deadbyte-mcp 0.15.65 → 0.15.67

package/test/r168-owner-reconciliation-contract.test.mjs

@@ -0,0 +1,250 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,sign} from 'node:crypto';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {persistR168OneUseAuthorization} from '../src/activation-reconciliation-receipt-store-r168.mjs';
+import {createR168TerminalResult,verifyR168TerminalResult} from '../src/activation-reconciliation-terminal-r168.mjs';
+import {mkdtemp,mkdir,readFile,rm,readdir} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {
+  createR168ReconciliationSubject,makeR168ConsentChallenge,
+  verifyR168OwnerApproval,createR168SignedAuthorization,verifyR168SignedAuthorization
+} from '../src/activation-reconciliation-consent-r168.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const domain=Buffer.from('DEADBYTE-R168-OWNER-APPROVAL-V1\0');
+const owner=generateKeyPairSync('ed25519');
+const machine=generateKeyPairSync('ed25519');
+const head={process:'a',coding:'b',autonomous:'c',desktop:'d',host:'e'};
+const counts={process:27,coding:29,autonomous:24,desktop:28,host:26};
+const observation=Object.freeze({
+  schema:'deadbyte.r168-readonly-reconciliation-observation.v1',
+  status:'NO_MATCHING_TRANSACTION_OBSERVED',terminalization_authorized:false,
+  old_operation_id:'c84d7ffa4eee80a2f467acda3ddd9332',
+  old_continuity_update_id:'r65-ef42bc84451ce024c4dee736d4047b36',
+  old_claim_sha256:H('lock'),old_outcome_sha256:H('outcome'),predecessor_pointer_sha256:H('ptr'),
+  coding_policy_sha256:H('policy'),coding_grant_sha256:H('grant'),coding_epoch_sha256:H(head.coding),
+  candidate_manifest_sha256:H('candidate'),signed_event_count:134,update_inventory_count:376,
+  epoch_history:Object.fromEntries(Object.entries(head).map(([p,c])=>[p,{
+    status:'PASS',verified_events:counts[p],event_sha256:H(c),head_action:p==='coding'?'grant':'user_revoke'
+  }])),
+  observation_sha256:null
+});
+const {observation_sha256:_,...observationBody}=observation;
+const observationFinal=Object.freeze({...observationBody,observation_sha256:H(canonicalJson(observationBody))});
+const claimSnapshot={fileId:'1234567890abcdef:1234567890abcdef1234567890abcdef',sha256:observationFinal.old_claim_sha256};
+const makeSubject=()=>createR168ReconciliationSubject({observation:observationFinal,
+  claimSnapshot,stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'});
+const now='2026-10-26T08:00:00.000Z';
+function approvalFor(subject,{bodyChanges={},signingKey=owner.privateKey}={}){
+  const body={schema:'deadbyte.r168-owner-approval.v1',action:'terminalize_unknown_without_replay',
+    subject_sha256:subject.subject_sha256,claim_operation_id:subject.claim_operation_id,
+    nonce:H('one-time-approval'),issued_at_utc:'2026-10-26T07:59:00.000Z',
+    expires_at_utc:'2026-10-26T08:04:00.000Z',...bodyChanges};
+  const bytes=Buffer.concat([domain,Buffer.from(canonicalJson(body))]);
+  return {body,attestation:{algorithm:'ed25519',domain:'DEADBYTE-R168-OWNER-APPROVAL-V1',
+    signature_base64:sign(null,bytes,signingKey).toString('base64')}};
+}
+test('R168 binds subject to exact claim FileId, five signed heads and all observed hashes',()=>{
+  const subject=makeSubject();
+  assert.equal(subject.schema,'deadbyte.r168-reconciliation-subject.v1');
+  assert.equal(subject.claim_file_id,claimSnapshot.fileId);
+  assert.equal(subject.old_outcome_sha256,observation.old_outcome_sha256);
+  assert.equal(Object.keys(subject.epoch_history).length,5);
+  assert.match(subject.subject_sha256,/^[a-f0-9]{64}$/);
+  assert.match(makeR168ConsentChallenge(subject),new RegExp(subject.claim_operation_id));
+});
+test('R168 rejects an audit claiming terminal authority or a mismatched lock identity',()=>{
+  assert.throws(()=>createR168ReconciliationSubject({observation:{...observationFinal,terminalization_authorized:true},claimSnapshot,
+    stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/terminal|observation/i);
+  assert.throws(()=>createR168ReconciliationSubject({observation:observationFinal,
