deadbyte-mcp 0.15.66 → 0.15.67

package/test/r168-protected-entrypoint.test.mjs

@@ -6,7 +6,7 @@ import {fileURLToPath} from 'node:url';
 import path from 'node:path';
 
 const root=fileURLToPath(new URL('..',import.meta.url));
-const script=path.join(root,'scripts','r168-protected-preflight.mjs');
+const script=path.join(root,'scripts','r172-protected-preflight.mjs');
 const protectedRoot='C:\\Program Files';
 const relative=path.win32.relative(protectedRoot,root);
 const isProtected=process.platform==='win32'&&relative!==''&&relative!=='..'&&!relative.startsWith('..'+path.win32.sep)&&!path.win32.isAbsolute(relative);
@@ -14,38 +14,38 @@ function launch(file,...args){return spawnSync(process.execPath,[file,...args],{
   encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:65536
 });}
 
-test('R168 installed preflight respects R89 protected-vs-writable execution context',()=>{
+test('R172 installed preflight respects R89 protected-vs-writable execution context',()=>{
   const result=launch(script);
   if(isProtected){
     assert.equal(result.status,0,result.stderr);
-    assert.match(result.stdout,/R168_PROTECTED_PREFLIGHT_READONLY_PASS/);
+    assert.match(result.stdout,/R172_PROTECTED_PREFLIGHT_READONLY_PASS/);
     assert.match(result.stdout,/"terminalization_authorized":false/);
     assert.match(result.stdout,/"activation_authorized":false/);
   }else{
     assert.notEqual(result.status,0);
-    assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
-    assert.match(result.stderr,/R168_.*_(UNPROTECTED|VERSION_DRIFT)/);
+    assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+    assert.match(result.stderr,/R172_.*_(UNPROTECTED|VERSION_DRIFT)/);
   }
 });
 
-test('R168 writable development copy remains blocked when protected fixture exists',()=>{
+test('R172 writable development copy remains blocked when protected fixture exists',()=>{
   const source=path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT||root);
   if(path.win32.relative(protectedRoot,source).toLowerCase()===path.win32.relative(protectedRoot,root).toLowerCase()&&isProtected)
     return test.skip('no separate development source configured');
-  const result=launch(path.join(source,'scripts','r168-protected-preflight.mjs'));
+  const result=launch(path.join(source,'scripts','r172-protected-preflight.mjs'));
   assert.notEqual(result.status,0);
-  assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
-  assert.match(result.stderr,/R168_.*_UNPROTECTED/);
+  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R172_.*_UNPROTECTED/);
 });
 
-test('R168 entrypoint does not accept flags to skip manifest, R89 or root checks',()=>{
+test('R172 entrypoint does not accept flags to skip manifest, R89 or root checks',()=>{
   const result=launch(script,'--skip-trust');
   assert.notEqual(result.status,0);
-  assert.match(result.stderr,/R168_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
   assert.match(result.stderr,/UNKNOWN_OPTION/);
 });
 
-test('R168 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
+test('R172 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
   const src=await readFile(script,'utf8');
   assert.match(src,/verifyManifestTreeExact\(/);
   assert.match(src,/inspectTrustedInstallation\(/);

package/test/r168-release-contract.test.mjs

@@ -11,25 +11,15 @@ const parent='v0.15.61-055d1ff0aa99e60b';
 const predecessorManifest='3316654646cc870584a7c969c2032af6c795229ff8c65e5a8b794f97c2458c41';
 const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484';
 
-test('R168 package 0.15.66 is distinct from published R167 and current live 0.15.61',async()=>{
- const [pkg,lock,release,provenance,bom,matrix,bridge]=await Promise.all([
-  read('package.json'),read('package-lock.json'),read('RELEASE.json'),
-  read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json'),read('bridge/package.json')]);
- for(const version of [DEADBYTE_VERSION,pkg.version,lock.version,lock.packages[''].version,
-   release.version,provenance.version,bom.metadata.component.version,matrix.version,bridge.version])
-   assert.equal(version,'0.15.66');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r168:0.15.66');
- assert.equal(release.train,'R168');assert.equal(matrix.train,'R168');
+test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
+ const release=await read('RELEASE.json');
  assert.equal(release.runtime_predecessor.version,'0.15.61');
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(release.parent.release_id,parent);
- assert.equal(release.source_predecessor.version,'0.15.65');
- assert.equal(release.source_predecessor.train,'R167');
- assert.equal(release.source_predecessor.manifest_sha256,predecessorManifest);
- assert.equal(release.source_predecessor.tarball_sha256,predecessorTarball);
- assert.equal(provenance.source_predecessor_manifest_file_sha256,predecessorManifest);
- assert.equal(provenance.source_predecessor_tarball_sha256,predecessorTarball);
  assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');
+ assert.equal(release.r168.source_predecessor_version,'0.15.65');
+ assert.equal(release.r168.source_predecessor_manifest_sha256,predecessorManifest);
+ assert.equal(release.r168.source_predecessor_tarball_sha256,predecessorTarball);
  assert.equal(release.r168.owner_approval,'NOT_PRESENT');
  assert.equal(release.r168.old_r65_activation_claim,'PRESERVED_UNKNOWN');
  assert.equal(release.r168.production_activation,'NOT_RUN');

