deadbyte-mcp 0.15.65 → 0.15.67

package/src/activation-preflight-r65.mjs

@@ -55,7 +55,8 @@ export function classifyActivationPreflight({pointer,expectedParent,candidate,ex
   for(const plane of PLANES){
     const entry=observation?.authority?.[plane],proof=observation?.authority_proof?.[plane];
     if(entry&&typeof entry==='object'){
-      const knownReason=entry.armed?entry.reason==='standing-grant':entry.reason==='disarmed'||entry.reason==='coding-disarmed';
+      const knownReason=entry.armed?entry.reason==='standing-grant':
+        entry.reason==='disarmed'||entry.reason==='coding-disarmed'||entry.reason==='epoch-revoked';
       if(!knownReason)return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority reason unverified`,...bound});
     }
     if(!proof)

package/src/activation-reconciliation-audit-r168.mjs

@@ -0,0 +1,200 @@
+// R168 read-only forensic audit. NEVER clears a claim or grants authority.
+import {createHash} from 'node:crypto';
+import {readFile,lstat,readdir,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {createAuthorityEpochStore} from './authority-continuity-r65.mjs';
+import {canonicalJson} from './canonical-json.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const GRANT_FIELD={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
+const SHA=/^[0-9a-f]{64}$/;
+const sha=x=>createHash('sha256').update(x).digest('hex');
+function check(condition,message){if(!condition)throw new Error('R168_AUDIT_BLOCKED '+message);}
+function within(root,file){
+  const relative=path.relative(path.resolve(root),path.resolve(file));
+  return relative!==''&&relative!=='..'&&!relative.startsWith('..'+path.sep)&&!path.isAbsolute(relative);
+}
+async function checkedBytes(file,limit=2*1024*1024){
+  const stat=await lstat(file);
+  check(stat.isFile()&&!stat.isSymbolicLink()&&stat.size>0&&stat.size<=limit,'nonregular or oversized evidence');
+  const target=await realpath(file);
+  check(path.resolve(target).toLowerCase()===path.resolve(file).toLowerCase(),'evidence reparse changed path');
+  const bytes=await readFile(file);
+  check(bytes.length===stat.size,'evidence changed while reading');
+  return bytes;
+}
+async function checkedJson(file,limit){
+  const bytes=await checkedBytes(file,limit);
+  let value;
+  try{value=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));}
+  catch{throw new Error('R168_AUDIT_BLOCKED invalid evidence JSON');}
+  return {value,sha256:sha(bytes)};
+}
+async function inventory(dir,max=4096){
+  const names=await readdir(dir,{withFileTypes:true});
+  check(names.length<=max,'inventory exceeds bounded scan budget');
+  check(names.every(x=>!x.isSymbolicLink()),'inventory contains symlink');
+  return names;
+}
+function immutableRef(value){return JSON.parse(JSON.stringify(value));}
+
+export function rejectR168MutationEvidence({events,continuityId,claimCreatedAt}){
+  check(typeof continuityId==='string'&&/^r65-[0-9a-f]{32}$/.test(continuityId),'invalid continuity identity');
+  check(Number.isFinite(Date.parse(claimCreatedAt)),'invalid claim time');
+  check(Array.isArray(events)&&events.length<=50000,'event inventory invalid');
+  for(const event of events){
+    check(event&&PLANES.includes(event.plane)&&Number.isSafeInteger(event.seq)&&event.seq>=1,'event identity incomplete');
+    check(!event.update_id||event.update_id!==continuityId,'old continuity mutation exists');
+    const t=Date.parse(event.recorded_at_utc);
+    check(Number.isFinite(t)&&t<Date.parse(claimCreatedAt),'authority event at or after old claim');
+  }
+  return {checked_events:events.length,old_continuity_events:0};
+}
+
+// This assessment is NOT a signed reconciliation receipt. It cannot terminalize claims.
+// It inventories the exact preserved unknown outcome against current durable authority.
