deadbyte-mcp 0.15.68 → 0.15.70

package/src/deadbyte-cli.mjs

@@ -27,11 +27,14 @@ import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentit
 import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import {observeOnlyAuthority,assertObserveOnlyMarker,assertMatchingForegroundRelease} from './r175-foreground-boundary.mjs';
 import { decodeRemoteLogBytes, boundedRemoteDiagnostic, readRemoteLogAppend } from './remote-log-decode-r60.mjs';
 import {reconcileStaleMarker,resumeMarkerReconciliation,recoverPublishedMarkerTerminal} from './clean-activation-recovery-r153.mjs';
 import {selectLegacyMarkerEvidence,verifyLocatedLegacyMarkerReceipt} from './legacy-marker-evidence-r159.mjs';
 import {normalizeHostCommandPins,encodeHostCommandPins} from './host-command-pins-r154.mjs';
 import {verifyPackageDecisionManifest} from './package-identity-r160.mjs';
+import {inspectTrustedInstallation} from './privileged-install-trust-r89.mjs';
+import {recoverLegacyForegroundOwnership} from './foreground-owner-recovery-r190.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -61,14 +64,15 @@ function printHelp(){
     `  npx -y ${exact} doctor              # verify current package/release truth`,
     `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
     `  npx -y ${exact} remote              # safe observation-only foreground session`,
-    `  npx -y ${exact} remote --operator   # process/coding/autonomous; explicit owner gates still apply`,
-    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
-    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
-    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
+    `  npx -y ${exact} remote --operator   # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --desktop    # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --host       # R175 blocked pending session-owned authority issuance`,
+    `  npx -y ${exact} remote --full       # R175 blocked pending session-owned authority issuance`,
     `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
     `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
  
     `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
+    `  npx -y ${exact} remote reconcileforeground --confirm-marker-sha256 <sha256> # protected marker-only recovery`,
     `  npx -y ${exact} remote status`,
     `  npx -y ${exact} remote restart`,
     `  npx -y ${exact} supervisor status`,
@@ -400,8 +404,8 @@ function timelineFilterEvent(timeline){
 }
 async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
   process.stdout.write(verbose
-    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
-    : '[LOG] Live tool calls with individual START/DONE, sanitized arguments and results. Transport hidden; signed audit remains on disk. Ctrl+C disconnects and revokes authority.\n');
+    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects; owner standing grants remain unchanged.\n'
+    : '[LOG] Live tool calls with individual START/DONE, sanitized arguments and results. Transport hidden; signed audit remains on disk. Ctrl+C disconnects; owner standing grants remain unchanged.\n');
   const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
   const partialLines=new Map();
   let liveFiles=[...activeOffsets.keys()];
@@ -455,7 +459,13 @@ function remoteTag(kind,displayMode){
   return (displayMode==='ascii'?ascii:unicode)[kind];
 }
 function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
-async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
+async function cleanupRemoteSession(ctx,{displayMode='unicode',marker=null}={}){
+  // R175 observation sessions issue no grants and must never revoke owner grants or park runtime.
+  // An invalid R175 marker must fail closed, not fall through to legacy revoke.
+  if(marker!==null){
+    if(!assertObserveOnlyMarker(marker))throw new Error('R175_INVALID_OBSERVE_ONLY_MARKER: no authority cleanup performed');
+    return;
+  }
   const failed=[];
   for(const command of SESSION_CLEANUP){
     try{
@@ -669,6 +679,15 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
   const markerPath=remoteSessionMarker(ctx.root);
   const snapshot=await readRemoteMarkerSnapshot(markerPath);
   if(!snapshot) return null;
+  if(assertObserveOnlyMarker(prior)){
+    // Owner and guardian lifetime were verified above. A monitor-only session
+    // owns the CAS marker, not any authority epoch or runtime lifecycle.
+    if(snapshot.marker?.owner_pid!==prior.owner_pid||snapshot.marker?.session_nonce!==prior.session_nonce)
+      throw new Error('R175 observation-only stale marker identity changed; marker retained');
+    if(deletePinnedRemoteMarker(markerPath,snapshot.sha256)!=='REMOVED')
+      throw new Error('R175 observation-only stale marker CAS failed; marker retained');
+    return null;
+  }
   const active=await readActiveRuntimeBinding(ctx.root);
   if(!active)throw new Error(`remote session ownership unverified for stale pid=${ownerPid}; active pointer missing; marker retained`);
   const observed=observedAuthority(ctx);
@@ -740,7 +759,7 @@ async function claimRemoteSession(ctx){
   const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
   const nonce=randomBytes(32).toString('hex');
   const resultSessionId=randomBytes(12).toString('hex');
-  const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
+  const marker={schema:'deadbyte.remote-session.v2',authority_scope:'observe-only',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
     result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
   marker.owner_identity=queryForegroundIdentity(process.pid);
   if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
@@ -749,7 +768,7 @@ async function claimRemoteSession(ctx){
   catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
   let guardian=null;
   try{
-    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
+    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc','--authority-scope','observe-only'],{
       detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
     });
     if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
@@ -786,6 +805,10 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
     throw new Error('remote session ownership marker replaced before native deletion; marker retained');
 }
 async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default',hostCommandPins=[]}={}){
+  // R175: elevated session flags need a distinct signed session-owned lease
+  // issuer before they can safely coexist with owner standing grants.
