deadbyte-mcp 0.15.70 → 0.15.71

package/test/r173-release-contract.test.mjs

@@ -13,21 +13,21 @@ test('R190 package identity binds the exact published R179 source and live runti
     json('package.json'),readReleaseLock(root),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.70');
-  assert.equal(lock.version,'0.15.70');
-  assert.equal(lock.packages[''].version,'0.15.70');
-  assert.equal(bridge.version,'0.15.70');
-  assert.equal(release.version,'0.15.70');
-  assert.equal(release.train,'R190');
-  assert.equal(matrix.version,'0.15.70');
-  assert.equal(matrix.train,'R190');
-  assert.equal(sbom.metadata.component.version,'0.15.70');
-  assert.equal(release.source_predecessor.version,'0.15.69');
-  assert.equal(release.source_predecessor.train,'R179');
-  assert.equal(release.source_predecessor.manifest_sha256,'cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0');
-  assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
+  assert.equal(pkg.version,'0.15.71');
+  assert.equal(lock.version,'0.15.71');
+  assert.equal(lock.packages[''].version,'0.15.71');
+  assert.equal(bridge.version,'0.15.71');
+  assert.equal(release.version,'0.15.71');
+  assert.equal(release.train,'R191');
+  assert.equal(matrix.version,'0.15.71');
+  assert.equal(matrix.train,'R191');
+  assert.equal(sbom.metadata.component.version,'0.15.71');
+  assert.equal(release.source_predecessor.version,'0.15.70');
+  assert.equal(release.source_predecessor.train,'R190');
+  assert.equal(release.source_predecessor.manifest_sha256,'df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3');
+  assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
   assert.equal(release.runtime_predecessor.version,'0.15.68');
-  assert.equal(provenance.version,'0.15.70');
+  assert.equal(provenance.version,'0.15.71');
   assert.equal(provenance.parent_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
 });

package/test/r179-release-contract.test.mjs

@@ -16,14 +16,14 @@ test('R190 version, lock snapshot, bridge, matrix, SBOM and provenance identify
   read('package.json'),readReleaseLock(root),read('bridge/package.json'),read('RELEASE.json'),
   read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,provenance.version,
-  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.70');
- assert.equal(release.train,'R190');assert.equal(matrix.train,'R190');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r190:0.15.70');
+  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.71');
+ assert.equal(release.train,'R191');assert.equal(matrix.train,'R191');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r191:0.15.71');
  assert.equal(release.parent.release_id,parent);assert.equal(release.parent.manifest_sha256,manifest);
  assert.equal(release.parent.generation_manifest_sha256,generation);
- assert.equal(release.source_predecessor.version,'0.15.69');
- assert.equal(release.source_predecessor.manifest_sha256,'cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0');
- assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
+ assert.equal(release.source_predecessor.version,'0.15.70');
+ assert.equal(release.source_predecessor.manifest_sha256,'df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3');
+ assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(provenance.runtime_predecessor.release_id,parent);
  assert.equal(provenance.parent_tarball_sha256,release.source_predecessor.tarball_sha256);
@@ -48,7 +48,7 @@ test('R190 retains historical R179 and R173 source evidence without promoting it
  assert.equal(release.r173.source_predecessor_version,'0.15.67');
  assert.equal(release.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
  assert.equal(prov.r173.source_predecessor_version,'0.15.67');
- assert.equal(release.source_predecessor.version,'0.15.69');
+ assert.equal(release.source_predecessor.version,'0.15.70');
  assert.notEqual(release.source_predecessor.tarball_sha256,release.r173.source_predecessor_tarball_sha256);
 });
 test('R184 ships a semantic lock snapshot matching installed package identity and dependencies',async()=>{

package/test/r190-foreground-cli.test.mjs

@@ -1,13 +1,17 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {spawnSync} from 'node:child_process';
+import {mkdtemp,stat,rm} from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
 