+    claimSnapshot:{...claimSnapshot,sha256:H('replaced')},stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/claim|lock/i);
+  assert.throws(()=>createR168ReconciliationSubject({observation:{...observationFinal,old_outcome_sha256:H('new')},claimSnapshot,
+    stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp'}),/digest|observation/i);
+});
+test('R168 owner consent requires an independent matching Ed25519 signature and fresh single-use identity',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  assert.equal(verifyR168OwnerApproval({subject,approval,ownerPublicKey:owner.publicKey,now}),true);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval,ownerPublicKey:machine.publicKey,now}),/signature|owner/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval,ownerPublicKey:owner.publicKey,
+    now:'2026-10-26T08:05:00.000Z'}),/expired|window/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:approvalFor(subject,{bodyChanges:{subject_sha256:H('other')}}),
+    ownerPublicKey:owner.publicKey,now}),/subject|approval/i);
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:approvalFor(subject,{bodyChanges:{nonce:'nothex'}}),
+    ownerPublicKey:owner.publicKey,now}),/nonce|approval/i);
+});
+test('R168 machine-signed reconciliation receipt is not authorization to delete until commit is separately approved',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.equal(receipt.body.terminalization_committed,false);
+  assert.equal(receipt.body.activation_authorized,false);
+  assert.equal(verifyR168SignedAuthorization({subject,approval,receipt,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),true);
+  assert.throws(()=>createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:'YES'}),/confirmation/i);
+  assert.throws(()=>createR168SignedAuthorization({subject,approval:null,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)}),/owner|approval/i);
+  const swapped={...receipt,body:{...receipt.body,terminalization_committed:true}};
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt:swapped,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),/receipt|signature|digest/i);
+});
+
+test('R168 forged extra approval fields and mismatched machine/owner key roles fail closed',()=>{
+  const subject=makeSubject();
+  const extra=approvalFor(subject,{bodyChanges:{grant_plane:'host'}});
+  assert.throws(()=>verifyR168OwnerApproval({subject,approval:extra,ownerPublicKey:owner.publicKey,now}),
+    /approval|shape|fields/i);
+  const sameKeyApproval=approvalFor(subject,{signingKey:machine.privateKey});
+  assert.throws(()=>createR168SignedAuthorization({subject,approval:sameKeyApproval,
+    ownerPublicKey:machine.publicKey,machinePrivateKey:machine.privateKey,
+    now,typedConfirmation:makeR168ConsentChallenge(subject)}),/independent|same key/i);
+});
+test('R168 signed subject does not survive changes to signed epoch history or claim binding',()=>{
+  const subject=makeSubject();
+  const tampered={...subject,epoch_history:{...subject.epoch_history,coding:{
+    ...subject.epoch_history.coding,event_sha256:H('different')}}};
+  assert.throws(()=>verifyR168OwnerApproval({subject:tampered,approval:approvalFor(subject),
+    ownerPublicKey:owner.publicKey,now}),/subject digest/i);
+});
+
+test('R168 one-use owner authorization receipt is exclusive, verified and never overwrites existing evidence',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'r168-receipt-only-'));
+  try{
+    const evidenceDir=path.join(dir,'evidence');
+    await mkdir(evidenceDir);
+    const subject=makeSubject(),approval=approvalFor(subject);
+    const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+      machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+    const args={evidenceDir,subject,approval,receipt,ownerPublicKey:owner.publicKey,
+      machinePublicKey:machine.publicKey,now};
+    const persisted=await persistR168OneUseAuthorization(args);
+    assert.match(persisted.sha256,/^[a-f0-9]{64}$/);
+    const body=JSON.parse(await readFile(persisted.path,'utf8'));