+  if(mode!=='default') throw new Error('R175_FOREGROUND_OWNER_BOUNDARY: elevated foreground modes require session-owned grants; use explicit remote arm* commands');
+  if(hostCommandPins.length) throw new Error('R175_FOREGROUND_OBSERVE_ONLY: host command repins require an explicit owner action outside foreground logging');
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -793,12 +816,15 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   // an EPOCH_NATIVE production runtime. This guard precedes session recovery,
   // marker claims, revocations and any controller startup.
   const active=await readActiveRuntimeBinding(ctx.root);
+  const currentManifestSha256=createHash('sha256')
+    .update(await readFile(path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'))).digest('hex');
+  assertMatchingForegroundRelease(active,{version:DEADBYTE_VERSION,manifest_sha256:currentManifestSha256});
   if(active){
     const decision=selectR168OneShotRemotePath({command:'start',active,cliVersion:DEADBYTE_VERSION});
     if(decision.mode==='blocked_version_skew') throw new Error(decision.message);
   }
-  // First installation without an active pointer retains the existing
-  // unbound bootstrap path. A bound older release must never auto-upgrade.
+  // R175 foreground is monitor-only: deployment and upgrades need separate owner action.
+  // Never synchronize runtime or mint/revoke a grant from this path.
   if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
   if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
   const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
@@ -807,9 +833,21 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     startupLock.assertHeld();
     await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
     startupLock.assertHeld();
-    const migrationContext=await recoverRemoteSession(ctx,{displayMode});
+    // R179: an observation session may recover ONLY its own observation marker.
+    // Legacy migration/revocation is a separately authorized controller action.
+    const staleObserver=await readRemoteSessionMarker(ctx.root);
+    if(staleObserver){
+      if(!assertObserveOnlyMarker(staleObserver))
+        throw new Error('R179_LEGACY_FOREGROUND_RECOVERY_REQUIRES_EXPLICIT_OWNER_COMMAND: no authority touched');
+      await recoverRemoteSession(ctx,{displayMode});
+    }
     startupLock.assertHeld();
-    await synchronizeForegroundRuntime(ctx,{displayMode,migrationContext,hostCommandPins});
+    const pinned=await readActiveRuntimeBinding(ctx.root);
+    assertMatchingForegroundRelease(pinned,{version:DEADBYTE_VERSION,manifest_sha256:currentManifestSha256});
+    for(const field of ['release_id','generation_manifest_sha256','generation_root']){
+      if(pinned[field]!==active[field])
+        throw new Error('R175_FOREGROUND_ACTIVE_DRIFT: no runtime update or grant mutation attempted');
+    }
     startupLock.assertHeld();
     marker=await claimRemoteSession(ctx);
     startupLock.assertHeld();
@@ -838,51 +876,29 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     process.stdout.write('[BOOT] Starting local + remote runtime...\n');
     const preflight=invokeController(ctx,'status',{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
     let startText=preflight.stdout||'';
-    if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
-      process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
-    }else{
-      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
-      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
-      const startCommand=recovery?'restart':'start';
-      const controllerLogDir=path.join(ctx.root,'runtime','logs');
-      await mkdir(controllerLogDir,{recursive:true});
-      const launchOutput={
-        stdout_path:path.join(controllerLogDir,`controller-${startCommand}.stdout.log`),
-        stderr_path:path.join(controllerLogDir,`controller-${startCommand}.stderr.log`)
-      };
-      const launch=invokeController(ctx,startCommand,{allowFailure:true,redirectOutput:launchOutput,timeoutMs:REMOTE_START_TIMEOUT_MS});
-      if(launch.status!==0){
-        const evidence=await readControllerStartFailure(ctx.root,startCommand);
-        const fallback=evidence?'':await readTailBounded(launchOutput.stderr_path,2048);
-        const detail=evidence?`; controller-start-failure: ${evidence.message}`:(fallback?`; controller-stderr: ${fallback}`:'');
-        throw new Error(`remote controller '${startCommand}' failed exit=${launch.status}${detail}`);
-      }
-      const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
-      startText=started.stdout||'';
-    }
+    if(preflight.status!==0||!controllerRuntimeReady(preflight.stdout))
+      throw new Error('R175_FOREGROUND_RUNTIME_NOT_READY: monitoring cannot start or restart a runtime; use explicit remote start');
+    process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
     process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
-    const desired=authorityVector(mode);
-    const priorAuthority=observedAuthority(ctx);
-    for(const plane of ['host','desktop','autonomous','coding','process'].filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
-      const command=`disarm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
-      const command=`arm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
+    // Observation is never a grant transition or an expectation that live
+    // owner grants remain frozen for the lifetime of this log session.
