deadbyte-mcp 0.15.70 → 0.15.71

package/docs/R184-package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.70",
+  "version": "0.15.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "deadbyte-mcp",
-      "version": "0.15.70",
+      "version": "0.15.71",
       "bundleDependencies": [
         "@modelcontextprotocol/server",
         "@modelcontextprotocol/client",
@@ -76,22 +76,115 @@
       "version": "7.0.6",
       "inBundle": true,
       "license": "MIT",
-      "dependencies": {"path-key":"^3.1.0","shebang-command":"^2.0.0","which":"^2.0.1"},
-      "engines": {"node":">= 8"}
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
     },
     "node_modules/eventsource": {
-      "version":"3.0.7","inBundle":true,"license":"MIT",
-      "dependencies":{"eventsource-parser":"^3.0.1"},"engines":{"node":">=18.0.0"}
+      "version": "3.0.7",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "eventsource-parser": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/eventsource-parser": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "ISC"
+    },
+    "node_modules/jose": {
+      "version": "6.2.10",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkce-challenge": {
+      "version": "5.0.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.20.0"
+      }
     },
-    "node_modules/eventsource-parser": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=18.0.0"}},
-    "node_modules/isexe": {"version":"2.0.0","inBundle":true,"license":"ISC"},
-    "node_modules/jose": {"version":"6.2.10","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/panva"}},
-    "node_modules/path-key": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/pkce-challenge": {"version":"5.0.1","inBundle":true,"license":"MIT","engines":{"node":">=16.20.0"}},
-    "node_modules/shebang-command": {"version":"2.0.0","inBundle":true,"license":"MIT","dependencies":{"shebang-regex":"^3.0.0"},"engines":{"node":">=8"}},
-    "node_modules/shebang-regex": {"version":"3.0.0","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/typescript": {"version":"5.9.3","inBundle":true,"license":"Apache-2.0","bin":{"tsc":"bin/tsc","tsserver":"bin/tsserver"},"engines":{"node":">=14.17"}},
-    "node_modules/which": {"version":"2.0.2","inBundle":true,"license":"ISC","dependencies":{"isexe":"^2.0.0"},"bin":{"node-which":"bin/node-which"},"engines":{"node":">= 8"}},
-    "node_modules/zod": {"version":"4.4.3","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/colinhacks"}}
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "inBundle": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.70",
+  "version": "0.15.71",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/deploy-r48.mjs

@@ -14,7 +14,7 @@ import {observeAuthorityEvidence} from '../src/activation-authority-proof-r75.mj
 import {proveLegacyOfflineScopeRepair} from '../src/legacy-offline-policy-proof-r146.mjs';
 import {claimWithOneTimeMigration,verifyNarrowedPolicyGeneration} from '../src/clean-activation-recovery-r153.mjs';
 import {verifyUacApproval,uacPointerSha256,protectedUacReceiptPath,requireTrustedUacInstallation} from '../src/uac-approval-contract-r153.mjs';
-import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
 import {normalizeHostCommandPins,hostCommandPinArgs} from '../src/host-command-pins-r154.mjs';
 import {parseActivationPathFlags,assertTrustedActivationEntrypoint,appendActivationPathArgs} from '../src/activation-path-r167.mjs';
 
@@ -310,7 +310,7 @@ if(deployArgs.uacLegacyMigration){
     expiresAt:deployArgs.migrationExpiresAt
   });
 }
-let activationPaths=null,activationPathError=null;
+let activationPaths=null,activationPathError=null,stageEpochRebind=false;
 if(preflight.authority_continuity==='EPOCH_NATIVE'){
   try{
     // Validate exact path identity before the ACL probe so an unrelated protected
@@ -329,12 +329,25 @@ if(preflight.authority_continuity==='EPOCH_NATIVE'){
   activationPathError=new Error('--authority-epoch-root is valid only for EPOCH_NATIVE activation');
 }else{
   activationPaths={authorityEpochRoot:null,developmentRoot:deployArgs.developmentRoot??root};
+  if(preflight.authority_continuity==='NOT_APPLICABLE'){
+    try{
+      const installed=await loadPowerShellDataFile(pointer.config_path);
+      if(installed.AuthorityEpochRoot){
+        stageEpochRebind=true;
+        // The successor stage itself must be OS ACL-protected. An inherited
+        // predecessor epoch root cannot attest different successor bytes.
+        await inspectTrustedInstallation(privilegedEpochInstallFiles(root,process.execPath));
+      }
+    }catch(error){activationPathError=error;}
+  }
 }
 