 const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 
-test('R190 CLI exposes explicit marker recovery and applies the R89 trust boundary before mutation',async()=>{
+test('R190 CLI proves R89 before touching isolated controller and fails closed on absent launcher',async t=>{
+ const stateRoot=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-r190-cli-'));
+ t.after(()=>rm(stateRoot,{recursive:true,force:true}));
  const installation=await inspectTrustedInstallation([
   process.execPath,
   path.join(root,'src','deadbyte-cli.mjs'),
@@ -21,11 +25,17 @@ test('R190 CLI exposes explicit marker recovery and applies the R89 trust bounda
   path.join(root,'bin','deadbyte-epoch-lock-r85.node')
  ]).catch(()=>({trusted:false}));
  const result=spawnSync(process.execPath,['src/deadbyte-cli.mjs','remote','reconcileforeground',
-  '--confirm-marker-sha256','f'.repeat(64)],{encoding:'utf8',windowsHide:true,shell:false});
+  '--confirm-marker-sha256','f'.repeat(64)],{encoding:'utf8',windowsHide:true,shell:false,
+    env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}});
  const output=String(result.stdout||'')+String(result.stderr||'');
  assert.notEqual(result.status,0,output);
- if(installation.trusted) assert.match(output,/marker (?:hash differs from explicit confirmation|absent without a durable R190 intent)/);
- else assert.match(output,/R190_PROTECTED_RECOVERY_REQUIRED/);
+ if(installation.trusted){
+   // R89 succeeded, but this isolated fixture has no controller launcher.
+   // The test must fail closed before foreground marker or production access.
+   assert.match(output,/ENOENT: no such file or directory, lstat .*DEADBYTE-MCP\.ps1/);
+ }else assert.match(output,/R190_PROTECTED_RECOVERY_REQUIRED/);
+ await assert.rejects(stat(path.join(stateRoot,'evidence','foreground-recovery-r190')),{code:'ENOENT'});
+ await assert.rejects(stat(path.join(stateRoot,'runtime','remote-session.json')),{code:'ENOENT'});
  assert.doesNotMatch(output,/unsupported remote command|EXACT_ACTIVE_RELEASE_REQUIRED/);
 });
 

package/test/r190-release-contract.test.mjs

@@ -8,17 +8,17 @@ test('R190 candidate identity separates published source 0.15.69 from active run
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
  for(const value of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
-  sbom.metadata.component.version])assert.equal(value,'0.15.70');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.70'/);
- assert.equal(release.train,'R190');assert.equal(matrix.train,'R190');
- assert.equal(release.source_predecessor.version,'0.15.69');
- assert.equal(release.source_predecessor.tarball_sha256,'578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3');
- assert.equal(release.source_predecessor.manifest_sha256,'cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0');
+  sbom.metadata.component.version])assert.equal(value,'0.15.71');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.71'/);
+ assert.equal(release.train,'R191');assert.equal(matrix.train,'R191');
+ assert.equal(release.source_predecessor.version,'0.15.70');
+ assert.equal(release.source_predecessor.tarball_sha256,'1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e');
+ assert.equal(release.source_predecessor.manifest_sha256,'df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3');
  assert.equal(release.runtime_predecessor.version,'0.15.68');
  assert.equal(release.runtime_predecessor.release_id,'v0.15.68-ff29dbb2fbb89862');
- assert.equal(provenance.source_predecessor_version,'0.15.69');
+ assert.equal(provenance.source_predecessor_version,'0.15.70');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
- assert.match(sbom.serialNumber,/r190:0\.15\.70$/);
+ assert.match(sbom.serialNumber,/r191:0\.15\.71$/);
 });
 
 test('R190 release metadata records verified recovery without claiming publication or activation',async()=>{

