deadbyte-mcp 0.15.67 → 0.15.69

package/scripts/install-r186-owner-trust.ps1

@@ -0,0 +1,59 @@
+#requires -Version 5.1
+#requires -RunAsAdministrator
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$OwnerPublicKeyPath,
+    [Parameter(Mandatory=$true)][string]$NodePath
+)
+$ErrorActionPreference = 'Stop'
+$target = 'C:\Program Files\DEADBYTE-OwnerTrust'
+$packageRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+$programFiles = [System.IO.Path]::GetFullPath($env:ProgramFiles).TrimEnd('\') + '\'
+if (-not ($packageRoot.TrimEnd('\') + '\').StartsWith($programFiles,[System.StringComparison]::OrdinalIgnoreCase)) {
+    throw 'R186 owner enrollment installer must run from a protected Program Files package'
+}
+if (-not (Test-Path -LiteralPath $NodePath -PathType Leaf)) { throw 'R186 Node executable missing' }
+if (-not (Test-Path -LiteralPath $OwnerPublicKeyPath -PathType Leaf)) { throw 'R186 owner public key missing' }
+if (Test-Path -LiteralPath $target) { throw 'R186 owner trust already exists; replacement requires a separate revocation workflow' }
+$inspect = Join-Path $packageRoot 'scripts\r186-owner-anchor-inspect.mjs'
+if (-not (Test-Path -LiteralPath $inspect -PathType Leaf)) { throw 'R186 protected anchor inspector missing' }
+$json = @(& $NodePath $inspect ([System.IO.Path]::GetFullPath($OwnerPublicKeyPath))) -join [Environment]::NewLine
+if ($LASTEXITCODE -ne 0) { throw 'R186 owner public key inspection failed' }
+$material = $json | ConvertFrom-Json
+if ([string]$material.anchor.schema -cne 'deadbyte.r186-owner-anchor.v1' -or
+    [string]$material.anchor.owner_key_id -cnotmatch '^[0-9a-f]{64}$' -or
+    [string]$material.public_key_pem -notmatch 'BEGIN PUBLIC KEY') { throw 'R186 owner anchor material invalid' }
+Write-Host ''
+Write-Host 'DEADBYTE OWNER KEY FINGERPRINT (SHA-256 SPKI):'
+Write-Host ([string]$material.anchor.owner_key_id) -ForegroundColor Yellow
+Write-Host 'Confirm this fingerprint using your independent owner-key display.'
+$typed = Read-Host 'Type the complete 64-character fingerprint to enroll it'
+if ([string]$typed -cne [string]$material.anchor.owner_key_id) { throw 'R186 owner fingerprint confirmation mismatch' }
+
+$admins = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$system = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')
+$users = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+$none = [System.Security.AccessControl.PropagationFlags]::None
+$allow = [System.Security.AccessControl.AccessControlType]::Allow
+New-Item -ItemType Directory -Path $target -ErrorAction Stop | Out-Null
+$dirAcl = New-Object System.Security.AccessControl.DirectorySecurity
+$dirAcl.SetAccessRuleProtection($true,$false)
+$dirAcl.SetOwner($admins)
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($admins,'FullControl',$inherit,$none,$allow)))
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($system,'FullControl',$inherit,$none,$allow)))
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($users,'ReadAndExecute',$inherit,$none,$allow)))
+Set-Acl -LiteralPath $target -AclObject $dirAcl
+
+$utf8 = New-Object System.Text.UTF8Encoding($false)
+$anchorPath = Join-Path $target 'owner-anchor.json'
+$keyPath = Join-Path $target 'owner-public.pem'
+$anchorText = $material.anchor | ConvertTo-Json -Compress
+foreach ($entry in @(@($anchorPath,$anchorText),@($keyPath,[string]$material.public_key_pem))) {
+    $stream = [System.IO.File]::Open([string]$entry[0],[System.IO.FileMode]::CreateNew,[System.IO.FileAccess]::Write,[System.IO.FileShare]::None)
+    try {
+        $writer = New-Object System.IO.StreamWriter($stream,$utf8)
+        try { $writer.Write([string]$entry[1]); $writer.Flush(); $stream.Flush($true) } finally { $writer.Dispose() }
+    } finally { $stream.Dispose() }
+}
+Write-Host "R186_OWNER_TRUST_ENROLLED owner_key_id=$($material.anchor.owner_key_id)"