+export async function inspectR168UnknownWithoutMutation({
+  stateRoot,expectedOperationId,expectedSubjectSha256,expectedOutcomeFilename,
+  expectedContinuityId,expectedPredecessorReleaseId,expectedPredecessorManifestSha256,
+  expectedPredecessorGenerationSha256,expectedCandidateManifestSha256
+}={}){
+  check(process.platform==='win32','Windows host required');
+  check(typeof stateRoot==='string'&&path.win32.isAbsolute(stateRoot),'state root must be Windows absolute');
+  check(/^[0-9a-f]{32}$/.test(String(expectedOperationId))&&SHA.test(String(expectedSubjectSha256)),'old claim identity invalid');
+  check(SHA.test(String(expectedPredecessorManifestSha256))&&SHA.test(String(expectedPredecessorGenerationSha256))&&
+    SHA.test(String(expectedCandidateManifestSha256)),'release identity incomplete');
+  check(/^r65-activation-outcome-[0-9]+-[0-9a-f]{16}\.json$/.test(String(expectedOutcomeFilename)),'outcome filename invalid');
+  const state=path.resolve(stateRoot),updatesDir=path.join(state,'evidence','updates');
+  const lockFile=path.join(updatesDir,'r65-activation.lock');
+  const outcomeFile=path.join(updatesDir,expectedOutcomeFilename);
+  const beforeLock=await checkedJson(lockFile,8192);
+  const beforeOutcome=await checkedJson(outcomeFile,32768);
+  const lock=beforeLock.value,outcome=beforeOutcome.value;
+  check(lock.schema==='deadbyte.r65-activation-claim.v1'&&lock.operation_id===expectedOperationId&&
+    lock.subject_sha256===expectedSubjectSha256,'old claim mismatch');
+  check(outcome.schema==='deadbyte.r65-activation-outcome.v1'&&
+    outcome.claim_operation_id===expectedOperationId&&outcome.preflight_subject_sha256===expectedSubjectSha256&&
+    outcome.candidate_version==='0.15.64'&&outcome.candidate_manifest_sha256===expectedCandidateManifestSha256&&
+    outcome.predecessor_release_id===expectedPredecessorReleaseId&&
+    outcome.update_id===null&&outcome.state_path===null&&
+    outcome.continuity_update_id===expectedContinuityId&&
+    outcome.outcome?.state==='ACTIVATION_OUTCOME_UNKNOWN'&&
+    String(outcome.outcome?.reason??'').includes('UNTRUSTED_WRITE_ACE'),'old unknown outcome mismatch');
+  check(Number.isFinite(Date.parse(lock.created_at_utc))&&Number.isFinite(Date.parse(outcome.observed_at_utc))&&
+    Date.parse(outcome.observed_at_utc)>=Date.parse(lock.created_at_utc),'claim/outcome ordering invalid');
+
+  const beforePointer=await checkedJson(path.join(state,'active-release.json'),32768);
+  const pointer=beforePointer.value;
+  check(pointer.release_id===expectedPredecessorReleaseId&&
+    pointer.manifest_sha256===expectedPredecessorManifestSha256&&
+    pointer.generation_manifest_sha256===expectedPredecessorGenerationSha256&&
+    pointer.version==='0.15.61','active predecessor changed');
+  const generation=path.resolve(pointer.generation_root??'');
+  check(within(path.join(state,'generations'),generation),'active generation escapes state');
+
+  const updateEntries=await inventory(updatesDir,4096);
+  const oldPrefix='r27-'+expectedCandidateManifestSha256.slice(0,16)+'-';
+  check(!updateEntries.some(x=>x.name.startsWith(oldPrefix)),'old candidate update evidence exists');
+  const matchingOutcomes=[];
+  for(const item of updateEntries){
+    if(!/^r65-activation-outcome-.*\.json$/.test(item.name))continue;
+    check(item.isFile(),'outcome inventory includes nonfile');
+    const parsed=await checkedJson(path.join(updatesDir,item.name),32768);
+    if(parsed.value?.claim_operation_id===expectedOperationId)matchingOutcomes.push({file:item.name,sha256:parsed.sha256});
+  }
+  check(matchingOutcomes.length===1&&matchingOutcomes[0].file===expectedOutcomeFilename&&
+    matchingOutcomes[0].sha256===beforeOutcome.sha256,'ambiguous old claim outcome inventory');
+
+  const runtime=path.join(state,'runtime'),store=createAuthorityEpochStore({runtimeDir:runtime});
+  const planeAudits={},observed=[];
+  for(const plane of PLANES){
+    const beforeAudit=await store.auditHistory({plane});
+    check(['PASS','EMPTY'].includes(beforeAudit.status),'signed history not complete');
+    const head=await store.readHead({plane});
+    const dir=path.join(runtime,'authority-epochs',plane,'events');
+    let files;
+    try{files=await inventory(dir,10000);}
+    catch(e){if(e.code==='ENOENT'&&beforeAudit.status==='EMPTY')files=[];else throw e;}
+    check(files.length===beforeAudit.verified_events,'epoch history file count drift');
+    const events=[];
+    for(const item of files){
+      check(item.isFile(),'epoch history contains unexpected entry');
+      const m=/^(\d{16})-([0-9a-f]{64})\.json$/.exec(item.name);
+      check(Boolean(m),'epoch history event filename invalid');
+      const bytes=await checkedBytes(path.join(dir,item.name),1048576);
+      check(sha(bytes)===m[2],'epoch history event digest mismatch');
+      const entry=JSON.parse(bytes.toString('utf8'));
+      check(entry.seq===Number(m[1])&&entry.plane===plane,'epoch event identity changed');
+      events.push({plane,seq:entry.seq,action:entry.action,update_id:entry.update_id,
+        recorded_at_utc:entry.recorded_at_utc,event_sha256:m[2]});
+    }
+    const afterAudit=await store.auditHistory({plane});
+    check(afterAudit.status===beforeAudit.status&&
+      afterAudit.verified_events===beforeAudit.verified_events&&
+      (afterAudit.event_sha256??null)===(beforeAudit.event_sha256??null),'signed epoch history changed');
+    rejectR168MutationEvidence({events,continuityId:expectedContinuityId,claimCreatedAt:lock.created_at_utc});
+    planeAudits[plane]={status:afterAudit.status,verified_events:afterAudit.verified_events,
+      event_sha256:afterAudit.event_sha256??null,head_action:head?.action??null};
+    observed.push(...events);
+  }
+
+  const disarmedPolicies={};
+  for(const plane of PLANES.filter(x=>x!=='coding')){
+    // Configured-but-disarmed is an actual absence assertion, not a guessed scope.
