deadbyte-mcp 0.15.65 → 0.15.66

package/src/activation-reconciliation-fence-r168.mjs

@@ -0,0 +1,87 @@
+// R168 five-plane R85 exclusion, with a deliberately non-injectable production
+// entrypoint. Simulation is ONLY a pure test of sequencing: no production proof.
+import {randomBytes} from 'node:crypto';
+import {lstat} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {acquireHeldEpochLock} from './epoch-lock-r85.mjs';
+import {queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const validate=(stateRoot,onHeld)=>{
+  if(typeof onHeld!=='function'||typeof stateRoot!=='string'||!path.isAbsolute(stateRoot))
+    throw new Error('R168 held epoch fence arguments invalid');
+};
+
+async function runHeldFence({stateRoot,onHeld,acquire,owner}){
+  validate(stateRoot,onHeld);
+  if(typeof acquire!=='function'||!validForegroundIdentity(owner)||owner.pid!==process.pid)
+    throw new Error('R168 native owner process identity unavailable');
+  const root=path.resolve(stateRoot),runtime=path.join(root,'runtime','authority-epochs');
+  const folders=PLANES.map(plane=>({plane,dir:path.join(runtime,plane)}));
+  // Preflight the entire directory set before acquiring any lock. Never make
+  // missing directories or silently repair a stale owner in reconciliation.
+  for(const entry of folders){
+    const stat=await lstat(entry.dir);
+    if(!stat.isDirectory()||stat.isSymbolicLink())
+      throw new Error('R168 epoch plane directory untrusted or unavailable: '+entry.plane);
+  }
+  const leases=[];
+  let started=false,primary=null,result;
+  try{
+    for(const entry of folders){
+      const bytes=Buffer.from(canonicalJson({
+        schema:'deadbyte.authority-epoch-lock.r65.v1',
+        pid:process.pid,token:randomBytes(16).toString('hex'),
+        created_at_utc:new Date().toISOString(),owner_identity:owner
+      }),'utf8');
+      const lease=await acquire(path.join(entry.dir,'.lock'),bytes);
+      if(!lease||typeof lease.release!=='function')
+        throw new Error('R168 epoch native lock busy: '+entry.plane);
+      leases.push({plane:entry.plane,lease});
+    }
+    started=true;
+    result=await onHeld(Object.freeze({
+      planeOrder:PLANES,
+      assertHeld:()=>{
+        if(!started||leases.length!==PLANES.length)
+          throw new Error('R168 five-plane native exclusion not held');
+        return true;
+      }
+    }));
+  }catch(error){primary=error;}
+  const releaseErrors=[];
+  for(const {plane,lease} of leases.reverse()){
+    try{await lease.release();}
+    catch(error){releaseErrors.push(new Error('R168 failed to release '+plane+' native epoch lock',{cause:error}));}
+  }
+  if(releaseErrors.length&&primary)
+    throw new AggregateError([primary,...releaseErrors],'R168 native epoch fence and cleanup ambiguous');
+  if(releaseErrors.length)throw new AggregateError(releaseErrors,'R168 native epoch fence release ambiguous');
+  if(primary)throw primary;
+  return result;
+}
+
+// Only this entrypoint can be used by any future trusted reconciliation commit.
+// The R85 loader itself enforces R89 and native binary/source identity.
+export async function withR168FivePlaneEpochFence(options={}){
+  if(!options||typeof options!=='object'||Array.isArray(options)||
+    Object.keys(options).some(key=>!['stateRoot','onHeld'].includes(key)))
+    throw new Error('R168 protected fence forbids injected or unknown options');
+  validate(options.stateRoot,options.onHeld);
+  if(process.platform!=='win32')throw new Error('R168 production epoch exclusion requires Windows');
+  const owner=queryForegroundIdentity(process.pid);
+  return runHeldFence({...options,owner,acquire:acquireHeldEpochLock});
+}
+
+// Non-authoritative simulation only. Deliberately NOT called by production
+// entrypoint; test-worker environment is not a security boundary.
+export async function simulateR168FivePlaneEpochFence({
+  stateRoot,onHeld,testAcquire,testOwnerIdentity
+}={}){
+  if(process.env.NODE_TEST_CONTEXT!=='child-v8')
+    throw new Error('R168 simulation requires a Node test worker');
+  if(typeof testAcquire!=='function')
+    throw new Error('R168 simulation requires a fake acquire');
+  return runHeldFence({stateRoot,onHeld,acquire:testAcquire,owner:testOwnerIdentity});
+}