+    assert.equal(body.receipt.body.subject_sha256,subject.subject_sha256);
+    assert.equal(body.receipt.body.terminalization_committed,false);
+    await assert.rejects(persistR168OneUseAuthorization(args),/exists|one-use|clobber/i);
+    assert.deepEqual((await readdir(evidenceDir)).length,1);
+    assert.equal(H(await readFile(persisted.path)),persisted.sha256);
+    await assert.rejects(persistR168OneUseAuthorization({...args,
+      receipt:{...receipt,receipt_sha256:H('tampered')}}),/receipt|digest|signature/i);
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('R168 rejects a signed but incomplete or extra-field reconciliation subject',()=>{
+  const incompleteBody={schema:'deadbyte.r168-reconciliation-subject.v1',
+    claim_operation_id:'c84d7ffa4eee80a2f467acda3ddd9332'};
+  const incomplete={...incompleteBody,subject_sha256:H(canonicalJson(incompleteBody))};
+  assert.throws(()=>verifyR168OwnerApproval({subject:incomplete,approval:approvalFor(incomplete),
+    ownerPublicKey:owner.publicKey,now}),/subject|shape|incomplete/i);
+  const original=makeSubject();
+  const {subject_sha256,...body}=original;
+  const modified={...body,unreviewed_authority:'host'};
+  const changed={...modified,subject_sha256:H(canonicalJson(modified))};
+  assert.throws(()=>verifyR168OwnerApproval({subject:changed,approval:approvalFor(changed),
+    ownerPublicKey:owner.publicKey,now}),/subject|shape|field/i);
+});
+
+test('R168 receipt verifier enforces independent owner/machine public-key roles',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt,
+    ownerPublicKey:owner.publicKey,machinePublicKey:owner.publicKey,now}),/independent|same key/i);
+});
+test('R168 receipt verifier refuses future creation time within an otherwise valid approval window',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const receipt=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now:'2026-10-26T07:59:30.000Z'}),/future|time|window/i);
+});
+test('R168 receipt verifier rejects machine-signed extra authority fields even when signature is valid',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const original=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const body={...original.body,enable_host:true};
+  const machineDomain=Buffer.from('DEADBYTE-R168-RECONCILIATION-ATTESTATION-V1\\0'.replace('\\0','\0'));
+  const unsigned={body,body_sha256:H(canonicalJson(body)),
+    attestation:{algorithm:'ed25519',domain:'DEADBYTE-R168-RECONCILIATION-ATTESTATION-V1',
+      signature_base64:sign(null,Buffer.concat([machineDomain,Buffer.from(canonicalJson(body))]),
+        machine.privateKey).toString('base64')}};
+  const forged={...unsigned,receipt_sha256:H(canonicalJson(unsigned))};
+  assert.throws(()=>verifyR168SignedAuthorization({subject,approval,receipt:forged,ownerPublicKey:owner.publicKey,
+    machinePublicKey:machine.publicKey,now}),/field|shape|extra/i);
+});
+
+test('R168 terminal result signed only after exact claim CAS removal and stable five-plane heads',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={
+    native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history
+  };
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.equal(terminal.body.terminalization_committed,true);
+  assert.equal(terminal.body.activation_authorized,false);
+  assert.equal(verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,now}),true);
+});
+test('R168 rejects terminal signing when CAS is not removed or history/pointer drifted',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const good={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const build=after=>createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.throws(()=>build({...good,native_cas_result:'CHANGED'}),/CAS|claim|removed/i);
+  assert.throws(()=>build({...good,claim_absent:false}),/CAS|claim|absent/i);
+  assert.throws(()=>build({...good,pointer_sha256:H('replaced')}),/pointer|predecessor/i);
+  assert.throws(()=>build({...good,epoch_history:{...good.epoch_history,coding:{