+    const policyFile=path.join(generation,plane+'-policy.json');
+    const currentPolicy=await checkedJson(policyFile,2*1024*1024);
+    const grantPath=path.resolve(currentPolicy.value?.[GRANT_FIELD[plane]]??'');
+    check(currentPolicy.value?.enabled===true&&within(runtime,grantPath),
+      plane+' policy or grant binding unavailable');
+    let present=false;
+    try{await lstat(grantPath);present=true;}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+    check(!present,plane+' disarmed grant file exists');
+    // A historical signed head is not itself an armed grant: the grant file is
+    // mandatory to authorize a session. Never rewrite or erase the head here.
+    // Full signature-chain audit and the no-post-claim-event rule ran above.
+    disarmedPolicies[plane]={policy_sha256:currentPolicy.sha256,grant_absent:true,
+      historical_head_action:planeAudits[plane].head_action,
+      historical_grant_head_without_grant_file:['grant','transaction_restore'].includes(planeAudits[plane].head_action)};
+  }
+
+  const codingPolicy=await checkedJson(path.join(generation,'coding-policy.json'),2*1024*1024);
+  check(codingPolicy.value?.schema==='deadbyte.coding-policy.v1','active Coding policy invalid');
+  const grantFile=path.resolve(codingPolicy.value.lease_file??'');
+  check(within(runtime,grantFile),'Coding grant outside state');
+  const grant=await checkedJson(grantFile,32768);
+  check(SHA.test(grant.value.policy_sha256)&&grant.value.policy_sha256===codingPolicy.sha256,
+    'Coding grant policy changed');
+  const trusted=await createAuthorityEpochStore({runtimeDir:runtime,policyBytes:await checkedBytes(path.join(generation,'coding-policy.json'))})
+    .verifyGrant({plane:'coding',grantBytes:await checkedBytes(grantFile),grantInstanceNonce:grant.value.instance_nonce,
+      policyBytes:await checkedBytes(path.join(generation,'coding-policy.json'))});
+  check(trusted.trusted===true,'Coding grant no longer signed trusted');
+  check(planeAudits.coding.event_sha256===trusted.event_sha256,'Coding head changed during audit');
+
+  for(const plane of PLANES){
+    const finalHistory=await store.auditHistory({plane});
+    check(finalHistory.status===planeAudits[plane].status&&
+      finalHistory.verified_events===planeAudits[plane].verified_events&&
+      (finalHistory.event_sha256??null)===planeAudits[plane].event_sha256,
+      'signed epoch history changed after policy/grant verification');
+  }
+  const afterLock=await checkedJson(lockFile,8192);
+  const afterOutcome=await checkedJson(outcomeFile,32768);
+  const afterPointer=await checkedJson(path.join(state,'active-release.json'),32768);
+  check(beforeLock.sha256===afterLock.sha256&&beforeOutcome.sha256===afterOutcome.sha256&&
+    beforePointer.sha256===afterPointer.sha256,'claim/outcome/pointer changed during audit');
+  const evidence={
+    schema:'deadbyte.r168-readonly-reconciliation-observation.v1',
+    status:'NO_MATCHING_TRANSACTION_OBSERVED',terminalization_authorized:false,
+    old_claim_sha256:beforeLock.sha256,old_outcome_sha256:beforeOutcome.sha256,
+    predecessor_pointer_sha256:beforePointer.sha256,old_operation_id:expectedOperationId,
+    old_continuity_update_id:expectedContinuityId,
+    candidate_manifest_sha256:expectedCandidateManifestSha256,
+    coding_policy_sha256:codingPolicy.sha256,coding_grant_sha256:grant.sha256,
+    coding_epoch_sha256:trusted.event_sha256,
+    disarmed_plane_policies:disarmedPolicies,
+    update_inventory_count:updateEntries.length,outcome_inventory:matchingOutcomes,
+    epoch_history:planeAudits,signed_event_count:observed.length
+  };
+  return Object.freeze({...evidence,observation_sha256:sha(Buffer.from(canonicalJson(evidence)))});
+}

package/src/activation-reconciliation-consent-r168.mjs

@@ -0,0 +1,235 @@
+// R168 cryptographic consent contract. Intentionally no filesystem, native CAS,
+// signing-key discovery, publication or authority mutation in this module.