package/test/r168-remote-one-shot-coherence.test.mjs

@@ -13,16 +13,17 @@ test('R168 status commands on skew observe the active release without activation
     assert.equal(r.active_version,'0.15.61');
   }
 });
-test('R168 arm, disarm and runtime commands reject skew before side effects',()=>{
-  const commands=['armprocess','armcoding','armautonomous','armdesktop','armhost',
-   'disarmprocess','disarmcoding','restart','stop','start','resume','clean','toggle','fulltest','test','menu','url'];
-  for(const command of commands){
-    const r=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
-    assert.equal(r.mode,'blocked_version_skew',command);
-    assert.equal(r.may_activate,false);
-    assert.equal(r.may_mutate_authority,false);
-    assert.match(r.message,/0\.15\.61/);
-    assert.match(r.message,/0\.15\.65/);
+test('R169 authority forwarding only, lifecycle remains skew-blocked',()=>{
+  const delegated=['armprocess','armcoding','armautonomous','armdesktop','armhost',
+   'disarmprocess','disarmcoding','disarmautonomous','disarmdesktop','disarmhost'];
+  const blocked=['restart','stop','start','resume','clean','toggle','fulltest','test','menu','url'];
+  for(const command of [...delegated,...blocked]){
+    const result=selectR168OneShotRemotePath({command,active,cliVersion:'0.15.65'});
+    assert.equal(result.mode,delegated.includes(command)?'delegate_active':'blocked_version_skew',command);
+    assert.equal(result.may_activate,false);
+    assert.equal(result.may_mutate_authority,delegated.includes(command));
+    assert.ok(result.message.includes('0.15.61'));
+    assert.ok(result.message.includes('0.15.65'));
   }
 });
 test('R168 coherent one-shot still defers to existing signed coherence verification',()=>{

package/test/r169-delegate-active.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {selectR168OneShotRemotePath} from '../src/remote-one-shot-coherence-r168.mjs';
+
+const active={version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b'};
+const cliVersion='0.15.66';
+
+test('R169 explicit arm and disarm commands delegate to already installed active runtime without activating npm cache',()=>{
+  const commands=['armprocess','disarmprocess','armcoding','disarmcoding','armautonomous',
+    'disarmautonomous','armdesktop','disarmdesktop','armhost','disarmhost'];
+  for(const command of commands){
+    const result=selectR168OneShotRemotePath({command,active,cliVersion});
+    assert.equal(result.mode,'delegate_active',command);
+    assert.equal(result.may_activate,false,command);
+    assert.equal(result.active_version,'0.15.61',command);
+    assert.equal(result.may_mutate_authority,true,command);
+  }
+});
+test('R169 leaves status as read-only and dangerous lifecycle commands fail closed on skew',()=>{
+  assert.equal(selectR168OneShotRemotePath({command:'status',active,cliVersion}).mode,'observe_active');
+  for(const command of ['restart','stop','start','resume','clean','toggle','park','menu','fulltest','test','hosttest','codingtest']){
+    const decision=selectR168OneShotRemotePath({command,active,cliVersion});
+    assert.equal(decision.mode,'blocked_version_skew',command);
+    assert.equal(decision.may_activate,false,command);
+    assert.equal(decision.may_mutate_authority,false,command);
+  }
+});
+test('R169 never delegates privilege changes if caller is older than active runtime',()=>{
+  const latest={version:'0.15.67',release_id:'v0.15.67-0000000000000000'};
+  const r=selectR168OneShotRemotePath({command:'armprocess',active:latest,cliVersion});
+  assert.equal(r.mode,'blocked_version_skew');
+  assert.equal(r.may_mutate_authority,false);
+});
+test('R169 missing active runtime cannot turn arm into an implicit installer',()=>{
+  assert.throws(()=>selectR168OneShotRemotePath({command:'armprocess',active:null,cliVersion}),/active runtime binding/);
+});