+    ...good.epoch_history.coding,event_sha256:H('revoked')}}}),/epoch|history|coding/i);
+});
+test('R168 signed terminal receipt is bound to independent machine key and current observed state',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:owner.publicKey,after,now}),/independent|signature|key/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,
+    after:{...after,claim_absent:false},now}),/CAS|claim|absent/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,
+    terminal:{...terminal,body:{...terminal.body,activation_authorized:true}},
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,now}),/receipt|result|digest|mismatch/i);
+});
+
+test('R168 archived terminal result stays verifiable after one-time owner approval expires',()=>{
+  const subject=makeSubject(),approval=approvalFor(subject);
+  const prepared=createR168SignedAuthorization({subject,approval,ownerPublicKey:owner.publicKey,
+    machinePrivateKey:machine.privateKey,now,typedConfirmation:makeR168ConsentChallenge(subject)});
+  const after={native_cas_result:'REMOVED',claim_absent:true,
+    pointer_sha256:subject.predecessor_pointer_sha256,old_outcome_sha256:subject.old_outcome_sha256,
+    coding_policy_sha256:subject.coding_policy_sha256,coding_grant_sha256:subject.coding_grant_sha256,
+    coding_epoch_sha256:subject.coding_epoch_sha256,epoch_history:subject.epoch_history};
+  const terminal=createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,now});
+  assert.equal(verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,
+    now:'2026-10-27T08:00:00.000Z'}),true);
+  assert.throws(()=>createR168TerminalResult({subject,approval,prepared,
+    ownerPublicKey:owner.publicKey,machinePrivateKey:machine.privateKey,after,
+    now:'2026-10-27T08:00:00.000Z'}),/approval|expired|window/i);
+  assert.throws(()=>verifyR168TerminalResult({subject,approval,prepared,terminal,
+    ownerPublicKey:owner.publicKey,machinePublicKey:machine.publicKey,after,
+    now:'2026-10-26T07:59:59.000Z'}),/future|time|observation/i);
+});

package/test/r168-protected-entrypoint.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+
+const root=fileURLToPath(new URL('..',import.meta.url));
+const script=path.join(root,'scripts','r172-protected-preflight.mjs');
+const protectedRoot='C:\\Program Files';
+const relative=path.win32.relative(protectedRoot,root);
+const isProtected=process.platform==='win32'&&relative!==''&&relative!=='..'&&!relative.startsWith('..'+path.win32.sep)&&!path.win32.isAbsolute(relative);
+function launch(file,...args){return spawnSync(process.execPath,[file,...args],{
+  encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:65536
+});}
+
+test('R172 installed preflight respects R89 protected-vs-writable execution context',()=>{
+  const result=launch(script);
+  if(isProtected){
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R172_PROTECTED_PREFLIGHT_READONLY_PASS/);
+    assert.match(result.stdout,/"terminalization_authorized":false/);
+    assert.match(result.stdout,/"activation_authorized":false/);
+  }else{
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+    assert.match(result.stderr,/R172_.*_(UNPROTECTED|VERSION_DRIFT)/);
+  }
+});
+
+test('R172 writable development copy remains blocked when protected fixture exists',()=>{
+  const source=path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT||root);
+  if(path.win32.relative(protectedRoot,source).toLowerCase()===path.win32.relative(protectedRoot,root).toLowerCase()&&isProtected)
+    return test.skip('no separate development source configured');
+  const result=launch(path.join(source,'scripts','r172-protected-preflight.mjs'));
+  assert.notEqual(result.status,0);
+  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R172_.*_UNPROTECTED/);
+});
+
+test('R172 entrypoint does not accept flags to skip manifest, R89 or root checks',()=>{
+  const result=launch(script,'--skip-trust');
+  assert.notEqual(result.status,0);
+  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/UNKNOWN_OPTION/);
+});
+
+test('R172 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
