deadbyte-mcp 0.15.65 → 0.15.66

package/test/r168-owner-reconciliation-contract.test.mjs

@@ -0,0 +1,250 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,sign} from 'node:crypto';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {persistR168OneUseAuthorization} from '../src/activation-reconciliation-receipt-store-r168.mjs';
+import {createR168TerminalResult,verifyR168TerminalResult} from '../src/activation-reconciliation-terminal-r168.mjs';
+import {mkdtemp,mkdir,readFile,rm,readdir} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {
+  createR168ReconciliationSubject,makeR168ConsentChallenge,
+  verifyR168OwnerApproval,createR168SignedAuthorization,verifyR168SignedAuthorization
+} from '../src/activation-reconciliation-consent-r168.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const domain=Buffer.from('DEADBYTE-R168-OWNER-APPROVAL-V1\0');
+const owner=generateKeyPairSync('ed25519');
+const machine=generateKeyPairSync('ed25519');
+const head={process:'a',coding:'b',autonomous:'c',desktop:'d',host:'e'};
+const counts={process:27,coding:29,autonomous:24,desktop:28,host:26};
+const observation=Object.freeze({
+  schema:'deadbyte.r168-readonly-reconciliation-observation.v1',
+  status:'NO_MATCHING_TRANSACTION_OBSERVED',terminalization_authorized:false,
+  old_operation_id:'c84d7ffa4eee80a2f467acda3ddd9332',
+  old_continuity_update_id:'r65-ef42bc84451ce024c4dee736d4047b36',
+  old_claim_sha256:H('lock'),old_outcome_sha256:H('outcome'),predecessor_pointer_sha256:H('ptr'),
+  coding_policy_sha256:H('policy'),coding_grant_sha256:H('grant'),coding_epoch_sha256:H(head.coding),
+  candidate_manifest_sha256:H('candidate'),signed_event_count:134,update_inventory_count:376,
+  epoch_history:Object.fromEntries(Object.entries(head).map(([p,c])=>[p,{
+    status:'PASS',verified_events:counts[p],event_sha256:H(c),head_action:p==='coding'?'grant':'user_revoke'
+  }])),
+  observation_sha256:null
+});
+const {observation_sha256:_,...observationBody}=observation;
+const observationFinal=Object.freeze({...observationBody,observation_sha256:H(canonicalJson(observationBody))});
+const claimSnapshot={fileId:'1234567890abcdef:1234567890abcdef1234567890abcdef',sha256:observationFinal.old_claim_sha256};
+const makeSubject=()=>createR168ReconciliationSubject({observation:observationFinal,
+  claimSnapshot,stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'});
+const now='2026-10-26T08:00:00.000Z';
+function approvalFor(subject,{bodyChanges={},signingKey=owner.privateKey}={}){
+  const body={schema:'deadbyte.r168-owner-approval.v1',action:'terminalize_unknown_without_replay',
+    subject_sha256:subject.subject_sha256,claim_operation_id:subject.claim_operation_id,
+    nonce:H('one-time-approval'),issued_at_utc:'2026-10-26T07:59:00.000Z',
+    expires_at_utc:'2026-10-26T08:04:00.000Z',...bodyChanges};
+  const bytes=Buffer.concat([domain,Buffer.from(canonicalJson(body))]);
+  return {body,attestation:{algorithm:'ed25519',domain:'DEADBYTE-R168-OWNER-APPROVAL-V1',
+    signature_base64:sign(null,bytes,signingKey).toString('base64')}};
+}
+test('R168 binds subject to exact claim FileId, five signed heads and all observed hashes',()=>{
+  const subject=makeSubject();
+  assert.equal(subject.schema,'deadbyte.r168-reconciliation-subject.v1');
+  assert.equal(subject.claim_file_id,claimSnapshot.fileId);
+  assert.equal(subject.old_outcome_sha256,observation.old_outcome_sha256);
+  assert.equal(Object.keys(subject.epoch_history).length,5);
+  assert.match(subject.subject_sha256,/^[a-f0-9]{64}$/);
+  assert.match(makeR168ConsentChallenge(subject),new RegExp(subject.claim_operation_id));
+});
+test('R168 rejects an audit claiming terminal authority or a mismatched lock identity',()=>{
+  assert.throws(()=>createR168ReconciliationSubject({observation:{...observationFinal,terminalization_authorized:true},claimSnapshot,
+    stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/terminal|observation/i);
+  assert.throws(()=>createR168ReconciliationSubject({observation:observationFinal,
+    claimSnapshot:{...claimSnapshot,sha256:H('replaced')},stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/claim|lock/i);
+  assert.throws(()=>createR168ReconciliationSubject({observation:{...observationFinal,old_outcome_sha256:H('new')},claimSnapshot,
+    stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/digest|observation/i);
+});