package/test/r169-delegate-cli-integration.test.mjs

@@ -0,0 +1,93 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import os from 'node:os';
+
+const cli=fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url));
+const hash=x=>createHash('sha256').update(x).digest('hex');
+async function scratch(){
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r169-cli-'));
+  const bin=path.join(state,'bin'),rel=path.join(state,'releases','fixture'),
+    gen=path.join(state,'generations','fixture');
+  for(const dir of [bin,rel,gen])await mkdir(dir,{recursive:true});
+  const launcher=path.join(bin,'DEADBYTE-MCP.ps1');
+  const log=path.join(state,'invocations.txt');
+  const source=`param([Parameter(ValueFromRemainingArguments=$true)][string[]]$ControllerArgs)
+  [IO.File]::AppendAllText('${log.replaceAll('\\','\\\\')}',([string]::Join(' ', $ControllerArgs)+'|'))
+  if($ControllerArgs[0] -eq 'armprocess') { Write-Output 'R169_CONTROLLER_COMMAND=armprocess';exit 0 }
+  if($ControllerArgs[0] -eq 'processstatus') { Write-Output 'Process plane: DISARMED';exit 0 }
+  Write-Error ('R169_FIXTURE_UNEXPECTED_COMMAND='+$ControllerArgs[0]);exit 5
+  `;
+  await writeFile(launcher,source,'utf8');
+  await writeFile(log,'','utf8');
+  const manifest=Buffer.from('R169 release placeholder manifest');
+  const generation=Buffer.from('R169 generation placeholder manifest');
+  await writeFile(path.join(rel,'MANIFEST.SHA256'),manifest);
+  await writeFile(path.join(gen,'GENERATION.SHA256'),generation);
+  await writeFile(path.join(gen,'controller-config.psd1'),'# scratch only\n');
+  const manifestSha=hash(manifest);
+  const pointer={schema:'deadbyte.active-release.v1',version:'0.15.61',
+    release_id:'v0.15.61-'+manifestSha.slice(0,16),
+    manifest_sha256:manifestSha,release_root:rel,generation_root:gen,
+    generation_manifest_sha256:hash(generation),
+    launcher_sha256:hash(await readFile(launcher)),config_path:path.join(gen,'controller-config.psd1')};
+  await writeFile(path.join(state,'active-release.json'),JSON.stringify(pointer)+'\n');
+  const run=(command='armprocess')=>spawnSync(process.execPath,[cli,'remote',command],{
+    cwd:path.dirname(cli),encoding:'utf8',shell:false,windowsHide:true,timeout:20000,
+    env:{...process.env,DEADBYTE_STATE_ROOT:state},maxBuffer:128*1024});
+  return {state,launcher,log,run};
+}
+test('R169 npm-cache CLI delegates explicit armprocess to pinned installed runtime without auto-activation',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const result=run();
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R169_CONTROLLER_COMMAND=armprocess/);
+    assert.equal(await readFile(log,'utf8'),'armprocess|');
+    const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+    assert.equal(pointer.version,'0.15.61');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+test('R169 rejects changed launcher bytes before invoking privileged controller',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,launcher,log,run}=await scratch();
+  try{
+    await writeFile(launcher,"throw 'modified launcher'\n");
+    const result=run();
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/launcher|digest|hash|integrity|pin/i);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+
+test('R169 rejects changed release manifest before any installed authority dispatch',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+    await writeFile(path.join(pointer.release_root,'MANIFEST.SHA256'),'tampered manifest');
+    const outcome=run();
+    assert.notEqual(outcome.status,0);
+    assert.match(outcome.stderr,/release manifest digest mismatch/);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});
+test('R169 rejects escaped release root and does not dispatch to an untrusted controller',async()=>{
+  if(process.platform!=='win32')return;
+  const {state,log,run}=await scratch();
+  try{
+    const pointerPath=path.join(state,'active-release.json');
+    const pointer=JSON.parse(await readFile(pointerPath,'utf8'));
+    pointer.release_root=path.join(os.tmpdir(),'escape-release');
+    await writeFile(pointerPath,JSON.stringify(pointer)+'\n');
+    const outcome=run();
+    assert.notEqual(outcome.status,0);
+    assert.match(outcome.stderr,/escapes state root/);
+    assert.equal(await readFile(log,'utf8'),'');
+  }finally{await rm(state,{force:true,recursive:true});}
+});