+import path from 'node:path';
+import {createHash,createPublicKey,sign,verify} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+
+const SHA=/^[0-9a-f]{64}$/, OP=/^[0-9a-f]{32}$/, FILE_ID=/^[0-9a-f]{16}:[0-9a-f]{32}$/;
+const PLANES=['process','coding','autonomous','desktop','host'];
+const OWNER_DOMAIN='DEADBYTE-R168-OWNER-APPROVAL-V1';
+const MACHINE_DOMAIN='DEADBYTE-R168-RECONCILIATION-ATTESTATION-V1';
+const hash=value=>createHash('sha256').update(value).digest('hex');
+const valueBytes=value=>Buffer.from(canonicalJson(value),'utf8');
+const signedMessage=(domain,body)=>Buffer.concat([Buffer.from(domain+'\0','utf8'),valueBytes(body)]);
+function requireR168(condition,message){if(!condition)throw new Error('R168 '+message);}
+function pub(input,label){
+  let k;
+  try{k=input?.type==='public'&&input?.asymmetricKeyType==='ed25519'?input:createPublicKey(input);}
+  catch{throw new Error('R168 '+label+' public key invalid');}
+  requireR168(k.asymmetricKeyType==='ed25519',label+' key is not Ed25519');
+  return k;
+}
+function strictSignature(attestation,domain){
+  requireR168(attestation&&typeof attestation==='object'&&
+    attestation.algorithm==='ed25519'&&attestation.domain===domain&&
+    typeof attestation.signature_base64==='string','signature identity invalid');
+  const buf=Buffer.from(attestation.signature_base64,'base64');
+  requireR168(buf.length===64&&buf.toString('base64')===attestation.signature_base64,'signature encoding invalid');
+  return buf;
+}
+function canonicalStateRoot(value){
+  requireR168(typeof value==='string'&&/^[A-Za-z]:\\/.test(value)&&
+    path.win32.isAbsolute(value)&&!value.includes('\0')&&!value.includes('/')&&
+    !value.startsWith('\\\\'),'state root invalid');
+  const normalized=path.win32.normalize(value);
+  requireR168(normalized===value,'state root must be canonical');
+  return normalized;
+}
+function canonicalSignedSubject(subject){
+  const fields=['schema','requested_action','state_root','claim_operation_id',
+    'old_continuity_update_id','claim_file_id','claim_file_sha256','observation_sha256',
+    'old_outcome_sha256','predecessor_pointer_sha256','coding_policy_sha256',
+    'coding_grant_sha256','coding_epoch_sha256','candidate_manifest_sha256',
+    'signed_event_count','update_inventory_count','epoch_history',
+    'terminalization_committed','activation_authorized','subject_sha256'];
+  requireR168(subject&&typeof subject==='object'&&!Array.isArray(subject)&&
+    subject.schema==='deadbyte.r168-reconciliation-subject.v1'&&
+    SHA.test(String(subject.subject_sha256)),'subject schema/digest invalid');
+  requireR168(Object.keys(subject).length===fields.length&&
+    fields.every(key=>Object.hasOwn(subject,key)),'subject field shape incomplete or unknown');
+  const {subject_sha256,...body}=subject;
+  requireR168(hash(valueBytes(body))===subject_sha256,'subject digest mismatch');
+  canonicalStateRoot(subject.state_root);
+  requireR168(subject.requested_action==='terminalize_unknown_without_replay'&&
+    subject.terminalization_committed===false&&subject.activation_authorized===false&&
+    OP.test(subject.claim_operation_id)&&
+    /^r65-[0-9a-f]{32}$/.test(subject.old_continuity_update_id)&&
+    FILE_ID.test(subject.claim_file_id),
+    'subject authority or claim identity invalid');
+  for(const key of ['claim_file_sha256','observation_sha256','old_outcome_sha256',
+    'predecessor_pointer_sha256','coding_policy_sha256','coding_grant_sha256',
+    'coding_epoch_sha256','candidate_manifest_sha256'])
+    requireR168(SHA.test(String(subject[key])),'subject evidence hash invalid');
+  requireR168(subject.epoch_history&&typeof subject.epoch_history==='object'&&
+    !Array.isArray(subject.epoch_history)&&
+    Object.keys(subject.epoch_history).length===PLANES.length&&
+    PLANES.every(plane=>subject.epoch_history[plane]?.status==='PASS'&&
+      SHA.test(String(subject.epoch_history[plane].event_sha256))&&
+      Number.isSafeInteger(subject.epoch_history[plane].verified_events)&&
+      subject.epoch_history[plane].verified_events>0),
+    'subject signed history incomplete');
+  requireR168(subject.coding_epoch_sha256===subject.epoch_history.coding.event_sha256&&
+    Number.isSafeInteger(subject.signed_event_count)&&
+    PLANES.reduce((n,p)=>n+subject.epoch_history[p].verified_events,0)===subject.signed_event_count&&
+    Number.isSafeInteger(subject.update_inventory_count)&&subject.update_inventory_count>=0,
+    'subject event inventory identity invalid');
+  return body;
+}
+function parseTime(value,name){
+  requireR168(typeof value==='string'&&/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value)&&
+    Number.isFinite(Date.parse(value))&&new Date(value).toISOString()===value,name+' time invalid');
+  return Date.parse(value);
+}
+