+  const src=await readFile(script,'utf8');
+  assert.match(src,/verifyManifestTreeExact\(/);
+  assert.match(src,/inspectTrustedInstallation\(/);
+  assert.doesNotMatch(src,/deletePinnedRemoteMarker\(|unlink\(|transaction_revoke\(/);
+});

package/test/r168-reconciliation-audit.test.mjs

@@ -0,0 +1,42 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {rejectR168MutationEvidence} from '../src/activation-reconciliation-audit-r168.mjs';
+
+const continuityId='r65-ef42bc84451ce024c4dee736d4047b36';
+const created='2026-10-26T04:31:15.000Z';
+const event=(changes={})=>({
+  plane:'coding',seq:1,action:'grant',update_id:null,
+  recorded_at_utc:'2026-10-26T04:30:15.000Z',...changes
+});
+const invoke=events=>rejectR168MutationEvidence({events,continuityId,claimCreatedAt:created});
+
+test('R168 historical signed-event inventory may be observed only when older than unknown claim',()=>{
+  assert.deepEqual(invoke([event(),event({plane:'process',action:'user_revoke',seq:2})]),
+    {checked_events:2,old_continuity_events:0});
+});
+test('R168 old continuity transaction cannot be treated as no mutation',()=>{
+  assert.throws(()=>invoke([event({action:'transaction_revoke',update_id:continuityId})]),
+    /old continuity mutation exists/);
+  assert.throws(()=>invoke([event({action:'transaction_restore',update_id:continuityId})]),
+    /old continuity mutation exists/);
+});
+test('R168 an event after claim, including unrelated grant or revoke, is not a no-mutation proof',()=>{
+  assert.throws(()=>invoke([event({recorded_at_utc:'2026-10-26T04:31:16.000Z'})]),
+    /authority event at or after old claim/);
+  assert.throws(()=>invoke([event({action:'user_revoke',recorded_at_utc:created})]),
+    /authority event at or after old claim/);
+});
+test('R168 malformed, missing or oversized event inventory is rejected',()=>{
+  assert.throws(()=>invoke([event({plane:'unexpected'})]),/event identity incomplete/);
+  assert.throws(()=>invoke([event({seq:0})]),/event identity incomplete/);
+  assert.throws(()=>invoke([event({recorded_at_utc:'invalid'})]),/authority event at or after old claim/);
+  assert.throws(()=>rejectR168MutationEvidence({events:[],continuityId:'wrong',claimCreatedAt:created}),/continuity identity/);
+  assert.throws(()=>invoke(new Array(50001).fill(event())),/event inventory invalid/);
+});
+test('R168 no-mutation diagnostic must remain non-signing and non-terminalizing',async()=>{
+  const fs=await import('node:fs/promises');
+  const url=new URL('../src/activation-reconciliation-audit-r168.mjs',import.meta.url);
+  const src=await fs.readFile(url,'utf8');
+  assert.match(src,/terminalization_authorized:false/);
+  assert.doesNotMatch(src,/\bunlink\s*\(|\brename\s*\(|\bwriteFile\s*\(/);
+});

package/test/r168-release-contract.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+import {assertR168NpmPublishReady,assertR168PackedIdentity} from '../scripts/npm-release-readiness-r168.mjs';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
+const parent='v0.15.61-055d1ff0aa99e60b';
+const predecessorManifest='3316654646cc870584a7c969c2032af6c795229ff8c65e5a8b794f97c2458c41';
+const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484';
+
+test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
+ const release=await read('RELEASE.json');
+ assert.equal(release.runtime_predecessor.version,'0.15.61');
+ assert.equal(release.runtime_predecessor.release_id,parent);
+ assert.equal(release.parent.release_id,parent);
+ assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');
+ assert.equal(release.r168.source_predecessor_version,'0.15.65');
+ assert.equal(release.r168.source_predecessor_manifest_sha256,predecessorManifest);
+ assert.equal(release.r168.source_predecessor_tarball_sha256,predecessorTarball);
+ assert.equal(release.r168.owner_approval,'NOT_PRESENT');
+ assert.equal(release.r168.old_r65_activation_claim,'PRESERVED_UNKNOWN');
+ assert.equal(release.r168.production_activation,'NOT_RUN');
+ assert.equal(release.r168.public_tool_delta,0);