 if(deployArgs.preflight){
+  const protectedEntrypoint=preflight.authority_continuity==='EPOCH_NATIVE'||stageEpochRebind;
   console.log(JSON.stringify({...preflight,
-    activation_entrypoint_state:activationPathError?'REJECTED':preflight.authority_continuity==='EPOCH_NATIVE'?'TRUSTED_READY':'NOT_APPLICABLE',
-    protected_activation_entrypoint:preflight.authority_continuity==='EPOCH_NATIVE'?!activationPathError:null,
+    safe_to_activate:preflight.safe_to_activate&&!activationPathError,
+    activation_entrypoint_state:activationPathError?'REJECTED':protectedEntrypoint?'TRUSTED_READY':'NOT_APPLICABLE',
+    protected_activation_entrypoint:protectedEntrypoint?!activationPathError:null,
     activation_entrypoint_reason:activationPathError?String(activationPathError?.message??activationPathError).slice(0,256):null}));
   process.exit(0);
 }

package/scripts/r191-acceptance-readonly.mjs

@@ -0,0 +1,7 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';

package/scripts/r191-existing-regression.mjs

@@ -0,0 +1,5 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r172-activation-recovery.test.mjs';

package/scripts/r191-existing-stage-audit.mjs

@@ -0,0 +1,21 @@
+import {readFile,lstat} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+const stage='C:\\Program Files\\DEADBYTE-01570-REGISTRY-df15db35c7dd';
+const expected='df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const info=await lstat(stage);if(!info.isDirectory()||info.isSymbolicLink())throw new Error('STAGE_DIRECTORY_INVALID');
+const manifest=sha(await readFile(path.join(stage,'MANIFEST.SHA256')));
+if(manifest!==expected)throw new Error('STAGE_HASH_DRIFT '+manifest);
+console.log('R191_EXISTING_EXACT_STAGE_MANIFEST='+manifest);
+try{
+  const trust=await inspectTrustedInstallation([...privilegedEpochInstallFiles(stage,process.execPath),
+    path.join(stage,'MANIFEST.SHA256'),path.join(stage,'scripts','deploy-r48.mjs'),
+    path.join(stage,'src','runtime-update.mjs'),path.join(stage,'src','trusted-epoch-bootstrap-r158.mjs')]);
+  if(!trust.trusted)throw new Error('R89_ACL_UNTRUSTED');
+  console.log('R191_EXACT_STAGE_R89_ACL=PASS');
+}catch(e){
+  console.error('R191_EXACT_STAGE_R89_ACL=BLOCKED '+e.message);
+  process.exitCode=3;
+}

package/scripts/r191-extended-security-gate.mjs

@@ -0,0 +1,14 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-preflight.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r65-deploy-preflight.test.mjs';
+import '../test/r65-transaction-precondition.test.mjs';
+import '../test/r153-r65-signed-precondition-recovery.test.mjs';
+import '../test/r153-staging-leaf-acl.test.mjs';
+import '../test/r153-uac-installed-manifest-contract.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r168-protected-entrypoint.test.mjs';
+import '../test/r190-foreground-owner-recovery.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-focused-tests.mjs

@@ -0,0 +1,3 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-full-runner.mjs

@@ -0,0 +1,18 @@
+import {readdir,mkdir,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const list=(await readdir(path.join(root,'test'))).filter(x=>x.endsWith('.test.mjs')&&!new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']).has(x));
+const output='D:\\Projects\\deadbyte-mcp\\testing\\r191\\R191-SOURCE-FULL-REGRESSION.txt';
+await mkdir(path.dirname(output),{recursive:true});
+console.log('FULL_SOURCE_REGRESSION_FILES='+list.length);
+const started=Date.now();
+const p=spawnSync(process.execPath,['--test','--test-concurrency=4',...list.map(x=>'test/'+x)],{cwd:root,shell:false,encoding:'utf8',windowsHide:true,maxBuffer:20*1024*1024,timeout:300000});
+const stdout=p.stdout||'',stderr=p.stderr||'';
+await writeFile(output,stdout+'\n===== STDERR =====\n'+stderr,'utf8');
+const summary=stdout.split(/\r?\n/).filter(x=>/^(?:ℹ (?:tests|pass|fail|skipped|duration_ms)|✖ |﹣ |✔ R191)/.test(x));
+console.log('RESULT_EXIT='+p.status+' SIGNAL='+p.signal+' ELAPSED_MS='+(Date.now()-started)+' ERROR='+(p.error?.message||'none'));
+console.log('SUMMARY='+JSON.stringify(summary.slice(-100)));
+console.log('TRANSCRIPT='+output);
+if(p.status!==0)process.exitCode=1;