+test('R168 owner consent requires an independent matching Ed25519 signature and fresh single-use identity',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  assert.equal(verifyR168OwnerApproval({subject,approval,ownerPublicKey:owner.publicKey,now}),true);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval,ownerPublicKey:machine.publicKey,now}),/signature|owner/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval,ownerPublicKey:owner.publicKey,
+    now:'2026-10-26T08:05:00.000Z'}),/expired|window/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:approvalFor(subject,{bodyChanges:{subject_sha256:H('other')}}),
+    ownerPublicKey:owner.publicKey,now}),/subject|approval/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:approvalFor(subject,{bodyChanges:{nonce:'nothex'}}),
+    ownerPublicKey:owner.publicKey,now}),/nonce|approval/i);
+});
+test('R168 machine-signed reconciliation receipt is not authorization to delete until commit is separately approved',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.equal(receipt.body.terminalization_committed,false);
+  assert.equal(receipt.body.activation_authorized,false);
+  assert.equal(verifyR168SignedAuthorization({subject,approval,receipt,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),true);
+  assert.throws(()=>createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:'YES'}),/confirmation/i);
+  assert.throws(()=>createR168SignedAuthorization({subject,approval:null,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)}),/owner|approval/i);
+  const swapped={...receipt,body:{...receipt.body,terminalization_committed:true}};
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt:swapped,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),/receipt|signature|digest/i);
+});
+
+test('R168 forged extra approval fields and mismatched machine/owner key roles fail closed',()=>{
+  const subject=makeSubject();
+  const extra=approvalFor(subject,{bodyChanges:{grant_plane:'host'}});
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:extra,ownerPublicKey:owner.publicKey,now}),
+    /approval|shape|fields/i);
+  const sameKeyApproval=approvalFor(subject,{signingKey:machine.privateKey});
+  assert.throws(()=>createR168SignedAuthorization({subject,approval:sameKeyApproval,
+    ownerPublicKey:machine.publicKey,machinePrivateKey:machine.privateKey,
+    now,typedConfirmation:makeR168ConsentChallenge(subject)}),/independent|same key/i);
+});
+test('R168 signed subject does not survive changes to signed epoch history or claim binding',()=>{
+  const subject=makeSubject();
+  const tampered={...subject,epoch_history:{...subject.epoch_history,coding:{
+    ...subject.epoch_history.coding,event_sha256:H('different')}}};
+  assert.throws(()=>verifyR168OwnerApproval({subject:tampered,approval:approvalFor(subject),
+    ownerPublicKey:owner.publicKey,now}),/subject digest/i);
+});
+
+test('R168 one-use owner authorization receipt is exclusive, verified and never overwrites existing evidence',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'r168-receipt-only-'));
+  try{
+    const evidenceDir=path.join(dir,'evidence');
+    await mkdir(evidenceDir);
+    const subject=makeSubject(),approval=approvalFor(subject);
+    const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+      machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+    const args={evidenceDir,subject,approval,receipt,ownerPublicKey:owner.publicKey,
+      machinePublicKey:machine.publicKey,now};
+    const persisted=await persistR168OneUseAuthorization(args);
+    assert.match(persisted.sha256,/^[a-f0-9]{64}$/);
+    const body=JSON.parse(await readFile(persisted.path,'utf8'));
+    assert.equal(body.receipt.body.subject_sha256,subject.subject_sha256);
+    assert.equal(body.receipt.body.terminalization_committed,false);
+    await assert.rejects(persistR168OneUseAuthorization(args),/exists|one-use|clobber/i);
+    assert.deepEqual((await readdir(evidenceDir)).length,1);
+    assert.equal(H(await readFile(persisted.path)),persisted.sha256);
+    await assert.rejects(persistR168OneUseAuthorization({...args,
+      receipt:{...receipt,receipt_sha256:H('tampered')}}),/receipt|digest|signature/i);
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('R168 rejects a signed but incomplete or extra-field reconciliation subject',()=>{
+  const incompleteBody={schema:'deadbyte.r168-reconciliation-subject.v1',
+    claim_operation_id:'c84d7ffa4eee80a2f467acda3ddd9332'};