package/test/r169-targeted-runner.mjs

@@ -0,0 +1,16 @@
+// R169 focused regression: existing R168 safety + new npm active-runtime delegation.
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+const dir=path.dirname(fileURLToPath(import.meta.url));
+const cases=['r168-five-plane-fence.test.mjs','r168-focused-suite.test.mjs',
+  'r168-crash-journal.test.mjs','r168-protected-entrypoint.test.mjs',
+  'r168-remote-one-shot-coherence.test.mjs',
+  'r169-delegate-active.test.mjs','r169-delegate-cli-integration.test.mjs'];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...cases.map(n=>path.join(dir,n))],{
+  cwd:dir,encoding:'utf8',shell:false,windowsHide:true,timeout:120000,maxBuffer:4*1024*1024
+});
+process.stdout.write(r.stdout??'');
+process.stderr.write(r.stderr??'');
+if(r.error)throw r.error;
+process.exitCode=r.status??1;

package/test/r172-activation-recovery.test.mjs

@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp, mkdir, readFile, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {classifyActivationPreflight} from '../src/activation-preflight-r65.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+import {withAuthorityProof} from './helpers/r75-authority-proof.mjs';
+
+const hex = c => c.repeat(64);
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const planes = ['process', 'coding', 'autonomous', 'desktop', 'host'];
+
+test('R172 accepts epoch-revoked only when independent proof says verified disarmed', () => {
+  const parent = {release_id: 'v0-parent', version: '0.15.61', manifest_sha256: hex('1'), generation_manifest_sha256: hex('2')};
+  const authority = Object.fromEntries(planes.map(plane => [plane, {
+    configured: true, armed: false, reason: plane === 'coding' ? 'epoch-revoked' : 'disarmed',
+    epoch_seq: null, epoch_sha256: null
+  }]));
+  const policy_sha256 = Object.fromEntries(planes.map((plane, index) => [plane, hex(String(index + 3))]));
+  const observation = withAuthorityProof({state: 'ONLINE', local_ready: true,
+    bridge: {alive: true, reason: 'verified', pid: 10}, core: {alive: true, reason: 'verified', pid: 11},
+    cloud: {alive: true, reason: 'verified', pid: 12}, supervisor: {running: true}, authority, policy_sha256,
+    active_release_id: parent.release_id, active_manifest_sha256: parent.manifest_sha256,
+    active_generation_manifest_sha256: parent.generation_manifest_sha256});
+  const result = classifyActivationPreflight({pointer: parent, expectedParent: parent,
+    candidate: {version: '0.15.67', manifest_sha256: hex('9')},
+    expectedCandidate: {version: '0.15.67', manifest_sha256: hex('9')}, observation});
+  assert.equal(result.state, 'ONLINE_READY');
+  const forged = structuredClone(observation);
+  forged.authority_proof.coding.state = 'UNVERIFIED';
+  assert.equal(classifyActivationPreflight({pointer: parent, expectedParent: parent,
+    candidate: {version: '0.15.67', manifest_sha256: hex('9')},
+    expectedCandidate: {version: '0.15.67', manifest_sha256: hex('9')}, observation: forged}).state, 'AUTHORITY_UNVERIFIED');
+});
+
+test('R172 reclaims a pre-dispatch continuity abort only after signed revoke has a trusted terminal grant', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r172-continuity-abort-'));
+  try {
+    const runtime = await prepareAuthorityTestTrust(root), updates = path.join(root, 'evidence', 'updates');
+    const generation = path.join(root, 'generations', 'v0-parent-g1');
+    await mkdir(updates, {recursive: true}); await mkdir(generation, {recursive: true});
+    const grantFile = path.join(runtime, 'coding-grant.json');
+    const policy = {schema: 'deadbyte.coding-policy.v1', enabled: true, lease_file: grantFile,
+      roots: {project: {path: path.join(root, 'project')}}};
+    const policyBytes = Buffer.from(JSON.stringify(policy));
+    await writeFile(path.join(generation, 'coding-policy.json'), policyBytes);
+    const oldGrant = Buffer.from(JSON.stringify({schema: 'deadbyte.coding-grant.v1', policy_sha256: sha(policyBytes),
+      instance_nonce: hex('a'), root_ids: ['project'], granted_at_utc: new Date().toISOString()}));
+    await writeFile(grantFile, oldGrant);
+    const store = createAuthorityEpochStore({runtimeDir: runtime, policyBytes});
+    const armed = await store.append({plane: 'coding', action: 'grant', grantBytes: oldGrant,
+      grantInstanceNonce: hex('a'), updateId: null});
+    const manager = createActivationClaimManager({stateRoot: root}), subject = hex('b');
+    const claim = await manager.claim(subject), continuity = 'r65-' + 'c'.repeat(32);
+    const revoked = await store.append({plane: 'coding', action: 'transaction_revoke', grantBytes: oldGrant,
+      grantInstanceNonce: hex('a'), updateId: continuity, expectedHeadSha256: armed.event_sha256});
+    const newGrant = Buffer.from(JSON.stringify({schema: 'deadbyte.coding-grant.v1', policy_sha256: sha(policyBytes),
+      instance_nonce: hex('d'), root_ids: ['project'], granted_at_utc: new Date().toISOString()}));
+    await writeFile(grantFile, newGrant);
+    await store.append({plane: 'coding', action: 'grant', grantBytes: newGrant,
+      grantInstanceNonce: hex('d'), updateId: null, expectedHeadSha256: revoked.event_sha256});
+    const pointer = {schema: 'deadbyte.active-release.v1', release_id: 'v0-parent', version: '0.15.61',
+      manifest_sha256: hex('1'), generation_manifest_sha256: hex('2'), generation_root: generation};
+    await writeFile(path.join(root, 'active-release.json'), JSON.stringify(pointer));
+    await writeFile(path.join(updates, 'r65-activation-outcome-r172.json'), JSON.stringify({
+      schema: 'deadbyte.r65-activation-outcome.v1', claim_operation_id: claim.operation_id,
+      preflight_subject_sha256: subject, candidate_version: '0.15.66', candidate_manifest_sha256: hex('9'),
+      predecessor_release_id: pointer.release_id, outcome: {state: 'ACTIVATION_OUTCOME_UNKNOWN', preflight: 'AUTHORITY_UNVERIFIED'},
+      update_id: null, state_path: null, continuity_update_id: continuity,
+      observed_at_utc: new Date().toISOString()
+    }));
+    const next = await manager.claim(hex('e'));
+    assert.notEqual(next.operation_id, claim.operation_id);
+    await next.release();
+  } finally { await rm(root, {recursive: true, force: true}); }
+});
+
+test('R172 keeps the claim when continuity revoke is not followed by a trusted terminal state', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r172-continuity-blocked-'));
+  try {
+    const updates = path.join(root, 'evidence', 'updates'); await mkdir(updates, {recursive: true});
+    const manager = createActivationClaimManager({stateRoot: root}), claim = await manager.claim(hex('a'));
+    await writeFile(path.join(updates, 'r65-activation-outcome-r172.json'), JSON.stringify({
+      schema: 'deadbyte.r65-activation-outcome.v1', claim_operation_id: claim.operation_id,
+      preflight_subject_sha256: hex('a'), candidate_version: '0.15.66', candidate_manifest_sha256: hex('9'),
+      predecessor_release_id: 'v0-parent', outcome: {state: 'ACTIVATION_OUTCOME_UNKNOWN', preflight: 'AUTHORITY_UNVERIFIED'},
+      update_id: null, state_path: null, continuity_update_id: 'r65-' + 'c'.repeat(32), observed_at_utc: new Date().toISOString()
+    }));
+    await assert.rejects(() => manager.claim(hex('e')), /unresolved|in progress/i);
+  } finally { await rm(root, {recursive: true, force: true}); }
+});