package/scripts/r191-historical-release-regression.mjs

@@ -0,0 +1,9 @@
+import '../test/r130-release-security-contract.test.mjs';
+import '../test/r153-prepublish-identity.test.mjs';
+import '../test/r165-live-cli-skew.test.mjs';
+import '../test/r167-release-contract.test.mjs';
+import '../test/r172-release-contract.test.mjs';
+import '../test/r173-release-contract.test.mjs';
+import '../test/r179-release-contract.test.mjs';
+import '../test/r190-release-contract.test.mjs';
+import '../test/release-version.test.mjs';

package/scripts/r191-live-claim-inspect.mjs

@@ -0,0 +1,15 @@
+import os from 'node:os';
+import path from 'node:path';
+import {readFile} from 'node:fs/promises';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+const state=path.join(os.homedir(),'.deadbyte-mcp');
+const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+const manager=createActivationClaimManager({stateRoot:state});
+const result=await manager.inspect();
+console.log(JSON.stringify({state:'READ_ONLY_INSPECTION',active_release_id:pointer.release_id,
+  manifest_sha256:pointer.manifest_sha256,
+  claim_status:result.status,claim_operation_id:result.operation_id??null,
+  subject_sha256:result.subject_sha256??null,matched:result.matched??null,
+  foreign:result.foreign??null,unknown:result.unknown??null}));
+if(pointer.release_id!=='v0.15.68-ff29dbb2fbb89862')process.exitCode=5;
+if(result.status!=='RECONCILABLE')process.exitCode=6;

package/scripts/r191-npm-registry-readonly.mjs

@@ -0,0 +1,14 @@
+import https from 'node:https';
+const read=url=>new Promise((resolve,reject)=>{
+ const req=https.get(url,{timeout:10000,headers:{'User-Agent':'deadbyte-r191-readonly-version-check'}},res=>{
+ let s='';res.on('data',b=>{if(s.length<40000)s+=b;});res.on('end',()=>resolve({status:res.statusCode,body:s}));});
+ req.on('timeout',()=>req.destroy(new Error('timeout')));req.on('error',reject);
+});
+for(const suffix of ['0.15.71','dist-tags']){
+ try{
+ const r=await read('https://registry.npmjs.org/deadbyte-mcp/'+suffix);
+ let v={status:r.status};
+ if(r.status===200){const p=JSON.parse(r.body);v=suffix==='dist-tags'?p:{name:p.name,version:p.version,tarball:p.dist?.tarball,integrity_present:Boolean(p.dist?.integrity)};}
+ console.log(JSON.stringify({target:suffix,...v}));
+ }catch(e){console.log(JSON.stringify({target:suffix,status:'NETWORK_UNVERIFIED',error:e.message}));}
+}

package/scripts/r191-old-version-audit.mjs

@@ -0,0 +1,12 @@
+import {readdir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const paths=await readdir(path.join(root,'test'));
+let hits=0;
+for(const f of paths.filter(x=>x.endsWith('.test.mjs'))){
+const s=await readFile(path.join(root,'test',f),'utf8');
+const n=s.split('0.15.70').length-1;
+if(n){hits++;const a=s.split(String.fromCharCode(10)).filter(l=>l.includes('0.15.70'));console.log(f+': '+n+' occurrences; '+a.slice(0,3).map(x=>x.trim().slice(0,150)).join(' | '));}
+}
+console.log('MATCHED_FILES='+hits);