     const current=await readActiveRuntimeBinding(ctx.root);
-    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
-      coreRoot:current?.release_root??null
-    }),desired);
+    for(const field of ['release_id','manifest_sha256','generation_manifest_sha256','generation_root'])
+      if(current?.[field]!==active[field])throw new Error('R175_FOREGROUND_ACTIVE_DRIFT: observed release changed');
+    const authority=assertRuntimeReadyObservation(observedAuthority(ctx),{
+      coreRoot:active.release_root
+    });
+    observeOnlyAuthority(authority);
+    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Observing existing grants without ARM or DISARM...\n`,displayMode);
     process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
-    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode==='default'?'revoked':mode});
+    // Signed machine test is safe only for already-disarmed authority vectors.
+    // Do not test against a made-up all-disarmed expectation while owner
+    // grants are live; never revoke them as a way to make that test pass.
+    if(AUTHORITY_PLANES.every(plane=>!authority.authority[plane].armed))
+      invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});
+    else process.stdout.write('[VERIFY] pre-existing owner grants preserved; revoked-plane probe omitted\n');
     ready=true;
     writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
     process.stdout.write('[OK] ONLINE\n');
@@ -906,8 +922,8 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
     if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
     process.stdout.write(`${formatRemoteLifecycle('cleanup',{displayMode})}\n`);
-    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; revoking authority...\n');
-    try{await cleanupRemoteSession(ctx,{displayMode});}
+    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; preserving owner standing grants...\n');
+    try{await cleanupRemoteSession(ctx,{displayMode,marker});}
     catch(cleanupError){
       if(sessionError) throw new AggregateError([sessionError,cleanupError],
         `remote activation failed: ${String(sessionError?.message||sessionError)}; cleanup failed, ownership marker retained: ${String(cleanupError?.message||cleanupError)}`);
@@ -921,8 +937,55 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     }
   }
 }
+async function readR190Evidence(file){
+  try{
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink()||info.size<1||info.size>64*1024)
+      throw new Error(`R190 recovery evidence is unsafe: ${path.basename(file)}`);
+    return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));
+  }catch(error){if(error?.code==='ENOENT')return null;throw error;}
+}
+async function runRemoteForegroundRecovery(expectedMarkerSha256){
+  const ctx=await remoteContext();
+  const thisFile=fileURLToPath(import.meta.url);
+  const protectedFiles=[process.execPath,thisFile,path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-owner-recovery-r190.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-marker-cas-win32.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-process-identity.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-session-lock.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','privileged-install-trust-r89.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','canonical-json.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'bin','deadbyte-epoch-lock-r85.node')];
+  let installation;
+  try{installation=await inspectTrustedInstallation(protectedFiles);}
+  catch(error){throw new Error(`R190_PROTECTED_RECOVERY_REQUIRED: ${boundedSingleLine(error?.message||error,512)}`);}
+  if(!installation.trusted)throw new Error('R190_PROTECTED_RECOVERY_REQUIRED: package ACL is not R89-trusted');
+  await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
+  const evidenceDir=path.join(ctx.root,'evidence','foreground-recovery-r190');
+  const intentPath=path.join(evidenceDir,`${expectedMarkerSha256}.intent.json`);
+  const terminalPath=path.join(evidenceDir,`${expectedMarkerSha256}.terminal.json`);
+  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
+  try{
+    startupLock.assertHeld();
+    const result=await recoverLegacyForegroundOwnership({
+      expectedMarkerSha256,
+      readMarkerSnapshot:()=>readRemoteMarkerSnapshot(remoteSessionMarker(ctx.root)),
+      deleteMarkerIfHash:expected=>deletePinnedRemoteMarker(remoteSessionMarker(ctx.root),expected),
+      readActivePointer:()=>readActiveRuntimeBinding(ctx.root),
+      readAuthority:()=>observedAuthority(ctx),
+      queryIdentity:identity=>queryForegroundIdentity(identity.pid),
+      loadIntent:()=>readR190Evidence(intentPath),loadTerminal:()=>readR190Evidence(terminalPath),
+      publishIntent:value=>publishExclusiveJson(intentPath,value),
+      publishTerminal:value=>publishExclusiveJson(terminalPath,value)
+    });
+    startupLock.assertHeld();
+    process.stdout.write(`${JSON.stringify({...result,intent_path:intentPath,terminal_path:terminalPath,
+      authority_mutated:false,runtime_mutated:false})}\n`);
+  }finally{await startupLock.release();}
+}
 async function runRemote(args){
   let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
+  let recoveryMarkerSha256=null;
   const hostCommandPinValues=[];
   const positional=[];
   for(let index=0;index<args.length;index++){
@@ -947,12 +1010,23 @@ async function runRemote(args){
       if(index+1>=args.length) throw new Error('remote --resume requires a cursor');
       resumeCursor=args[++index];continue;
     }
+    if(arg==='--confirm-marker-sha256'){
+      if(recoveryMarkerSha256!==null) throw new Error('remote --confirm-marker-sha256 may be specified once');
+      recoveryMarkerSha256=String(args[++index]??'');continue;
+    }
     positional.push(arg);
   }
   let hostCommandPins;
   try{hostCommandPins=normalizeHostCommandPins(hostCommandPinValues);}
   catch(error){throw new Error(`remote --host-command-pin ${error.message}`);}
   const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default'||hostCommandPins.length>0;
+  if(positional.length===1&&positional[0]==='reconcileforeground'){
+    if(presentation)throw new Error('remote reconcileforeground does not accept presentation or authority flags');
+    if(!/^[0-9a-f]{64}$/.test(String(recoveryMarkerSha256??'')))