package/src/activation-reconciliation-journal-r168.mjs

@@ -0,0 +1,100 @@
+// R168 fail-closed, non-mutating reconciliation intent journal.
+// This is a standalone receipt contract. Production CAS MUST NOT use it
+// without a trusted R89 entrypoint, held five-plane R85 locks, actual owner
+// approval and native FileIdInfo observations. No delete/revoke here.
+import {createHash} from 'node:crypto';
+import {lstat,open,readFile,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR168SignedAuthorization} from './activation-reconciliation-consent-r168.mjs';
+import {verifyR168TerminalResult} from './activation-reconciliation-terminal-r168.mjs';
+
+const SHA=/^[a-f0-9]{64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const stable=body=>Buffer.from(canonicalJson(body)+'\n','utf8');
+function check(condition,reason){if(!condition)throw new Error('R168 journal '+reason);}
+async function normalDirectory(value){
+  check(typeof value==='string'&&path.isAbsolute(value),'evidence directory must be absolute');
+  const dir=path.resolve(value),stat=await lstat(dir);
+  check(stat.isDirectory()&&!stat.isSymbolicLink(),'evidence directory not ordinary');
+  check(path.resolve(await realpath(dir)).toLowerCase()===dir.toLowerCase(),
+    'evidence directory reparse denied');
+  return dir;
+}
+function content(subject,approval,prepared){
+  const body={schema:'deadbyte.r168-terminal-intent.v1',
+    phase:'INTENT_PREPARED_ONLY',
+    subject_sha256:subject.subject_sha256,
+    claim_operation_id:subject.claim_operation_id,
+    claim_file_id:subject.claim_file_id,
+    claim_file_sha256:subject.claim_file_sha256,
+    predecessor_pointer_sha256:subject.predecessor_pointer_sha256,
+    owner_approval_nonce:approval.body.nonce,
+    owner_approval_sha256:sha(Buffer.from(canonicalJson(approval))),
+    prepared_receipt_sha256:prepared.receipt_sha256,
+    terminalization_committed:false,activation_authorized:false};
+  return {body,body_sha256:sha(Buffer.from(canonicalJson(body)))};
+}
+export async function prepareR168TerminalIntent({
+  evidenceDir,subject,approval,prepared,ownerPublicKey,machinePublicKey,now
+}={}){
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,
+    ownerPublicKey,machinePublicKey,now});
+  const dir=await normalDirectory(evidenceDir);
+  check(SHA.test(approval.body.nonce),'owner approval nonce invalid');
+  const file=path.join(dir,'r168-terminal-intent-'+approval.body.nonce+'.json');
+  const encoded=stable(content(subject,approval,prepared));
+  check(encoded.length<32768,'intent size exceeded');
+  let handle;
+  try{handle=await open(file,'wx',0o600);}
+  catch(error){if(error?.code==='EEXIST')throw new Error('R168 journal one-use intent already exists; no-clobber');throw error;}
+  try{
+    // A write or fsync error leaves any incomplete intent in place to block
+    // replay. We never rename/rewrite it to appear as a successful receipt.
+    await handle.writeFile(encoded);
+    await handle.sync();
+  }finally{await handle.close();}
+  const checkBytes=await readFile(file);
+  check(checkBytes.equals(encoded),'intent changed during readback');
+  return Object.freeze({file,sha256:sha(encoded),bytes:encoded.length,
+    state:'INTENT_PREPARED_ONLY',activation_authorized:false});
+}
+export async function classifyR168Recovery({
+  recordFile,subject,approval,prepared,ownerPublicKey,machinePublicKey,
+  observedClaim,terminal=null,after=null,now
+}={}){
+  // Historical validity of a recorded intent remains verifiable after the
+  // one-time owner's approval window expires. This DOES NOT grant fresh consent.
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,ownerPublicKey,machinePublicKey,
+    now:prepared?.body?.created_at_utc});
+  check(typeof recordFile==='string'&&path.isAbsolute(recordFile),'record path invalid');
+  const stat=await lstat(recordFile);
+  check(stat.isFile()&&!stat.isSymbolicLink()&&stat.size>0&&stat.size<=32768,
+    'journal file is not regular or bounded');
+  const original=await readFile(recordFile);
+  check(original.length===stat.size,'journal file changed during audit');
+  let record;
+  try{record=JSON.parse(original.toString('utf8'));}catch{throw new Error('R168 journal damaged JSON');}
+  const expected=content(subject,approval,prepared);
+  check(record?.body_sha256===expected.body_sha256&&
+    canonicalJson(record.body)===canonicalJson(expected.body)&&
+    sha(Buffer.from(canonicalJson(record.body)))===record.body_sha256,
+    'journal digest/identity tampered');
+  check(observedClaim&&typeof observedClaim==='object','claim observation absent');
+  if(observedClaim.state==='PRESENT'){
+    if(terminal)throw new Error('R168 journal terminal/claim state ambiguous');
+    const same=observedClaim.fileId===subject.claim_file_id&&
+      observedClaim.sha256===subject.claim_file_sha256;
+    return Object.freeze({state:same?'PRECOMMIT_CLAIM_PRESENT_BLOCKED':'CLAIM_CHANGED_BLOCKED',
+      activation_authorized:false,terminalization_committed:false});
+  }
+  check(observedClaim.state==='ABSENT','claim observation unverified');
+  if(!terminal)return Object.freeze({state:'CAS_OUTCOME_UNKNOWN_BLOCKED',
+    activation_authorized:false,terminalization_committed:false});
+  check(after,'terminal post-CAS evidence missing');
+  verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey,machinePublicKey,after,now});
+  return Object.freeze({state:'TERMINAL_VERIFIED_ACTIVATION_SEPARATE',
+    activation_authorized:false,terminalization_committed:true,
+    terminal_receipt_sha256:terminal.receipt_sha256});
+}