+ assert.equal(release.r168.authority_scope_delta,0);
+ assert.equal(release.r168.stable_final_claim,false);
+});
+test('R168 exact-byte publisher refuses absent full protected closure',async()=>{
+ const release=await read('RELEASE.json'),saved=process.env.DEADBYTE_R168_CLOSURE_ROOT;
+ try{
+  delete process.env.DEADBYTE_R168_CLOSURE_ROOT;
+  await assert.rejects(assertR168NpmPublishReady(release,{root}),/PUBLISH_BLOCKED R168/);
+ }finally{
+  if(saved===undefined)delete process.env.DEADBYTE_R168_CLOSURE_ROOT;
+  else process.env.DEADBYTE_R168_CLOSURE_ROOT=saved;
+ }
+});
+test('R168 publisher refuses any tarball digest mismatch',()=>{
+ const expected={tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-expected',
+   tarball_shasum:'b'.repeat(40)};
+ assert.throws(()=>assertR168PackedIdentity({...expected,
+   observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),
+   /PUBLISH_BLOCKED R168/);
+});

package/test/r168-remote-one-shot-coherence.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {selectR168OneShotRemotePath} from '../src/remote-one-shot-coherence-r168.mjs';
+
+const active={version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b'};
+test('R168 status commands on skew observe the active release without activation/disarm',()=>{
+  for(const command of ['status','processstatus','codingstatus','autonomousstatus','desktopstatus','hoststatus']){
+    const r=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
+    assert.equal(r.mode,'observe_active');
+    assert.equal(r.may_activate,false);
+    assert.equal(r.may_mutate_authority,false);
+    assert.equal(r.active_version,'0.15.61');
+  }
+});
+test('R169 authority forwarding only, lifecycle remains skew-blocked',()=>{
+  const delegated=['armprocess','armcoding','armautonomous','armdesktop','armhost',
+   'disarmprocess','disarmcoding','disarmautonomous','disarmdesktop','disarmhost'];
+  const blocked=['restart','stop','start','resume','clean','toggle','fulltest','test','menu','url'];
+  for(const command of [...delegated,...blocked]){
+    const result=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
+    assert.equal(result.mode,delegated.includes(command)?'delegate_active':'blocked_version_skew',command);
+    assert.equal(result.may_activate,false);
+    assert.equal(result.may_mutate_authority,delegated.includes(command));
+    assert.ok(result.message.includes('0.15.61'));
+    assert.ok(result.message.includes('0.15.65'));
+  }
+});
+test('R168 coherent one-shot still defers to existing signed coherence verification',()=>{
+  const r=selectR168OneShotRemotePath({command:'status',active:{...active,version:'0.15.65'},cliVersion:'0.15.65'});
+  assert.equal(r.mode,'verify_coherent');
+  assert.equal(r.may_activate,false);
+});
+test('R168 absent binding permits read-only observation but never authority mutation',()=>{
+  const observation=selectR168OneShotRemotePath({command:'status',active:null,cliVersion:'0.15.65'});
+  assert.equal(observation.mode,'observe_unbound');
+  assert.equal(observation.may_activate,false);
+  assert.equal(observation.may_mutate_authority,false);
+  for(const command of ['armcoding','disarmcoding','restart']){
+    assert.throws(()=>selectR168OneShotRemotePath({command,active:null,cliVersion:'0.15.65'}),/active|binding/i);
+  }
+  assert.throws(()=>selectR168OneShotRemotePath({command:'status',active:{version:'bad'},cliVersion:'0.15.65'}),/version|binding/i);
+  assert.throws(()=>selectR168OneShotRemotePath({command:'invalid',active,cliVersion:'0.15.65'}),/unsupported|command/i);
+});
+test('R168 CLI wires classification before synchronizeOneShotRuntime and no longer upgrades status',async()=>{
+  const src=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const command=src.slice(src.indexOf('  const command=positional[0];'),src.indexOf('\nasync function runSupervisor'));
+  assert.match(src,/selectR168OneShotRemotePath/);
+  assert.match(command,/selectR168OneShotRemotePath/);
+  assert.match(command,/blocked_version_skew/);