+      throw new Error('remote reconcileforeground requires --confirm-marker-sha256 with the exact current marker hash');
+    await runRemoteForegroundRecovery(recoveryMarkerSha256);return;
+  }
+  if(recoveryMarkerSha256!==null)throw new Error('remote --confirm-marker-sha256 is valid only with reconcileforeground');
   if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode,hostCommandPins});return;}
   if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
   if(positional.length>1) throw new Error('remote accepts one controller command');

package/src/foreground-owner-recovery-r190.mjs

@@ -0,0 +1,117 @@
+// Explicit, marker-only recovery for pre-R175 foreground ownership records.
+// It never starts/stops runtime processes and never creates, revokes or restores
+// authority. The caller must provide native CAS deletion and no-clobber evidence.
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {foregroundIdentityMatches,validForegroundIdentity} from './foreground-process-identity.mjs';
+
+const SHA=/^[0-9a-f]{64}$/;
+const PLANES=['process','coding','autonomous','desktop','host'];
+const hash=value=>createHash('sha256').update(Buffer.from(canonicalJson(value))).digest('hex');
+function insist(condition,message){if(!condition)throw new Error(`R190 foreground recovery blocked: ${message}`);}
+function pointerSubject(pointer){
+ const fields=['release_id','version','manifest_sha256','generation_manifest_sha256','generation_root'];
+ insist(pointer&&typeof pointer==='object','active pointer missing');
+ for(const field of fields)insist(typeof pointer[field]==='string'&&pointer[field].length>0,`active pointer ${field} invalid`);
+ insist(SHA.test(pointer.manifest_sha256)&&SHA.test(pointer.generation_manifest_sha256),'active pointer digest invalid');
+ insist(path.isAbsolute(pointer.generation_root),'active generation root invalid');
+ return Object.freeze(Object.fromEntries(fields.map(field=>[field,pointer[field]])));
+}
+function authoritySubject(observation){
+ insist(observation?.state==='ONLINE'&&observation.local_ready===true,'runtime is not verified ONLINE');
+ insist(observation?.supervisor?.running===true,'supervisor is not verified running');
+ const subject={state:'ONLINE',local_ready:true,supervisor_running:true};
+ for(const plane of PLANES){
+  const value=observation.authority?.[plane];
+  insist(value?.configured===true&&typeof value.armed==='boolean'&&typeof value.reason==='string',`${plane} authority unverified`);
+  subject[plane]=Object.freeze({configured:true,armed:value.armed,reason:value.reason});
+ }
+ return Object.freeze(subject);
+}
+function staleIdentity(identity,queryIdentity,label){
+ insist(validForegroundIdentity(identity),`${label} identity invalid`);
+ let actual;
+ try{actual=queryIdentity(identity);}catch{throw new Error(`R190 foreground recovery blocked: ${label} identity observation unavailable`);}
+ if(actual===null)return Object.freeze({pid:identity.pid,state:'absent'});
+ insist(validForegroundIdentity(actual),`${label} current identity invalid`);
+ insist(!foregroundIdentityMatches(identity,actual),`${label} process is still active`);
+ return Object.freeze({pid:identity.pid,state:'pid_reused',actual_creation_utc:actual.creation_utc,
+  actual_executable_path:actual.executable_path});
+}
+function terminalFor(intent,status,completedAt){
+ const body={schema:'deadbyte.r190-foreground-recovery-terminal.v1',status,
+  intent_sha256:intent.intent_sha256,marker_sha256:intent.marker_sha256,
+  pointer:intent.pointer,authority:intent.authority,completed_at_utc:completedAt};
+ return Object.freeze({...body,receipt_sha256:hash(body)});
+}
+function validateIntent(intent,expected,pointer,authority){
+ insist(intent?.schema==='deadbyte.r190-foreground-recovery-intent.v1','recovery intent schema invalid');
+ insist(intent.marker_sha256===expected,'recovery intent marker mismatch');
+ const body={...intent};delete body.intent_sha256;
+ insist(SHA.test(String(intent.intent_sha256))&&hash(body)===intent.intent_sha256,'recovery intent digest invalid');