package/scripts/r191-privilege-readonly.mjs

@@ -0,0 +1,6 @@
+import {access,constants,stat} from 'node:fs/promises';
+import os from 'node:os';
+const programFiles='C:\\Program Files';
+try{await access(programFiles,constants.W_OK);console.log('PROGRAM_FILES_WRITE_PROBE=ACCESS_ALLOWED')}catch(e){console.log('PROGRAM_FILES_WRITE_PROBE='+e.code);}
+console.log('HOME='+os.homedir());
+console.log('PROCESS_PLATFORM='+process.platform);

package/scripts/r191-process-policy-focused.mjs

@@ -0,0 +1 @@
+import '../test/process-policy-refresh.test.mjs';

package/scripts/r191-protected-failure-gate.mjs

@@ -0,0 +1,3 @@
+import '../test/r166-hotfix-contract.test.mjs';
+import '../test/r190-foreground-cli.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';

package/scripts/r191-release-contract-runner.mjs

@@ -0,0 +1 @@
+import '../test/r191-release-contract.test.mjs';

package/scripts/r191-unreached-focused.mjs

@@ -0,0 +1,29 @@
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,readFile} from 'node:fs/promises';
+import {createPublicKey} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import os from 'node:os';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const parentPublicKey=path.join(os.homedir(),'.deadbyte-mcp','trust','ed25519-public.pem');
+const pubKey=createPublicKey(await readFile(parentPublicKey));
+if(pubKey.asymmetricKeyType!=='ed25519')throw new Error('R43_PARENT_PUBLIC_KEY_NOT_ED25519');
+const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-unreached-'));
+const scratch='D:\\Projects\\deadbyte-mcp\\testing\\r191\\cross-volume-focused';
+if(path.parse(scratch).root.toLowerCase()===path.parse(os.tmpdir()).root.toLowerCase())throw new Error('R67_CROSS_VOLUME_NOT_DISTINCT');
+await mkdir(scratch,{recursive:true});
+const tests=[
+ 'test/r132-release-identity.test.mjs',
+ 'test/r59-tool-surface-compat.test.mjs',
+ 'test/production-docs.test.mjs',
+ 'test/r191-inherited-epoch-preflight.test.mjs',
+ 'test/r67-npm-cross-volume.test.mjs',
+ 'test/r43-parent.test.mjs'
+];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests],{
+ cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:isolated,DEADBYTE_PARENT_VERIFY_KEY:parentPublicKey,DEADBYTE_TEST_CROSS_VOLUME_ROOT:scratch},
+ windowsHide:true,shell:false,encoding:'utf8',timeout:160000,maxBuffer:2000000});
+console.log('FOCUSED_EXIT='+r.status+' ERROR='+(r.error?.message??'none'));
+console.log((r.stdout??'').slice(-19000));
+if(r.stderr)console.error(r.stderr.slice(-1400));
+if(r.error||r.status!==0)process.exitCode=1;

package/src/activation-lock-r65.mjs

@@ -115,7 +115,7 @@ async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
      body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
      body.attempted_pointer!==null||body.rollback?.attempted!==false||
      !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
-     !(/^(?:host command 'powershell_script' executable pin drift detected;|windows release gate package script invalid$)/.test(String(body.error?.message??'')))||
+     !(/^(?:host command 'powershell_script' executable pin drift detected;.*$|windows release gate package script invalid$|authority epoch exact release source hash mismatch: manifest\.sha256$)/.test(String(body.error?.message??'')))||
      !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
      !samePointerIdentity(body.prior_pointer,current))return false;
   return true;
@@ -162,6 +162,14 @@ export function createActivationClaimManager({stateRoot}={}){
   }
 
   return Object.freeze({
+    async inspect(){
+      const claim=await readLock(lockPath);
+      if(!claim)return Object.freeze({status:'NO_CLAIM'});
+      const evidence=await findTerminalOutcome(updatesDir,claim,state);
+      const safe=evidence.matched&&!evidence.foreign&&!evidence.unknown;
+      return Object.freeze({status:safe?'RECONCILABLE':'UNRESOLVED',operation_id:claim.operation_id,
+        subject_sha256:claim.subject_sha256,matched:evidence.matched,foreign:evidence.foreign,unknown:evidence.unknown});
+    },
     async claim(subjectSha256){
       if(!HEX64.test(String(subjectSha256??'')))throw new Error('activation claim subject invalid');
       await mkdir(updatesDir,{recursive:true});