package/scripts/r173-protected-preflight.mjs

@@ -0,0 +1,42 @@
+// R173 privileged preflight; read-only. Never invokes native CAS or changes grants.
+import {createHash} from 'node:crypto';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const version='0.15.68',expectedTrain='R173';
+const mandatory=['scripts/r173-protected-preflight.mjs','src/activation-continuity-abort-r172.mjs',
+  'src/activation-lock-r65.mjs','src/activation-preflight-r65.mjs',
+  'src/activation-reconciliation-journal-r168.mjs','src/activation-reconciliation-terminal-r168.mjs',
+  'src/activation-reconciliation-fence-r168.mjs','src/activation-reconciliation-audit-r168.mjs'];
+function denied(reason){throw new Error('R173_'+reason);}
+function actualProtectedRoot(){
+  const trusted='C:\\Program Files',rel=path.win32.relative(trusted,root);
+  if(!rel||rel==='..'||rel.startsWith('..'+path.win32.sep)||path.win32.isAbsolute(rel))denied('ROOT_UNPROTECTED');
+  return root;
+}
+async function main(){
+  if(process.platform!=='win32'||process.arch!=='x64')denied('WINDOWS_X64_REQUIRED');
+  if(process.argv.length!==2)denied('UNKNOWN_OPTION');
+  const verifiedRoot=actualProtectedRoot();
+  const pkg=JSON.parse(await readFile(path.join(verifiedRoot,'package.json'),'utf8'));
+  const release=JSON.parse(await readFile(path.join(verifiedRoot,'RELEASE.json'),'utf8'));
+  if(pkg.name!=='deadbyte-mcp'||pkg.version!==version||release.name!=='deadbyte-mcp'||
+     release.version!==version||release.train!==expectedTrain)denied('VERSION_DRIFT');
+  const manifest=await readFile(path.join(verifiedRoot,'MANIFEST.SHA256'));
+  const entries=parseManifest(manifest.toString('utf8'));
+  for(const name of mandatory)if(!entries.has(name))denied('SOURCE_NOT_IN_MANIFEST');
+  await verifyManifestTreeExact(verifiedRoot,entries,{allowedExtraPaths:['.npmignore','package-lock.json']});
+  const important=[...privilegedEpochInstallFiles(verifiedRoot,process.execPath),
+    ...mandatory.map(rel=>path.win32.join(verifiedRoot,...rel.split('/'))),
+    path.win32.join(verifiedRoot,'MANIFEST.SHA256'),path.win32.join(verifiedRoot,'RELEASE.json'),
+    path.win32.join(verifiedRoot,'package.json')];
+  await inspectTrustedInstallation(important);
+  const hash=createHash('sha256').update(manifest).digest('hex');
+  process.stdout.write(JSON.stringify({status:'R173_PROTECTED_PREFLIGHT_READONLY_PASS',version,train:expectedTrain,
+    manifest_sha256:hash,files:entries.size,terminalization_authorized:false,activation_authorized:false})+'\n');
+}
+try{await main();}catch(error){process.stderr.write('R173_PROTECTED_PREFLIGHT=BLOCKED '+String(error?.message??error)+'\n');process.exitCode=1;}

package/scripts/r175-focused-runner.mjs

@@ -0,0 +1,38 @@
+// R175 development-only verification runner. Executes fixed local tests, not production.
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const repo=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const groups=Object.freeze({
+  boundary:['r175-foreground-boundary','r175-guardian-owner-boundary','r175-cli-flags',
+    'remote-live-log-recovery-r36','stabilization-guardian',
+    'r58-guardian-channel','r76-pinned-marker-cas'],
+  owner:['r174-owner-webauthn','r70-owner-approval','r70-autonomous-grant-expiry',
+    'r70-autonomous-policy-bootstrap','r70-controller-owner-issue-boundary'],
+  legacy:['r51-runtime-coherence','r72-remote-safe-contract'],
+  logs:['r176-pretty-live-log','r155-default-live-log','remote-live-log-r37','r155-commander-live-log','r67-live-log-secret-canary','r177-windows-absolute-live-path'],
+  foreground:['remote-session-cli']
+});
+const group=process.argv[2]??'boundary';
+if(!Object.hasOwn(groups,group))throw Error('R175 test group invalid');
+for(const p of ['src/deadbyte-cli.mjs','src/remote-session-guardian.mjs','src/r175-foreground-boundary.mjs']){
+ const c=spawnSync(process.execPath,['--check',p],{cwd:repo,encoding:'utf8',windowsHide:true,timeout:20000});
+ if(c.error||c.status!==0)throw Error('R175 syntax '+p+': '+String(c.stderr||c.error));
+}
+const tests=groups[group].map(x=>'test/'+x+'.test.mjs');
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests],{
+ cwd:repo,encoding:'utf8',windowsHide:true,timeout:180000,
+ maxBuffer:12*1024*1024
+});
+const log=(r.stdout??'')+(r.stderr??'');
+const output=log.split(/\r?\n/);
+for(const row of output.filter(x=>/^(ℹ (tests|pass|fail|skipped|duration_ms)|✔|✖)/.test(x)).slice(-40))
+ process.stdout.write(row+'\n');
+process.stdout.write('R175_GROUP='+group+' EXIT='+String(r.status)+'\n');
+if(r.error)process.stderr.write('R175_RUNNER_ERROR='+String(r.error)+'\n');
+if(r.status!==0){
+ const errors=output.filter(x=>/Error:|AssertionError|Missing expected|expected|actual|✖|fail/gi.test(x));
+ for(const line of errors.slice(-25))process.stderr.write(line.slice(0,700)+'\n');
+ process.exitCode=1;
+}

package/scripts/r176-log-preview.mjs

@@ -0,0 +1,18 @@
+// R176 presentation preview with fixed synthetic events. No runtime access.
+import {createLiveTimelineTracker,defaultForegroundTimelineOptions} from '../src/remote-live-log.mjs';
+const base=Date.parse('2026-10-27T12:25:56.000Z');let offset=0;
+const tracker=createLiveTimelineTracker({clock:()=>base+offset,rootPaths:{projects:String.raw`D:\Projects`},...defaultForegroundTimelineOptions({verbose:false})});
+let seq=0;
+function send(e){const lines=tracker.observe(e,{sequence:++seq});for(const l of (Array.isArray(lines)?lines:[lines]))if(l)process.stdout.write(l+'\n');}
+function call(requestId,tool,args,ms,status='ok',reason=null){
+ offset+=ms;send({event_type:'tool.request',tool,request_id:requestId,args});
+ offset+=ms;send({event_type:'tool.result',tool,request_id:requestId,
+   outcome:{status,is_error:status==='denied',duration_ms:ms, ...(reason?{reason}:{})}});
+}
+call('r176-write-preview','coding_file_write',{root_id:'projects',path:'deadbyte-mcp/development/deadbyte-mcp-0.15.69-r174-owner-consent/src/alpha.mjs',content:'example-only'},17);
+for(let i=0;i<5;i++)call('poll-'+i,'machine_status',{},2);
+call('r176-denied','host_file_read',{root_id:'core',path:'secret-file'},1,'denied','arm file missing');
+offset+=1;send({event_type:'tool.request',tool:'coding_file_write',request_id:'r176-unknown',args:{root_id:'core',path:'output.bin'}});
+offset+=1;send({event_type:'tool.result',tool:'coding_file_write',request_id:'r176-unknown',outcome:{status:'interrupted',side_effect_state:'unknown',reason:'result unavailable after dispatch'}});
+for(const l of tracker.reconcileInterrupted())process.stdout.write(l+'\n');
+process.stdout.write(tracker.summary()+'\n');