+export function createR168ReconciliationSubject({observation,claimSnapshot,stateRoot}={}){
+  requireR168(observation?.schema==='deadbyte.r168-readonly-reconciliation-observation.v1'&&
+    observation.status==='NO_MATCHING_TRANSACTION_OBSERVED'&&observation.terminalization_authorized===false,
+    'observation is not read-only verified');
+  requireR168(SHA.test(String(observation.observation_sha256)),'observation digest missing');
+  const {observation_sha256,...details}=observation;
+  requireR168(hash(valueBytes(details))===observation.observation_sha256,'observation digest mismatch');
+  requireR168(OP.test(String(observation.old_operation_id))&&
+    /^r65-[0-9a-f]{32}$/.test(String(observation.old_continuity_update_id)),
+    'claim/continuity identity invalid');
+  requireR168(SHA.test(String(claimSnapshot?.sha256))&&
+    claimSnapshot.sha256===observation.old_claim_sha256&&FILE_ID.test(String(claimSnapshot?.fileId)),
+    'native claim lock file identity mismatch');
+  requireR168(PLANES.every(p=>observation.epoch_history?.[p]?.status==='PASS'&&
+    SHA.test(String(observation.epoch_history[p].event_sha256))&&
+    Number.isSafeInteger(observation.epoch_history[p].verified_events)&&observation.epoch_history[p].verified_events>0)&&
+    Object.keys(observation.epoch_history).length===PLANES.length,
+    'signed epoch history incomplete');
+  requireR168(PLANES.reduce((n,p)=>n+observation.epoch_history[p].verified_events,0)===observation.signed_event_count,
+    'signed epoch inventory count mismatch');
+  requireR168(SHA.test(String(observation.coding_epoch_sha256))&&
+    observation.epoch_history.coding.event_sha256===observation.coding_epoch_sha256&&
+    SHA.test(String(observation.coding_policy_sha256))&&
+    SHA.test(String(observation.coding_grant_sha256))&&SHA.test(String(observation.predecessor_pointer_sha256))&&
+    SHA.test(String(observation.old_outcome_sha256))&&
+    SHA.test(String(observation.candidate_manifest_sha256)),
+    'observation authority or predecessor identity invalid');
+  requireR168(Number.isSafeInteger(observation.update_inventory_count)&&
+    observation.update_inventory_count>=0,'evidence inventory count invalid');
+  const body={
+    schema:'deadbyte.r168-reconciliation-subject.v1',
+    requested_action:'terminalize_unknown_without_replay',
+    state_root:canonicalStateRoot(stateRoot),
+    claim_operation_id:observation.old_operation_id,
+    old_continuity_update_id:observation.old_continuity_update_id,
+    claim_file_id:claimSnapshot.fileId,
+    claim_file_sha256:claimSnapshot.sha256,
+    observation_sha256:observation.observation_sha256,
+    old_outcome_sha256:observation.old_outcome_sha256,
+    predecessor_pointer_sha256:observation.predecessor_pointer_sha256,
+    coding_policy_sha256:observation.coding_policy_sha256,
+    coding_grant_sha256:observation.coding_grant_sha256,
+    coding_epoch_sha256:observation.coding_epoch_sha256,
+    candidate_manifest_sha256:observation.candidate_manifest_sha256,
+    signed_event_count:observation.signed_event_count,
+    update_inventory_count:observation.update_inventory_count,
+    epoch_history:structuredClone(observation.epoch_history),
+    terminalization_committed:false,activation_authorized:false
+  };
+  return Object.freeze({...body,subject_sha256:hash(valueBytes(body))});
+}
+
+export function makeR168ConsentChallenge(subject){
+  canonicalSignedSubject(subject);
+  return 'RECONCILE '+subject.claim_operation_id+' '+subject.subject_sha256;
+}
+
+export function verifyR168OwnerApproval({subject,approval,ownerPublicKey,now}={}){
+  canonicalSignedSubject(subject);
+  const ownerFields=['schema','action','subject_sha256','claim_operation_id','nonce','issued_at_utc','expires_at_utc'];
+  requireR168(approval&&typeof approval==='object'&&!Array.isArray(approval)&&
+    Object.keys(approval).length===2&&Object.hasOwn(approval,'body')&&Object.hasOwn(approval,'attestation')&&
+    approval.body&&typeof approval.body==='object'&&!Array.isArray(approval.body)&&
+    Object.keys(approval.body).length===ownerFields.length&&
+    ownerFields.every(key=>Object.hasOwn(approval.body,key)),
+    'owner approval field shape invalid');
+  requireR168(approval?.body?.schema==='deadbyte.r168-owner-approval.v1'&&
+    approval.body.action==='terminalize_unknown_without_replay'&&
+    approval.body.subject_sha256===subject.subject_sha256&&
+    approval.body.claim_operation_id===subject.claim_operation_id,
+    'owner approval subject mismatch');
+  requireR168(SHA.test(String(approval.body.nonce)),'owner approval nonce invalid');
+  const issue=parseTime(approval.body.issued_at_utc,'approval issue');
+  const expiry=parseTime(approval.body.expires_at_utc,'approval expiry');
+  const nowValue=parseTime(now??new Date().toISOString(),'approval check');