package/test/r191-epoch-root-selection.test.mjs

@@ -0,0 +1,24 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as epoch from '../src/trusted-epoch-bootstrap-r158.mjs';
+
+const predecessor='C:\\Program Files\\DEADBYTE-R173-Protected-0.15.68-ff29dbb2fbb89862-Test';
+const candidate='C:\\Program Files\\DEADBYTE-01571-REGISTRY-candidate';
+test('R191 inherited predecessor epoch is rebound to exact successor staging root',()=>{
+  assert.equal(epoch.selectActivationEpochRoot({
+    configuredEpochRoot:predecessor,explicitEpochRoot:null,stageRoot:candidate
+  }),candidate);
+});
+test('R191 no inherited epoch does not create an authority epoch path',()=>{
+  assert.equal(epoch.selectActivationEpochRoot({
+    configuredEpochRoot:null,explicitEpochRoot:null,stageRoot:candidate
+  }),null);
+});
+test('R191 explicit epoch root remains exact and invalid paths reject',()=>{
+  assert.equal(epoch.selectActivationEpochRoot({
+    configuredEpochRoot:predecessor,explicitEpochRoot:candidate,stageRoot:candidate
+  }),candidate);
+  assert.throws(()=>epoch.selectActivationEpochRoot({
+    configuredEpochRoot:predecessor,explicitEpochRoot:'..\\writable',stageRoot:candidate
+  }),/absolute|root|path/i);
+});