package/scripts/r177-owner-trust-inventory.ps1

@@ -0,0 +1,36 @@
+$ErrorActionPreference='Stop'
+$state=Join-Path $HOME '.deadbyte-mcp'
+$trust=Join-Path $state 'trust'
+$pub=Join-Path $trust 'r70-owner-public.pem'
+Write-Output ('R177_TRUST_DIR_EXISTS='+(Test-Path -LiteralPath $trust -PathType Container))
+Write-Output ('R177_OWNER_PUBLIC_KEY_EXISTS='+(Test-Path -LiteralPath $pub -PathType Leaf))
+if(Test-Path -LiteralPath $pub -PathType Leaf){
+ $entry=Get-Item -LiteralPath $pub
+ $acl=Get-Acl -LiteralPath $pub
+ Write-Output ('R177_PUBLIC_KEY_BYTES='+$entry.Length)
+ Write-Output ('R177_PUBLIC_KEY_SHA256='+(Get-FileHash -LiteralPath $pub -Algorithm SHA256).Hash.ToLowerInvariant())
+ Write-Output ('R177_PUBLIC_KEY_OWNER='+$acl.Owner)
+ Write-Output ('R177_PUBLIC_KEY_READONLY='+$entry.IsReadOnly)
+}
+$activePath=Join-Path $state 'active-release.json'
+if(Test-Path $activePath){
+ $a=Get-Content -LiteralPath $activePath -Raw|ConvertFrom-Json
+ Write-Output ('R177_ACTIVE_VERSION='+$a.version)
+ Write-Output ('R177_ACTIVE_RELEASE='+$a.release_id)
+ $codingFile=Join-Path $a.generation_root 'coding-policy.json'
+ if(Test-Path $codingFile){
+  $policy=Get-Content -LiteralPath $codingFile -Raw|ConvertFrom-Json
+  foreach($root in $policy.roots.PSObject.Properties){
+   Write-Output ('R177_CODING_ROOT='+$root.Name+' exec='+[bool]$root.Value.exec+' write='+[bool]$root.Value.write)
+  }
+ }
+}
+$evidence=Join-Path $state 'evidence'
+if(Test-Path -LiteralPath $evidence){
+ Get-ChildItem -LiteralPath $evidence -Recurse -File -ErrorAction SilentlyContinue|
+  Where-Object { $_.Name -match 'owner|approval|enrollment' }|
+  Sort-Object LastWriteTimeUtc -Descending|
+  Select-Object -First 12 |
+  ForEach-Object{Write-Output ('R177_OWNER_EVIDENCE_NAME='+$_.Name+' size='+$_.Length+' utc='+$_.LastWriteTimeUtc.ToString('o'))}
+}
+Write-Output 'R177_READ_ONLY_COMPLETE=true'

package/scripts/r178-full-regression.mjs

@@ -0,0 +1,21 @@
+import {spawnSync} from 'node:child_process';
+import {readdirSync,mkdirSync,writeFileSync,readFileSync} from 'node:fs';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const root=path.resolve(import.meta.dirname,'..');
+const testRoot=path.join(root,'test');
+const files=readdirSync(testRoot).filter(n=>n.endsWith('.test.mjs')).sort().map(n=>path.join('test',n));
+const outDir=path.resolve(root,'..','..','testing','r178-01569-candidate');
+mkdirSync(outDir,{recursive:true});
+const args=['--test','--test-concurrency=4',...files];
+console.log('R178_TOTAL_TEST_FILES='+files.length);
+const result=spawnSync(process.execPath,args,{cwd:root,encoding:'utf8',windowsHide:true,timeout:300000,maxBuffer:40*1024*1024,
+ env:{...process.env,DEADBYTE_RELEASE_TEST:'1'}});
+const log=String(result.stdout||'')+'\n=== STDERR ===\n'+String(result.stderr||'');
+const fp=path.join(outDir,'R178-FULL-REGRESSION.txt');
+writeFileSync(fp,log);
+console.log('R178_FULL_EXIT='+result.status+' signal='+result.signal+' error='+String(result.error?.code??'none'));
+for(const l of log.split(/\r?\n/).filter(s=>/^(ℹ (tests|pass|fail|skipped|duration_ms)|# (tests|pass|fail|skipped|duration_ms)|✖|not ok)/.test(s)).slice(-30))console.log(l.slice(0,300));
+console.log('R178_EVIDENCE='+fp);
+console.log('R178_EVIDENCE_SHA256='+createHash('sha256').update(readFileSync(fp)).digest('hex'));
+if(result.status!==0)process.exitCode=1;

package/scripts/r178-npm-ci.mjs

@@ -0,0 +1,10 @@
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+const root=path.resolve(import.meta.dirname,'..');
+const npm=process.env.npm_execpath||path.join(path.dirname(process.execPath),'node_modules','npm','bin','npm-cli.js');
+const r=spawnSync(process.execPath,[npm,'ci','--ignore-scripts','--no-audit','--no-fund','--prefer-offline'],{cwd:root,encoding:'utf8',timeout:180000,windowsHide:true,maxBuffer:1024*1024});
+console.log('NPM_CI_EXIT='+r.status);
+if(r.error)console.log('NPM_CI_ERROR='+String(r.error.code));
+console.log('NPM_CI_STDOUT='+String(r.stdout||'').slice(-1500));
+console.log('NPM_CI_STDERR='+String(r.stderr||'').slice(-1500));
+if(r.status!==0)process.exitCode=1;