package/src/deadbyte-cli.mjs

@@ -946,7 +946,7 @@ async function readR190Evidence(file){
   }catch(error){if(error?.code==='ENOENT')return null;throw error;}
 }
 async function runRemoteForegroundRecovery(expectedMarkerSha256){
-  const ctx=await remoteContext();
+  // Reject writable/untrusted CLI bytes before reading controller state.
   const thisFile=fileURLToPath(import.meta.url);
   const protectedFiles=[process.execPath,thisFile,path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'),
     path.join(CURRENT_PACKAGE_ROOT,'src','foreground-owner-recovery-r190.mjs'),
@@ -961,6 +961,7 @@ async function runRemoteForegroundRecovery(expectedMarkerSha256){
   catch(error){throw new Error(`R190_PROTECTED_RECOVERY_REQUIRED: ${boundedSingleLine(error?.message||error,512)}`);}
   if(!installation.trusted)throw new Error('R190_PROTECTED_RECOVERY_REQUIRED: package ACL is not R89-trusted');
   await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
+  const ctx=await remoteContext();
   const evidenceDir=path.join(ctx.root,'evidence','foreground-recovery-r190');
   const intentPath=path.join(evidenceDir,`${expectedMarkerSha256}.intent.json`);
   const terminalPath=path.join(evidenceDir,`${expectedMarkerSha256}.terminal.json`);

package/src/runtime-update.mjs

@@ -23,7 +23,7 @@ import {assertStageOwnedPath,assertStagingBootstrapInputs,assertStagingControlCo
 import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
 import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
 import {verifyNarrowedPolicyGeneration} from './clean-activation-recovery-r153.mjs';
-import {parseProtectedEpochRoot,verifyTrustedEpochRelease} from './trusted-epoch-bootstrap-r158.mjs';
+import {parseProtectedEpochRoot,selectActivationEpochRoot,verifyTrustedEpochRelease} from './trusted-epoch-bootstrap-r158.mjs';
 
 export {windowsPowerShellEnvironment};
 
@@ -1913,7 +1913,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     workspace=await workspacePlan(control.workspaceRoot,state);launchers=await launcherPlan(state);
     // A protected installation is an explicit owner-provisioned candidate.
     // No discovery/fallback to writable npm roots and no automatic grant.
-    const requestedEpochRoot=authorityEpochRoot??control.config.AuthorityEpochRoot;
+    const requestedEpochRoot=selectActivationEpochRoot({stageRoot,configuredEpochRoot:control.config.AuthorityEpochRoot,explicitEpochRoot:authorityEpochRoot});
     if(requestedEpochRoot){
       const proof=await verifyTrustedEpochRelease({
         epochRoot:requestedEpochRoot,releaseRoot:slot.release_root,

package/src/trusted-epoch-bootstrap-r158.mjs

@@ -13,6 +13,14 @@ export function parseProtectedEpochRoot(input){
     throw new Error('authority epoch root may not be a drive root');
   return root;
 }
+// An inherited protected root belongs to the predecessor. Successor bytes
+// must be verified against their own exact, independently ACL-trusted stage.
+export function selectActivationEpochRoot({stageRoot,configuredEpochRoot=null,explicitEpochRoot=null}={}){
+  if(explicitEpochRoot!==null)return parseProtectedEpochRoot(explicitEpochRoot);
+  if(!configuredEpochRoot)return null;
+  parseProtectedEpochRoot(configuredEpochRoot);
+  return parseProtectedEpochRoot(stageRoot);
+}
 // This is a read-only proof, not installation or an authority grant.
 // Windows ACL verification must run against OS Get-Acl, never a staged snapshot.
 export async function verifyTrustedEpochRelease({epochRoot,releaseRoot,nodeExecutable}){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.70';
+export const DEADBYTE_VERSION = '0.15.71';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/process-policy-refresh.test.mjs