package/src/activation-reconciliation-receipt-store-r168.mjs

@@ -0,0 +1,42 @@
+// R168 exclusive storage for *authorization-only* receipts.
+// Does not sign an owner approval, terminalize claims or invoke native deletion.
+import {createHash} from 'node:crypto';
+import {lstat,open,readFile,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {verifyR168SignedAuthorization} from './activation-reconciliation-consent-r168.mjs';
+
+const SHA=/^[a-f0-9]{64}$/;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+export async function persistR168OneUseAuthorization({
+  evidenceDir,subject,approval,receipt,ownerPublicKey,machinePublicKey,now
+}={}){
+  verifyR168SignedAuthorization({subject,approval,receipt,ownerPublicKey,machinePublicKey,now});
+  if(typeof evidenceDir!=='string'||!path.isAbsolute(evidenceDir))
+    throw new Error('R168 receipt evidence directory must be absolute');
+  const dir=path.resolve(evidenceDir);
+  const stats=await lstat(dir);
+  if(!stats.isDirectory()||stats.isSymbolicLink()||path.resolve(await realpath(dir))!==dir)
+    throw new Error('R168 receipt directory not a real bounded directory');
+  const nonce=approval.body.nonce;
+  if(!SHA.test(String(nonce)))throw new Error('R168 receipt one-use nonce invalid');
+  const file=path.join(dir,'r168-reconciliation-authorization-'+nonce+'.json');
+  const data=Buffer.from(JSON.stringify({
+    schema:'deadbyte.r168-reconciliation-authorization-record.v1',
+    status:'PREPARED_ONLY',
+    owner_approval:approval,
+    receipt
+  })+'\n','utf8');
+  if(data.length>32768)throw new Error('R168 authorization receipt oversized');
+  let handle;
+  try{handle=await open(file,'wx',0o600);}
+  catch(error){if(error?.code==='EEXIST')throw new Error('R168 one-use receipt already exists; no-clobber');throw error;}
+  try{
+    await handle.writeFile(data);
+    await handle.sync();
+  }finally{await handle.close();}
+  const observed=await readFile(file);
+  if(!observed.equals(data))throw new Error('R168 one-use authorization receipt changed during verification');
+  return Object.freeze({path:file,sha256:digest(data),bytes:data.length,
+    terminalization_committed:false,activation_authorized:false});
+}

