deadbyte-mcp 0.15.63 → 0.15.65

package/test/r167-activation-path.test.mjs

@@ -0,0 +1,124 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,readdir,rm,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {
+  parseActivationPathFlags,
+  assertTrustedActivationEntrypoint,
+  appendActivationPathArgs
+} from '../src/activation-path-r167.mjs';
+
+const protectedRoot='C:\\Program Files\\DEADBYTE-R167';
+const developmentRoot='D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.65-r167-activation-path';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const H=value=>createHash('sha256').update(value).digest('hex');
+
+test('R167 parses one exact protected epoch root and one separate development root',()=>{
+  const parsed=parseActivationPathFlags([
+    '--preflight','--authority-epoch-root',protectedRoot,'--development-root',developmentRoot
+  ]);
+  assert.equal(parsed.authorityEpochRoot,protectedRoot);
+  assert.equal(parsed.developmentRoot,developmentRoot);
+  assert.deepEqual(parsed.remainingArgs,['--preflight']);
+});
+
+test('R167 rejects missing duplicate relative UNC drive-relative and noncanonical roots',()=>{
+  const invalid=[
+    ['--authority-epoch-root'],
+    ['--development-root'],
+    ['--authority-epoch-root','relative'],
+    ['--authority-epoch-root','\\\\server\\share'],
+    ['--authority-epoch-root','C:relative'],
+    ['--authority-epoch-root','C:\\Program Files\\..\\Writable'],
+    ['--authority-epoch-root',protectedRoot,'--authority-epoch-root',protectedRoot],
+    ['--development-root',developmentRoot,'--development-root',developmentRoot]
+  ];
+  for(const argv of invalid)assert.throws(()=>parseActivationPathFlags(argv));
+});
+
+test('R167 EPOCH_NATIVE activation requires the executing package root to be the trusted protected root',()=>{
+  assert.throws(()=>assertTrustedActivationEntrypoint({
+    continuity:'EPOCH_NATIVE',packageRoot:developmentRoot,
+    authorityEpochRoot:protectedRoot,developmentRoot,trusted:true
+  }),/protected entrypoint/i);
+  assert.throws(()=>assertTrustedActivationEntrypoint({
+    continuity:'EPOCH_NATIVE',packageRoot:protectedRoot,
+    authorityEpochRoot:protectedRoot,developmentRoot,trusted:false
+  }),/ACL-trusted/i);
+  assert.deepEqual(assertTrustedActivationEntrypoint({
+    continuity:'EPOCH_NATIVE',packageRoot:protectedRoot,
+    authorityEpochRoot:protectedRoot,developmentRoot,trusted:true
+  }),{authorityEpochRoot:protectedRoot,developmentRoot});
+});
+
+test('R167 forwards exact protected stage epoch and development roots to updater without fallback',()=>{
+  const args=appendActivationPathArgs(['--expected-version','0.15.65'],{
+    stageRoot:protectedRoot,authorityEpochRoot:protectedRoot,developmentRoot
+  });
+  assert.deepEqual(args,[
+    '--expected-version','0.15.65','--stage',protectedRoot,
+    '--development-root',developmentRoot,'--authority-epoch-root',protectedRoot
+  ]);
+  assert.throws(()=>appendActivationPathArgs([],{
+    stageRoot:developmentRoot,authorityEpochRoot:protectedRoot,developmentRoot
+  }),/stage.*protected/i);
+});
+
+test('R167 writable EPOCH_NATIVE entrypoint rejects before creating an activation claim',
+  {skip:process.platform!=='win32'},async()=>{
+  const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r167-preclaim-'));
+  try{
+    const state=path.join(isolated,'state'),runtime=path.join(state,'runtime'),bin=path.join(state,'bin');
+    const generation=path.join(state,'generations','fixture'),policies=path.join(state,'policies');
+    await Promise.all([mkdir(runtime,{recursive:true}),mkdir(bin,{recursive:true}),mkdir(generation,{recursive:true}),mkdir(policies,{recursive:true})]);
+    const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+    const fields={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
+    const policyPaths={},config=[];
+    const configFields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
+    for(const [plane,field] of Object.entries(fields)){
+      const grant=path.join(runtime,`${plane}-grant.json`),policy=path.join(policies,`${plane}.json`);
+      const body={schema:plane==='host'?'deadbyte.host-policy.v2':`deadbyte.${plane}-policy.v1`,enabled:true,[field]:grant};
+      await writeFile(policy,JSON.stringify(body));
+      policyPaths[plane]=policy;
+      config.push(`${configFields[plane]} = '${policy.replaceAll("'","''")}'`);
+      if(plane==='coding')await writeFile(grant,JSON.stringify({schema:'fixture',nonce:H('coding-grant')}));
+    }
+    const pointer={schema:'deadbyte.active-release.v1',...release.parent,
+      release_root:path.join(state,'releases',release.parent.release_id),generation_root:generation,
+      launcher_sha256:H('launcher'),config_path:path.join(generation,'controller-config.psd1')};
+    await writeFile(pointer.config_path,`@{ ${config.join('; ')} }\n`);
+    const pointerBytes=Buffer.from(JSON.stringify(pointer));
+    await writeFile(path.join(state,'active-release.json'),pointerBytes);
+    const disarmed=plane=>({configured:true,armed:false,reason:plane==='autonomous'?'coding-disarmed':'disarmed'});
+    const observation={schema:'deadbyte.controller-observation.v1',state:'ONLINE',local_ready:true,
+      bridge:{alive:true,reason:'verified',pid:101},core:{alive:true,reason:'verified',pid:102},
+      cloud:{alive:true,reason:'verified',pid:103},supervisor:{running:true},
+      authority:{process:disarmed('process'),coding:{configured:true,armed:true,reason:'standing-grant',epoch_seq:7,epoch_sha256:H('coding-epoch')},
+        autonomous:disarmed('autonomous'),desktop:disarmed('desktop'),host:disarmed('host')}};
+    const observationPath=path.join(state,'observation.json');
+    await writeFile(observationPath,JSON.stringify(observation));
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),`param([string]$Command,[switch]$Json)\nif($Command -ne 'status' -or -not $Json){throw 'mutation attempted'}\nGet-Content -Raw -LiteralPath '${observationPath.replaceAll("'","''")}'\n`);
+    const before=H(pointerBytes);
+    const preflightRun=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),'--preflight',
+      '--authority-epoch-root',protectedRoot,'--development-root',developmentRoot],{
+      env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:30000,windowsHide:true});
+    assert.equal(preflightRun.status,0,preflightRun.stderr);
+    const preflight=JSON.parse(preflightRun.stdout.trim());
+    assert.equal(preflight.authority_continuity,'EPOCH_NATIVE');
+    assert.equal(preflight.activation_entrypoint_state,'REJECTED');
+    assert.equal(preflight.protected_activation_entrypoint,false);
+    assert.match(preflight.activation_entrypoint_reason,/protected|trusted|UNTRUSTED_WRITE_ACE/i);
+    const run=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),
+      '--authority-epoch-root',protectedRoot,'--development-root',developmentRoot],{
+      env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:30000,windowsHide:true});
+    assert.notEqual(run.status,0,run.stdout);
+    assert.match(run.stderr,/trusted|protected|UNTRUSTED_WRITE_ACE/i);
+    assert.equal(H(await readFile(path.join(state,'active-release.json'))),before);
+    const updates=path.join(state,'evidence','updates');
+    await assert.rejects(readdir(updates),error=>error?.code==='ENOENT');
+  }finally{await rm(isolated,{recursive:true,force:true});}
+});