+ insist(canonicalJson(intent.pointer)===canonicalJson(pointer),'active pointer drift after marker delete');
+ insist(canonicalJson(intent.authority)===canonicalJson(authority),'authority drift after marker delete');
+}
+
+export async function recoverLegacyForegroundOwnership({
+ expectedMarkerSha256,readMarkerSnapshot,deleteMarkerIfHash,readActivePointer,readAuthority,
+ queryIdentity,loadIntent,loadTerminal,publishIntent,publishTerminal,now=()=>new Date()
+}={}){
+ insist(typeof expectedMarkerSha256==='string'&&SHA.test(expectedMarkerSha256),'confirmation SHA-256 invalid');
+ for(const [name,fn] of Object.entries({readMarkerSnapshot,deleteMarkerIfHash,readActivePointer,
+  readAuthority,queryIdentity,loadIntent,loadTerminal,publishIntent,publishTerminal}))
+  insist(typeof fn==='function',`${name} callback missing`);
+ const pointer=pointerSubject(await readActivePointer());
+ const authority=authoritySubject(await readAuthority());
+ const snapshot=await readMarkerSnapshot();
+ const priorIntent=await loadIntent();
+ const priorTerminal=await loadTerminal();
+ if(snapshot===null){
+  insist(priorIntent,'marker absent without a durable R190 intent');
+  validateIntent(priorIntent,expectedMarkerSha256,pointer,authority);
+  if(priorTerminal){
+   insist(priorTerminal.intent_sha256===priorIntent.intent_sha256&&priorTerminal.marker_sha256===expectedMarkerSha256,
+    'terminal identity mismatch');
+   return Object.freeze({status:'MARKER_ALREADY_RECONCILED',marker_sha256:expectedMarkerSha256,
+    intent_sha256:priorIntent.intent_sha256,receipt_sha256:priorTerminal.receipt_sha256});
+  }
+  const terminal=terminalFor(priorIntent,'MARKER_RECONCILED_AFTER_DELETE',now().toISOString());
+  await publishTerminal(terminal);
+  return Object.freeze({status:terminal.status,marker_sha256:expectedMarkerSha256,
+   intent_sha256:priorIntent.intent_sha256,receipt_sha256:terminal.receipt_sha256});
+ }
+ insist(snapshot?.sha256===expectedMarkerSha256,'marker hash differs from explicit confirmation');
+ const marker=snapshot.marker;
+ insist(marker?.schema==='deadbyte.remote-session.v2','marker schema is not recoverable');
+ insist(marker.authority_scope===undefined||marker.authority_scope===null,'scoped marker must use its normal lifecycle');
+ insist(Number.isInteger(marker.owner_pid)&&marker.owner_pid>0&&marker.owner_identity,'owner marker identity invalid');
+ insist(Number.isInteger(marker.guardian_pid)&&marker.guardian_pid>0&&marker.guardian_identity,'guardian marker identity invalid');
+ const owner=staleIdentity(marker.owner_identity,queryIdentity,'owner');
+ const guardian=staleIdentity(marker.guardian_identity,queryIdentity,'guardian');
+ const intentBody={schema:'deadbyte.r190-foreground-recovery-intent.v1',action:'reconcile_legacy_foreground_marker_only',
+  marker_sha256:expectedMarkerSha256,pointer,authority,owner,guardian,requested_at_utc:now().toISOString(),
+  authority_mutation_allowed:false,runtime_mutation_allowed:false};
+ const intent=Object.freeze({...intentBody,intent_sha256:hash(intentBody)});
+ if(priorIntent)validateIntent(priorIntent,expectedMarkerSha256,pointer,authority);
+ else await publishIntent(intent);
+ const pinnedIntent=priorIntent??intent;
+ const pointerBeforeDelete=pointerSubject(await readActivePointer());
+ const authorityBeforeDelete=authoritySubject(await readAuthority());
+ insist(canonicalJson(pointerBeforeDelete)===canonicalJson(pointer),'active pointer drift before CAS delete');
+ insist(canonicalJson(authorityBeforeDelete)===canonicalJson(authority),'authority drift before CAS delete');
+ const current=await readMarkerSnapshot();
+ insist(current?.sha256===expectedMarkerSha256,'marker changed before CAS delete');
+ staleIdentity(marker.owner_identity,queryIdentity,'owner');
+ staleIdentity(marker.guardian_identity,queryIdentity,'guardian');
+ insist(await deleteMarkerIfHash(expectedMarkerSha256)==='REMOVED','native marker CAS did not remove exact identity');