@@ -67,7 +67,17 @@ async function fixture() {
 
 test('R167 process policy binds coherently to the explicit development root', async () => {
   const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const expectedRoot = path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT || repoRoot);
+  // The distributed policy is pinned to its explicit development provenance,
+  // not to the physical extraction path of the exact immutable npm tarball.
+  const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
+  const approvedRoot = release.r191_activation_repair?.development_policy_root;
+  assert.equal(typeof approvedRoot, 'string', 'R191 development policy root must be explicit in release metadata');
+  assert.ok(path.isAbsolute(approvedRoot), 'R191 development policy root must be absolute');
+  const expectedRoot = path.resolve(approvedRoot);
+  if (process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT) {
+    assert.equal(path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT), expectedRoot,
+      'caller-supplied development root cannot override R191 release provenance');
+  }
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
   const policy = JSON.parse(await readFile(policyPath, 'utf8'));
   assert.equal(path.resolve(policy.roots.core.path), expectedRoot);

package/test/r130-release-security-contract.test.mjs

@@ -14,13 +14,13 @@ test('current successor retains the R130 security baseline with truthful R190 id
     read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.70');
-  assert.equal(release.train,'R190');
-  assert.equal(matrix.train,'R190');
-  assert.equal(release.source_predecessor.version,'0.15.69');
-  assert.equal(release.source_predecessor.train,'R179');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.69\.tgz/i);
-  assert.equal(release.source_predecessor.manifest_status,'PUBLISHED_PREVIEW_MANIFEST_VERIFIED_NOT_ACTIVE');
+    assert.equal(actual,'0.15.71');
+  assert.equal(release.train,'R191');
+  assert.equal(matrix.train,'R191');
+  assert.equal(release.source_predecessor.version,'0.15.70');
+  assert.equal(release.source_predecessor.train,'R190');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.70\.tgz/i);
+  assert.equal(release.source_predecessor.manifest_status,'PUBLISHED_EXACT_MANIFEST_VERIFIED_NOT_ACTIVE');
   assert.equal(release.runtime_predecessor.version,'0.15.68');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -16,15 +16,15 @@ test('R190 package identity preserves R132 evidence and published R179 source pr
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R190');
-  assert.equal(matrix.train,'R190');
-  assert.equal(release.source_predecessor.version,'0.15.69');
-  assert.equal(release.source_predecessor.train,'R179');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.69\.tgz/i);
+  assert.equal(release.train,'R191');
+  assert.equal(matrix.train,'R191');
+  assert.equal(release.source_predecessor.version,'0.15.70');
+  assert.equal(release.source_predecessor.train,'R190');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.70\.tgz/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
+  assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
   assert.notEqual(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(release.runtime_predecessor.version,'0.15.68');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.70');
+ assert.equal(state.pkg.version,'0.15.71');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.70');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.71');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');

package/test/r167-release-contract.test.mjs

@@ -8,7 +8,7 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.70';
+const VERSION='0.15.71';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
@@ -20,20 +20,20 @@ test('current package identity retains the immutable R167/R173 activation lineag
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R190');
-  assert.equal(matrix.train,'R190');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r190:0.15.70');
+  assert.equal(release.train,'R191');
+  assert.equal(matrix.train,'R191');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r191:0.15.71');
   assert.deepEqual(release.runtime_predecessor,{
     version:'0.15.68',release_id:'v0.15.68-ff29dbb2fbb89862',
     manifest_sha256:'ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885',
     generation_manifest_sha256:'2887d4a8d54ea6fc6b28869072f72491c892dfe28178b3537936dce958147bd2'
   });
-  assert.equal(release.source_predecessor.version,'0.15.69');
-  assert.equal(release.source_predecessor.train,'R179');
-  assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
+  assert.equal(release.source_predecessor.version,'0.15.70');
+  assert.equal(release.source_predecessor.train,'R190');
+  assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
   assert.equal(release.r173.source_predecessor_version,'0.15.67');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3');
   assert.equal(provenance.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');

package/test/r172-release-contract.test.mjs

@@ -16,11 +16,11 @@ test('R190 binds the published source predecessor separately from the active run
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.70');
-  assert.equal(release.train,'R190'); assert.equal(matrix.train,'R190');
-  assert.equal(release.source_predecessor.version,'0.15.69');
-  assert.equal(release.source_predecessor.manifest_sha256,'cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0');
-  assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
+  for(const value of versions)assert.equal(value,'0.15.71');
+  assert.equal(release.train,'R191'); assert.equal(matrix.train,'R191');
+  assert.equal(release.source_predecessor.version,'0.15.70');
+  assert.equal(release.source_predecessor.manifest_sha256,'df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3');
+  assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
   assert.equal(release.runtime_predecessor.release_id,'v0.15.68-ff29dbb2fbb89862');
   assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });