_sha256,tests,passes,skips});
+}

package/scripts/npm-release-readiness-r167.mjs

@@ -0,0 +1,70 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const required=(value,message)=>{if(!value)throw new Error(`PUBLISH_BLOCKED R167 ${message}`);};
+
+async function checkedFile(file,expected,{maxBytes=32*1024*1024}={}){
+  required(hex(expected),'evidence digest missing');
+  const info=await lstat(file);
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+export function assertR167PackedIdentity({
+  tarball_sha256,tarball_integrity,tarball_shasum,
+  observedSha256,observedIntegrity,observedShasum
+}={}){
+  required(hex(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR167NpmPublishReady(release,{root}={}){
+  required(release?.version==='0.15.65'&&release?.train==='R167'&&
+    release?.r167?.scope==='TRUSTED_EPOCH_ACTIVATION_ENTRYPOINT_AND_EXPLICIT_ROOT_FORWARDING',
+    'candidate metadata invalid');
+  required(release?.parent?.release_id==='v0.15.61-055d1ff0aa99e60b'&&
+    release?.source_predecessor?.version==='0.15.64'&&release?.source_predecessor?.train==='R166',
+    'lineage mismatch');
+  const evidence=process.env.DEADBYTE_R167_CLOSURE_ROOT;
+  required(root&&path.isAbsolute(root)&&evidence&&path.isAbsolute(evidence),'closure root absent');
+  const allowed=path.resolve(root,'..','..','testing','r167-final-gate-final');
+  required(path.resolve(evidence).toLowerCase()===allowed.toLowerCase(),'closure root not in scoped testing folder');
+  const closure=JSON.parse(await readFile(path.join(evidence,'closure.json'),'utf8'));
+  required(closure?.schema==='deadbyte.r167-release-closure.v1'&&closure.status==='PASS'&&closure.version==='0.15.65',
+    'closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&hex(closure.manifest_sha256),'predecessor or manifest invalid');
+  required(closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+
+  const receiptBytes=await checkedFile(path.join(evidence,'protected-install-receipt.json'),closure.protected_receipt_sha256);
+  const receipt=JSON.parse(receiptBytes.toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.65'&&
+    receipt.source_manifest_sha256===closure.manifest_sha256&&receipt.protected_manifest_sha256===closure.manifest_sha256,
+    'protected exact-byte receipt mismatch');
+
+  const focused=(await checkedFile(path.join(evidence,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(evidence,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(evidence,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R167_STAGE_PASS=focused')&&focused.includes('# fail 0'),'focused protected gate incomplete');
+  required(full.includes('R167_STAGE_PASS=full')&&full.includes('# fail 0'),'full protected gate incomplete');
+  const summaries=[...full.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,'full TAP summary absent');
+  const final=summaries.at(-1),tests=Number(final[1]),passes=Number(final[3]),fails=Number(final[4]),skips=Number(final[6]);
+  required(tests>=1971&&passes>=1921&&fails===0&&skips<=50&&passes+skips===tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),
+    'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{required(false,'tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.65.tgz'&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum&&artifact.bytes>0,
+    'tarball identity mismatch');
+  return Object.freeze({status:'R167_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,tests,passes,skips});
+}

package/src/activation-lock-r65.mjs

@@ -114,7 +114,7 @@ async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
      body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
      body.attempted_pointer!==null||body.rollback?.attempted!==false||
      !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
-     !/^host command 'powershell_script' executable pin drift detected;/.test(String(body.error?.message??''))||
+     !(/^(?:host command 'powershell_script' executable pin drift detected;|windows release gate package script invalid$)/.test(String(body.error?.message??'')))||
      !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
      !samePointerIdentity(body.prior_pointer,current))return false;
   return true;

package/src/activation-path-r167.mjs

@@ -0,0 +1,55 @@
+import path from 'node:path';
+
+function canonicalWindowsRoot(value,label){
+  if(typeof value!=='string'||value.length===0)throw new Error(`${label} requires a path`);
+  if(value.includes('\0')||value.startsWith('\\\\')||value.startsWith('\\\\?\\')||value.includes('/'))
+    throw new Error(`${label} must be a canonical local Windows path`);
+  if(!/^[A-Za-z]:\\/.test(value)||!path.win32.isAbsolute(value))
+    throw new Error(`${label} must be an absolute local Windows path`);
+  const normalized=path.win32.normalize(value);
+  if(normalized!==value||/(?:^|\\)\.\.?($|\\)/.test(value))
+    throw new Error(`${label} must be canonical`);
+  return value;
+}
+
+const samePath=(left,right)=>path.win32.normalize(left).toLowerCase()===path.win32.normalize(right).toLowerCase();
+
+export function parseActivationPathFlags(argv){
+  if(!Array.isArray(argv))throw new TypeError('deploy argv must be an array');
+  let authorityEpochRoot=null,developmentRoot=null;
+  const remainingArgs=[];
+  for(let index=0;index<argv.length;index++){
+    const arg=argv[index];
+    if(arg!=='--authority-epoch-root'&&arg!=='--development-root'){
+      remainingArgs.push(arg);continue;
+    }
+    const value=argv[++index];
+    if(arg==='--authority-epoch-root'){
+      if(authorityEpochRoot!==null)throw new Error('duplicate --authority-epoch-root');
+      authorityEpochRoot=canonicalWindowsRoot(value,'--authority-epoch-root');
+    }else{
+      if(developmentRoot!==null)throw new Error('duplicate --development-root');
+      developmentRoot=canonicalWindowsRoot(value,'--development-root');
+    }
+  }
+  return Object.freeze({authorityEpochRoot,developmentRoot,remainingArgs:Object.freeze(remainingArgs)});
+}
+
+export function assertTrustedActivationEntrypoint({continuity,packageRoot,authorityEpochRoot,developmentRoot,trusted}){
+  if(continuity!=='EPOCH_NATIVE')return Object.freeze({authorityEpochRoot,developmentRoot});
+  const epoch=canonicalWindowsRoot(authorityEpochRoot,'--authority-epoch-root');
+  const development=canonicalWindowsRoot(developmentRoot,'--development-root');
+  const activeRoot=canonicalWindowsRoot(packageRoot,'deploy package root');
+  if(!samePath(activeRoot,epoch))throw new Error('EPOCH_NATIVE activation requires the protected entrypoint package root');
+  if(trusted!==true)throw new Error('EPOCH_NATIVE activation package root is not ACL-trusted');
+  return Object.freeze({authorityEpochRoot:epoch,developmentRoot:development});
+}
+
+export function appendActivationPathArgs(args,{stageRoot,authorityEpochRoot,developmentRoot}){
+  if(!Array.isArray(args))throw new TypeError('updater args must be an array');
+  const stage=canonicalWindowsRoot(stageRoot,'stage root');
+  const epoch=canonicalWindowsRoot(authorityEpochRoot,'--authority-epoch-root');
+  const development=canonicalWindowsRoot(developmentRoot,'--development-root');
+  if(!samePath(stage,epoch))throw new Error('updater stage must equal the protected authority epoch root');
+  return [...args,'--stage',stage,'--development-root',development,'--authority-epoch-root',epoch];
+}

package/src/release-generation.mjs

@@ -87,7 +87,7 @@ async function currentWindowsGateScript(rootPath){
   try{ pkg=JSON.parse(await readFile(packagePath,'utf8')); }
   catch{ throw new Error('windows release gate package.json malformed'); }
   const command=String(pkg?.scripts?.['gate:windows']??'').trim();
-  const match=/^powershell(?:\.exe)?\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-File\s+(scripts\/[A-Za-z0-9._\/-]+\.ps1)$/i.exec(command);
+  const match=/^powershell(?:\.exe)?\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-File\s+(scripts\/[A-Za-z0-9._\/-]+\.ps1)(?:\s+-Stage\s+all)?$/i.exec(command);
   if(!match) throw new Error('windows release gate package script invalid');
   return safeRel(match[1]);
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.63';
+export const DEADBYTE_VERSION = '0.15.65';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/process-policy-refresh.test.mjs