+ insist(await readMarkerSnapshot()===null,'marker remained or reappeared after CAS delete');
+ const finalPointer=pointerSubject(await readActivePointer());
+ const finalAuthority=authoritySubject(await readAuthority());
+ insist(canonicalJson(finalPointer)===canonicalJson(pointer),'active pointer drift after CAS delete');
+ insist(canonicalJson(finalAuthority)===canonicalJson(authority),'authority drift after CAS delete');
+ const terminal=terminalFor(pinnedIntent,'MARKER_RECONCILED',now().toISOString());
+ await publishTerminal(terminal);
+ return Object.freeze({status:terminal.status,marker_sha256:expectedMarkerSha256,
+  intent_sha256:pinnedIntent.intent_sha256,receipt_sha256:terminal.receipt_sha256});
+}

package/src/r174-owner-webauthn.mjs

@@ -0,0 +1,176 @@
+// R174 pure WebAuthn owner assertion verifier.
+//
+// This module does not enroll a credential, solicit owner consent, consume a
+// challenge, write an authority epoch, or grant autonomous access. Those are
+// separate protected-host boundaries and MUST NOT be supplied by an agent.
+import {createHash,createPublicKey,verify,timingSafeEqual} from 'node:crypto';
+import {lstat,realpath,open} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const B64URL=/^[A-Za-z0-9_-]+$/;
+const sha256=x=>createHash('sha256').update(x).digest();
+const canonicalHash=x=>sha256(Buffer.from(canonicalJson(x),'utf8')).toString('hex');
+function requireRecord(x,label){
+  if(!x||typeof x!=='object'||Array.isArray(x))throw new Error('R174 '+label+' invalid');
+  return x;
+}
+function keys(x,names,label){
+  requireRecord(x,label);
+  if(Object.keys(x).length!==names.length||names.some(n=>!Object.hasOwn(x,n)))
+    throw new Error('R174 '+label+' fields invalid');
+}
+function base64url(value,label,minimum=1,maximum=16384){
+  if(typeof value!=='string'||value.length>maximum*2||!B64URL.test(value))
+    throw new Error('R174 '+label+' encoding invalid');
+  const decoded=Buffer.from(value,'base64url');
+  if(decoded.length<minimum||decoded.length>maximum||decoded.toString('base64url')!==value)
+    throw new Error('R174 '+label+' encoding invalid');
+  return decoded;
+}
+function matches(a,b){return a.length===b.length&&timingSafeEqual(a,b);}
+function instant(value){
+  if(typeof value!=='string'||!/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value))
+    throw new Error('R174 transaction UTC invalid');
+  const timestamp=Date.parse(value);
+  if(!Number.isFinite(timestamp)||new Date(timestamp).toISOString()!==value)
+    throw new Error('R174 transaction UTC invalid');
+  return timestamp;
+}
+function validateSubject(s){
+  keys(s,['schema','release_manifest_sha256','coding_policy_sha256',
+    'autonomous_policy_sha256','root_id','project_root','effect','max_seconds'],'subject');
+  if(s.schema!=='deadbyte.r174-autonomous-owner-subject.v1'||
+     [s.release_manifest_sha256,s.coding_policy_sha256,s.autonomous_policy_sha256]
+       .some(x=>typeof x!=='string'||!HEX64.test(x))||
+     s.root_id!=='core'||typeof s.project_root!=='string'||
+     !path.isAbsolute(s.project_root)||s.effect!=='autonomous_goal_run'||
+     !Number.isSafeInteger(s.max_seconds)||s.max_seconds<1||s.max_seconds>3600)
+    throw new Error('R174 subject scope invalid');
+}
+export async function verifyR174OwnerAssertion({credential,subject,transaction,assertion,now}={}){
+  validateSubject(subject);
+  keys(transaction,['schema','challenge_b64url','subject_sha256','issued_at_utc','expires_at_utc'],'challenge');
+  if(transaction.schema!=='deadbyte.r174-owner-challenge.v1'||!HEX64.test(transaction.subject_sha256))
+    throw new Error('R174 challenge schema invalid');
+  const challenge=base64url(transaction.challenge_b64url,'challenge',32,32);
+  if(canonicalHash(subject)!==transaction.subject_sha256)
+    throw new Error('R174 subject hash mismatch');
+  const issued=instant(transaction.issued_at_utc),expires=instant(transaction.expires_at_utc);
+  if(expires<=issued||expires-issued>300000)
+    throw new Error('R174 challenge lifetime exceeds five minutes');