package/test/r172-release-contract.test.mjs

@@ -0,0 +1,35 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
+const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
+
+test('R172 binds the published source predecessor separately from the active runtime predecessor',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
+    read('package.json'),readOptional('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
+    read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
+  const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
+    bom.metadata.component.version,DEADBYTE_VERSION];
+  if(lock)versions.push(lock.version,lock.packages[''].version);
+  for(const value of versions)assert.equal(value,'0.15.67');
+  assert.equal(release.train,'R172'); assert.equal(matrix.train,'R172');
+  assert.equal(release.source_predecessor.version,'0.15.66');
+  assert.equal(release.source_predecessor.manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
+  assert.equal(release.source_predecessor.tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
+  assert.equal(release.r172.public_tool_delta,0); assert.equal(release.r172.authority_scope_delta,0);
+});
+
+test('R172 recovery remains fail closed until final protected and publication gates pass',async()=>{
+  const [release,matrix]=await Promise.all([read('RELEASE.json'),read('TEST-MATRIX.json')]);
+  assert.equal(release.r172.current_predispatch_claim,'PENDING_VERIFIED_RECONCILIATION');
+  assert.equal(release.r172.protected_full_regression,'PENDING_FINAL_BYTES');
+  assert.equal(matrix.r172.protected_native_positive,'PASS_27_TESTS_0_FAILURES');
+  assert.equal(release.r172.npm_publish,'NOT_RUN');
+  assert.equal(release.r172.production_activation,'NOT_RUN');
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');