package/test/r167-release-contract.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
+const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
+const VERSION='0.15.65';
+const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
+const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
+
+test('R167 package identity binds published R166 source separately from active R153 runtime',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
+    read('package.json'),readOptional('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
+    read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
+  const versions=[pkg.version,bridge.version,release.version,
+    provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
+  if(lock)versions.push(lock.version,lock.packages[''].version);
+  for(const version of versions)assert.equal(version,VERSION);
+  assert.equal(release.train,'R167');
+  assert.equal(matrix.train,'R167');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r167:0.15.65');
+  assert.deepEqual(release.runtime_predecessor,{
+    version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b',
+    manifest_sha256:'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf',
+    generation_manifest_sha256:'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
+  });
+  assert.equal(release.source_predecessor.version,'0.15.64');
+  assert.equal(release.source_predecessor.train,'R166');
+  assert.equal(release.source_predecessor.tarball_sha256,R166_TARBALL);
+  assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,R166_MANIFEST);
+  assert.equal(provenance.source_predecessor_tarball_sha256,R166_TARBALL);
+  assert.equal(release.r167.public_tool_delta,0);
+  assert.equal(release.r167.authority_scope_delta,0);
+  assert.equal(release.r167.production_activation,'NOT_RUN');
+  assert.equal(release.r167.npm_publish,'NOT_RUN');
+});
+
+test('R167 protected continuity remains pending until exact Windows fixture evidence exists',async()=>{
+  const [release,provenance,matrix]=await Promise.all([
+    read('RELEASE.json'),read('PROVENANCE.json'),read('TEST-MATRIX.json')]);
+  assert.equal(release.r167.protected_entrypoint_continuity,'PENDING_PROTECTED_WINDOWS_FIXTURE');
+  assert.equal(provenance.r167.final_manifest_evidence,'PENDING_PROTECTED_WINDOWS_FIXTURE');
+  assert.equal(matrix.r167.protected_epoch_continuity,'PENDING_PROTECTED_WINDOWS_FIXTURE');
+  assert.equal(matrix.r167.new_public_tools,0);
+  assert.equal(matrix.r167.new_authority_scopes,0);
+});

package/test/r167-release-readiness.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {readFile} from 'node:fs/promises';
+import {assertR167NpmPublishReady,assertR167PackedIdentity} from '../scripts/npm-release-readiness-r167.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+
+test('R167 publication refuses absent external exact-byte closure',async()=>{
+  const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+  const prior=process.env.DEADBYTE_R167_CLOSURE_ROOT;
+  try{
+    delete process.env.DEADBYTE_R167_CLOSURE_ROOT;
+    await assert.rejects(assertR167NpmPublishReady(release,{root}),/PUBLISH_BLOCKED R167/);
+  }finally{
+    if(prior===undefined)delete process.env.DEADBYTE_R167_CLOSURE_ROOT;
+    else process.env.DEADBYTE_R167_CLOSURE_ROOT=prior;
+  }
+});
+
+test('R167 publication rejects a repacked artifact that differs from verified closure bytes',()=>{
+  const expected={tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-expected',tarball_shasum:'b'.repeat(40)};
+  assert.throws(()=>assertR167PackedIdentity({
+    ...expected,observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)
+  }),/PUBLISH_BLOCKED R167.*tarball/i);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');