+  if(!(now instanceof Date)||!Number.isFinite(now.getTime())||
+     now.getTime()<issued||now.getTime()>=expires)
+    throw new Error('R174 challenge expired or not yet valid');
+  keys(credential,['schema','credential_id_b64url','rp_id','origin',
+    'public_key_spki_pem','algorithm','sign_count'],'credential');
+  if(credential.schema!=='deadbyte.r174-owner-credential.v1'||credential.algorithm!=='ES256'||
+     typeof credential.rp_id!=='string'||!credential.rp_id||typeof credential.origin!=='string'||
+     !Number.isSafeInteger(credential.sign_count)||credential.sign_count<0)
+    throw new Error('R174 credential identity invalid');
+  if(credential.origin!=='https://'+credential.rp_id)
+    throw new Error('R174 RP ID and origin binding mismatch');
+  const credentialId=base64url(credential.credential_id_b64url,'credential id',16,1024);
+  keys(assertion,['credential_id_b64url','client_data_json_b64url',
+    'authenticator_data_b64url','signature_b64url'],'assertion');
+  if(!matches(credentialId,base64url(assertion.credential_id_b64url,'credential id',16,1024)))
+    throw new Error('R174 credential id mismatch');
+  const rawClient=base64url(assertion.client_data_json_b64url,'client data',16,16384);
+  let client;
+  try{client=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(rawClient));}
+  catch{throw new Error('R174 client data JSON invalid');}
+  if(!client||typeof client!=='object'||Array.isArray(client)||client.type!=='webauthn.get')
+    throw new Error('R174 client data type invalid');
+  if(client.challenge!==transaction.challenge_b64url||
+     !matches(base64url(client.challenge,'challenge',32,32),challenge))
+    throw new Error('R174 client challenge mismatch');
+  if(client.origin!==credential.origin)throw new Error('R174 client origin mismatch');
+  if(client.crossOrigin===true||client.topOrigin!==undefined)
+    throw new Error('R174 cross-origin assertion denied');
+  const authenticator=base64url(assertion.authenticator_data_b64url,'authenticator data',37,16384);
+  const rpIdHash=sha256(Buffer.from(credential.rp_id,'utf8'));
+  if(!matches(authenticator.subarray(0,32),rpIdHash))
+    throw new Error('R174 RP ID hash mismatch');
+  const flags=authenticator[32];
+  if((flags&0x01)!==0x01)throw new Error('R174 user presence required');
+  if((flags&0x04)!==0x04)throw new Error('R174 user verification required');
+  const signCount=authenticator.readUInt32BE(33);
+  // Zero counters are common with platform authenticators. Replay resistance
+  // for such devices MUST be enforced by a one-time protected challenge journal.
+  if(credential.sign_count>0&&signCount<=credential.sign_count)
+    throw new Error('R174 sign counter rollback');
+  let key;
+  try{key=createPublicKey(credential.public_key_spki_pem);}
+  catch{throw new Error('R174 owner key invalid');}
+  if(key.asymmetricKeyType!=='ec'||key.asymmetricKeyDetails?.namedCurve!=='prime256v1')
+    throw new Error('R174 owner key must be ES256 P-256');
+  const signed=Buffer.concat([authenticator,sha256(rawClient)]);
+  const signature=base64url(assertion.signature_b64url,'signature',8,256);
+  if(!verify('sha256',signed,key,signature))
+    throw new Error('R174 signature verification failed');
+  return Object.freeze({status:'verified',subject_sha256:transaction.subject_sha256,
+    challenge_b64url:transaction.challenge_b64url,credential_id_b64url:credential.credential_id_b64url,
+    sign_count:signCount,user_verified:true,
+    // NOT an authority grant. Protected challenge consumption still mandatory.
+    authority_granted:false});
+}
+
+// The protected-host use-once boundary is intentionally separate from signature verification.
+export async function acceptR174OwnerProof({ledgerRoot,ownerTrust,...inputs}={}){
+  // A trusted caller MUST load ownerTrust from an independently pinned
+  // owner-controlled trust store, not copy it from request JSON. This
+  // primitive deliberately does not authenticate its caller or issue grants.