package/scripts/r178-npm-preflight.mjs

@@ -0,0 +1,16 @@
+import {spawnSync} from 'node:child_process';
+import {existsSync} from 'node:fs';
+import path from 'node:path';
+const cwd=path.resolve(import.meta.dirname,'..');
+const npm=process.env.npm_execpath||path.join(path.dirname(process.execPath),'node_modules','npm','bin','npm-cli.js');
+function exec(args,ms=30000){
+  const r=spawnSync(process.execPath,[npm,...args],{cwd,encoding:'utf8',windowsHide:true,timeout:ms,env:{...process.env,npm_config_update_notifier:'false'}});
+  const s=String(r.stdout||'').trim(),e=String(r.stderr||'').trim();
+  return {ok:r.status===0,exit:r.status,error:r.error?.code??null,
+   output:args[0]==='whoami'?(r.status===0?s:'[NOT_AUTHENTICATED]'):String((s||e).slice(0,500)).replace(/https?:\/\/[^\s]+/g,'[url-redacted]')};
+}
+console.log('NODE='+process.version+' npm_cli_available='+existsSync(npm));
+console.log('node_modules_present='+existsSync(path.join(cwd,'node_modules')));
+console.log('NPM_VERSION='+JSON.stringify(exec(['--version'])));
+console.log('NPM_WHOAMI='+JSON.stringify(exec(['whoami'])));
+console.log('NPM_01569_REGISTRY='+JSON.stringify(exec(['view','deadbyte-mcp@0.15.69','version','--json'])));

package/scripts/r178-release-gates-readonly.mjs

@@ -0,0 +1,9 @@
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+const root=path.resolve(import.meta.dirname,'..');
+for(const args of [['scripts/release-manifest.mjs','verify'],['scripts/npm-release-r48.mjs','--verify-only']]){
+ const r=spawnSync(process.execPath,args,{cwd:root,encoding:'utf8',timeout:30000,windowsHide:true,maxBuffer:2*1024*1024});
+ console.log('R178_CHECK='+args.join(' ')+' EXIT='+r.status);
+ const out=String(r.stdout||'')+'\n'+String(r.stderr||'');
+ for(const line of out.split(/\r?\n/).filter(x=>/MANIFEST_|FAIL|release identity|version mismatch|not published|PROVENANCE|PUBLISH|READY|error:/i.test(x)).slice(0,12))console.log(line.slice(0,500));
+}

package/scripts/r178-shard-regression.mjs

@@ -0,0 +1,25 @@
+import {spawnSync} from 'node:child_process';
+import {readdirSync,mkdirSync,writeFileSync,readFileSync} from 'node:fs';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const root=path.resolve(import.meta.dirname,'..');
+const testRoot=path.join(root,'test');
+const files=readdirSync(testRoot).filter(n=>n.endsWith('.test.mjs')).sort();
+const size=Number(process.argv[3]??16),index=Number(process.argv[2]);
+if(!Number.isInteger(index)||index<0||!Number.isInteger(size)||size<1||size>32)throw Error('invalid shard');
+const selection=files.slice(index*size,(index+1)*size);
+if(!selection.length)throw Error('empty shard');
+const outDir=path.resolve(root,'..','..','testing','r178-01569-candidate');
+mkdirSync(outDir,{recursive:true});
+const testArgs=['--test','--test-concurrency=3',...selection.map(n=>path.join('test',n))];
+const result=spawnSync(process.execPath,testArgs,{cwd:root,encoding:'utf8',windowsHide:true,
+ timeout:26000,maxBuffer:12*1024*1024});
+const log=String(result.stdout||'')+'\n=== STDERR ===\n'+String(result.stderr||'');
+const fp=path.join(outDir,'shard-'+String(index).padStart(2,'0')+'.log');
+writeFileSync(fp,log);
+const sha=createHash('sha256').update(readFileSync(fp)).digest('hex');
+const stat=log.split(/\r?\n/).filter(x=>/^(ℹ (tests|pass|fail|skipped|duration_ms)|# (tests|pass|fail|skipped|duration_ms)|✖|not ok)/.test(x));
+console.log('R178_SHARD='+index+' FILES='+selection.length+' EXIT='+result.status+' TIMEOUT='+Boolean(result.error?.code==='ETIMEDOUT'));
+console.log(stat.slice(-8).map(x=>x.slice(0,300)).join('\n'));
+console.log('EVIDENCE='+fp+' SHA256='+sha);
+if(result.status!==0)process.exitCode=1;

