deadbyte-mcp 0.15.72 → 0.15.74

package/src/r193-live-owner-subject.mjs

@@ -0,0 +1,110 @@
+// Build the R193 owner-signing subject from independently observed live state.
+// No caller-supplied digest is trusted until it matches these exact bytes.
+import {createHash} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR188OwnerUacRequest} from './r188-owner-uac.mjs';
+
+const SHA=/^[a-f0-9]{64}$/;
+const FILETIME=/^[a-f0-9]{16}$/;
+const COMPONENTS=Object.freeze(['bridge','cloud','core','supervisor']);
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function block(reason){throw new Error('R193 live owner subject blocked: '+reason);}
+function record(value,label){if(!value||typeof value!=='object'||Array.isArray(value))block(label+' invalid');return value;}
+function digest(value,label){if(typeof value!=='string'||!SHA.test(value))block(label+' invalid');return value;}
+function samePath(a,b){return typeof a==='string'&&typeof b==='string'&&
+ a.replaceAll('/','\\').toLowerCase()===b.replaceAll('/','\\').toLowerCase();}
+function isoFiletime(value){
+ const match=/^(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d)\.(\d{1,7})Z$/.exec(value??'');
+ if(!match)block('process creation UTC invalid');
+ const base=Date.parse(match[1]+'.000Z');
+ if(!Number.isFinite(base))block('process creation UTC invalid');
+ return (BigInt(base+11644473600000)*10000n+
+  BigInt(match[2].padEnd(7,'0'))).toString(16).padStart(16,'0');
+}
+function authorityVector(observation){
+ const authority=record(observation.authority,'authority observation');
+ const out={};
+ for(const plane of PLANES){
+  const item=record(authority[plane],plane+' authority');
+  if(typeof item.configured!=='boolean'||typeof item.armed!=='boolean'||
+     typeof item.reason!=='string'||item.reason.length<1||item.reason.length>64)
+   block(plane+' authority fields invalid');
+  const seq=item.epoch_seq??null,head=item.epoch_sha256??null;
+  if((seq!==null&&(!Number.isSafeInteger(seq)||seq<0))||
+     (head!==null&&!SHA.test(head)))block(plane+' epoch identity invalid');
+  if(item.armed===true&&(seq===null||head===null))block(plane+' armed epoch missing');
+  out[plane]={configured:item.configured,armed:item.armed,reason:item.reason,
+   epoch_seq:seq,epoch_sha256:head};
+ }
+ return out;
+}
+
+export function createR193LiveMachineEpoch({activePointer,controllerObservation}={}){
+ const pointer=record(activePointer,'active pointer');
+ const observation=record(controllerObservation,'controller observation');
+ for(const field of ['release_id','version','manifest_sha256','generation_manifest_sha256'])
+  if(typeof pointer[field]!=='string'||!pointer[field])block('active pointer '+field+' invalid');
+ digest(pointer.manifest_sha256,'release manifest SHA-256');
+ digest(pointer.generation_manifest_sha256,'generation manifest SHA-256');
+ if(observation.schema!=='deadbyte.controller-observation.v1'||
+    !samePath(observation.core_root,pointer.release_root))
+  block('controller does not match active release');
+ return sha(Buffer.from(canonicalJson({
+  schema:'deadbyte.r193-live-machine-epoch.v1',
+  release_id:pointer.release_id,version:pointer.version,
+  manifest_sha256:pointer.manifest_sha256,
+  generation_manifest_sha256:pointer.generation_manifest_sha256,
+  authority:authorityVector(observation)
+ }),'utf8'));
+}
+