+  requireR168(expiry>issue&&expiry-issue<=600000&&nowValue>=issue&&nowValue<expiry,
+    'owner approval expired or outside window');
+  const sig=strictSignature(approval.attestation,OWNER_DOMAIN);
+  requireR168(verify(null,signedMessage(OWNER_DOMAIN,approval.body),pub(ownerPublicKey,'owner'),sig),
+    'owner approval signature invalid');
+  return true;
+}
+
+export function createR168SignedAuthorization({
+  subject,approval,ownerPublicKey,machinePrivateKey,now,typedConfirmation
+}={}){
+  verifyR168OwnerApproval({subject,approval,ownerPublicKey,now});
+  requireR168(typedConfirmation===makeR168ConsentChallenge(subject),
+    'explicit typed confirmation does not match approved claim');
+  requireR168(machinePrivateKey?.asymmetricKeyType==='ed25519'&&machinePrivateKey?.type==='private',
+    'machine signing key unavailable');
+  const ownerPublic=pub(ownerPublicKey,'owner');
+  const machinePublic=createPublicKey(machinePrivateKey);
+  const spki=k=>Buffer.from(k.export({type:'spki',format:'der'}));
+  requireR168(!spki(ownerPublic).equals(spki(machinePublic)),
+    'owner and machine signing identities must use independent keys');
+  const body={
+    schema:'deadbyte.r168-reconciliation-authorization.v1',
+    action:'prepare_exact_claim_terminalization',
+    subject_sha256:subject.subject_sha256,
+    claim_operation_id:subject.claim_operation_id,
+    claim_file_id:subject.claim_file_id,
+    owner_approval_sha256:hash(valueBytes(approval)),
+    created_at_utc:now,
+    terminalization_committed:false,
+    activation_authorized:false
+  };
+  const signature=sign(null,signedMessage(MACHINE_DOMAIN,body),machinePrivateKey);
+  const unsigned={body,body_sha256:hash(valueBytes(body)),
+    attestation:{algorithm:'ed25519',domain:MACHINE_DOMAIN,signature_base64:signature.toString('base64')}};
+  return Object.freeze({...unsigned,receipt_sha256:hash(valueBytes(unsigned))});
+}
+
+export function verifyR168SignedAuthorization({
+  subject,approval,receipt,ownerPublicKey,machinePublicKey,now
+}={}){
+  verifyR168OwnerApproval({subject,approval,ownerPublicKey,now});
+  const ownerKey=pub(ownerPublicKey,'owner'),machineKey=pub(machinePublicKey,'machine');
+  const spki=key=>Buffer.from(key.export({type:'spki',format:'der'}));
+  requireR168(!spki(ownerKey).equals(spki(machineKey)),
+    'owner and machine signer identities must be independent');
+  const fields=['schema','action','subject_sha256','claim_operation_id','claim_file_id',
+    'owner_approval_sha256','created_at_utc','terminalization_committed','activation_authorized'];
+  requireR168(receipt&&typeof receipt==='object'&&!Array.isArray(receipt)&&
+    Object.keys(receipt).length===4&&
+    ['body','body_sha256','attestation','receipt_sha256'].every(k=>Object.hasOwn(receipt,k))&&
+    receipt.body&&typeof receipt.body==='object'&&!Array.isArray(receipt.body)&&
+    Object.keys(receipt.body).length===fields.length&&fields.every(k=>Object.hasOwn(receipt.body,k)),
+    'authorization receipt field shape invalid');
+  requireR168(receipt?.body?.schema==='deadbyte.r168-reconciliation-authorization.v1'&&
+    receipt.body.action==='prepare_exact_claim_terminalization'&&
+    receipt.body.subject_sha256===subject.subject_sha256&&
+    receipt.body.claim_operation_id===subject.claim_operation_id&&
+    receipt.body.claim_file_id===subject.claim_file_id&&
+    receipt.body.owner_approval_sha256===hash(valueBytes(approval))&&
+    receipt.body.terminalization_committed===false&&receipt.body.activation_authorized===false,
+    'authorization receipt subject/permission mismatch');
+  const created=parseTime(receipt.body.created_at_utc,'receipt');
+  const issued=parseTime(approval.body.issued_at_utc,'owner approval issue');
+  const expiry=parseTime(approval.body.expires_at_utc,'owner approval expiry');
+  const current=parseTime(now??new Date().toISOString(),'verification');
+  requireR168(created>=issued&&created<=current&&created<expiry,
+    'authorization receipt created outside owner approval time window or in the future');
+  requireR168(receipt.body_sha256===hash(valueBytes(receipt.body)),
+    'authorization receipt body digest mismatch');
+  const {receipt_sha256,...unsigned}=receipt;
+  requireR168(receipt_sha256===hash(valueBytes(unsigned)),'authorization receipt digest mismatch');
+  const signature=strictSignature(receipt.attestation,MACHINE_DOMAIN);
+  requireR168(verify(null,signedMessage(MACHINE_DOMAIN,receipt.body),machineKey,signature),
+    'authorization receipt signature invalid');
+  return true;
+}

package/src/activation-reconciliation-fence-r168.mjs

@@ -0,0 +1,87 @@
+// R168 five-plane R85 exclusion, with a deliberately non-injectable production
+// entrypoint. Simulation is ONLY a pure test of sequencing: no production proof.
+import {randomBytes} from 'node:crypto';
+import {lstat} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {acquireHeldEpochLock} from './epoch-lock-r85.mjs';
+import {queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const validate=(stateRoot,onHeld)=>{
+  if(typeof onHeld!=='function'||typeof stateRoot!=='string'||!path.isAbsolute(stateRoot))
+    throw new Error('R168 held epoch fence arguments invalid');
+};
+
+async function runHeldFence({stateRoot,onHeld,acquire,owner}){
+  validate(stateRoot,onHeld);
+  if(typeof acquire!=='function'||!validForegroundIdentity(owner)||owner.pid!==process.pid)
+    throw new Error('R168 native owner process identity unavailable');
+  const root=path.resolve(stateRoot),runtime=path.join(root,'runtime','authority-epochs');
+  const folders=PLANES.map(plane=>({plane,dir:path.join(runtime,plane)}));
+  // Preflight the entire directory set before acquiring any lock. Never make
+  // missing directories or silently repair a stale owner in reconciliation.
+  for(const entry of folders){
+    const stat=await lstat(entry.dir);
+    if(!stat.isDirectory()||stat.isSymbolicLink())
+      throw new Error('R168 epoch plane directory untrusted or unavailable: '+entry.plane);
+  }
+  const leases=[];
+  let started=false,primary=null,result;
+  try{
+    for(const entry of folders){
+      const bytes=Buffer.from(canonicalJson({
+        schema:'deadbyte.authority-epoch-lock.r65.v1',
+        pid:process.pid,token:randomBytes(16).toString('hex'),
+        created_at_utc:new Date().toISOString(),owner_identity:owner
+      }),'utf8');
+      const lease=await acquire(path.join(entry.dir,'.lock'),bytes);
+      if(!lease||typeof lease.release!=='function')
+        throw new Error('R168 epoch native lock busy: '+entry.plane);
+      leases.push({plane:entry.plane,lease});
+    }
+    started=true;
+    result=await onHeld(Object.freeze({
+      planeOrder:PLANES,
+      assertHeld:()=>{
+        if(!started||leases.length!==PLANES.length)
+          throw new Error('R168 five-plane native exclusion not held');
+        return true;
+      }
+    }));
+  }catch(error){primary=error;}
+  const releaseErrors=[];
+  for(const {plane,lease} of leases.reverse()){
+    try{await lease.release();}
+    catch(error){releaseErrors.push(new Error('R168 failed to release '+plane+' native epoch lock',{cause:error}));}
+  }
+  if(releaseErrors.length&&primary)
+    throw new AggregateError([primary,...releaseErrors],'R168 native epoch fence and cleanup ambiguous');
+  if(releaseErrors.length)throw new AggregateError(releaseErrors,'R168 native epoch fence release ambiguous');
+  if(primary)throw primary;
+  return result;
+}
+
+// Only this entrypoint can be used by any future trusted reconciliation commit.
+// The R85 loader itself enforces R89 and native binary/source identity.
+export async function withR168FivePlaneEpochFence(options={}){
+  if(!options||typeof options!=='object'||Array.isArray(options)||
+    Object.keys(options).some(key=>!['stateRoot','onHeld'].includes(key)))
+    throw new Error('R168 protected fence forbids injected or unknown options');
+  validate(options.stateRoot,options.onHeld);
+  if(process.platform!=='win32')throw new Error('R168 production epoch exclusion requires Windows');
+  const owner=queryForegroundIdentity(process.pid);
+  return runHeldFence({...options,owner,acquire:acquireHeldEpochLock});
+}
+
+// Non-authoritative simulation only. Deliberately NOT called by production
+// entrypoint; test-worker environment is not a security boundary.
+export async function simulateR168FivePlaneEpochFence({
+  stateRoot,onHeld,testAcquire,testOwnerIdentity
+}={}){
+  if(process.env.NODE_TEST_CONTEXT!=='child-v8')
+    throw new Error('R168 simulation requires a Node test worker');
+  if(typeof testAcquire!=='function')
+    throw new Error('R168 simulation requires a fake acquire');
+  return runHeldFence({stateRoot,onHeld,acquire:testAcquire,owner:testOwnerIdentity});
+}

package/src/activation-reconciliation-journal-r168.mjs

@@ -0,0 +1,100 @@
+// R168 fail-closed, non-mutating reconciliation intent journal.
+// This is a standalone receipt contract. Production CAS MUST NOT use it
+// without a trusted R89 entrypoint, held five-plane R85 locks, actual owner
+// approval and native FileIdInfo observations. No delete/revoke here.