package/test/r191-epoch-source-claim.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,sign} from 'node:crypto';
+import {mkdir,mkdtemp,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+
+const sha=v=>createHash('sha256').update(v).digest('hex');
+const DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\\0'.replace('\\0','\0'),'utf8');
+const manifest='d'.repeat(64);
+function receipt(body,key){
+  const bytes=Buffer.from(canonicalJson(body));
+  const signed=sign(null,Buffer.concat([DOMAIN,bytes]),key.privateKey);
+  const payload={body,body_sha256:sha(bytes),
+    attestation:{algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+      key_id:sha(key.publicKey.export({type:'spki',format:'der'})),signature_base64:signed.toString('base64')}};
+  payload.receipt_sha256=sha(Buffer.from(canonicalJson(payload)));
+  return payload;
+}
+async function fixture({tamper=false,drift=false}={}){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-r65-'));
+  const updates=path.join(root,'evidence','updates'),trust=path.join(root,'trust');
+  await mkdir(updates,{recursive:true});await mkdir(trust,{recursive:true});
+  const key=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-public.pem'),key.publicKey.export({type:'spki',format:'pem'}));
+  const prior={schema:'deadbyte.active-release.v1',release_id:'v0.15.68-ff29dbb2fbb89862',
+    version:'0.15.68',manifest_sha256:'f'.repeat(64),generation_manifest_sha256:'a'.repeat(64)};
+  await writeFile(path.join(root,'active-release.json'),JSON.stringify(drift?{...prior,release_id:'v0-other'}:prior));
+  const manager=createActivationClaimManager({stateRoot:root}),subject='b'.repeat(64);
+  const claim=await manager.claim(subject);
+  const updateId='r27-'+manifest.slice(0,16)+'-r191proof';
+  const dir=path.join(updates,updateId);await mkdir(dir);
+  const body={schema:'deadbyte.r27-slot-update-failure.v1',update_id:updateId,
+    release_version:'0.15.70',candidate_manifest_sha256:manifest,
+    failed_at_utc:new Date().toISOString(),result:'PRECONDITION_REJECTED',phase:'initial',
+    error:{name:'Error',code:null,message:'authority epoch exact release source hash mismatch: manifest.sha256'},
+    prior_pointer:prior,attempted_pointer:null,
+    rollback:{attempted:false,errors:[]}};
+  const signed=receipt(body,key);
+  if(tamper)signed.body.error.message='altered message';
+  await writeFile(path.join(dir,'failure-receipt.json'),JSON.stringify(signed));
+  await writeFile(path.join(updates,'r65-activation-outcome-r191.json'),JSON.stringify({
+    schema:'deadbyte.r65-activation-outcome.v1',claim_operation_id:claim.operation_id,
+    preflight_subject_sha256:subject,candidate_version:'0.15.70',
+    candidate_manifest_sha256:manifest,predecessor_release_id:prior.release_id,
+    outcome:{state:'ACTIVATION_OUTCOME_UNKNOWN',reason:body.error.message},
+    update_id:null,state_path:null,continuity_update_id:null,observed_at_utc:new Date().toISOString()
+  }));
+  return {root,manager,claim};
+}
+test('R191 signed initial epoch source mismatch may reconcile an R65 claim with unchanged predecessor',async()=>{
+  const f=await fixture();
+  try{const next=await f.manager.claim('c'.repeat(64));
+    assert.notEqual(next.operation_id,f.claim.operation_id);await next.release();
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+test('R191 tampered signed failure receipt cannot reconcile R65 claim',async()=>{
+  const f=await fixture({tamper:true});
+  try{await assert.rejects(()=>f.manager.claim('c'.repeat(64)),/unresolved|in progress/);}
+  finally{await rm(f.root,{recursive:true,force:true});}
+});
+test('R191 changed predecessor pointer cannot reconcile R65 claim',async()=>{
+  const f=await fixture({drift:true});
+  try{await assert.rejects(()=>f.manager.claim('c'.repeat(64)),/unresolved|in progress/);}
+  finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+
+test('R191 read-only inspection reports a safe signed precondition claim without reclaiming it',async()=>{
+  const f=await fixture();
+  try{
+    const before=await readFile(path.join(f.root,'evidence','updates','r65-activation.lock'),'utf8');
+    const audit=await f.manager.inspect();
+    assert.equal(audit.status,'RECONCILABLE');
+    assert.equal(audit.operation_id,f.claim.operation_id);
+    const after=await readFile(path.join(f.root,'evidence','updates','r65-activation.lock'),'utf8');
+    assert.equal(after,before);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+test('R191 read-only inspection leaves a tampered evidence claim blocked',async()=>{
+  const f=await fixture({tamper:true});
+  try{
+    const audit=await f.manager.inspect();
+    assert.equal(audit.status,'UNRESOLVED');
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/r191-inherited-epoch-preflight.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,readdir,rm,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const src=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const H=b=>createHash('sha256').update(b).digest('hex');
+
+test('R191 real preflight rejects writable staging when predecessor has a protected epoch', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-preflight-'));
+  try{
+    const state=path.join(root,'state'),bin=path.join(state,'bin'),gen=path.join(state,'generations','parent'),policies=path.join(state,'policies');
+    await Promise.all([mkdir(bin,{recursive:true}),mkdir(gen,{recursive:true}),mkdir(policies,{recursive:true}),mkdir(path.join(state,'runtime'),{recursive:true})]);
+    const release=JSON.parse(await readFile(path.join(src,'RELEASE.json'),'utf8'));
+    const configFields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
+    const policyPaths={};
+    for(const plane of Object.keys(configFields)){
+      const f=path.join(policies,plane+'.json');
+      const grant=path.join(state,'runtime',plane+'-grant.json');
+      const grantField=plane==='host'?'arm_file':plane==='process'||plane==='desktop'?'grant_file':'lease_file';
+      await writeFile(f,JSON.stringify({schema:plane==='host'?'deadbyte.host-policy.v2':'deadbyte.'+plane+'-policy.v1',enabled:true,[grantField]:grant}));
+      policyPaths[configFields[plane]]=f;
+    }
+    const configPath=path.join(gen,'controller-config.psd1');
+    const epoch='C:\\Program Files\\DEADBYTE-R173-Protected-0.15.68-ff29dbb2fbb89862-Test';
+    await writeFile(configPath,'@{ '+Object.entries({...policyPaths,AuthorityEpochRoot:epoch}).map(([k,v])=>k+" = '"+v.replaceAll("'","''")+"'").join('; ')+' }');
+    const pointer={schema:'deadbyte.active-release.v1',...release.parent,release_root:path.join(state,'releases',release.parent.release_id),generation_root:gen,
+      launcher_sha256:H('launcher'),config_path:configPath};
+    const pointerBytes=Buffer.from(JSON.stringify(pointer));
+    await writeFile(path.join(state,'active-release.json'),pointerBytes);
+    const disarmed={configured:true,armed:false,reason:'disarmed'};
+    const observation={schema:'deadbyte.controller-observation.v1',state:'ONLINE',local_ready:true,
+      bridge:{alive:true,reason:'verified',pid:111},core:{alive:true,reason:'verified',pid:112},
+      cloud:{alive:true,reason:'verified',pid:113},supervisor:{running:true},
+      authority:Object.fromEntries(Object.keys(configFields).map(plane=>[plane,disarmed]))};
+    const observed=path.join(state,'observed.json');await writeFile(observed,JSON.stringify(observation));
+    const ps="param([string]$Command,[switch]$Json)\nif($Command -ne 'status' -or -not $Json){throw 'unexpected mutation'}\nGet-Content -Raw -LiteralPath '"+observed.replaceAll("'","''")+"'\n";
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),ps);
+    const result=spawnSync(process.execPath,[path.join(src,'scripts','deploy-r48.mjs'),'--preflight'],{
+      env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:src,encoding:'utf8',timeout:30000,windowsHide:true});
+    assert.equal(result.status,0,result.stderr);
+    const preflight=JSON.parse(result.stdout.trim());
+    assert.equal(preflight.state,'ONLINE_READY');
+    assert.equal(preflight.authority_continuity,'NOT_APPLICABLE');
+    // The same exact release may execute from a writable developer tree
+    // or from an R89-protected immutable installation. The decision must
+    // follow OS ACL trust, not the test file's assumed extraction location.
+    const {inspectTrustedInstallation,privilegedEpochInstallFiles}=await import('../src/privileged-install-trust-r89.mjs');
+    let stageTrusted=false;
+    try {
+      const trust=await inspectTrustedInstallation(privilegedEpochInstallFiles(src,process.execPath));
+      stageTrusted=trust.trusted===true;
+    } catch {stageTrusted=false;}
+    assert.equal(preflight.safe_to_activate,stageTrusted);
+    assert.equal(preflight.activation_entrypoint_state,stageTrusted?'TRUSTED_READY':'REJECTED');
+    assert.equal(preflight.protected_activation_entrypoint,stageTrusted);
+    if(stageTrusted)assert.equal(preflight.activation_entrypoint_reason,null);
+    else assert.match(preflight.activation_entrypoint_reason,/R89|ACL|protected/i);
+    assert.equal(H(await readFile(path.join(state,'active-release.json'))),H(pointerBytes));
+    await assert.rejects(readdir(path.join(state,'evidence','updates')),e=>e?.code==='ENOENT');
+  } finally {await rm(root,{recursive:true,force:true});}
+});