+export function buildR193LiveOwnerBoundary({request,activePointer,installedManifestBytes,
+ codingPolicyBytes,autonomousPolicyBytes,controllerObservation,supervisorLedger,
+ processReports,brokerR89Trusted,keyAclTrusted,uac,ownerGesture,now=new Date()}={}){
+ if(!Buffer.isBuffer(installedManifestBytes)||installedManifestBytes.length<1)block('manifest bytes missing');
+ if(!Buffer.isBuffer(codingPolicyBytes)||codingPolicyBytes.length<1)block('Coding policy bytes missing');
+ if(!Buffer.isBuffer(autonomousPolicyBytes)||autonomousPolicyBytes.length<1)block('Autonomous policy bytes missing');
+ const pointer=record(activePointer,'active pointer');
+ const observation=record(controllerObservation,'controller observation');
+ const manifestSha=sha(installedManifestBytes),codingSha=sha(codingPolicyBytes),autonomousSha=sha(autonomousPolicyBytes);
+ if(pointer.manifest_sha256!==manifestSha)block('active release manifest drift');
+ if(request?.subject?.release_manifest_sha256!==manifestSha||
+    request?.subject?.coding_policy_sha256!==codingSha||
+    request?.subject?.autonomous_policy_sha256!==autonomousSha)
+  block('request release or policy drift');
+ const machineEpoch=createR193LiveMachineEpoch({activePointer:pointer,controllerObservation:observation});
+ const expected={machineEpoch,releaseManifestSha256:manifestSha,codingPolicySha256:codingSha,
+  autonomousPolicySha256:autonomousSha,rootId:request?.subject?.root_id,
+  projectRoot:request?.subject?.project_root,maxSeconds:request?.subject?.max_seconds};
+ verifyR188OwnerUacRequest({request,expected,now});
+ const supervisor=record(supervisorLedger,'supervisor ledger');
+ const sources={bridge:observation.bridge,core:observation.core,cloud:observation.cloud,supervisor};
+ const reports=record(processReports,'native process reports');
+ const agent_processes=[];
+ for(const component of COMPONENTS){
+  const source=record(sources[component],component+' identity');
+  const report=record(reports[component],component+' token report');
+  if(source.alive!==true&&component!=='supervisor')block(component+' is not alive');
+  if(component==='supervisor'&&observation.supervisor?.running!==true)block('supervisor is not running');
+  if(report.schema!=='deadbyte.r193-native-process-token.v1'||report.alive!==true||
+     report.identity_verified!==true||report.pid!==source.pid||
+     !FILETIME.test(report.creation_filetime_hex)||
+     report.creation_filetime_hex!==isoFiletime(source.creation_time_utc))
+   block(component+' native process identity mismatch');
+  agent_processes.push({component,pid:report.pid,
+   creation_time_utc:new Date(Date.parse(source.creation_time_utc)).toISOString(),
+   alive:true,identity_verified:true,elevated:report.elevated,
+   admin_enabled:report.admin_enabled,integrity_rid:report.integrity_rid,
+   token_type:report.token_type});
+ }
+ const u=record(uac,'UAC policy');
+ return Object.freeze({expected:Object.freeze(expected),boundary:Object.freeze({
+  schema:'deadbyte.r193-owner-runtime-boundary.v1',
+  broker_r89_trusted:brokerR89Trusted===true,key_acl_trusted:keyAclTrusted===true,
+  enable_uac:u.enable_uac===true,secure_desktop:u.secure_desktop===true,
+  prompt_mode:u.prompt_mode,owner_gesture:ownerGesture,
+  live_epoch_verified:true,live_policies_verified:true,live_release_verified:true,
+  agent_processes:Object.freeze(agent_processes)
+ })});
+}