+  assert.match(command,/observe_active/);
+  assert.ok(command.indexOf('selectR168OneShotRemotePath')<command.indexOf('synchronizeOneShotRuntime'));
+});
+
+test('R168 foreground remote refuses npm-cache version skew before session marker, revoke or activation',async()=>{
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const start=cli.indexOf('async function runRemoteSession(');
+  const end=cli.indexOf('\nasync function runRemote(',start);
+  assert.ok(start>0&&end>start);
+  const source=cli.slice(start,end);
+  assert.match(source,/selectR168OneShotRemotePath/);
+  const safety=source.indexOf('selectR168OneShotRemotePath');
+  for(const operation of ['recoverRemoteSession(ctx','acquireForegroundSessionLock({root','synchronizeForegroundRuntime(ctx']){
+    assert.ok(safety<source.indexOf(operation),'version guard must precede '+operation);
+  }
+});

package/test/r169-delegate-active.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {selectR168OneShotRemotePath} from '../src/remote-one-shot-coherence-r168.mjs';
+
+const active={version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b'};
+const cliVersion='0.15.66';
+
+test('R169 explicit arm and disarm commands delegate to already installed active runtime without activating npm cache',()=>{
+  const commands=['armprocess','disarmprocess','armcoding','disarmcoding','armautonomous',
+    'disarmautonomous','armdesktop','disarmdesktop','armhost','disarmhost'];
+  for(const command of commands){
+    const result=selectR168OneShotRemotePath({command,active,cliVersion});
+    assert.equal(result.mode,'delegate_active',command);
+    assert.equal(result.may_activate,false,command);
+    assert.equal(result.active_version,'0.15.61',command);
+    assert.equal(result.may_mutate_authority,true,command);
+  }
+});
+test('R169 leaves status as read-only and dangerous lifecycle commands fail closed on skew',()=>{
+  assert.equal(selectR168OneShotRemotePath({command:'status',active,cliVersion}).mode,'observe_active');
+  for(const command of ['restart','stop','start','resume','clean','toggle','park','menu','fulltest','test','hosttest','codingtest']){
+    const decision=selectR168OneShotRemotePath({command,active,cliVersion});
+    assert.equal(decision.mode,'blocked_version_skew',command);
+    assert.equal(decision.may_activate,false,command);
+    assert.equal(decision.may_mutate_authority,false,command);
+  }
+});
+test('R169 never delegates privilege changes if caller is older than active runtime',()=>{
+  const latest={version:'0.15.67',release_id:'v0.15.67-0000000000000000'};
+  const r=selectR168OneShotRemotePath({command:'armprocess',active:latest,cliVersion});
+  assert.equal(r.mode,'blocked_version_skew');
+  assert.equal(r.may_mutate_authority,false);
+});
+test('R169 missing active runtime cannot turn arm into an implicit installer',()=>{
+  assert.throws(()=>selectR168OneShotRemotePath({command:'armprocess',active:null,cliVersion}),/active runtime binding/);
+});

package/test/r169-delegate-cli-integration.test.mjs

@@ -0,0 +1,93 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import os from 'node:os';
+
+const cli=fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url));
+const hash=x=>createHash('sha256').update(x).digest('hex');
+async function scratch(){
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r169-cli-'));
+  const bin=path.join(state,'bin'),rel=path.join(state,'releases','fixture'),
+    gen=path.join(state,'generations','fixture');
+  for(const dir of [bin,rel,gen])await mkdir(dir,{recursive:true});
+  const launcher=path.join(bin,'DEADBYTE-MCP.ps1');
+  const log=path.join(state,'invocations.txt');
+  const source=`param([Parameter(ValueFromRemainingArguments=$true)][string[]]$ControllerArgs)
+  [IO.File]::AppendAllText('${log.replaceAll('\\','\\\\')}',([string]::Join(' ', $ControllerArgs)+'|'))
+  if($ControllerArgs[0] -eq 'armprocess') { Write-Output 'R169_CONTROLLER_COMMAND=armprocess';exit 0 }
+  if($ControllerArgs[0] -eq 'processstatus') { Write-Output 'Process plane: DISARMED';exit 0 }
