deadbyte-mcp 0.15.67 → 0.15.69

package/src/activation-preflight-r65.mjs

@@ -63,7 +63,8 @@ export function classifyActivationPreflight({pointer,expectedParent,candidate,ex
       return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof missing`,...bound});
     if(proof&&(proof.policy_sha256!==observation?.policy_sha256?.[plane]||
         proof.state!==(authority[plane]?'VERIFIED_ARMED':'VERIFIED_DISARMED')||
-        (!authority[plane]&&proof.grant_absent!==true)))
+        (!authority[plane]&&proof.grant_absent!==true&&
+          !(entry?.reason==='epoch-revoked'&&proof.transaction_revoked===true))))
       return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof unverified`,...bound});
   }
   if(PLANES.some(plane=>!HEX64.test(String(observation?.policy_sha256?.[plane]))))

package/src/deadbyte-cli.mjs

@@ -27,6 +27,7 @@ import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentit
 import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import {observeOnlyAuthority,assertObserveOnlyMarker,assertMatchingForegroundRelease} from './r175-foreground-boundary.mjs';
 import { decodeRemoteLogBytes, boundedRemoteDiagnostic, readRemoteLogAppend } from './remote-log-decode-r60.mjs';
 import {reconcileStaleMarker,resumeMarkerReconciliation,recoverPublishedMarkerTerminal} from './clean-activation-recovery-r153.mjs';
 import {selectLegacyMarkerEvidence,verifyLocatedLegacyMarkerReceipt} from './legacy-marker-evidence-r159.mjs';
@@ -61,10 +62,10 @@ function printHelp(){
     `  npx -y ${exact} doctor              # verify current package/release truth`,
     `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
     `  npx -y ${exact} remote              # safe observation-only foreground session`,
-    `  npx -y ${exact} remote --operator   # process/coding/autonomous; explicit owner gates still apply`,
-    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
-    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
-    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
+    `  npx -y ${exact} remote --operator   # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --desktop    # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --host       # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --full       # R175 blocked pending session-owned authority issuance`,
     `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
     `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
  