package/src/activation-reconciliation-terminal-r168.mjs

@@ -0,0 +1,111 @@
+// R168 cryptographic terminal-result contract. Pure: no CAS, filesystem,
+// owner-key discovery or authority mutation occurs here. A protected caller
+// must obtain every 'after' field from native handle-bound observations under
+// its five-plane epoch fence before invoking this contract.
+import {createHash,createPublicKey,sign,verify} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR168SignedAuthorization} from './activation-reconciliation-consent-r168.mjs';
+
+const DOMAIN='DEADBYTE-R168-TERMINAL-RESULT-V1';
+const SHA=/^[0-9a-f]{64}$/;
+const PLANES=['process','coding','autonomous','desktop','host'];
+const hash=body=>createHash('sha256').update(Buffer.from(canonicalJson(body),'utf8')).digest('hex');
+const message=body=>Buffer.concat([Buffer.from(DOMAIN+'\0','utf8'),
+  Buffer.from(canonicalJson(body),'utf8')]);
+function requireR168(ok,reason){if(!ok)throw new Error('R168 terminal '+reason);}
+
+function verifiedAfter(subject,after){
+  requireR168(after&&typeof after==='object'&&!Array.isArray(after)&&
+    Object.keys(after).length===8&&
+    ['native_cas_result','claim_absent','pointer_sha256','old_outcome_sha256',
+      'coding_policy_sha256','coding_grant_sha256','coding_epoch_sha256','epoch_history']
+      .every(k=>Object.hasOwn(after,k)),'post-CAS evidence field shape invalid');
+  requireR168(after.native_cas_result==='REMOVED'&&after.claim_absent===true,
+    'claim native CAS removal and absence not verified');
+  requireR168(after.pointer_sha256===subject.predecessor_pointer_sha256,
+    'predecessor pointer changed');
+  requireR168(after.old_outcome_sha256===subject.old_outcome_sha256,
+    'old outcome evidence changed');
+  requireR168(after.coding_policy_sha256===subject.coding_policy_sha256&&
+    after.coding_grant_sha256===subject.coding_grant_sha256&&
+    after.coding_epoch_sha256===subject.coding_epoch_sha256,
+    'Coding grant/epoch changed after CAS');
+  requireR168(after.epoch_history&&typeof after.epoch_history==='object'&&
+    Object.keys(after.epoch_history).length===PLANES.length&&
+    canonicalJson(after.epoch_history)===canonicalJson(subject.epoch_history),
+    'signed five-plane epoch history changed after CAS');
+}
+
+function expectedBody({subject,prepared,after,now}){
+  verifiedAfter(subject,after);
+  requireR168(SHA.test(String(prepared?.receipt_sha256)), 'prepared receipt digest invalid');
+  return Object.freeze({
+    schema:'deadbyte.r168-terminal-result.v1',
+    action:'terminalize_unknown_without_replay',
+    subject_sha256:subject.subject_sha256,
+    prepared_receipt_sha256:prepared.receipt_sha256,
+    claim_file_sha256:subject.claim_file_sha256,claim_file_id:subject.claim_file_id,
+    old_outcome_sha256:after.old_outcome_sha256,
+    predecessor_pointer_sha256:after.pointer_sha256,
+    coding_policy_sha256:after.coding_policy_sha256,
+    coding_grant_sha256:after.coding_grant_sha256,
+    coding_epoch_sha256:after.coding_epoch_sha256,
+    epoch_history:structuredClone(after.epoch_history),
+    native_cas_result:'REMOVED',claim_absent:true,
+    observed_at_utc:now,
+    terminalization_committed:true,activation_authorized:false
+  });
+}
+
+export function createR168TerminalResult({
+  subject,approval,prepared,ownerPublicKey,machinePrivateKey,after,now
+}={}){
+  requireR168(machinePrivateKey?.asymmetricKeyType==='ed25519'&&machinePrivateKey?.type==='private',
+    'trusted machine signing key invalid');
+  const machinePublicKey=createPublicKey(machinePrivateKey);
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,
+    ownerPublicKey,machinePublicKey,now});
+  const body=expectedBody({subject,prepared,after,now});
+  const signature=sign(null,message(body),machinePrivateKey);
+  const unsigned={body,body_sha256:hash(body),
+    attestation:{algorithm:'ed25519',domain:DOMAIN,signature_base64:signature.toString('base64')}};
+  return Object.freeze({...unsigned,receipt_sha256:hash(unsigned)});
+}
+
+export function verifyR168TerminalResult({
+  subject,approval,prepared,terminal,ownerPublicKey,machinePublicKey,after,now
+}={}){
+  // Archived evidence remains verifiable after one-time approval expiry, but
+  // only if the signed preparation AND terminal observation occurred inside
+  // that original approval interval. Never interpret replay as live consent.
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,
+    ownerPublicKey,machinePublicKey,now:prepared?.body?.created_at_utc});
+  const terminalTime=terminal?.body?.observed_at_utc;
+  const observed=Date.parse(terminalTime),preparedAt=Date.parse(prepared?.body?.created_at_utc);
+  const expires=Date.parse(approval?.body?.expires_at_utc);
+  const checkTime=Date.parse(now??new Date().toISOString());
+  requireR168(typeof terminalTime==='string'&&
+    terminalTime.length===24&&terminalTime.endsWith('Z')&&
+    Number.isFinite(observed)&&new Date(observed).toISOString()===terminalTime&&
+    Number.isFinite(checkTime)&&observed>=preparedAt&&observed<expires&&observed<=checkTime,
+    'terminal observation time outside approved window or in the future');
+  const expected=expectedBody({subject,prepared,after,now:terminalTime});
+  requireR168(terminal?.body&&canonicalJson(terminal.body)===canonicalJson(expected),
+    'terminal result body differs from verified post-CAS evidence');
+  requireR168(terminal.body_sha256===hash(terminal.body),
+    'terminal result body digest invalid');
+  const {receipt_sha256,...unsigned}=terminal;
+  requireR168(receipt_sha256===hash(unsigned),'terminal result receipt digest mismatch');
+  requireR168(terminal.attestation?.algorithm==='ed25519'&&terminal.attestation?.domain===DOMAIN,
+    'terminal result attestation identity invalid');
+  const encoded=terminal.attestation.signature_base64;
+  const signature=Buffer.from(String(encoded??''),'base64');
+  requireR168(signature.length===64&&signature.toString('base64')===encoded,
+    'terminal result signature encoding invalid');
+  const key=machinePublicKey?.type==='public'&&machinePublicKey?.asymmetricKeyType==='ed25519'?
+    machinePublicKey:createPublicKey(machinePublicKey);
+  requireR168(key.asymmetricKeyType==='ed25519'&&
+    verify(null,message(terminal.body),key,signature),
+    'terminal result machine signature invalid');
+  return true;
+}