package/scripts/r179-predecessor-registry.mjs

@@ -0,0 +1,24 @@
+import {spawnSync} from 'node:child_process';
+import {mkdtempSync,readdirSync,readFileSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const npm=process.env.npm_execpath||path.join(path.dirname(process.execPath),'node_modules','npm','bin','npm-cli.js');
+function run(args,timeout=80000){const p=spawnSync(process.execPath,[npm,...args],{encoding:'utf8',shell:false,windowsHide:true,timeout,maxBuffer:3*1024*1024});if(p.error||p.status!==0)throw Error('npm read-only '+args[0]+' failed '+(p.stderr||p.error));return p.stdout.trim();}
+const dir=mkdtempSync(path.join(tmpdir(),'deadbyte-r179-source-'));
+try {
+ const metadata=JSON.parse(run(['view','deadbyte-mcp@0.15.68','dist','--json']));
+ console.log('PREDECESSOR_DIST_TARBALL='+JSON.stringify(metadata.tarball));
+ console.log('PREDECESSOR_DIST_SHASUM='+metadata.shasum);
+ const info=JSON.parse(run(['pack','deadbyte-mcp@0.15.68','--pack-destination',dir,'--ignore-scripts','--json']));
+ if(!Array.isArray(info)||info.length!==1)throw Error('parent npm pack response shape invalid');
+ const file=path.join(dir,info[0].filename);
+ const bytes=readFileSync(file);
+ const sha256=createHash('sha256').update(bytes).digest('hex');
+ const sha1=createHash('sha1').update(bytes).digest('hex');
+ if(sha1!==metadata.shasum)throw Error('parent npm registry SHA-1 identity mismatch');
+ console.log('PREDECESSOR_VERSION=0.15.68');
+ console.log('PREDECESSOR_TARBALL_SHA256='+sha256);
+ console.log('PREDECESSOR_PACKED_BYTES='+bytes.length);
+ console.log('PREDECESSOR_REGISTRY_MATCH=PASS');
+}finally{rmSync(dir,{recursive:true,force:true});}

package/scripts/r179-protected-inventory.ps1

@@ -0,0 +1,21 @@
+$ErrorActionPreference='Stop'
+$root='C:\Program Files'
+$paths=@(
+ 'C:\Program Files\DEADBYTE-R153-Protected-01560-Test',
+ 'C:\Program Files\DEADBYTE-R168-Protected-Test',
+ 'C:\Program Files\DEADBYTE-R174-Test'
+)
+if(Test-Path -LiteralPath $root){
+ Get-ChildItem -LiteralPath $root -Directory -ErrorAction SilentlyContinue |
+ Where-Object {$_.Name -match 'DEADBYTE|R174|R175|R178'} |
+ Select-Object -First 25 | ForEach-Object {
+  $package=Join-Path $_.FullName 'package.json'
+  $ver='missing';if(Test-Path -LiteralPath $package){try{$ver=(Get-Content -Raw -LiteralPath $package|ConvertFrom-Json).version}catch{$ver='invalid'}}
+  $owner=(Get-Acl -LiteralPath $_.FullName).Owner
+  Write-Output ('PROTECTED_CANDIDATE='+$_.FullName+' version='+$ver+' owner='+$owner)
+ }
+}
+$state=Join-Path $HOME '.deadbyte-mcp'
+$a=Get-Content (Join-Path $state 'active-release.json') -Raw|ConvertFrom-Json
+Write-Output ('ACTIVE='+$a.release_id+' version='+$a.version)
+Write-Output ('R179_READONLY_COMPLETE=TRUE')

package/scripts/r186-focused-runner.mjs

@@ -0,0 +1,22 @@
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {readFileSync,writeFileSync,existsSync} from 'node:fs';
+import path from 'node:path';
+const root=path.resolve(import.meta.dirname,'..');
+const dir=path.resolve(root,'..','..','testing','r186-owner-consent');
+const tests=['test/r186-owner-consent-preflight.test.mjs','test/r186-owner-request.test.mjs',
+ 'test/r70-owner-approval.test.mjs',
+ 'test/r70-controller-owner-issue-boundary.test.mjs',
+ 'test/r70-autonomous-grant-expiry.test.mjs',
+ 'test/r174-owner-webauthn.test.mjs'];
+const result=spawnSync(process.execPath,['--test','--test-concurrency=2',...tests],{
+ cwd:root,encoding:'utf8',windowsHide:true,timeout:60000,maxBuffer:2*1024*1024});
+const s=String(result.stdout??'')+'\n'+String(result.stderr??'');
+const sha=createHash('sha256').update(s).digest('hex');
+const output=path.join(dir,'R186-OWNER-FOCUSED-V2-20261028.log');
+if(existsSync(output))throw Error('R186_FOCUSED_EVIDENCE_ALREADY_EXISTS');
+writeFileSync(output,s,{flag:'wx'});
+for(const line of s.split(/\r?\n/).filter(x=>/^(✔|✖|ℹ (tests|pass|fail|skipped|cancelled))/.test(x)).slice(-45))
+ console.log(line);
+console.log('R186_FOCUSED_EXIT='+result.status+' LOG_SHA256='+sha);
+if(result.status!==0)process.exitCode=1;

package/scripts/r186-owner-anchor-inspect.mjs

@@ -0,0 +1,6 @@
+import {readFile} from 'node:fs/promises';
+import {createR186OwnerAnchor} from '../src/r186-owner-anchor.mjs';
+const [file]=process.argv.slice(2);
+if(process.argv.slice(2).length!==1)throw new Error('usage: r186-owner-anchor-inspect.mjs <owner-public.pem>');
+const out=createR186OwnerAnchor(await readFile(file,'utf8'));
+process.stdout.write(JSON.stringify(out));