+  const incomplete={...incompleteBody,subject_sha256:H(canonicalJson(incompleteBody))};
+  assert.throws(()=>verifyR168OwnerApproval({subject:incomplete,approval:approvalFor(incomplete),
+    ownerPublicKey:owner.publicKey,now}),/subject|shape|incomplete/i);
+  const original=makeSubject();
+  const {subject_sha256,...body}=original;
+  const modified={...body,unreviewed_authority:'host'};
+  const changed={...modified,subject_sha256:H(canonicalJson(modified))};
+  assert.throws(()=>verifyR168OwnerApproval({subject:changed,approval:approvalFor(changed),
+    ownerPublicKey:owner.publicKey,now}),/subject|shape|field/i);
+});
+
+test('R168 receipt verifier enforces independent owner/machine public-key roles',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt,
+    ownerPublicKey:owner.publicKey,machinePublicKey:owner.publicKey,now}),/independent|same key/i);
+});
+test('R168 receipt verifier refuses future creation time within an otherwise valid approval window',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now:'2026-10-26T07:59:30.000Z'}),/future|time|window/i);
+});
+test('R168 receipt verifier rejects machine-signed extra authority fields even when signature is valid',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const original=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const body={...original.body,enable_host:true};
+  const machineDomain=Buffer.from('DEADBYTE-R168-RECONCILIATION-ATTESTATION-V1\\0'.replace('\\0','\0'));
+  const unsigned={body,body_sha256:H(canonicalJson(body)),
+    attestation:{algorithm:'ed25519',domain:'DEADBYTE-R168-RECONCILIATION-ATTESTATION-V1',
+      signature_base64:sign(null,Buffer.concat([machineDomain,Buffer.from(canonicalJson(body))]),
+        machine.privateKey).toString('base64')}};
+  const forged={...unsigned,receipt_sha256:H(canonicalJson(unsigned))};
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt:forged,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),/field|shape|extra/i);
+});
+
+test('R168 terminal result signed only after exact claim CAS removal and stable five-plane heads',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={
+    native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history
+  };
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.equal(terminal.body.terminalization_committed,true);
+  assert.equal(terminal.body.activation_authorized,false);
+  assert.equal(verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,now}),true);
+});
+test('R168 rejects terminal signing when CAS is not removed or history/pointer drifted',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const good={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const build=after=>createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.throws(()=>build({...good,native_cas_result:'CHANGED'}),/CAS|claim|removed/i);
+  assert.throws(()=>build({...good,claim_absent:false}),/CAS|claim|absent/i);
+  assert.throws(()=>build({...good,pointer_sha256:H('replaced')}),/pointer|predecessor/i);
+  assert.throws(()=>build({...good,epoch_history:{...good.epoch_history,coding:{
+    ...good.epoch_history.coding,event_sha256:H('revoked')}}}),/epoch|history|coding/i);
+});
+test('R168 signed terminal receipt is bound to independent machine key and current observed state',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:owner.publicKey,after,now}),/independent|signature|key/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,
+    after:{...after,claim_absent:false},now}),/CAS|claim|absent/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,
+    terminal:{...terminal,body:{...terminal.body,activation_authorized:true}},
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,now}),/receipt|result|digest|mismatch/i);
+});
+
+test('R168 archived terminal result stays verifiable after one-time owner approval expires',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.equal(verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,
+    now:'2026-10-27T08:00:00.000Z'}),true);
+  assert.throws(()=>createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,
+    now:'2026-10-27T08:00:00.000Z'}),/approval|expired|window/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,
+    now:'2026-10-26T07:59:59.000Z'}),/future|time|observation/i);
+});

package/test/r168-protected-entrypoint.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+
+const root=fileURLToPath(new URL('..',import.meta.url));