package/src/r193-owner-secret-acl.mjs

@@ -0,0 +1,67 @@
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import path from 'node:path';
+
+const execFileAsync=promisify(execFile);
+const TRUSTED=new Set(['S-1-5-18','S-1-5-32-544',
+ 'S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464']);
+function blocked(reason,pathValue=null){return Object.freeze({trusted:false,reason,path:pathValue});}
+export function evaluateR193OwnerSecretAcl(records,files){
+ if(!Array.isArray(files)||files.length!==2||!Array.isArray(records)||records.length!==2)
+  return blocked('INCOMPLETE_OWNER_SECRET_ACL');
+ const expected=new Set(files.map(file=>path.win32.normalize(file).toLowerCase()));
+ const seen=new Set();
+ for(const record of records){
+  const key=typeof record?.path==='string'?path.win32.normalize(record.path).toLowerCase():'';
+  if(!expected.has(key)||seen.has(key))return blocked('OWNER_SECRET_ACL_PATH_MISMATCH',key);
+  seen.add(key);
+  if(record.reparse!==false||record.protected!==true||!TRUSTED.has(record.owner)||
+     typeof record.directory!=='boolean'||!Array.isArray(record.aces))
+   return blocked('OWNER_SECRET_ACL_UNTRUSTED',key);
+  for(const ace of record.aces){
+   if(!ace||!['Allow','Deny'].includes(ace.type)||typeof ace.sid!=='string'||
+      typeof ace.inherited!=='boolean'||!Number.isSafeInteger(ace.mask))
+    return blocked('OWNER_SECRET_ACL_UNKNOWN_RULE',key);
+   if(ace.inherited===true)return blocked('OWNER_SECRET_ACL_INHERITED_RULE',key);
+   if(ace.type==='Allow'&&!TRUSTED.has(ace.sid))
+    return blocked('OWNER_SECRET_READABLE_BY_AGENT_PRINCIPAL',key);
+  }
+ }
+ return Object.freeze({trusted:true,reason:'OWNER_SECRET_ADMIN_SYSTEM_ONLY'});
+}
+
+const probe=String.raw`
+$ErrorActionPreference='Stop';Set-StrictMode -Version Latest
+try{
+ $files=ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__FILES__')))
+ $out=@()
+ foreach($p in @($files)){
+  $item=Get-Item -LiteralPath $p -Force -ErrorAction Stop
+  $acl=Get-Acl -LiteralPath $p -ErrorAction Stop
+  $rules=@()
+  foreach($entry in $acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){
+   $rules+=@{sid=$entry.IdentityReference.Value;type=$entry.AccessControlType.ToString();
+    mask=([int64]$entry.FileSystemRights -band [int64]4294967295);inherited=[bool]$entry.IsInherited}
+  }
+  $out+=@{path=$item.FullName;owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;
+   reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);
+   protected=[bool]$acl.AreAccessRulesProtected;directory=[bool]$item.PSIsContainer;aces=$rules}
+ }
+ ConvertTo-Json @($out) -Depth 7 -Compress
+}catch{[Console]::Error.WriteLine('R193_OWNER_SECRET_ACL_PROBE_FAILED');exit 12}
+`;
+export async function inspectR193OwnerSecretAcl(files){
+ if(process.platform!=='win32'||process.arch!=='x64')
+  throw new Error('R193 owner secret ACL requires Windows x64');
+ const ps='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+ const encodedFiles=Buffer.from(JSON.stringify(files),'utf8').toString('base64');
+ const encoded=Buffer.from(probe.replace('__FILES__',encodedFiles),'utf16le').toString('base64');
+ let stdout;
+ try{({stdout}=await execFileAsync(ps,['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+  {windowsHide:true,timeout:12000,maxBuffer:128*1024,encoding:'utf8'}));}
+ catch{throw new Error('R193 owner secret ACL inspection failed closed');}
+ let records;try{records=JSON.parse(stdout);}catch{throw new Error('R193 owner secret ACL response invalid');}
+ const decision=evaluateR193OwnerSecretAcl(records,files);
+ if(!decision.trusted)throw new Error('R193 owner secret ACL untrusted: '+decision.reason);
+ return decision;
+}

package/src/r193-owner-uac-broker.mjs

@@ -0,0 +1,85 @@
+// R193 protected owner decision boundary.
+//
+// This module is deliberately pure. It cannot launch UAC, enroll a key, write
+// an approval, issue a grant, or mutate an epoch. A protected interactive host
+// must independently observe the Windows token/process vector and R89/key ACLs
+// before calling it. The returned R70 approval remains single-use input to the
+// existing R186 transaction; it is not authority by itself.
+import {createPublicKey} from 'node:crypto';
+import {signR193R70ApprovalFromOwnerReview} from './r193-uac-r70-bridge.mjs';
+
+const COMPONENTS=Object.freeze(['bridge','cloud','core','supervisor']);
+const BOUNDARY_FIELDS=Object.freeze([
+ 'schema','broker_r89_trusted','key_acl_trusted','enable_uac','secure_desktop',
+ 'prompt_mode','owner_gesture','live_epoch_verified','live_policies_verified',
+ 'live_release_verified','agent_processes'
+]);
+const PROCESS_FIELDS=Object.freeze([
+ 'component','pid','creation_time_utc','alive','identity_verified','elevated',
+ 'admin_enabled','integrity_rid','token_type'
+]);
+
+function block(reason){throw new Error(`R193 owner UAC broker blocked: ${reason}`);}
+function exact(value,fields,label){
+ if(!value||typeof value!=='object'||Array.isArray(value)||
+    Object.keys(value).length!==fields.length||
+    fields.some(field=>!Object.hasOwn(value,field)))block(`${label} schema mismatch`);
+}
+function canonicalUtc(value,label){
+ if(typeof value!=='string'||
+    !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value)||
+    !Number.isFinite(Date.parse(value))||new Date(value).toISOString()!==value)
+  block(`${label} creation identity invalid`);
+}
+function verifyProcesses(processes){
+ if(!Array.isArray(processes)||processes.length!==COMPONENTS.length)
+  block('complete agent process vector required');
+ const observed=[];
+ for(const process of processes){
+  exact(process,PROCESS_FIELDS,'agent process');
+  if(!COMPONENTS.includes(process.component)||observed.includes(process.component))
+   block('agent process component missing or duplicated');
+  observed.push(process.component);
+  if(!Number.isSafeInteger(process.pid)||process.pid<1||process.pid>0x7fffffff)
+   block('agent process PID invalid');
+  canonicalUtc(process.creation_time_utc,process.component);
+  if(process.alive!==true||process.identity_verified!==true)
+   block(`${process.component} process identity unverified`);
+  if(process.elevated!==false||process.admin_enabled!==false||
+     process.integrity_rid<8192||process.integrity_rid>=12288||
+     process.token_type!=='primary')
+   block(`${process.component} process is not a verified Limited primary token`);
+ }
+ if(COMPONENTS.some(component=>!observed.includes(component)))
+  block('complete agent process vector required');
+}
+
+export function approveR193OwnerRequest({request,expected,privateKeyDer,boundary,now=new Date()}={}){
+ exact(boundary,BOUNDARY_FIELDS,'runtime boundary');
+ if(boundary.schema!=='deadbyte.r193-owner-runtime-boundary.v1')
+  block('runtime boundary schema invalid');
+ if(boundary.broker_r89_trusted!==true)block('R89 protected broker not verified');
+ if(boundary.key_acl_trusted!==true)block('owner signing key ACL not verified');
+ if(boundary.enable_uac!==true||boundary.secure_desktop!==true||
+    boundary.prompt_mode!=='explicit_secure_desktop')
+  block('secure interactive UAC policy not verified');
+ if(boundary.owner_gesture!=='approved')block('owner gesture absent or rejected');
+ if(boundary.live_epoch_verified!==true)block('live authority epoch not verified');
+ if(boundary.live_policies_verified!==true)block('live policy identities not verified');
+ if(boundary.live_release_verified!==true)block('live release identity not verified');
+ verifyProcesses(boundary.agent_processes);
+ const signed=signR193R70ApprovalFromOwnerReview({request,expected,privateKeyDer,now});
+ const publicPem=createPublicKey({key:signed.owner_public_key_spki_der,
+  format:'der',type:'spki'}).export({format:'pem',type:'spki'}).toString();
+ return Object.freeze({
+  status:'OWNER_APPROVED_FOR_SINGLE_USE_GRANT',
+  request_sha256:signed.request_sha256,
+  owner_key_id:signed.approval.owner_key_id,
+  owner_public_key_pem:publicPem,
+  approval:signed.approval,
+  owner_approved:true,
+  authority_granted:false,
+  private_key_material_returned:false,
+  next_gate:'R186_PROTECTED_SINGLE_USE_GRANT_TRANSACTION'
+ });
+}

package/src/r193-uac-r70-bridge.mjs

@@ -0,0 +1,54 @@
+// R193 bridge: translate a short-lived, exact R188 scope review into the
+// already-supported R70 signed approval format. This function is NOT consent,
+// UAC evidence, protected-key enrollment, epoch issuance or a grant. Its caller
+// must be an independently elevated, R89-protected owner broker and must never
+// expose the owner's private DER or the signing operation to an agent process.
+import {createHash,createPrivateKey,createPublicKey,sign} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR188OwnerUacRequest} from './r188-owner-uac.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const encode=x=>Buffer.from(canonicalJson(x),'utf8');
+const DOMAIN=Buffer.from('DEADBYTE-R70-PROJECT-OWNER-APPROVAL\0','utf8');
+
+export function signR193R70ApprovalFromOwnerReview({
+  request,expected,privateKeyDer,now=new Date()
+}={}){
+  // The supplied private key is data for an already-trusted protected caller.
+  // Never read it from an agent-accessible path inside this module.
+  if(!Buffer.isBuffer(privateKeyDer)||privateKeyDer.length<32||privateKeyDer.length>8192)
+    throw Error('R193 protected owner signing material missing');
+  if(!(now instanceof Date)||!Number.isFinite(now.getTime()))
+    throw Error('R193 invalid review time');
+  const verified=verifyR188OwnerUacRequest({request,expected,now});
+  if(verified.status!=='VERIFIED_FOR_REVIEW_ONLY'||verified.authority_granted!==false)
+    throw Error('R193 unexpected owner-review contract');
+  let privateKey;
+  try{privateKey=createPrivateKey({key:privateKeyDer,format:'der',type:'pkcs8'});}
+  catch{throw Error('R193 protected Ed25519 key invalid');}
+  if(privateKey.asymmetricKeyType!=='ed25519')
+    throw Error('R193 protected signing key must be Ed25519');
+  const publicKey=createPublicKey(privateKey);
+  const ownerKeyId=sha(publicKey.export({format:'der',type:'spki'}));
+  const s=request.subject;
+  // Preserve the exact request expiry: signing does not extend authority.
+  const subject=Object.freeze({
+    schema:'deadbyte.project-authority-subject.r70.v1',
+    scope:'coding_autonomous_native_diff',
+    root_id:s.root_id,project_root:s.project_root,
+    coding_policy_sha256:s.coding_policy_sha256,
+    autonomous_policy_sha256:s.autonomous_policy_sha256,
+    reviewed_artifact_sha256:s.release_manifest_sha256,
+    issued_at_utc:s.issued_at_utc,expires_at_utc:s.expires_at_utc
+  });
+  const digest=sha(encode(subject));
+  const signed=Object.freeze({schema:'deadbyte.project-owner-approval.r70.v1',
+    subject_sha256:digest,owner_key_id:ownerKeyId});
+  const signature=sign(null,Buffer.concat([DOMAIN,encode(signed)]),privateKey);
+  return Object.freeze({
+    status:'PROTECTED_SIGNATURE_FORMAT_ONLY',authority_granted:false,owner_approved:false,
+    request_sha256:verified.request_sha256,
+    owner_public_key_spki_der:publicKey.export({format:'der',type:'spki'}),
+    approval:Object.freeze({...signed,subject,signature_base64:signature.toString('base64')})
+  });
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.72';
+export const DEADBYTE_VERSION = '0.15.74';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/process-policy-refresh.test.mjs

@@ -70,7 +70,7 @@ test('R167 process policy binds coherently to the explicit development root', as
   // The distributed policy is pinned to its explicit development provenance,
   // not to the physical extraction path of the exact immutable npm tarball.
   const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
-  const approvedRoot = release.r192?.development_policy_root;
+  const approvedRoot = release.r194?.development_policy_root;
   assert.equal(typeof approvedRoot, 'string', 'R191 development policy root must be explicit in release metadata');
   assert.ok(path.isAbsolute(approvedRoot), 'R191 development policy root must be absolute');
   const expectedRoot = path.resolve(approvedRoot);

package/test/r130-release-security-contract.test.mjs

@@ -14,14 +14,14 @@ test('current successor retains the R130 security baseline with truthful R190 id
     read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.72');
-  assert.equal(release.train,'R192');
-  assert.equal(matrix.train,'R192');
-  assert.equal(release.source_predecessor.version,'0.15.71');
-  assert.equal(release.source_predecessor.train,'R191');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.71\.tgz/i);
-  assert.equal(release.source_predecessor.manifest_status,'PUBLISHED_EXACT_MANIFEST_VERIFIED_ACTIVE_PRODUCTION');
-  assert.equal(release.runtime_predecessor.version,'0.15.71');
+    assert.equal(actual,'0.15.74');
+  assert.equal(release.train,'R194');
+  assert.equal(matrix.train,'R194');
+  assert.equal(release.source_predecessor.version,'0.15.73');
+  assert.equal(release.source_predecessor.train,'R193');
+  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
+  assert.equal(release.source_predecessor.manifest_status,'FROZEN_R193_CLOSURE_VERIFIED');
+  assert.equal(release.runtime_predecessor.version,'0.15.72');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -16,17 +16,17 @@ test('R190 package identity preserves R132 evidence and published R179 source pr
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R192');
-  assert.equal(matrix.train,'R192');
-  assert.equal(release.source_predecessor.version,'0.15.71');
-  assert.equal(release.source_predecessor.train,'R191');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.71\.tgz/i);
+  assert.equal(release.train,'R194');
+  assert.equal(matrix.train,'R194');
+  assert.equal(release.source_predecessor.version,'0.15.73');
+  assert.equal(release.source_predecessor.train,'R193');
+  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27');
+  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
   assert.notEqual(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(release.runtime_predecessor.version,'0.15.71');
+  assert.equal(release.runtime_predecessor.version,'0.15.72');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
   assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.72');
+ assert.equal(state.pkg.version,'0.15.74');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -8,9 +8,9 @@ const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
 test('R160 historical contract remains distinct from the current package identity',async()=>{
   const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
-  assert.equal(release.runtime_predecessor.version,'0.15.71');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.71-1818abc327478a96');
-  assert.equal(release.runtime_predecessor.manifest_sha256,'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c');
+  assert.equal(release.runtime_predecessor.version,'0.15.72');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90');
   assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
   assert.equal(release.r160.source_predecessor_train,'R159');
   assert.equal(release.r160.public_tool_delta,0);

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.72');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.74');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');

package/test/r167-release-contract.test.mjs

@@ -8,7 +8,7 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.72';
+const VERSION='0.15.74';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
@@ -20,20 +20,20 @@ test('current package identity retains the immutable R167/R173 activation lineag
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R192');
-  assert.equal(matrix.train,'R192');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r192:0.15.72');
+  assert.equal(release.train,'R194');
+  assert.equal(matrix.train,'R194');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
   assert.deepEqual(release.runtime_predecessor,{
-    version:'0.15.71',release_id:'v0.15.71-1818abc327478a96',
-    manifest_sha256:'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c',
-    generation_manifest_sha256:'aef437280102171a9b68da754fca16a03202104db7d5c420751624580ad6fadc'
+    version:'0.15.72',release_id:'v0.15.72-0a5d9436e06e2d9e',
+    manifest_sha256:'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90',
+    generation_manifest_sha256:'aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
   });
-  assert.equal(release.source_predecessor.version,'0.15.71');
-  assert.equal(release.source_predecessor.train,'R191');
-  assert.equal(release.source_predecessor.tarball_sha256,'20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27');
+  assert.equal(release.source_predecessor.version,'0.15.73');
+  assert.equal(release.source_predecessor.train,'R193');
+  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
   assert.equal(release.r173.source_predecessor_version,'0.15.67');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
   assert.equal(provenance.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');

package/test/r168-release-contract.test.mjs

@@ -13,10 +13,10 @@ const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc
 
 test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
  const release=await read('RELEASE.json');
- assert.equal(release.runtime_predecessor.version,'0.15.71');
- assert.equal(release.parent.version,'0.15.71');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.71-1818abc327478a96');
- assert.equal(release.parent.release_id,'v0.15.71-1818abc327478a96');
+ assert.equal(release.runtime_predecessor.version,'0.15.72');
+ assert.equal(release.parent.version,'0.15.72');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
+ assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
  assert.notEqual(release.runtime_predecessor.release_id,parent);
  assert.notEqual(release.parent.release_id,parent);
  assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');

package/test/r172-release-contract.test.mjs

@@ -16,12 +16,12 @@ test('R190 binds the published source predecessor separately from the active run
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.72');
-  assert.equal(release.train,'R192'); assert.equal(matrix.train,'R192');
-  assert.equal(release.source_predecessor.version,'0.15.71');
-  assert.equal(release.source_predecessor.manifest_sha256,'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c');
-  assert.equal(release.source_predecessor.tarball_sha256,'20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.71-1818abc327478a96');
+  for(const value of versions)assert.equal(value,'0.15.74');
+  assert.equal(release.train,'R194'); assert.equal(matrix.train,'R194');
+  assert.equal(release.source_predecessor.version,'0.15.73');
+  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
   assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });
 