package/src/deadbyte-cli.mjs

@@ -19,6 +19,7 @@ import { printDoctor } from './doctor-r45.mjs';
 import { classifyRemoteAuditOutcome, createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, defaultForegroundTimelineOptions, formatRemoteLogResetNotice, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine, selectLiveLogNames } from './remote-live-log.mjs';
 import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
+import {selectR168OneShotRemotePath} from './remote-one-shot-coherence-r168.mjs';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity,proveRestrictedPidReuse} from './foreground-process-identity.mjs';
@@ -787,6 +788,16 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
+  // Never attempt automatic activation or cleanup from an npm-cache build on
+  // an EPOCH_NATIVE production runtime. This guard precedes session recovery,
+  // marker claims, revocations and any controller startup.
+  const active=await readActiveRuntimeBinding(ctx.root);
+  if(active){
+    const decision=selectR168OneShotRemotePath({command:'start',active,cliVersion:DEADBYTE_VERSION});
+    if(decision.mode==='blocked_version_skew') throw new Error(decision.message);
+  }
+  // First installation without an active pointer retains the existing
+  // unbound bootstrap path. A bound older release must never auto-upgrade.
   if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
   if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
   const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
@@ -946,6 +957,15 @@ async function runRemote(args){
   if(positional.length>1) throw new Error('remote accepts one controller command');
   const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
   const ctx=await remoteContext();
+  const active=await readActiveRuntimeBinding(ctx.root);
+  const decision=selectR168OneShotRemotePath({command,active,cliVersion:DEADBYTE_VERSION});
+  if(decision.mode==='blocked_version_skew') throw new Error(decision.message);
+  if(decision.mode==='observe_active'||decision.mode==='observe_unbound'){
+    if(decision.mode==='observe_active')await reportVersionCoherence(ctx.root,{displayMode:'ascii'});
+    const observed=invokeController(ctx,command,{allowFailure:true,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    process.exitCode=observed.status;
+    return;
+  }
   await synchronizeOneShotRuntime(ctx,{displayMode:'ascii'});
   const result=invokeController(ctx,command,{allowFailure:true});
   process.exitCode=result.status;

package/src/npm-publication-resume-r168.mjs

@@ -0,0 +1,25 @@
+// R168: derive resume metadata only from a hash-pinned immutable npm artifact.
+import {createHash} from 'node:crypto';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const digest=(alg,bytes,encoding='hex')=>createHash(alg).update(bytes).digest(encoding);
+
+export function resumePackRecord({filename,localBytes,claim,version,manifestSha256}={}){
+  if(typeof version!=='string'||!/^\d+\.\d+\.\d+$/.test(version)||
+    filename!=='deadbyte-mcp-'+version+'.tgz')
+    throw new Error('npm resume version or filename invalid');
+  if(!Buffer.isBuffer(localBytes)||localBytes.length<1)
+    throw new Error('npm resume preserved tarball bytes unavailable');
+  if(!HEX64.test(String(manifestSha256))||
+    !claim||typeof claim!=='object'||Array.isArray(claim)||
+    claim.schema!=='deadbyte.npm-publication-claim.r65.v1'||claim.version!==version||
+    claim.manifest_sha256!==manifestSha256||
+    !HEX64.test(String(claim.tarball_sha256)))
+    throw new Error('npm resume immutable claim manifest or version mismatch');
+  const sha256=digest('sha256',localBytes);
+  if(sha256!==claim.tarball_sha256)
+    throw new Error('npm resume preserved tarball differs from immutable claim digest');
+  return Object.freeze({filename,sha256,
+    integrity:'sha512-'+digest('sha512',localBytes,'base64'),
+    shasum:digest('sha1',localBytes)});
+}

package/src/remote-one-shot-coherence-r168.mjs

@@ -0,0 +1,36 @@
+// R168 one-shot command dispatch. Pure policy. Does not spawn or modify state.
+import {compareRuntimeVersions} from './runtime-coherence.mjs';
+
+const COMMANDS=new Set([
+  'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
+  'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
+  'armdesktop','disarmdesktop','desktopstatus',
+  'armcoding','disarmcoding','codingstatus','codingtest',
+  'armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
+]);
+const OBSERVE=new Set(['status','processstatus','codingstatus','autonomousstatus','desktopstatus','hoststatus']);
+const safe=(mode,active,cli,message=null)=>Object.freeze({
+  mode,active_version:active,cli_version:cli,message,
+  may_activate:false,may_mutate_authority:false
+});
+
+export function selectR168OneShotRemotePath({command,active,cliVersion}={}){
+  if(typeof command!=='string'||!COMMANDS.has(command))
+    throw new Error('R168 unsupported remote controller command');
+  if(active===null||active===undefined){
+    if(OBSERVE.has(command))return safe('observe_unbound',null,cliVersion,
+      'R168 active runtime binding absent: read-only status only, never activate.');
+    throw new Error('R168 active runtime binding unavailable for authority mutation');
+  }
+  if(typeof active!=='object'||typeof active.version!=='string'||
+    !/^\d+\.\d+\.\d+$/.test(active.version))
+    throw new Error('R168 active runtime binding unavailable or invalid');
+  const relation=compareRuntimeVersions(cliVersion,active.version);
+  if(relation===0) return safe('verify_coherent',active.version,cliVersion);
+  const explanation=
+    'R168 version skew: installed runtime '+active.version+', npm CLI '+cliVersion+
+    '. Automatic activation from npm cache is forbidden. Existing runtime remains unchanged.';
+  if(OBSERVE.has(command))return safe('observe_active',active.version,cliVersion,explanation);
+  return safe('blocked_version_skew',active.version,cliVersion,
+    explanation+' Run the corresponding command through the installed active-release launcher only if specifically authorized.');
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.65';
+export const DEADBYTE_VERSION = '0.15.66';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -7,18 +7,18 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-test('current successor retains the R130 security baseline with truthful R167 identity',async()=>{
+test('current successor retains the R130 security baseline with truthful R168 identity',async()=>{
   const [pkg,release,provenance,bom,lock,matrix]=await Promise.all([
     read('package.json'),read('RELEASE.json'),read('PROVENANCE.json'),
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.65');
-  assert.equal(release.train,'R167');
-  assert.equal(matrix.train,'R167');
-  assert.equal(release.source_predecessor.version,'0.15.64');
-  assert.equal(release.source_predecessor.train,'R166');
-  assert.match(release.source_predecessor.source_path,/0\.15\.64-r166-final/i);
+    assert.equal(actual,'0.15.66');
+  assert.equal(release.train,'R168');
+  assert.equal(matrix.train,'R168');
+  assert.equal(release.source_predecessor.version,'0.15.65');
+  assert.equal(release.source_predecessor.train,'R167');
+  assert.match(release.source_predecessor.source_path,/0\.15\.65-r167-activation-path/i);
   assert.equal(release.source_predecessor.manifest_status,'VERIFIED_FINAL_BYTES');
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');

package/test/r132-release-identity.test.mjs

@@ -8,22 +8,22 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R167 package identity preserves R132 evidence and published R166 source predecessor',async()=>{
+test('R168 package identity preserves R132 evidence and published R167 source predecessor',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
     read('package.json'),read('package-lock.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R167');
-  assert.equal(matrix.train,'R167');
-  assert.equal(release.source_predecessor.version,'0.15.64');
-  assert.equal(release.source_predecessor.train,'R166');
-  assert.match(release.source_predecessor.source_path,/0\.15\.64-r166-final/i);
+  assert.equal(release.train,'R168');
+  assert.equal(matrix.train,'R168');
+  assert.equal(release.source_predecessor.version,'0.15.65');
+  assert.equal(release.source_predecessor.train,'R167');
+  assert.match(release.source_predecessor.source_path,/0\.15\.65-r167-activation-path/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653');
+  assert.equal(release.source_predecessor.tarball_sha256,'fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484');
   assert.equal(prov.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.65');
+ assert.equal(state.pkg.version,'0.15.66');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -8,7 +8,7 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const version='0.15.65';
+const version='0.15.66';
 const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
 const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -21,7 +21,7 @@ async function generation(state,label){
   await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
-test('R167 isolated immutable slot activates, rolls back, and restores 0.15.65 without authority or production mutation',async()=>{
+test('R168 isolated immutable slot activates, rolls back, and restores 0.15.66 without authority or production mutation',async()=>{
   const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
   const state=path.join(stateBase,'state');
   try{