+const script=path.join(root,'scripts','r168-protected-preflight.mjs');
+const protectedRoot='C:\\Program Files';
+const relative=path.win32.relative(protectedRoot,root);
+const isProtected=process.platform==='win32'&&relative!==''&&relative!=='..'&&!relative.startsWith('..'+path.win32.sep)&&!path.win32.isAbsolute(relative);
+function launch(file,...args){return spawnSync(process.execPath,[file,...args],{
+  encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:65536
+});}
+
+test('R168 installed preflight respects R89 protected-vs-writable execution context',()=>{
+  const result=launch(script);
+  if(isProtected){
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R168_PROTECTED_PREFLIGHT_READONLY_PASS/);
+    assert.match(result.stdout,/"terminalization_authorized":false/);
+    assert.match(result.stdout,/"activation_authorized":false/);
+  }else{
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
+    assert.match(result.stderr,/R168_.*_(UNPROTECTED|VERSION_DRIFT)/);
+  }
+});
+
+test('R168 writable development copy remains blocked when protected fixture exists',()=>{
+  const source=path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT||root);
+  if(path.win32.relative(protectedRoot,source).toLowerCase()===path.win32.relative(protectedRoot,root).toLowerCase()&&isProtected)
+    return test.skip('no separate development source configured');
+  const result=launch(path.join(source,'scripts','r168-protected-preflight.mjs'));
+  assert.notEqual(result.status,0);
+  assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R168_.*_UNPROTECTED/);
+});
+
+test('R168 entrypoint does not accept flags to skip manifest, R89 or root checks',()=>{
+  const result=launch(script,'--skip-trust');
+  assert.notEqual(result.status,0);
+  assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/UNKNOWN_OPTION/);
+});
+
+test('R168 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
+  const src=await readFile(script,'utf8');
+  assert.match(src,/verifyManifestTreeExact\(/);
+  assert.match(src,/inspectTrustedInstallation\(/);
+  assert.doesNotMatch(src,/deletePinnedRemoteMarker\(|unlink\(|transaction_revoke\(/);
+});

package/test/r168-reconciliation-audit.test.mjs

@@ -0,0 +1,42 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {rejectR168MutationEvidence} from '../src/activation-reconciliation-audit-r168.mjs';
+
+const continuityId='r65-ef42bc84451ce024c4dee736d4047b36';
+const created='2026-10-26T04:31:15.000Z';
+const event=(changes={})=>({
+  plane:'coding',seq:1,action:'grant',update_id:null,
+  recorded_at_utc:'2026-10-26T04:30:15.000Z',...changes
+});
+const invoke=events=>rejectR168MutationEvidence({events,continuityId,claimCreatedAt:created});
+
+test('R168 historical signed-event inventory may be observed only when older than unknown claim',()=>{
+  assert.deepEqual(invoke([event(),event({plane:'process',action:'user_revoke',seq:2})]),
+    {checked_events:2,old_continuity_events:0});
+});
+test('R168 old continuity transaction cannot be treated as no mutation',()=>{
+  assert.throws(()=>invoke([event({action:'transaction_revoke',update_id:continuityId})]),
+    /old continuity mutation exists/);
+  assert.throws(()=>invoke([event({action:'transaction_restore',update_id:continuityId})]),
+    /old continuity mutation exists/);
+});
+test('R168 an event after claim, including unrelated grant or revoke, is not a no-mutation proof',()=>{
+  assert.throws(()=>invoke([event({recorded_at_utc:'2026-10-26T04:31:16.000Z'})]),
+    /authority event at or after old claim/);
+  assert.throws(()=>invoke([event({action:'user_revoke',recorded_at_utc:created})]),
+    /authority event at or after old claim/);
+});
+test('R168 malformed, missing or oversized event inventory is rejected',()=>{
+  assert.throws(()=>invoke([event({plane:'unexpected'})]),/event identity incomplete/);
+  assert.throws(()=>invoke([event({seq:0})]),/event identity incomplete/);
+  assert.throws(()=>invoke([event({recorded_at_utc:'invalid'})]),/authority event at or after old claim/);
+  assert.throws(()=>rejectR168MutationEvidence({events:[],continuityId:'wrong',claimCreatedAt:created}),/continuity identity/);
+  assert.throws(()=>invoke(new Array(50001).fill(event())),/event inventory invalid/);
+});
+test('R168 no-mutation diagnostic must remain non-signing and non-terminalizing',async()=>{
+  const fs=await import('node:fs/promises');
+  const url=new URL('../src/activation-reconciliation-audit-r168.mjs',import.meta.url);