@@ -65,14 +65,17 @@ async function fixture() {
   };
 }
 
-test('R33 candidate process policy self-binds to the current repository root', async () => {
+test('R167 process policy binds coherently to the explicit development root', async () => {
   const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const expectedRoot = path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT || repoRoot);
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
   const policy = JSON.parse(await readFile(policyPath, 'utf8'));
-  assert.equal(policy.grant_file, path.join(repoRoot, 'controller', 'runtime', 'process-grant.json'));
-  assert.equal(policy.state_dir, path.join(repoRoot, 'controller', 'runtime', 'process-state'));
-  assert.equal(policy.native_host.path, path.join(repoRoot, 'bin', 'deadbyte-process-host.exe'));
-  assert.equal(policy.roots.core.path, repoRoot);
+  assert.equal(path.resolve(policy.roots.core.path), expectedRoot);
+  assert.notEqual(expectedRoot, path.parse(expectedRoot).root, 'development root must not be a broad filesystem root');
+  assert.equal(policy.grant_file, path.join(expectedRoot, 'controller', 'runtime', 'process-grant.json'));
+  assert.equal(policy.state_dir, path.join(expectedRoot, 'controller', 'runtime', 'process-state'));
+  assert.equal(policy.native_host.path, path.join(expectedRoot, 'bin', 'deadbyte-process-host.exe'));
+  assert.equal(policy.native_host.sha256, sha256(await readFile(policy.native_host.path)));
   assert.ok(policy.profiles.ping_hold);
   assert.ok(policy.profiles.powershell);
   assert.ok(policy.profiles.powershell_repl);

package/test/r130-release-security-contract.test.mjs

@@ -7,18 +7,18 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-test('R130 security patch has a new immutable package identity and truthful source predecessor',async()=>{
+test('current successor retains the R130 security baseline with truthful R167 identity',async()=>{
   const [pkg,release,provenance,bom,lock,matrix]=await Promise.all([
     read('package.json'),read('RELEASE.json'),read('PROVENANCE.json'),
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.63');
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
-  assert.equal(release.source_predecessor.version,'0.15.62');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/0\.15\.62-r163-release-closure/i);
+    assert.equal(actual,'0.15.65');
+  assert.equal(release.train,'R167');
+  assert.equal(matrix.train,'R167');
+  assert.equal(release.source_predecessor.version,'0.15.64');
+  assert.equal(release.source_predecessor.train,'R166');
+  assert.match(release.source_predecessor.source_path,/0\.15\.64-r166-final/i);
   assert.equal(release.source_predecessor.manifest_status,'VERIFIED_FINAL_BYTES');
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');

package/test/r132-release-identity.test.mjs

@@ -8,22 +8,22 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R165 package identity preserves R132 evidence and published source predecessor',async()=>{
+test('R167 package identity preserves R132 evidence and published R166 source predecessor',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
     read('package.json'),read('package-lock.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
-  assert.equal(release.source_predecessor.version,'0.15.62');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/0\.15\.62-r163-release-closure/i);
+  assert.equal(release.train,'R167');
+  assert.equal(matrix.train,'R167');
+  assert.equal(release.source_predecessor.version,'0.15.64');
+  assert.equal(release.source_predecessor.train,'R166');
+  assert.match(release.source_predecessor.source_path,/0\.15\.64-r166-final/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,release.r165.published_source_tarball_sha256);
+  assert.equal(release.source_predecessor.tarball_sha256,'3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653');
   assert.equal(prov.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);

package/test/r153-prepublish-identity.test.mjs

@@ -22,11 +22,11 @@ const historical=()=>{
       runtime_predecessor:runtime,parent:{...runtime}}};
 };
 const copy=()=>historical();
-test('R153 historical verifier refuses current R160 package identity',async()=>{
+test('R153 historical verifier refuses current successor package identity',async()=>{
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.63');
+ assert.equal(state.pkg.version,'0.15.65');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -3,25 +3,17 @@ import assert from 'node:assert/strict';
 import {readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
-import {DEADBYTE_VERSION} from '../src/version.mjs';
-
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R160 package identity separates source and live runtime predecessors',async()=>{
-  const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
-    read('package.json'),read('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
-    read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
-  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,
-    provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION]) assert.equal(version,'0.15.63');
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
+test('R160 historical contract remains distinct from the current package identity',async()=>{
+  const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
   assert.equal(release.runtime_predecessor.manifest_sha256,'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf');
   assert.equal(release.runtime_predecessor.generation_manifest_sha256,'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.62-r163-release-closure/i);
+  assert.equal(release.r160.source_predecessor_train,'R159');
+  assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
   assert.equal(release.r160.public_tool_delta,0);
   assert.equal(release.r160.authority_scope_delta,0);
   assert.equal(release.r160.production_activation,'NOT_RUN');