+import {createHash} from 'node:crypto';
+import {lstat,open,readFile,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR168SignedAuthorization} from './activation-reconciliation-consent-r168.mjs';
+import {verifyR168TerminalResult} from './activation-reconciliation-terminal-r168.mjs';
+
+const SHA=/^[a-f0-9]{64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const stable=body=>Buffer.from(canonicalJson(body)+'\n','utf8');
+function check(condition,reason){if(!condition)throw new Error('R168 journal '+reason);}
+async function normalDirectory(value){
+  check(typeof value==='string'&&path.isAbsolute(value),'evidence directory must be absolute');
+  const dir=path.resolve(value),stat=await lstat(dir);
+  check(stat.isDirectory()&&!stat.isSymbolicLink(),'evidence directory not ordinary');
+  check(path.resolve(await realpath(dir)).toLowerCase()===dir.toLowerCase(),
+    'evidence directory reparse denied');
+  return dir;
+}
+function content(subject,approval,prepared){
+  const body={schema:'deadbyte.r168-terminal-intent.v1',
+    phase:'INTENT_PREPARED_ONLY',
+    subject_sha256:subject.subject_sha256,
+    claim_operation_id:subject.claim_operation_id,
+    claim_file_id:subject.claim_file_id,
+    claim_file_sha256:subject.claim_file_sha256,
+    predecessor_pointer_sha256:subject.predecessor_pointer_sha256,
+    owner_approval_nonce:approval.body.nonce,
+    owner_approval_sha256:sha(Buffer.from(canonicalJson(approval))),
+    prepared_receipt_sha256:prepared.receipt_sha256,
+    terminalization_committed:false,activation_authorized:false};
+  return {body,body_sha256:sha(Buffer.from(canonicalJson(body)))};
+}
+export async function prepareR168TerminalIntent({
+  evidenceDir,subject,approval,prepared,ownerPublicKey,machinePublicKey,now
+}={}){
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,
+    ownerPublicKey,machinePublicKey,now});
+  const dir=await normalDirectory(evidenceDir);
+  check(SHA.test(approval.body.nonce),'owner approval nonce invalid');
+  const file=path.join(dir,'r168-terminal-intent-'+approval.body.nonce+'.json');
+  const encoded=stable(content(subject,approval,prepared));
+  check(encoded.length<32768,'intent size exceeded');
+  let handle;
+  try{handle=await open(file,'wx',0o600);}
+  catch(error){if(error?.code==='EEXIST')throw new Error('R168 journal one-use intent already exists; no-clobber');throw error;}
+  try{
+    // A write or fsync error leaves any incomplete intent in place to block
+    // replay. We never rename/rewrite it to appear as a successful receipt.
+    await handle.writeFile(encoded);
+    await handle.sync();
+  }finally{await handle.close();}
+  const checkBytes=await readFile(file);
+  check(checkBytes.equals(encoded),'intent changed during readback');
+  return Object.freeze({file,sha256:sha(encoded),bytes:encoded.length,
+    state:'INTENT_PREPARED_ONLY',activation_authorized:false});
+}
+export async function classifyR168Recovery({
+  recordFile,subject,approval,prepared,ownerPublicKey,machinePublicKey,
+  observedClaim,terminal=null,after=null,now
+}={}){
+  // Historical validity of a recorded intent remains verifiable after the
+  // one-time owner's approval window expires. This DOES NOT grant fresh consent.
+  verifyR168SignedAuthorization({subject,approval,receipt:prepared,ownerPublicKey,machinePublicKey,
+    now:prepared?.body?.created_at_utc});
+  check(typeof recordFile==='string'&&path.isAbsolute(recordFile),'record path invalid');
+  const stat=await lstat(recordFile);
+  check(stat.isFile()&&!stat.isSymbolicLink()&&stat.size>0&&stat.size<=32768,
+    'journal file is not regular or bounded');
+  const original=await readFile(recordFile);
+  check(original.length===stat.size,'journal file changed during audit');
+  let record;
+  try{record=JSON.parse(original.toString('utf8'));}catch{throw new Error('R168 journal damaged JSON');}
+  const expected=content(subject,approval,prepared);
+  check(record?.body_sha256===expected.body_sha256&&
+    canonicalJson(record.body)===canonicalJson(expected.body)&&
+    sha(Buffer.from(canonicalJson(record.body)))===record.body_sha256,
+    'journal digest/identity tampered');
+  check(observedClaim&&typeof observedClaim==='object','claim observation absent');
+  if(observedClaim.state==='PRESENT'){
+    if(terminal)throw new Error('R168 journal terminal/claim state ambiguous');
+    const same=observedClaim.fileId===subject.claim_file_id&&
+      observedClaim.sha256===subject.claim_file_sha256;
+    return Object.freeze({state:same?'PRECOMMIT_CLAIM_PRESENT_BLOCKED':'CLAIM_CHANGED_BLOCKED',
+      activation_authorized:false,terminalization_committed:false});
+  }
+  check(observedClaim.state==='ABSENT','claim observation unverified');
+  if(!terminal)return Object.freeze({state:'CAS_OUTCOME_UNKNOWN_BLOCKED',
+    activation_authorized:false,terminalization_committed:false});
+  check(after,'terminal post-CAS evidence missing');
+  verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey,machinePublicKey,after,now});
+  return Object.freeze({state:'TERMINAL_VERIFIED_ACTIVATION_SEPARATE',
+    activation_authorized:false,terminalization_committed:true,
+    terminal_receipt_sha256:terminal.receipt_sha256});
+}