@@ -400,8 +401,8 @@ function timelineFilterEvent(timeline){
 }
 async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
   process.stdout.write(verbose
-    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
-    : '[LOG] Live tool calls with individual START/DONE, sanitized arguments and results. Transport hidden; signed audit remains on disk. Ctrl+C disconnects and revokes authority.\n');
+    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects; owner standing grants remain unchanged.\n'
+    : '[LOG] Live tool calls with individual START/DONE, sanitized arguments and results. Transport hidden; signed audit remains on disk. Ctrl+C disconnects; owner standing grants remain unchanged.\n');
   const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
   const partialLines=new Map();
   let liveFiles=[...activeOffsets.keys()];
@@ -455,7 +456,13 @@ function remoteTag(kind,displayMode){
   return (displayMode==='ascii'?ascii:unicode)[kind];
 }
 function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
-async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
+async function cleanupRemoteSession(ctx,{displayMode='unicode',marker=null}={}){
+  // R175 observation sessions issue no grants and must never revoke owner grants or park runtime.
+  // An invalid R175 marker must fail closed, not fall through to legacy revoke.
+  if(marker!==null){
+    if(!assertObserveOnlyMarker(marker))throw new Error('R175_INVALID_OBSERVE_ONLY_MARKER: no authority cleanup performed');
+    return;
+  }
   const failed=[];
   for(const command of SESSION_CLEANUP){
     try{
@@ -669,6 +676,15 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
   const markerPath=remoteSessionMarker(ctx.root);
   const snapshot=await readRemoteMarkerSnapshot(markerPath);
   if(!snapshot) return null;
+  if(assertObserveOnlyMarker(prior)){
+    // Owner and guardian lifetime were verified above. A monitor-only session
+    // owns the CAS marker, not any authority epoch or runtime lifecycle.
+    if(snapshot.marker?.owner_pid!==prior.owner_pid||snapshot.marker?.session_nonce!==prior.session_nonce)
+      throw new Error('R175 observation-only stale marker identity changed; marker retained');
+    if(deletePinnedRemoteMarker(markerPath,snapshot.sha256)!=='REMOVED')
+      throw new Error('R175 observation-only stale marker CAS failed; marker retained');
+    return null;
+  }
   const active=await readActiveRuntimeBinding(ctx.root);
   if(!active)throw new Error(`remote session ownership unverified for stale pid=${ownerPid}; active pointer missing; marker retained`);
   const observed=observedAuthority(ctx);
@@ -740,7 +756,7 @@ async function claimRemoteSession(ctx){
   const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
   const nonce=randomBytes(32).toString('hex');
   const resultSessionId=randomBytes(12).toString('hex');
-  const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
+  const marker={schema:'deadbyte.remote-session.v2',authority_scope:'observe-only',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
     result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
   marker.owner_identity=queryForegroundIdentity(process.pid);
   if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
@@ -749,7 +765,7 @@ async function claimRemoteSession(ctx){
   catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
   let guardian=null;
   try{
-    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
+    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc','--authority-scope','observe-only'],{
       detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
     });
     if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
@@ -786,6 +802,10 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
     throw new Error('remote session ownership marker replaced before native deletion; marker retained');
 }
 async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default',hostCommandPins=[]}={}){
+  // R175: elevated session flags need a distinct signed session-owned lease
+  // issuer before they can safely coexist with owner standing grants.
+  if(mode!=='default') throw new Error('R175_FOREGROUND_OWNER_BOUNDARY: elevated foreground modes require session-owned grants; use explicit remote arm* commands');
+  if(hostCommandPins.length) throw new Error('R175_FOREGROUND_OBSERVE_ONLY: host command repins require an explicit owner action outside foreground logging');
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -793,12 +813,15 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   // an EPOCH_NATIVE production runtime. This guard precedes session recovery,
   // marker claims, revocations and any controller startup.
   const active=await readActiveRuntimeBinding(ctx.root);
+  const currentManifestSha256=createHash('sha256')
+    .update(await readFile(path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'))).digest('hex');
+  assertMatchingForegroundRelease(active,{version:DEADBYTE_VERSION,manifest_sha256:currentManifestSha256});
   if(active){
     const decision=selectR168OneShotRemotePath({command:'start',active,cliVersion:DEADBYTE_VERSION});
     if(decision.mode==='blocked_version_skew') throw new Error(decision.message);
   }
-  // First installation without an active pointer retains the existing
-  // unbound bootstrap path. A bound older release must never auto-upgrade.
+  // R175 foreground is monitor-only: deployment and upgrades need separate owner action.
+  // Never synchronize runtime or mint/revoke a grant from this path.
   if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
   if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
   const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
@@ -807,9 +830,21 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     startupLock.assertHeld();
     await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
     startupLock.assertHeld();
-    const migrationContext=await recoverRemoteSession(ctx,{displayMode});
+    // R179: an observation session may recover ONLY its own observation marker.
+    // Legacy migration/revocation is a separately authorized controller action.
+    const staleObserver=await readRemoteSessionMarker(ctx.root);
+    if(staleObserver){
+      if(!assertObserveOnlyMarker(staleObserver))
+        throw new Error('R179_LEGACY_FOREGROUND_RECOVERY_REQUIRES_EXPLICIT_OWNER_COMMAND: no authority touched');
+      await recoverRemoteSession(ctx,{displayMode});
+    }
     startupLock.assertHeld();
-    await synchronizeForegroundRuntime(ctx,{displayMode,migrationContext,hostCommandPins});
+    const pinned=await readActiveRuntimeBinding(ctx.root);
+    assertMatchingForegroundRelease(pinned,{version:DEADBYTE_VERSION,manifest_sha256:currentManifestSha256});
+    for(const field of ['release_id','generation_manifest_sha256','generation_root']){
+      if(pinned[field]!==active[field])
+        throw new Error('R175_FOREGROUND_ACTIVE_DRIFT: no runtime update or grant mutation attempted');
+    }
     startupLock.assertHeld();
     marker=await claimRemoteSession(ctx);
     startupLock.assertHeld();
@@ -838,51 +873,29 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     process.stdout.write('[BOOT] Starting local + remote runtime...\n');
     const preflight=invokeController(ctx,'status',{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
     let startText=preflight.stdout||'';
-    if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
-      process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
-    }else{
-      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
-      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
-      const startCommand=recovery?'restart':'start';
-      const controllerLogDir=path.join(ctx.root,'runtime','logs');
-      await mkdir(controllerLogDir,{recursive:true});
-      const launchOutput={
-        stdout_path:path.join(controllerLogDir,`controller-${startCommand}.stdout.log`),
-        stderr_path:path.join(controllerLogDir,`controller-${startCommand}.stderr.log`)
-      };
-      const launch=invokeController(ctx,startCommand,{allowFailure:true,redirectOutput:launchOutput,timeoutMs:REMOTE_START_TIMEOUT_MS});
-      if(launch.status!==0){
-        const evidence=await readControllerStartFailure(ctx.root,startCommand);
-        const fallback=evidence?'':await readTailBounded(launchOutput.stderr_path,2048);
-        const detail=evidence?`; controller-start-failure: ${evidence.message}`:(fallback?`; controller-stderr: ${fallback}`:'');
-        throw new Error(`remote controller '${startCommand}' failed exit=${launch.status}${detail}`);
-      }
-      const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
-      startText=started.stdout||'';
-    }
+    if(preflight.status!==0||!controllerRuntimeReady(preflight.stdout))
+      throw new Error('R175_FOREGROUND_RUNTIME_NOT_READY: monitoring cannot start or restart a runtime; use explicit remote start');
+    process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
     process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
-    const desired=authorityVector(mode);
-    const priorAuthority=observedAuthority(ctx);
-    for(const plane of ['host','desktop','autonomous','coding','process'].filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
-      const command=`disarm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
-      const command=`arm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
+    // Observation is never a grant transition or an expectation that live
+    // owner grants remain frozen for the lifetime of this log session.
     const current=await readActiveRuntimeBinding(ctx.root);
-    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
-      coreRoot:current?.release_root??null
-    }),desired);
+    for(const field of ['release_id','manifest_sha256','generation_manifest_sha256','generation_root'])
+      if(current?.[field]!==active[field])throw new Error('R175_FOREGROUND_ACTIVE_DRIFT: observed release changed');
+    const authority=assertRuntimeReadyObservation(observedAuthority(ctx),{
+      coreRoot:active.release_root
+    });
+    observeOnlyAuthority(authority);
+    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Observing existing grants without ARM or DISARM...\n`,displayMode);
     process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
-    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode==='default'?'revoked':mode});
+    // Signed machine test is safe only for already-disarmed authority vectors.
+    // Do not test against a made-up all-disarmed expectation while owner
+    // grants are live; never revoke them as a way to make that test pass.
+    if(AUTHORITY_PLANES.every(plane=>!authority.authority[plane].armed))
+      invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});
+    else process.stdout.write('[VERIFY] pre-existing owner grants preserved; revoked-plane probe omitted\n');
     ready=true;
     writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
     process.stdout.write('[OK] ONLINE\n');
@@ -906,8 +919,8 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
     if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
     process.stdout.write(`${formatRemoteLifecycle('cleanup',{displayMode})}\n`);
-    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; revoking authority...\n');
-    try{await cleanupRemoteSession(ctx,{displayMode});}
+    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; preserving owner standing grants...\n');
+    try{await cleanupRemoteSession(ctx,{displayMode,marker});}
     catch(cleanupError){
       if(sessionError) throw new AggregateError([sessionError,cleanupError],
         `remote activation failed: ${String(sessionError?.message||sessionError)}; cleanup failed, ownership marker retained: ${String(cleanupError?.message||cleanupError)}`);

package/src/r174-owner-webauthn.mjs

@@ -0,0 +1,176 @@
+// R174 pure WebAuthn owner assertion verifier.
+//
+// This module does not enroll a credential, solicit owner consent, consume a
+// challenge, write an authority epoch, or grant autonomous access. Those are
+// separate protected-host boundaries and MUST NOT be supplied by an agent.
+import {createHash,createPublicKey,verify,timingSafeEqual} from 'node:crypto';
+import {lstat,realpath,open} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const B64URL=/^[A-Za-z0-9_-]+$/;
+const sha256=x=>createHash('sha256').update(x).digest();
+const canonicalHash=x=>sha256(Buffer.from(canonicalJson(x),'utf8')).toString('hex');
+function requireRecord(x,label){
+  if(!x||typeof x!=='object'||Array.isArray(x))throw new Error('R174 '+label+' invalid');
+  return x;
+}
+function keys(x,names,label){
+  requireRecord(x,label);
+  if(Object.keys(x).length!==names.length||names.some(n=>!Object.hasOwn(x,n)))
+    throw new Error('R174 '+label+' fields invalid');
+}
+function base64url(value,label,minimum=1,maximum=16384){
+  if(typeof value!=='string'||value.length>maximum*2||!B64URL.test(value))
+    throw new Error('R174 '+label+' encoding invalid');
+  const decoded=Buffer.from(value,'base64url');
+  if(decoded.length<minimum||decoded.length>maximum||decoded.toString('base64url')!==value)
+    throw new Error('R174 '+label+' encoding invalid');
+  return decoded;
+}
+function matches(a,b){return a.length===b.length&&timingSafeEqual(a,b);}
+function instant(value){
+  if(typeof value!=='string'||!/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value))
+    throw new Error('R174 transaction UTC invalid');
+  const timestamp=Date.parse(value);
+  if(!Number.isFinite(timestamp)||new Date(timestamp).toISOString()!==value)
+    throw new Error('R174 transaction UTC invalid');
+  return timestamp;
+}
+function validateSubject(s){
+  keys(s,['schema','release_manifest_sha256','coding_policy_sha256',
+    'autonomous_policy_sha256','root_id','project_root','effect','max_seconds'],'subject');
+  if(s.schema!=='deadbyte.r174-autonomous-owner-subject.v1'||
+     [s.release_manifest_sha256,s.coding_policy_sha256,s.autonomous_policy_sha256]
+       .some(x=>typeof x!=='string'||!HEX64.test(x))||
+     s.root_id!=='core'||typeof s.project_root!=='string'||
+     !path.isAbsolute(s.project_root)||s.effect!=='autonomous_goal_run'||
+     !Number.isSafeInteger(s.max_seconds)||s.max_seconds<1||s.max_seconds>3600)
+    throw new Error('R174 subject scope invalid');
+}
+export async function verifyR174OwnerAssertion({credential,subject,transaction,assertion,now}={}){
+  validateSubject(subject);
+  keys(transaction,['schema','challenge_b64url','subject_sha256','issued_at_utc','expires_at_utc'],'challenge');
+  if(transaction.schema!=='deadbyte.r174-owner-challenge.v1'||!HEX64.test(transaction.subject_sha256))
+    throw new Error('R174 challenge schema invalid');
+  const challenge=base64url(transaction.challenge_b64url,'challenge',32,32);
+  if(canonicalHash(subject)!==transaction.subject_sha256)
+    throw new Error('R174 subject hash mismatch');
+  const issued=instant(transaction.issued_at_utc),expires=instant(transaction.expires_at_utc);
+  if(expires<=issued||expires-issued>300000)
+    throw new Error('R174 challenge lifetime exceeds five minutes');
+  if(!(now instanceof Date)||!Number.isFinite(now.getTime())||
+     now.getTime()<issued||now.getTime()>=expires)
+    throw new Error('R174 challenge expired or not yet valid');
+  keys(credential,['schema','credential_id_b64url','rp_id','origin',
+    'public_key_spki_pem','algorithm','sign_count'],'credential');
+  if(credential.schema!=='deadbyte.r174-owner-credential.v1'||credential.algorithm!=='ES256'||
+     typeof credential.rp_id!=='string'||!credential.rp_id||typeof credential.origin!=='string'||
+     !Number.isSafeInteger(credential.sign_count)||credential.sign_count<0)
+    throw new Error('R174 credential identity invalid');
+  if(credential.origin!=='https://'+credential.rp_id)
+    throw new Error('R174 RP ID and origin binding mismatch');
+  const credentialId=base64url(credential.credential_id_b64url,'credential id',16,1024);
+  keys(assertion,['credential_id_b64url','client_data_json_b64url',
+    'authenticator_data_b64url','signature_b64url'],'assertion');
+  if(!matches(credentialId,base64url(assertion.credential_id_b64url,'credential id',16,1024)))
+    throw new Error('R174 credential id mismatch');
+  const rawClient=base64url(assertion.client_data_json_b64url,'client data',16,16384);
+  let client;
+  try{client=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(rawClient));}
+  catch{throw new Error('R174 client data JSON invalid');}
+  if(!client||typeof client!=='object'||Array.isArray(client)||client.type!=='webauthn.get')
+    throw new Error('R174 client data type invalid');
+  if(client.challenge!==transaction.challenge_b64url||
+     !matches(base64url(client.challenge,'challenge',32,32),challenge))
+    throw new Error('R174 client challenge mismatch');
+  if(client.origin!==credential.origin)throw new Error('R174 client origin mismatch');
+  if(client.crossOrigin===true||client.topOrigin!==undefined)
+    throw new Error('R174 cross-origin assertion denied');
+  const authenticator=base64url(assertion.authenticator_data_b64url,'authenticator data',37,16384);
+  const rpIdHash=sha256(Buffer.from(credential.rp_id,'utf8'));
+  if(!matches(authenticator.subarray(0,32),rpIdHash))
+    throw new Error('R174 RP ID hash mismatch');
+  const flags=authenticator[32];
+  if((flags&0x01)!==0x01)throw new Error('R174 user presence required');
+  if((flags&0x04)!==0x04)throw new Error('R174 user verification required');
+  const signCount=authenticator.readUInt32BE(33);
+  // Zero counters are common with platform authenticators. Replay resistance
+  // for such devices MUST be enforced by a one-time protected challenge journal.
+  if(credential.sign_count>0&&signCount<=credential.sign_count)
+    throw new Error('R174 sign counter rollback');
+  let key;
+  try{key=createPublicKey(credential.public_key_spki_pem);}
+  catch{throw new Error('R174 owner key invalid');}
+  if(key.asymmetricKeyType!=='ec'||key.asymmetricKeyDetails?.namedCurve!=='prime256v1')
+    throw new Error('R174 owner key must be ES256 P-256');
+  const signed=Buffer.concat([authenticator,sha256(rawClient)]);
+  const signature=base64url(assertion.signature_b64url,'signature',8,256);
+  if(!verify('sha256',signed,key,signature))
+    throw new Error('R174 signature verification failed');
+  return Object.freeze({status:'verified',subject_sha256:transaction.subject_sha256,
+    challenge_b64url:transaction.challenge_b64url,credential_id_b64url:credential.credential_id_b64url,
+    sign_count:signCount,user_verified:true,
+    // NOT an authority grant. Protected challenge consumption still mandatory.
+    authority_granted:false});
+}
+
+// The protected-host use-once boundary is intentionally separate from signature verification.
+export async function acceptR174OwnerProof({ledgerRoot,ownerTrust,...inputs}={}){
+  // A trusted caller MUST load ownerTrust from an independently pinned
+  // owner-controlled trust store, not copy it from request JSON. This
+  // primitive deliberately does not authenticate its caller or issue grants.
+  keys(ownerTrust,['schema','credential_id_b64url','public_key_spki_sha256',
+    'rp_id','origin','subject_sha256'],'owner trust');
+  if(ownerTrust.schema!=='deadbyte.r174-owner-trust-binding.v1'||
+     typeof ownerTrust.public_key_spki_sha256!=='string'||
+     !HEX64.test(ownerTrust.public_key_spki_sha256)||
+     typeof ownerTrust.subject_sha256!=='string'||
+     !HEX64.test(ownerTrust.subject_sha256))
+    throw new Error('R174 owner trust metadata invalid');
+  const {credential,transaction,subject}=inputs;
+  const credentialKey=createPublicKey(credential?.public_key_spki_pem??'');
+  const keySha=sha256(credentialKey.export({type:'spki',format:'der'})).toString('hex');
+  if(keySha!==ownerTrust.public_key_spki_sha256 ||
+     ownerTrust.credential_id_b64url!==credential?.credential_id_b64url ||
+     ownerTrust.rp_id!==credential?.rp_id ||
+     ownerTrust.origin!==credential?.origin ||
+     ownerTrust.subject_sha256!==transaction?.subject_sha256 ||
+     ownerTrust.subject_sha256!==canonicalHash(subject))
+    throw new Error('R174 owner trust credential or reviewed subject binding mismatch');
+  // Then check signed owner assertion. Invalid assertions must never
+  // consume a challenge or produce a receipt.
+  const proof=await verifyR174OwnerAssertion(inputs);
+  if(typeof ledgerRoot!=='string'||!path.isAbsolute(ledgerRoot))
+    throw new Error('R174 replay ledger root must be absolute');
+  const dir=await lstat(ledgerRoot);
+  if(!dir.isDirectory()||dir.isSymbolicLink()||
+      path.resolve(await realpath(ledgerRoot)).toLowerCase()!==path.resolve(ledgerRoot).toLowerCase())
+    throw new Error('R174 replay ledger must be a real directory');
+  // Caller must independently attest protected ACLs and owner-only trust.
+  // This primitive does NOT establish those conditions or grant authority.
+  // A challenge is globally one-use within this protected journal regardless
+  // of owner credential or scoped subject. Identity is checked by the signature
+  // verifier; it must not widen the replay key.
+  const id=sha256(Buffer.concat([
+    Buffer.from('DEADBYTE-R174-OWNER-CHALLENGE-CONSUMPTION-v1','utf8'),
+    base64url(proof.challenge_b64url,'challenge',32,32)
+  ])).toString('hex');
+  const file=path.join(ledgerRoot,'used-'+id+'.json');
+  const receipt={schema:'deadbyte.r174-consumed-owner-challenge.v1',
+    id,subject_sha256:proof.subject_sha256,credential_id_b64url:proof.credential_id_b64url,
+    challenge_b64url:proof.challenge_b64url,sign_count:proof.sign_count,
+    authority_granted:false,consumed_at_utc:new Date().toISOString()};
+  let handle;
+  try{handle=await open(file,'wx',0o600);}
+  catch(error){
+    if(error?.code==='EEXIST')throw new Error('R174 owner challenge replay denied');
+    throw error;
+  }
+  try{
+    await handle.writeFile(JSON.stringify(receipt)+'\n');
+    await handle.sync();
+  }finally{await handle.close();}
+  return Object.freeze({...proof,status:'consumed',id,authority_granted:false});
+}

package/src/r175-foreground-boundary.mjs

@@ -0,0 +1,28 @@
+// R175: foreground log sessions never own operator standing grants.
+import {AUTHORITY_PLANES} from './remote-authority.mjs';
+export function observeOnlyAuthority(snapshot){
+  const expected={};
+  if(snapshot?.state!=='ONLINE')throw new Error('R175 foreground requires ONLINE runtime');
+  for(const plane of AUTHORITY_PLANES){
+    const observed=snapshot.authority?.[plane];
+    if(!observed||typeof observed.armed!=='boolean'||typeof observed.configured!=='boolean')
+      throw new Error('R175 foreground authority observation invalid: '+plane);
+    expected[plane]=observed.armed;
+  }
+  return Object.freeze({authority_scope:'observe-only',expected:Object.freeze(expected),
+    commands:Object.freeze([])});
+}
+export function assertObserveOnlyMarker(marker){
+  return marker?.schema==='deadbyte.remote-session.v2'&&
+    marker.authority_scope==='observe-only'&&
+    Number.isInteger(marker.owner_pid)&&marker.owner_pid>0&&
+    typeof marker.session_nonce==='string'&&/^[0-9a-f]{64}$/.test(marker.session_nonce);
+}
+
+export function assertMatchingForegroundRelease(active,{version,manifest_sha256}={}){
+  if(!active||typeof version!=='string'||!/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version)||
+     typeof manifest_sha256!=='string'||!/^[0-9a-f]{64}$/.test(manifest_sha256)||
+     active.version!==version||active.manifest_sha256!==manifest_sha256)
+    throw new Error('R175_EXACT_ACTIVE_RELEASE_REQUIRED: observation session will not activate, downgrade or upgrade runtime');
+  return active;
+}

package/src/r186-owner-anchor.mjs

@@ -0,0 +1,12 @@
+import {createHash,createPublicKey} from 'node:crypto';
+
+export function createR186OwnerAnchor(publicKeyPem){
+ if(typeof publicKeyPem!=='string'||publicKeyPem.length<32||publicKeyPem.length>8192||/PRIVATE KEY/.test(publicKeyPem))
+  throw new Error('R186 owner enrollment requires a public PEM only');
+ let key;try{key=createPublicKey(publicKeyPem);}catch{throw new Error('R186 owner public key invalid');}
+ if(key.asymmetricKeyType!=='ed25519')throw new Error('R186 owner public key must be Ed25519');
+ const canonicalPem=key.export({type:'spki',format:'pem'}).toString();
+ const owner_key_id=createHash('sha256').update(key.export({type:'spki',format:'der'})).digest('hex');
+ return Object.freeze({anchor:Object.freeze({schema:'deadbyte.r186-owner-anchor.v1',owner_key_id}),
+  public_key_pem:canonicalPem});
+}

package/src/r186-owner-consent-preflight.mjs

@@ -0,0 +1,63 @@
+// R186: only a read-only verifier for independently enrolled owner consent.
+// A successful result MUST NOT be treated as an Autonomous grant. The caller
+// must separately prove protected enrollment, single-use consumption and epoch.
+import {createHash,createPublicKey} from 'node:crypto';
+import path from 'node:path';
+import {verifyProjectOwnerApproval} from './r70-owner-approval.mjs';
+
+const SHA=/^[0-9a-f]{64}$/;
+function exact(value,fields,label){
+ if(!value||typeof value!=='object'||Array.isArray(value)||
+    Object.keys(value).length!==fields.length||
+    fields.some(field=>!Object.hasOwn(value,field)))
+   throw new Error('R186 '+label+' invalid');
+}
+export async function verifyR186OwnerConsent({ownerTrust,ownerPublicKeyPem,approval,expected,now=new Date()}={}){
+ exact(ownerTrust,['schema','owner_key_id'],'owner anchor');
+ if(ownerTrust.schema!=='deadbyte.r186-owner-anchor.v1'||
+    typeof ownerTrust.owner_key_id!=='string'||!SHA.test(ownerTrust.owner_key_id))
+   throw new Error('R186 owner anchor schema or fingerprint invalid');
+ if(typeof ownerPublicKeyPem!=='string'||ownerPublicKeyPem.length>8192)
+   throw new Error('R186 owner anchor public key invalid');
+ let pub;
+ try{pub=createPublicKey(ownerPublicKeyPem);}catch{throw new Error('R186 owner anchor public key invalid');}
+ if(pub.asymmetricKeyType!=='ed25519')throw new Error('R186 owner anchor must be Ed25519');
+ const keySha=createHash('sha256').update(pub.export({type:'spki',format:'der'})).digest('hex');
+ if(ownerTrust.owner_key_id!==keySha)
+   throw new Error('R186 owner anchor public key mismatch');
+ const approved=await verifyProjectOwnerApproval({approval,ownerPublicKey:pub,expected,now});
+ return Object.freeze({status:'verified_readonly',authority_granted:false,
+  owner_key_id:keySha,subject_sha256:approved.subject_sha256,
+  root_id:approved.root_id,project_root:approved.project_root,
+  expires_at_utc:approved.expires_at_utc,
+  next_gate:'PROTECTED_OWNER_ENROLLMENT_AND_SINGLE_USE_EPOCH_ISSUANCE_REQUIRED'});
+}
+
+export function verifyR186PolicyRootBinding({
+ codingPolicy,autonomousPolicy,rootId,projectRoot,codingPolicySha256
+}={}){
+ if(!codingPolicy||typeof codingPolicy!=='object'||
+    codingPolicy.schema!=='deadbyte.coding-policy.v1'||codingPolicy.enabled!==true)
+  throw new Error('R186 coding policy schema invalid');
+ if(!autonomousPolicy||typeof autonomousPolicy!=='object'||
+    autonomousPolicy.schema!=='deadbyte.autonomous-policy.v1'||autonomousPolicy.enabled!==true)
+  throw new Error('R186 autonomous policy schema invalid');
+ if(typeof rootId!=='string'||!/^[A-Za-z0-9._-]{1,64}$/.test(rootId)||
+    !Array.isArray(autonomousPolicy.root_ids)||
+    autonomousPolicy.root_ids.length!==1||autonomousPolicy.root_ids[0]!==rootId)
+  throw new Error('R186 Autonomous root vector exceeds owner-reviewed scope');
+ if(typeof codingPolicySha256!=='string'||!SHA.test(codingPolicySha256)||
+    autonomousPolicy.coding_policy_sha256!==codingPolicySha256)
+  throw new Error('R186 coding-policy digest binding mismatch');
+ const bound=codingPolicy.roots?.[rootId]?.path;
+ if(typeof bound!=='string'||typeof projectRoot!=='string'||
+    !path.win32.isAbsolute(bound)||!path.win32.isAbsolute(projectRoot)||
+    bound.startsWith('\\\\')||projectRoot.startsWith('\\\\'))
+  throw new Error('R186 coding project root is not a real absolute drive path');
+ const actual=path.win32.normalize(bound).toLowerCase();
+ const requested=path.win32.normalize(projectRoot).toLowerCase();
+ if(actual!==requested||
+    actual===path.win32.parse(actual).root.toLowerCase())
+  throw new Error('R186 reviewed root must match selected Coding project root');
+ return Object.freeze({root_id:rootId,project_root:bound});
+}

package/src/r186-owner-grant-broker.mjs

@@ -0,0 +1,96 @@
+// Single-use R186 Autonomous grant issuance. This module does not enroll owner
+// keys and accepts no caller-selected authority scope: the policy, reviewed
+// manifest and independently protected owner anchor are the complete subject.
+import {createHash,createPrivateKey,createPublicKey,randomBytes,sign,verify} from 'node:crypto';
+import {mkdir,open,readFile,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {createAuthorityEpochStore} from './authority-continuity-r65.mjs';
+import {verifyR186OwnerConsent,verifyR186PolicyRootBinding} from './r186-owner-consent-preflight.mjs';
+
+const SHA=/^[0-9a-f]{64}$/;
+const TERMINAL_DOMAIN=Buffer.from('DEADBYTE-R186-OWNER-GRANT-TERMINAL\0','utf8');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const bytes=value=>Buffer.from(canonicalJson(value),'utf8');
+async function writeExclusive(file,data){
+ await mkdir(path.dirname(file),{recursive:true});
+ const handle=await open(file,'wx',0o600);
+ try{await handle.writeFile(data);await handle.sync();}
+ finally{await handle.close();}
+}
+function insist(condition,message){if(!condition)throw new Error(`R186 owner grant blocked: ${message}`);}
+async function signTerminal(runtimeDir,body){
+ const trustDir=path.join(path.dirname(path.resolve(runtimeDir)),'trust');
+ const [privatePem,publicPem]=await Promise.all([
+  readFile(path.join(trustDir,'ed25519-private.pem')),readFile(path.join(trustDir,'ed25519-public.pem'))]);
+ const privateKey=createPrivateKey(privatePem),publicKey=createPublicKey(publicPem);
+ insist(privateKey.asymmetricKeyType==='ed25519'&&publicKey.asymmetricKeyType==='ed25519','machine receipt key type invalid');
+ const privateKeyId=sha(createPublicKey(privateKey).export({type:'spki',format:'der'}));
+ const publicKeyId=sha(publicKey.export({type:'spki',format:'der'}));
+ insist(privateKeyId===publicKeyId,'machine receipt key pair mismatch');
+ const signature=sign(null,Buffer.concat([TERMINAL_DOMAIN,bytes(body)]),privateKey);
+ insist(verify(null,Buffer.concat([TERMINAL_DOMAIN,bytes(body)]),publicKey,signature),'machine terminal signature self-check failed');
+ return Object.freeze({algorithm:'ed25519',domain:'DEADBYTE-R186-OWNER-GRANT-TERMINAL',key_id:publicKeyId,signature_base64:signature.toString('base64')});
+}
+
+export async function issueR186AutonomousGrant({
+ runtimeDir,grantFile,codingPolicy,codingPolicyBytes,autonomousPolicy,autonomousPolicyBytes,
+ releaseManifestBytes,ownerTrust,ownerPublicKeyPem,approval,now=new Date(),epochStore=null
+}={}){
+ insist(typeof runtimeDir==='string'&&path.isAbsolute(runtimeDir),'runtime directory invalid');
+ insist(typeof grantFile==='string'&&path.isAbsolute(grantFile),'grant path invalid');
+ for(const [name,value] of [['Coding policy',codingPolicyBytes],['Autonomous policy',autonomousPolicyBytes],['release manifest',releaseManifestBytes]])
+  insist(Buffer.isBuffer(value)&&value.length>0,`${name} bytes invalid`);
+ insist(autonomousPolicy?.schema==='deadbyte.autonomous-policy.v1'&&autonomousPolicy.enabled===true,'Autonomous policy invalid');
+ insist(path.resolve(autonomousPolicy.lease_file)===path.resolve(grantFile),'policy grant path mismatch');
+ const runtimePrefix=path.resolve(runtimeDir)+path.sep;
+ insist(path.resolve(grantFile).startsWith(runtimePrefix),'grant path outside runtime');
+ const codingSha=sha(codingPolicyBytes),autonomousSha=sha(autonomousPolicyBytes),manifestSha=sha(releaseManifestBytes);
+ const rootId=Array.isArray(autonomousPolicy.root_ids)&&autonomousPolicy.root_ids.length===1?autonomousPolicy.root_ids[0]:null;
+ const projectRoot=rootId?codingPolicy?.roots?.[rootId]?.path:null;
+ const binding=verifyR186PolicyRootBinding({codingPolicy,autonomousPolicy,rootId,projectRoot,codingPolicySha256:codingSha});
+ const consent=await verifyR186OwnerConsent({ownerTrust,ownerPublicKeyPem,approval,now,expected:{
+  rootId:binding.root_id,projectRoot:binding.project_root,codingPolicySha256:codingSha,
+  autonomousPolicySha256:autonomousSha,reviewedArtifactSha256:manifestSha
+ }});
+ const evidenceDir=path.join(runtimeDir,'owner-consent','r186');
+ const claimPath=path.join(evidenceDir,`${consent.subject_sha256}.claim.json`);
+ const terminalPath=path.join(evidenceDir,`${consent.subject_sha256}.terminal.json`);
+ try{await readFile(terminalPath);throw new Error('R186 owner approval already consumed; replay denied');}
+ catch(error){if(error?.code!=='ENOENT')throw error;}
+ const nonce=randomBytes(32).toString('hex');
+ const claim={schema:'deadbyte.r186-owner-grant-claim.v1',subject_sha256:consent.subject_sha256,
+  owner_key_id:consent.owner_key_id,policy_sha256:autonomousSha,coding_policy_sha256:codingSha,
+  release_manifest_sha256:manifestSha,root_id:binding.root_id,project_root:binding.project_root,
+  grant_instance_nonce:nonce,claimed_at_utc:now.toISOString()};
+ try{await writeExclusive(claimPath,bytes(claim));}
+ catch(error){if(error?.code==='EEXIST')throw new Error('R186 owner approval already consumed or in progress; replay denied');throw error;}
+ const grant={schema:'deadbyte.autonomous-grant.v2',policy_sha256:autonomousSha,
+  coding_policy_sha256:codingSha,instance_nonce:nonce,root_ids:[binding.root_id],
+  granted_at_utc:now.toISOString(),expires_at_utc:consent.expires_at_utc};
+ const grantBytes=bytes(grant);
+ try{await writeExclusive(grantFile,grantBytes);}
+ catch(error){throw Object.assign(new Error(`R186 grant write failed after durable claim: ${error?.message??error}`),{outcome:'OUTCOME_UNKNOWN'});}
+ const store=epochStore??createAuthorityEpochStore({runtimeDir,policyBytes:autonomousPolicyBytes});
+ let head;
+ try{head=await store.append({plane:'autonomous',action:'grant',grantBytes,grantInstanceNonce:nonce,updateId:null});}
+ catch(error){throw Object.assign(new Error(`R186 epoch issuance failed after grant write: ${error?.message??error}`),{outcome:'OUTCOME_UNKNOWN'});}
+ insist(SHA.test(String(head?.event_sha256)),'epoch identity invalid after issuance');
+ const verified=await store.verifyGrant({plane:'autonomous',grantBytes,grantInstanceNonce:nonce,policyBytes:autonomousPolicyBytes});
+ insist(verified?.trusted===true&&verified.event_sha256===head.event_sha256,'grant epoch read-back failed');
+ insist((await readFile(grantFile)).equals(grantBytes),'grant changed after epoch issuance');
+ const terminalBody={schema:'deadbyte.r186-owner-grant-terminal.v1',status:'GRANTED',
+  subject_sha256:consent.subject_sha256,owner_key_id:consent.owner_key_id,
+  claim_sha256:sha(bytes(claim)),grant_sha256:sha(grantBytes),grant_instance_nonce:nonce,
+  policy_sha256:autonomousSha,coding_policy_sha256:codingSha,release_manifest_sha256:manifestSha,
+  root_id:binding.root_id,project_root:binding.project_root,epoch_event_sha256:head.event_sha256,
+  epoch_seq:head.seq,expires_at_utc:consent.expires_at_utc,completed_at_utc:new Date().toISOString()};
+ const attestation=await signTerminal(runtimeDir,terminalBody);
+ const unsigned={body:terminalBody,attestation};
+ const terminal={...unsigned,receipt_sha256:sha(bytes(unsigned))};
+ try{await writeExclusive(terminalPath,bytes(terminal));}
+ catch(error){throw Object.assign(new Error(`R186 terminal receipt write failed: ${error?.message??error}`),{outcome:'OUTCOME_UNKNOWN'});}
+ return Object.freeze({status:'GRANTED',authority_granted:true,subject_sha256:consent.subject_sha256,
+  grant_sha256:terminalBody.grant_sha256,epoch_event_sha256:head.event_sha256,epoch_seq:head.seq,
+  terminal_path:terminalPath,receipt_sha256:terminal.receipt_sha256});
+}