+  Write-Error ('R169_FIXTURE_UNEXPECTED_COMMAND='+$ControllerArgs[0]);exit 5
+  `;
+  await writeFile(launcher,source,'utf8');
+  await writeFile(log,'','utf8');
+  const manifest=Buffer.from('R169 release placeholder manifest');
+  const generation=Buffer.from('R169 generation placeholder manifest');
+  await writeFile(path.join(rel,'MANIFEST.SHA256'),manifest);
+  await writeFile(path.join(gen,'GENERATION.SHA256'),generation);
+  await writeFile(path.join(gen,'controller-config.psd1'),'# scratch only\n');
+  const manifestSha=hash(manifest);
+  const pointer={schema:'deadbyte.active-release.v1',version:'0.15.61',
+    release_id:'v0.15.61-'+manifestSha.slice(0,16),
+    manifest_sha256:manifestSha,release_root:rel,generation_root:gen,
+    generation_manifest_sha256:hash(generation),
+    launcher_sha256:hash(await readFile(launcher)),config_path:path.join(gen,'controller-config.psd1')};
+  await writeFile(path.join(state,'active-release.json'),JSON.stringify(pointer)+'\n');
+  const run=(command='armprocess')=>spawnSync(process.execPath,[cli,'remote',command],{
+    cwd:path.dirname(cli),encoding:'utf8',shell:false,windowsHide:true,timeout:20000,
+    env:{...process.env,DEADBYTE_STATE_ROOT:state},maxBuffer:128*1024});
+  return {state,launcher,log,run};
+}
+test('R169 npm-cache CLI delegates explicit armprocess to pinned installed runtime without auto-activation',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const result=run();
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R169_CONTROLLER_COMMAND=armprocess/);
+    assert.equal(await readFile(log,'utf8'),'armprocess|');
+    const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+    assert.equal(pointer.version,'0.15.61');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+test('R169 rejects changed launcher bytes before invoking privileged controller',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,launcher,log,run}=await scratch();
+  try{
+    await writeFile(launcher,"throw 'modified launcher'\n");
+    const result=run();
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/launcher|digest|hash|integrity|pin/i);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+
+test('R169 rejects changed release manifest before any installed authority dispatch',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+    await writeFile(path.join(pointer.release_root,'MANIFEST.SHA256'),'tampered manifest');
+    const outcome=run();
+    assert.notEqual(outcome.status,0);
+    assert.match(outcome.stderr,/release manifest digest mismatch/);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+test('R169 rejects escaped release root and does not dispatch to an untrusted controller',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const pointerPath=path.join(state,'active-release.json');
+    const pointer=JSON.parse(await readFile(pointerPath,'utf8'));
+    pointer.release_root=path.join(os.tmpdir(),'escape-release');
+    await writeFile(pointerPath,JSON.stringify(pointer)+'\n');
+    const outcome=run();
+    assert.notEqual(outcome.status,0);
+    assert.match(outcome.stderr,/escapes state root/);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});

package/test/r169-targeted-runner.mjs

@@ -0,0 +1,16 @@
+// R169 focused regression: existing R168 safety + new npm active-runtime delegation.
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+const dir=path.dirname(fileURLToPath(import.meta.url));
+const cases=['r168-five-plane-fence.test.mjs','r168-focused-suite.test.mjs',
+  'r168-crash-journal.test.mjs','r168-protected-entrypoint.test.mjs',
+  'r168-remote-one-shot-coherence.test.mjs',
+  'r169-delegate-active.test.mjs','r169-delegate-cli-integration.test.mjs'];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...cases.map(n=>path.join(dir,n))],{
+  cwd:dir,encoding:'utf8',shell:false,windowsHide:true,timeout:120000,maxBuffer:4*1024*1024
+});
+process.stdout.write(r.stdout??'');
+process.stderr.write(r.stderr??'');
+if(r.error)throw r.error;
+process.exitCode=r.status??1;