+  const src=await fs.readFile(url,'utf8');
+  assert.match(src,/terminalization_authorized:false/);
+  assert.doesNotMatch(src,/\bunlink\s*\(|\brename\s*\(|\bwriteFile\s*\(/);
+});

package/test/r168-release-contract.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+import {assertR168NpmPublishReady,assertR168PackedIdentity} from '../scripts/npm-release-readiness-r168.mjs';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
+const parent='v0.15.61-055d1ff0aa99e60b';
+const predecessorManifest='3316654646cc870584a7c969c2032af6c795229ff8c65e5a8b794f97c2458c41';
+const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484';
+
+test('R168 package 0.15.66 is distinct from published R167 and current live 0.15.61',async()=>{
+ const [pkg,lock,release,provenance,bom,matrix,bridge]=await Promise.all([
+  read('package.json'),read('package-lock.json'),read('RELEASE.json'),
+  read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json'),read('bridge/package.json')]);
+ for(const version of [DEADBYTE_VERSION,pkg.version,lock.version,lock.packages[''].version,
+   release.version,provenance.version,bom.metadata.component.version,matrix.version,bridge.version])
+   assert.equal(version,'0.15.66');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r168:0.15.66');
+ assert.equal(release.train,'R168');assert.equal(matrix.train,'R168');
+ assert.equal(release.runtime_predecessor.version,'0.15.61');
+ assert.equal(release.runtime_predecessor.release_id,parent);
+ assert.equal(release.parent.release_id,parent);
+ assert.equal(release.source_predecessor.version,'0.15.65');
+ assert.equal(release.source_predecessor.train,'R167');
+ assert.equal(release.source_predecessor.manifest_sha256,predecessorManifest);
+ assert.equal(release.source_predecessor.tarball_sha256,predecessorTarball);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,predecessorManifest);
+ assert.equal(provenance.source_predecessor_tarball_sha256,predecessorTarball);
+ assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');
+ assert.equal(release.r168.owner_approval,'NOT_PRESENT');
+ assert.equal(release.r168.old_r65_activation_claim,'PRESERVED_UNKNOWN');
+ assert.equal(release.r168.production_activation,'NOT_RUN');
+ assert.equal(release.r168.public_tool_delta,0);
+ assert.equal(release.r168.authority_scope_delta,0);
+ assert.equal(release.r168.stable_final_claim,false);
+});
+test('R168 exact-byte publisher refuses absent full protected closure',async()=>{
+ const release=await read('RELEASE.json'),saved=process.env.DEADBYTE_R168_CLOSURE_ROOT;
+ try{
+  delete process.env.DEADBYTE_R168_CLOSURE_ROOT;
+  await assert.rejects(assertR168NpmPublishReady(release,{root}),/PUBLISH_BLOCKED R168/);
+ }finally{
+  if(saved===undefined)delete process.env.DEADBYTE_R168_CLOSURE_ROOT;
+  else process.env.DEADBYTE_R168_CLOSURE_ROOT=saved;
+ }
+});
+test('R168 publisher refuses any tarball digest mismatch',()=>{
+ const expected={tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-expected',
+   tarball_shasum:'b'.repeat(40)};
+ assert.throws(()=>assertR168PackedIdentity({...expected,
+   observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),
+   /PUBLISH_BLOCKED R168/);
+});

package/test/r168-remote-one-shot-coherence.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {selectR168OneShotRemotePath} from '../src/remote-one-shot-coherence-r168.mjs';
+
+const active={version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b'};
+test('R168 status commands on skew observe the active release without activation/disarm',()=>{
+  for(const command of ['status','processstatus','codingstatus','autonomousstatus','desktopstatus','hoststatus']){
+    const r=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
+    assert.equal(r.mode,'observe_active');
+    assert.equal(r.may_activate,false);
+    assert.equal(r.may_mutate_authority,false);
+    assert.equal(r.active_version,'0.15.61');
+  }
+});
+test('R168 arm, disarm and runtime commands reject skew before side effects',()=>{
+  const commands=['armprocess','armcoding','armautonomous','armdesktop','armhost',
+   'disarmprocess','disarmcoding','restart','stop','start','resume','clean','toggle','fulltest','test','menu','url'];
+  for(const command of commands){
+    const r=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
+    assert.equal(r.mode,'blocked_version_skew',command);
+    assert.equal(r.may_activate,false);