package/scripts/r186-owner-consent-check.mjs

@@ -0,0 +1,86 @@
+// R186 read-only inspection of independently enrolled owner authorization.
+// No key enrollment, challenge consumption, grant or policy mutation occurs here.
+// This CLI MUST run from an R89-protected exact release. Any agent-writable
+// source tree or owner public key path is rejected by the native OS ACL audit.
+import {createHash} from 'node:crypto';
+import {readFile,lstat} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {verifyR186OwnerConsent,verifyR186PolicyRootBinding} from '../src/r186-owner-consent-preflight.mjs';
+
+const THIS=fileURLToPath(import.meta.url);
+const ROOT=path.resolve(path.dirname(THIS),'..');
+const OWNER_DIR='C:\\Program Files\\DEADBYTE-OwnerTrust';
+const KEY=path.win32.join(OWNER_DIR,'owner-public.pem');
+const ANCHOR=path.win32.join(OWNER_DIR,'owner-anchor.json');
+const SHA=/^[0-9a-f]{64}$/;
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const reject=m=>{throw Error('R186_OWNER_PREFLIGHT_BLOCKED: '+m)};
+async function bounded(file,limit){
+ const st=await lstat(file);
+ if(!st.isFile()||st.isSymbolicLink()||st.size<1||st.size>limit)reject('unsafe input file');
+ return readFile(file);
+}
+async function main(){
+ if(process.platform!=='win32'||process.arch!=='x64')reject('requires Windows x64');
+ // No dynamic owner key paths. Owner trust must have been installed by the
+ // physical owner through an independently approved protected workflow.
+ const args=process.argv.slice(2);
+ if(args.length!==5)reject('usage: <approval-json> <root-id> <project-root> <coding-policy-json> <autonomous-policy-json>');
+ const [approvalPath,rootId,projectRoot,codingPolicyPath,autonomousPolicyPath]=args;
+ if(![approvalPath,projectRoot,codingPolicyPath,autonomousPolicyPath].every(p=>path.win32.isAbsolute(p)))
+  reject('absolute paths required');
+ if(!/^[A-Za-z0-9._-]{1,64}$/.test(rootId))reject('root identity invalid');
+ // Do not trust agent-provided signature keys. R89 rejects writable ancestor,
+ // unsafe owner and any writable ACE on the pin or enrolled public key.
+ const trustedFiles=[
+  process.execPath,THIS,ANCHOR,KEY,
+  path.join(ROOT,'MANIFEST.SHA256'),
+  path.join(ROOT,'src','r186-owner-consent-preflight.mjs'),
+  path.join(ROOT,'src','r70-owner-approval.mjs'),
+  path.join(ROOT,'src','canonical-json.mjs'),
+  path.join(ROOT,'src','release-slot.mjs'),
+  path.join(ROOT,'src','privileged-install-trust-r89.mjs')
+ ];
+ const os=await inspectTrustedInstallation(trustedFiles);
+ if(!os.trusted)reject('owner trust ACL untrusted');
+ const manifestBytes=await bounded(path.join(ROOT,'MANIFEST.SHA256'),512*1024);
+ const manifest=parseManifest(manifestBytes.toString('utf8'));
+ await verifyManifestTreeExact(ROOT,manifest);
+ const codingBytes=await bounded(codingPolicyPath,1024*1024);
+ const autonomousBytes=await bounded(autonomousPolicyPath,1024*1024);
+ const binding=verifyR186PolicyRootBinding({
+  codingPolicy:JSON.parse(codingBytes.toString('utf8')),
+  autonomousPolicy:JSON.parse(autonomousBytes.toString('utf8')),
+  rootId,projectRoot,codingPolicySha256:sha(codingBytes)
+ });
+ const [approvalBuf,trustBuf,keyBuf]=await Promise.all([
+  bounded(approvalPath,64*1024),bounded(ANCHOR,4*1024),bounded(KEY,8*1024)
+ ]);
+ const decision=await verifyR186OwnerConsent({
+  ownerTrust:JSON.parse(trustBuf.toString('utf8')),
+  ownerPublicKeyPem:keyBuf.toString('utf8'),
+  approval:JSON.parse(approvalBuf.toString('utf8')),
+  expected:{
+   rootId:binding.root_id,projectRoot:binding.project_root,
+   codingPolicySha256:sha(codingBytes),
+   autonomousPolicySha256:sha(autonomousBytes),
+   reviewedArtifactSha256:sha(manifestBytes)
+  }
+ });
+ console.log(JSON.stringify({
+  schema:'deadbyte.r186-owner-preflight.v1',
+  status:decision.status,
+  authority_granted:false,
+  owner_key_id:decision.owner_key_id,
+  subject_sha256:decision.subject_sha256,
+  release_manifest_sha256:sha(manifestBytes),
+  os_acl_trusted:true,
+  project_root:decision.project_root,
+  expires_at_utc:decision.expires_at_utc,
+  next_gate:'OWNER_APPROVAL_SINGLE_USE_CONSUMPTION_AND_SIGNED_EPOCH_ISSUANCE'
+ }));
+}
+main().catch(e=>{console.error('R186_OWNER_PREFLIGHT_BLOCKED '+String(e?.message??e).slice(0,300));process.exitCode=2;});