package/test/r173-release-contract.test.mjs

@@ -13,21 +13,21 @@ test('R190 package identity binds the exact published R179 source and live runti
     json('package.json'),readReleaseLock(root),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.72');
-  assert.equal(lock.version,'0.15.72');
-  assert.equal(lock.packages[''].version,'0.15.72');
-  assert.equal(bridge.version,'0.15.72');
-  assert.equal(release.version,'0.15.72');
-  assert.equal(release.train,'R192');
-  assert.equal(matrix.version,'0.15.72');
-  assert.equal(matrix.train,'R192');
-  assert.equal(sbom.metadata.component.version,'0.15.72');
-  assert.equal(release.source_predecessor.version,'0.15.71');
-  assert.equal(release.source_predecessor.train,'R191');
-  assert.equal(release.source_predecessor.manifest_sha256,'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c');
-  assert.equal(release.source_predecessor.tarball_sha256,'20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27');
-  assert.equal(release.runtime_predecessor.version,'0.15.71');
-  assert.equal(provenance.version,'0.15.72');
-  assert.equal(provenance.parent_tarball_sha256,release.source_predecessor.tarball_sha256);
+  assert.equal(pkg.version,'0.15.74');
+  assert.equal(lock.version,'0.15.74');
+  assert.equal(lock.packages[''].version,'0.15.74');
+  assert.equal(bridge.version,'0.15.74');
+  assert.equal(release.version,'0.15.74');
+  assert.equal(release.train,'R194');
+  assert.equal(matrix.version,'0.15.74');
+  assert.equal(matrix.train,'R194');
+  assert.equal(sbom.metadata.component.version,'0.15.74');
+  assert.equal(release.source_predecessor.version,'0.15.73');
+  assert.equal(release.source_predecessor.train,'R193');
+  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.runtime_predecessor.version,'0.15.72');
+  assert.equal(provenance.version,'0.15.74');
+  assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
   assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
 });

package/test/r179-release-contract.test.mjs

@@ -7,26 +7,26 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 import {readReleaseLock} from './helpers/release-lock.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-const parent='v0.15.71-1818abc327478a96';
-const manifest='1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c';
-const generation='aef437280102171a9b68da754fca16a03202104db7d5c420751624580ad6fadc';
+const parent='v0.15.72-0a5d9436e06e2d9e';
+const manifest='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
+const generation='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0';
 const tarball='1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf';
 test('R190 version, lock snapshot, bridge, matrix, SBOM and provenance identify exact 0.15.70 successor',async()=>{
  const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
   read('package.json'),readReleaseLock(root),read('bridge/package.json'),read('RELEASE.json'),
   read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,provenance.version,
-  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.72');
- assert.equal(release.train,'R192');assert.equal(matrix.train,'R192');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r192:0.15.72');
+  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.74');
+ assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
  assert.equal(release.parent.release_id,parent);assert.equal(release.parent.manifest_sha256,manifest);
  assert.equal(release.parent.generation_manifest_sha256,generation);
- assert.equal(release.source_predecessor.version,'0.15.71');
- assert.equal(release.source_predecessor.manifest_sha256,'1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c');
- assert.equal(release.source_predecessor.tarball_sha256,'20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27');
+ assert.equal(release.source_predecessor.version,'0.15.73');
+ assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+ assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(provenance.runtime_predecessor.release_id,parent);
- assert.equal(provenance.parent_tarball_sha256,release.source_predecessor.tarball_sha256);
+ assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
 });
 test('R179 does not misrepresent owner Autonomous enrollment, protected regression or publication as finished',async()=>{
@@ -48,7 +48,7 @@ test('R190 retains historical R179 and R173 source evidence without promoting it
  assert.equal(release.r173.source_predecessor_version,'0.15.67');
  assert.equal(release.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
  assert.equal(prov.r173.source_predecessor_version,'0.15.67');
- assert.equal(release.source_predecessor.version,'0.15.71');
+ assert.equal(release.source_predecessor.version,'0.15.73');
  assert.notEqual(release.source_predecessor.tarball_sha256,release.r173.source_predecessor_tarball_sha256);
 });
 test('R184 ships a semantic lock snapshot matching installed package identity and dependencies',async()=>{