+    assert.equal(r.may_mutate_authority,false);
+    assert.match(r.message,/0\.15\.61/);
+    assert.match(r.message,/0\.15\.65/);
+  }
+});
+test('R168 coherent one-shot still defers to existing signed coherence verification',()=>{
+  const r=selectR168OneShotRemotePath({command:'status',active:{...active,version:'0.15.65'},cliVersion:'0.15.65'});
+  assert.equal(r.mode,'verify_coherent');
+  assert.equal(r.may_activate,false);
+});
+test('R168 absent binding permits read-only observation but never authority mutation',()=>{
+  const observation=selectR168OneShotRemotePath({command:'status',active:null,cliVersion:'0.15.65'});
+  assert.equal(observation.mode,'observe_unbound');
+  assert.equal(observation.may_activate,false);
+  assert.equal(observation.may_mutate_authority,false);
+  for(const command of ['armcoding','disarmcoding','restart']){
+    assert.throws(()=>selectR168OneShotRemotePath({command,active:null,cliVersion:'0.15.65'}),/active|binding/i);
+  }
+  assert.throws(()=>selectR168OneShotRemotePath({command:'status',active:{version:'bad'},cliVersion:'0.15.65'}),/version|binding/i);
+  assert.throws(()=>selectR168OneShotRemotePath({command:'invalid',active,cliVersion:'0.15.65'}),/unsupported|command/i);
+});
+test('R168 CLI wires classification before synchronizeOneShotRuntime and no longer upgrades status',async()=>{
+  const src=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const command=src.slice(src.indexOf('  const command=positional[0];'),src.indexOf('\nasync function runSupervisor'));
+  assert.match(src,/selectR168OneShotRemotePath/);
+  assert.match(command,/selectR168OneShotRemotePath/);
+  assert.match(command,/blocked_version_skew/);
+  assert.match(command,/observe_active/);
+  assert.ok(command.indexOf('selectR168OneShotRemotePath')<command.indexOf('synchronizeOneShotRuntime'));
+});
+
+test('R168 foreground remote refuses npm-cache version skew before session marker, revoke or activation',async()=>{
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const start=cli.indexOf('async function runRemoteSession(');
+  const end=cli.indexOf('\nasync function runRemote(',start);
+  assert.ok(start>0&&end>start);
+  const source=cli.slice(start,end);
+  assert.match(source,/selectR168OneShotRemotePath/);
+  const safety=source.indexOf('selectR168OneShotRemotePath');
+  for(const operation of ['recoverRemoteSession(ctx','acquireForegroundSessionLock({root','synchronizeForegroundRuntime(ctx']){
+    assert.ok(safety<source.indexOf(operation),'version guard must precede '+operation);
+  }
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r63-one-shot-coherence.test.mjs

@@ -24,15 +24,20 @@ test('R63 one-shot upgrade restore plan reproduces the exact pre-upgrade authori
   ]);
 });
 
-test('R63 explicit remote command synchronizes runtime before dispatch instead of warn-only skew reporting',async()=>{
+test('R63 coherent one-shot still synchronizes before dispatch; R168 rejects skew before mutation',async()=>{
   const source=await readFile(path.join(root,'src','deadbyte-cli.mjs'),'utf8');
   const start=source.indexOf('async function runRemote(args){');
   const end=source.indexOf('\nasync function runSupervisor(',start);
   assert.ok(start>=0&&end>start,'runRemote source boundary missing');
   const body=source.slice(start,end);
+  const guarded=body.indexOf('selectR168OneShotRemotePath(');
+  const reject=body.indexOf("decision.mode==='blocked_version_skew'");
+  const observe=body.indexOf("decision.mode==='observe_active'");
   const sync=body.indexOf("await synchronizeOneShotRuntime(ctx,{displayMode:'ascii'});");
-  const dispatch=body.indexOf('invokeController(ctx,command,{allowFailure:true})');
-  assert.ok(sync>=0,'one-shot remote command must synchronize the active runtime');
-  assert.ok(dispatch>sync,'runtime synchronization must complete before controller dispatch');
-  assert.doesNotMatch(body,/reportVersionCoherence/,'warn-only skew path must not remain in one-shot dispatch');
+  const dispatch=body.indexOf("invokeController(ctx,command,{allowFailure:true})");
+  assert.ok(guarded>=0&&reject>guarded&&observe>guarded,
+    'R168 one-shot skew must choose read-only status or fail closed before synchronization');
+  assert.ok(sync>reject&&sync>observe,
+    'version-skew guard must precede coherent runtime sync');
+  assert.ok(dispatch>sync,'coherent R63 runtime synchronization must complete before dispatch');
 });