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.65');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.66');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');
@@ -65,26 +65,26 @@ async function run(fx){
  assert.doesNotMatch(trace,/\b(?:start|restart|armprocess|armcoding|armautonomous|deploy)\b/i,'unexpected runtime operation');
  return {output:(result.stderr||'')+'\n'+(result.stdout||''),trace};
 }
-gate('R167 executable CLI passes completed R159 history, reaches 0.15.61 -> 0.15.65 synchronization safely',async t=>{
+gate('R168 executable CLI blocks npm-cache activation on version skew before touching R159 history',async t=>{
  const fx=await fixture(t,'completed');
  const r=await run(fx);
- assert.match(r.output,/runtime coherence 'disarmhost' failed exit=93/i,r.output);
+ assert.match(r.output,/R168 version skew.*0\.15\.61.*0\.15\.66/i,r.output);
  assert.doesNotMatch(r.output,/R159 ambiguous multiple completed/i);
- assert.match(r.trace,/disarmhost/);
+ assert.equal(r.trace,'');
  assert.doesNotMatch(r.trace,/disarmdesktop/);
 });
 gate('R165 executable CLI rejects pending current reconciliation before upgrade',async t=>{
  const fx=await fixture(t,'pending'),r=await run(fx);
- assert.match(r.output,/pending marker reconciliation requires an offline runtime/i,r.output);
+ assert.match(r.output,/R168 version skew/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });
 gate('R165 executable CLI rejects tampered terminal before upgrade',async t=>{
  const fx=await fixture(t,'tampered'),r=await run(fx);
- assert.match(r.output,/terminal intent\/subject mismatch|terminal.*mismatch/i,r.output);
+ assert.match(r.output,/R168 version skew/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });
 gate('R165 executable CLI keeps ambiguous history fail-closed when predecessor is not ONLINE',async t=>{
  const fx=await fixture(t,'offline'),r=await run(fx);
- assert.match(r.output,/R159 ambiguous multiple completed reconciliation receipts/i,r.output);
+ assert.match(r.output,/R168 version skew/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });

package/test/r167-release-contract.test.mjs

@@ -8,11 +8,11 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.65';
+const VERSION='0.15.66';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
-test('R167 package identity binds published R166 source separately from active R153 runtime',async()=>{
+test('R168 package identity binds published R167 source separately from active R153 runtime',async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
     read('package.json'),readOptional('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
@@ -20,20 +20,20 @@ test('R167 package identity binds published R166 source separately from active R
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R167');
-  assert.equal(matrix.train,'R167');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r167:0.15.65');
+  assert.equal(release.train,'R168');
+  assert.equal(matrix.train,'R168');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r168:0.15.66');
   assert.deepEqual(release.runtime_predecessor,{
     version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b',
     manifest_sha256:'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf',
     generation_manifest_sha256:'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
   });
-  assert.equal(release.source_predecessor.version,'0.15.64');
-  assert.equal(release.source_predecessor.train,'R166');
-  assert.equal(release.source_predecessor.tarball_sha256,R166_TARBALL);
+  assert.equal(release.source_predecessor.version,'0.15.65');
+  assert.equal(release.source_predecessor.train,'R167');
+  assert.equal(release.source_predecessor.tarball_sha256,'fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_tarball_sha256,R166_TARBALL);
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'3316654646cc870584a7c969c2032af6c795229ff8c65e5a8b794f97c2458c41');
+  assert.equal(provenance.source_predecessor_tarball_sha256,'fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484');
   assert.equal(release.r167.public_tool_delta,0);
   assert.equal(release.r167.authority_scope_delta,0);
   assert.equal(release.r167.production_activation,'NOT_RUN');