package/scripts/r186-owner-grant-cli.mjs

@@ -0,0 +1,45 @@
+// Protected, fixed-scope R186 grant broker entrypoint. The controller chooses
+// neither a trust key nor an approval path; both are fixed by the contract.
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {issueR186AutonomousGrant} from '../src/r186-owner-grant-broker.mjs';
+
+const THIS=fileURLToPath(import.meta.url),ROOT=path.resolve(path.dirname(THIS),'..');
+const OWNER_DIR='C:\\Program Files\\DEADBYTE-OwnerTrust';
+const KEY=path.win32.join(OWNER_DIR,'owner-public.pem');
+const ANCHOR=path.win32.join(OWNER_DIR,'owner-anchor.json');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const block=m=>{throw new Error(`R186_OWNER_GRANT_BLOCKED: ${m}`);};
+async function bounded(file,limit){const st=await lstat(file);if(!st.isFile()||st.isSymbolicLink()||st.size<1||st.size>limit)block('unsafe input file');return readFile(file);}
+async function main(){
+ if(process.platform!=='win32'||process.arch!=='x64')block('requires Windows x64');
+ const [runtimeDir,codingPolicyPath,autonomousPolicyPath]=process.argv.slice(2);
+ if(process.argv.slice(2).length!==3||![runtimeDir,codingPolicyPath,autonomousPolicyPath].every(p=>path.win32.isAbsolute(p)))
+  block('usage: <runtime-dir> <coding-policy-json> <autonomous-policy-json>');
+ const approvalPath=path.join(runtimeDir,'owner-consent','autonomous-approval.json');
+ const protectedFiles=[process.execPath,THIS,ANCHOR,KEY,path.join(ROOT,'MANIFEST.SHA256'),
+  path.join(ROOT,'src','r186-owner-grant-broker.mjs'),path.join(ROOT,'src','r186-owner-consent-preflight.mjs'),
+  path.join(ROOT,'src','r70-owner-approval.mjs'),path.join(ROOT,'src','authority-continuity-r65.mjs'),
+  path.join(ROOT,'src','epoch-lock-r85.mjs'),path.join(ROOT,'bin','deadbyte-epoch-lock-r85.node')];
+ const trust=await inspectTrustedInstallation(protectedFiles);
+ if(!trust.trusted)block('protected package or owner trust ACL untrusted');
+ const manifestBytes=await bounded(path.join(ROOT,'MANIFEST.SHA256'),512*1024);
+ await verifyManifestTreeExact(ROOT,parseManifest(manifestBytes.toString('utf8')));
+ const [codingBytes,autonomousBytes,approvalBytes,anchorBytes,keyBytes]=await Promise.all([
+  bounded(codingPolicyPath,1024*1024),bounded(autonomousPolicyPath,1024*1024),bounded(approvalPath,64*1024),
+  bounded(ANCHOR,4096),bounded(KEY,8192)]);
+ const autonomous=JSON.parse(autonomousBytes.toString('utf8'));
+ const result=await issueR186AutonomousGrant({runtimeDir,grantFile:autonomous.lease_file,
+  codingPolicy:JSON.parse(codingBytes.toString('utf8')),codingPolicyBytes:codingBytes,
+  autonomousPolicy:autonomous,autonomousPolicyBytes:autonomousBytes,releaseManifestBytes:manifestBytes,
+  ownerTrust:JSON.parse(anchorBytes.toString('utf8')),ownerPublicKeyPem:keyBytes.toString('utf8'),
+  approval:JSON.parse(approvalBytes.toString('utf8'))});
+ if(sha(await readFile(codingPolicyPath))!==sha(codingBytes)||sha(await readFile(autonomousPolicyPath))!==sha(autonomousBytes))
+  block('policy changed during grant transaction; outcome requires reconciliation');
+ process.stdout.write(JSON.stringify(result));
+}
+main().catch(error=>{console.error(String(error?.message??error).slice(0,500));process.exitCode=2;});

package/scripts/r186-owner-key-local.mjs

@@ -0,0 +1,22 @@
+// Owner-operated only. Do not invoke from an agent workflow.
+import {generateKeyPairSync} from 'node:crypto';
+import {mkdir,open,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {createR186OwnerAnchor} from '../src/r186-owner-anchor.mjs';
+import {createR186OwnerApproval} from '../src/r186-owner-local-signing.mjs';
+
+function args(values){const out={};for(let i=0;i<values.length;i+=2){if(!values[i]?.startsWith('--')||!values[i+1])throw new Error('invalid arguments');out[values[i].slice(2)]=path.resolve(values[i+1]);}return out;}
+async function exclusive(file,data,mode=0o600){await mkdir(path.dirname(file),{recursive:true});const h=await open(file,'wx',mode);try{await h.writeFile(data);await h.sync();}finally{await h.close();}}
+const [command,...rest]=process.argv.slice(2),opt=args(rest);
+if(command==='keygen'){
+ if(!opt['private-out']||!opt['public-out'])throw new Error('usage: keygen --private-out PATH --public-out PATH');
+ const pair=generateKeyPairSync('ed25519'),privatePem=pair.privateKey.export({type:'pkcs8',format:'pem'}).toString();
+ const material=createR186OwnerAnchor(pair.publicKey.export({type:'spki',format:'pem'}).toString());
+ await exclusive(opt['private-out'],privatePem,0o600);await exclusive(opt['public-out'],material.public_key_pem,0o644);
+ console.log(`R186_OWNER_KEY_CREATED public=${opt['public-out']} owner_key_id=${material.anchor.owner_key_id}`);
+}else if(command==='sign'){
+ if(!opt.request||!opt['private-key']||!opt['approval-out'])throw new Error('usage: sign --request PATH --private-key PATH --approval-out PATH');
+ const approval=createR186OwnerApproval({request:JSON.parse(await readFile(opt.request,'utf8')),privateKeyPem:await readFile(opt['private-key'],'utf8')});
+ await exclusive(opt['approval-out'],Buffer.from(JSON.stringify(approval,null,2)+'\n'),0o600);
+ console.log(`R186_OWNER_APPROVAL_CREATED approval=${opt['approval-out']} subject_sha256=${approval.subject_sha256} owner_key_id=${approval.owner_key_id}`);
+}else throw new Error('usage: r186-owner-key-local.mjs <keygen|sign> ...');

package/scripts/r186-owner-review-export.mjs

@@ -0,0 +1,34 @@
+// Protected exact-byte review-request export. No owner key or grant is used.
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {writeR186OwnerReviewRequest} from '../src/r186-owner-review-export.mjs';
+import {readFile} from 'node:fs/promises';
+
+const THIS=fileURLToPath(import.meta.url),ROOT=path.resolve(path.dirname(THIS),'..');
+const fail=message=>{throw new Error(`R186_OWNER_REVIEW_EXPORT_BLOCKED: ${message}`);};
+async function main(){
+ if(process.platform!=='win32'||process.arch!=='x64')fail('requires Windows x64');
+ const [rootId,projectRoot,codingPolicyPath,autonomousPolicyPath,outputPath]=process.argv.slice(2);
+ if(process.argv.slice(2).length!==5||
+    ![projectRoot,codingPolicyPath,autonomousPolicyPath,outputPath].every(value=>path.win32.isAbsolute(value)))
+  fail('usage: <root-id> <project-root> <coding-policy-json> <autonomous-policy-json> <output-json>');
+ const manifestPath=path.join(ROOT,'MANIFEST.SHA256');
+ const protectedFiles=[process.execPath,THIS,manifestPath,
+  path.join(ROOT,'src','r186-owner-review-export.mjs'),
+  path.join(ROOT,'src','r186-owner-request.mjs'),
+  path.join(ROOT,'src','r186-owner-consent-preflight.mjs'),
+  path.join(ROOT,'src','canonical-json.mjs'),
+  path.join(ROOT,'src','privileged-install-trust-r89.mjs'),
+  path.join(ROOT,'src','release-slot.mjs')];
+ const trust=await inspectTrustedInstallation(protectedFiles);
+ if(!trust.trusted)fail('protected package ACL untrusted');
+ const manifestBytes=await readFile(manifestPath);
+ await verifyManifestTreeExact(ROOT,parseManifest(manifestBytes.toString('utf8')));
+ const request=await writeR186OwnerReviewRequest({rootId,projectRoot,codingPolicyPath,
+  autonomousPolicyPath,manifestPath,outputPath});
+ process.stdout.write(JSON.stringify({status:'REVIEW_REQUEST_EXPORTED',authority_granted:false,
+  owner_signature_present:false,subject_sha256:request.subject_sha256,output_path:outputPath}));
+}
+main().catch(error=>{console.error(String(error?.message??error).slice(0,500));process.exitCode=2;});

package/src/activation-authority-proof-r75.mjs

@@ -1,6 +1,7 @@
 import {createHash} from 'node:crypto';
 import {lstat,open,realpath} from 'node:fs/promises';
 import path from 'node:path';
+import {createAuthorityEpochStore} from './authority-continuity-r65.mjs';
 
 const FIELDS=Object.freeze({process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'});
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -22,7 +23,9 @@ async function readRegularPinned(file,label){
   }finally{await handle.close();}
 }
 
-export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority}){
+export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority,
+  epochStoreFactory=createAuthorityEpochStore}){
+  if(typeof epochStoreFactory!=='function')throw new Error('authority epoch store factory invalid');
   const runtimeRoot=await realpath(path.join(stateRoot,'runtime'));
   const result={};
   for(const [plane,field] of Object.entries(FIELDS)){
@@ -49,11 +52,31 @@ export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha2
     const grantAbsent=grantInfo===undefined;
     if(grantInfo&&(!grantInfo.isFile()||grantInfo.isSymbolicLink()))throw new Error(`${plane} grant file type invalid`);
     const validEntry=entry&&entry.configured===true&&typeof entry.armed==='boolean';
-    const validDisarmed=validEntry&&!entry.armed&&grantAbsent&&
-      (entry.reason==='disarmed'||(plane==='autonomous'&&entry.reason==='coding-disarmed'));
+    const grantBytes=grantInfo?await readRegularPinned(checkedPath,`${plane} grant`):null;
+    const grantSha=grantBytes?sha(grantBytes):null;
+    let transactionRevoked=false;
+    if(validEntry&&!entry.armed&&entry.reason==='epoch-revoked'&&grantBytes){
+      let grant;
+      try{grant=JSON.parse(grantBytes.toString('utf8').replace(/^\uFEFF/,''));}catch{}
+      const nonce=grant?.instance_nonce;
+      if(typeof nonce==='string'&&/^[0-9a-f]{64}$/.test(nonce)){
+        const store=epochStoreFactory({runtimeDir:parent,policyBytes});
+        const [audit,head,verification]=await Promise.all([
+          store.auditHistory({plane}),store.readHead({plane}),
+          store.verifyGrant({plane,grantBytes,grantInstanceNonce:nonce,policyBytes})
+        ]);
+        transactionRevoked=audit?.status==='PASS'&&Number.isSafeInteger(audit.verified_events)&&audit.verified_events>0&&
+          head?.action==='transaction_revoke'&&Number.isSafeInteger(head.seq)&&head.seq>0&&
+          /^[0-9a-f]{64}$/.test(String(head.event_sha256??''))&&
+          head.policy_sha256===expectedHash&&head.grant_sha256===grantSha&&head.grant_instance_nonce===nonce&&
+          /^r65-[0-9a-f]{32}$/.test(String(head.update_id??''))&&verification?.trusted===false&&
+          verification?.reason==='epoch-revoked'&&verification?.event_sha256===head.event_sha256;
+      }
+    }
+    const validDisarmed=validEntry&&!entry.armed&&(
+      (grantAbsent&&(entry.reason==='disarmed'||(plane==='autonomous'&&entry.reason==='coding-disarmed')))||transactionRevoked);
     const validArmed=validEntry&&entry.armed&&!grantAbsent&&entry.reason==='standing-grant'&&
       Number.isSafeInteger(entry.epoch_seq)&&entry.epoch_seq>0&&/^[0-9a-f]{64}$/.test(entry.epoch_sha256??'');
-    const grantSha=grantInfo?sha(await readRegularPinned(checkedPath,`${plane} grant`)):null;
     let grantFinal;
     try{grantFinal=await lstat(checkedPath);}
     catch(error){if(error?.code!=='ENOENT')throw error;}
@@ -61,6 +84,7 @@ export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha2
       throw new Error(`${plane} grant identity changed during observation`);
     result[plane]=Object.freeze({state:validDisarmed?'VERIFIED_DISARMED':validArmed?'VERIFIED_ARMED':'UNVERIFIED',
       policy_sha256:expectedHash,grant_absent:grantAbsent,
+      ...(transactionRevoked?{transaction_revoked:true}:{}),
       ...(grantSha?{grant_sha256:grantSha}:{})});
   }
   return Object.freeze(result);