package/test/r191-release-contract.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const json=async f=>JSON.parse(await readFile(path.join(root,f),'utf8'));
+const predecessor='v0.15.68-ff29dbb2fbb89862';
+const publishedManifest='df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3';
+const publishedTarball='1a5f5f30bf4781ed951d6d201b8a972d088b2091555d7f4cc2e2bb899ed5707e';
+test('R191 exact version identity includes bundled bridge, lock snapshot, SBOM, provenance and matrix',async()=>{
+ const [pkg,bridge,lock,release,provenance,matrix,bom]=await Promise.all(['package.json','bridge/package.json','docs/R184-package-lock.json','RELEASE.json','PROVENANCE.json','TEST-MATRIX.json','SBOM.cdx.json'].map(json));
+ for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.71');
+ for(const train of [release.train,matrix.train])assert.equal(train,'R191');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r191:0.15.71');
+ assert.equal(release.parent.release_id,predecessor);
+ assert.equal(provenance.parent_release_id,predecessor);
+ assert.equal(release.source_predecessor.version,'0.15.70');
+ assert.equal(release.source_predecessor.manifest_sha256,publishedManifest);
+ assert.equal(release.source_predecessor.tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_version,'0.15.70');
+ assert.equal(provenance.parent_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,publishedManifest);
+ assert.equal(release.r191_activation_repair.npm_publish,'NOT_RUN');
+ assert.equal(release.r191_activation_repair.production_activation,'NOT_RUN');
+ assert.equal(release.r190_foreground_recovery.status,'PREPUBLISH_VERIFIED');
+ assert.equal(release.r179.stable_final_claim,false);
+ assert.equal(matrix.required.some(x=>x.id==='r191-trusted-successor-epoch-root'),true);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');