+  keys(ownerTrust,['schema','credential_id_b64url','public_key_spki_sha256',
+    'rp_id','origin','subject_sha256'],'owner trust');
+  if(ownerTrust.schema!=='deadbyte.r174-owner-trust-binding.v1'||
+     typeof ownerTrust.public_key_spki_sha256!=='string'||
+     !HEX64.test(ownerTrust.public_key_spki_sha256)||
+     typeof ownerTrust.subject_sha256!=='string'||
+     !HEX64.test(ownerTrust.subject_sha256))
+    throw new Error('R174 owner trust metadata invalid');
+  const {credential,transaction,subject}=inputs;
+  const credentialKey=createPublicKey(credential?.public_key_spki_pem??'');
+  const keySha=sha256(credentialKey.export({type:'spki',format:'der'})).toString('hex');
+  if(keySha!==ownerTrust.public_key_spki_sha256 ||
+     ownerTrust.credential_id_b64url!==credential?.credential_id_b64url ||
+     ownerTrust.rp_id!==credential?.rp_id ||
+     ownerTrust.origin!==credential?.origin ||
+     ownerTrust.subject_sha256!==transaction?.subject_sha256 ||
+     ownerTrust.subject_sha256!==canonicalHash(subject))
+    throw new Error('R174 owner trust credential or reviewed subject binding mismatch');
+  // Then check signed owner assertion. Invalid assertions must never
+  // consume a challenge or produce a receipt.
+  const proof=await verifyR174OwnerAssertion(inputs);
+  if(typeof ledgerRoot!=='string'||!path.isAbsolute(ledgerRoot))
+    throw new Error('R174 replay ledger root must be absolute');
+  const dir=await lstat(ledgerRoot);
+  if(!dir.isDirectory()||dir.isSymbolicLink()||
+      path.resolve(await realpath(ledgerRoot)).toLowerCase()!==path.resolve(ledgerRoot).toLowerCase())
+    throw new Error('R174 replay ledger must be a real directory');
+  // Caller must independently attest protected ACLs and owner-only trust.
+  // This primitive does NOT establish those conditions or grant authority.
+  // A challenge is globally one-use within this protected journal regardless
+  // of owner credential or scoped subject. Identity is checked by the signature
+  // verifier; it must not widen the replay key.
+  const id=sha256(Buffer.concat([
+    Buffer.from('DEADBYTE-R174-OWNER-CHALLENGE-CONSUMPTION-v1','utf8'),
+    base64url(proof.challenge_b64url,'challenge',32,32)
+  ])).toString('hex');
+  const file=path.join(ledgerRoot,'used-'+id+'.json');
+  const receipt={schema:'deadbyte.r174-consumed-owner-challenge.v1',
+    id,subject_sha256:proof.subject_sha256,credential_id_b64url:proof.credential_id_b64url,
+    challenge_b64url:proof.challenge_b64url,sign_count:proof.sign_count,
+    authority_granted:false,consumed_at_utc:new Date().toISOString()};
+  let handle;
+  try{handle=await open(file,'wx',0o600);}
+  catch(error){
+    if(error?.code==='EEXIST')throw new Error('R174 owner challenge replay denied');
+    throw error;
+  }
+  try{
+    await handle.writeFile(JSON.stringify(receipt)+'\n');
+    await handle.sync();
+  }finally{await handle.close();}
+  return Object.freeze({...proof,status:'consumed',id,authority_granted:false});
+}

package/src/r175-foreground-boundary.mjs

@@ -0,0 +1,28 @@
+// R175: foreground log sessions never own operator standing grants.
+import {AUTHORITY_PLANES} from './remote-authority.mjs';
+export function observeOnlyAuthority(snapshot){
+  const expected={};
+  if(snapshot?.state!=='ONLINE')throw new Error('R175 foreground requires ONLINE runtime');
+  for(const plane of AUTHORITY_PLANES){
+    const observed=snapshot.authority?.[plane];
+    if(!observed||typeof observed.armed!=='boolean'||typeof observed.configured!=='boolean')
+      throw new Error('R175 foreground authority observation invalid: '+plane);
+    expected[plane]=observed.armed;
+  }
+  return Object.freeze({authority_scope:'observe-only',expected:Object.freeze(expected),
+    commands:Object.freeze([])});
+}
+export function assertObserveOnlyMarker(marker){
+  return marker?.schema==='deadbyte.remote-session.v2'&&
+    marker.authority_scope==='observe-only'&&
+    Number.isInteger(marker.owner_pid)&&marker.owner_pid>0&&
+    typeof marker.session_nonce==='string'&&/^[0-9a-f]{64}$/.test(marker.session_nonce);
+}
+
+export function assertMatchingForegroundRelease(active,{version,manifest_sha256}={}){
+  if(!active||typeof version!=='string'||!/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version)||
+     typeof manifest_sha256!=='string'||!/^[0-9a-f]{64}$/.test(manifest_sha256)||
+     active.version!==version||active.manifest_sha256!==manifest_sha256)
+    throw new Error('R175_EXACT_ACTIVE_RELEASE_REQUIRED: observation session will not activate, downgrade or upgrade runtime');
+  return active;
+}