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -8,7 +8,7 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const version='0.15.63';
+const version='0.15.65';
 const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
 const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -21,7 +21,7 @@ async function generation(state,label){
   await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
-test('R165 isolated immutable slot activates, rolls back, and restores 0.15.63 without authority or production mutation',async()=>{
+test('R167 isolated immutable slot activates, rolls back, and restores 0.15.65 without authority or production mutation',async()=>{
   const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
   const state=path.join(stateBase,'state');
   try{

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.63');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.65');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');
@@ -65,7 +65,7 @@ async function run(fx){
  assert.doesNotMatch(trace,/\b(?:start|restart|armprocess|armcoding|armautonomous|deploy)\b/i,'unexpected runtime operation');
  return {output:(result.stderr||'')+'\n'+(result.stdout||''),trace};
 }
-gate('R165 executable CLI passes completed R159 history, reaches 0.15.61 -> 0.15.63 synchronization safely',async t=>{
+gate('R167 executable CLI passes completed R159 history, reaches 0.15.61 -> 0.15.65 synchronization safely',async t=>{
  const fx=await fixture(t,'completed');
  const r=await run(fx);
  assert.match(r.output,/runtime coherence 'disarmhost' failed exit=93/i,r.output);

package/test/r166-hotfix-contract.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+const release = await readFile(new URL('../src/release-generation.mjs',import.meta.url),'utf8');
+const gate = await readFile(new URL('../scripts/gate-windows-r166.ps1',import.meta.url),'utf8');
+const pkg = JSON.parse(await readFile(new URL('../package.json',import.meta.url),'utf8'));
+const lock = await readFile(new URL('../src/activation-lock-r65.mjs',import.meta.url),'utf8');
+test('exact Windows gate grammar supports only optional Stage all',()=>{
+  const line = release.split('\n').find(x=>x.includes('const match=/^powershell'));
+  assert.ok(line);
+  const regexSource=line.slice(line.indexOf('const match=')+12,line.lastIndexOf('.exec(command)'));
+  const regex=Function(`return ${regexSource}`)();
+  assert.ok(regex.test(pkg.scripts['gate:windows']));
+  assert.equal(regex.test(pkg.scripts['gate:windows']+'; echo injected'),false);
+  assert.equal(regex.test(pkg.scripts['gate:windows'].replace('all','focused')),false);
+});
+test('corrected gate matches candidate identity',()=>{
+  assert.match(gate,/R166_CANDIDATE_VERSION_DRIFT/);
+  assert.match(gate,/\$pkg.version -ne '0.15.64'/);
+  assert.match(gate,/\$release.train -ne 'R166'/);
+});
+test('recovery is restricted to exact recognized signed preconditions',()=>{
+  assert.match(lock,/windows release gate package script invalid\$/);
+  assert.match(lock,/verifySlotUpdateEnvelope\(signed,publicKey\)/);
+  assert.match(lock,/body.phase!=='initial'/);
+  assert.match(lock,/body.attempted_pointer!==null/);
+});

package/test/r166-release-readiness.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {assertR166NpmPublishReady} from '../scripts/npm-release-readiness-r166.mjs';
+test('R166 publication refuses absent external closure',async()=>{
+  const release=JSON.parse(await readFile(new URL('../RELEASE.json',import.meta.url)));
+  const old=process.env.DEADBYTE_R166_CLOSURE_ROOT;
+  try{delete process.env.DEADBYTE_R166_CLOSURE_ROOT;await assert.rejects(assertR166NpmPublishReady(release,{root:new URL('..',import.meta.url).pathname}),/PUBLISH_BLOCKED R166/);}
+  finally{if(old===undefined)delete process.env.DEADBYTE_R166_CLOSURE_ROOT;else process.env.DEADBYTE_R166_CLOSURE_ROOT=old;}
+});