deadbyte-mcp 0.15.72 → 0.15.75

package/scripts/gate-windows-r193.ps1

@@ -0,0 +1,108 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$productionState=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.72-0a5d9436e06e2d9e'
+$parentSha='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90'
+$parentGen='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+$parentTarball='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Need([bool]$condition,[string]$message){if(-not $condition){throw $message}}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    Need ($null -ne $nodeArgs -and $nodeArgs.Count -gt 0) "R193_${label}_NO_NODE_ARGUMENTS"
+    Write-Output "R193_STAGE_START=$label"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R193_${label}_FAILED exit=$exit"}
+    Write-Output "R193_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    Need (-not [string]::IsNullOrWhiteSpace([string]$release.r192.development_policy_root)) 'R193_DEVELOPMENT_PROVENANCE_ROOT_MISSING'
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=[IO.Path]::GetFullPath([string]$release.r192.development_policy_root)
+    Need ($pkg.version -eq '0.15.73' -and $release.version -eq '0.15.73' -and $release.train -eq 'R193') 'R193_CANDIDATE_VERSION_DRIFT'
+    Need ($release.source_predecessor.version -eq '0.15.72' -and $release.source_predecessor.train -eq 'R192') 'R193_SOURCE_PREDECESSOR_VERSION_DRIFT'
+    Need ($release.source_predecessor.manifest_sha256 -eq $parentSha -and $release.source_predecessor.tarball_sha256 -eq $parentTarball) 'R193_SOURCE_PREDECESSOR_IDENTITY_DRIFT'
+    Need ($release.runtime_predecessor.release_id -eq $parentId -and $release.runtime_predecessor.manifest_sha256 -eq $parentSha -and $release.runtime_predecessor.generation_manifest_sha256 -eq $parentGen) 'R193_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'
+    $active=Get-Content -LiteralPath (Join-Path $productionState 'active-release.json') -Raw | ConvertFrom-Json
+    Need ($active.version -eq '0.15.72' -and $active.release_id -eq $parentId -and $active.manifest_sha256 -eq $parentSha -and $active.generation_manifest_sha256 -eq $parentGen) 'R193_ACTIVE_RUNTIME_DRIFT'
+    Need ((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -eq $parentSha) 'R193_ACTIVE_MANIFEST_MISMATCH'
+    Write-Output 'R193_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        $focused=@(
+            'test/r70-owner-approval.test.mjs',
+            'test/r89-privileged-install-boundary.test.mjs',
+            'test/r186-controller-owner-grant.test.mjs',
+            'test/r186-owner-consent-preflight.test.mjs',
+            'test/r186-owner-enrollment.test.mjs',
+            'test/r186-owner-grant-broker.test.mjs',
+            'test/r186-owner-local-signing.test.mjs',
+            'test/r186-owner-request.test.mjs',
+            'test/r186-owner-review-export.test.mjs',
+            'test/r188-owner-uac.test.mjs',
+            'test/r188-uac-boundary.test.mjs',
+            'test/r193-limited-migration-contract.test.mjs',
+            'test/r193-live-owner-subject.test.mjs',
+            'test/r193-native-process-observer.test.mjs',
+            'test/r193-native-token.test.mjs',
+            'test/r193-owner-enrollment-entrypoint.test.mjs',
+            'test/r193-owner-secret-acl.test.mjs',
+            'test/r193-owner-uac-broker.test.mjs',
+            'test/r193-owner-uac-entrypoint.test.mjs',
+            'test/r193-release-readiness.test.mjs',
+            'test/r193-release-identity.test.mjs',
+            'test/r193-uac-r70-bridge.test.mjs',
+            'test/r193-windows-gate.test.mjs'
+        )
+        Run-Node -label 'focused' -nodeArgs (@('--test','--test-reporter=tap','--test-concurrency=1')+$focused)
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        Need (Test-Path -LiteralPath $scratchDrive -PathType Container) 'R193_CROSS_VOLUME_DRIVE_UNAVAILABLE'
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R193-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previousStateRoot=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r193-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            [IO.Directory]::CreateDirectory($isolated)|Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previousStateRoot
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R193_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot
+    Pop-Location
+}

package/scripts/gate-windows-r194.ps1

@@ -0,0 +1,112 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$productionState=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.72-0a5d9436e06e2d9e'
+$parentSha='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90'
+$parentGen='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+$parentTarball='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Need([bool]$condition,[string]$message){if(-not $condition){throw $message}}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    Need ($null -ne $nodeArgs -and $nodeArgs.Count -gt 0) "R194_${label}_NO_NODE_ARGUMENTS"
+    Write-Output "R194_STAGE_START=$label"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R194_${label}_FAILED exit=$exit"}
+    Write-Output "R194_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    Need (-not [string]::IsNullOrWhiteSpace([string]$release.r194.development_policy_root)) 'R194_DEVELOPMENT_PROVENANCE_ROOT_MISSING'
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=[IO.Path]::GetFullPath([string]$release.r194.development_policy_root)
+    Need ($pkg.version -eq '0.15.74' -and $release.version -eq '0.15.74' -and $release.train -eq 'R194') 'R194_CANDIDATE_VERSION_DRIFT'
+    Need ($release.source_predecessor.version -eq '0.15.73' -and $release.source_predecessor.train -eq 'R193') 'R194_SOURCE_PREDECESSOR_VERSION_DRIFT'
+    Need ($release.source_predecessor.manifest_sha256 -eq 'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd' -and $release.source_predecessor.tarball_sha256 -eq '13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534') 'R194_SOURCE_PREDECESSOR_IDENTITY_DRIFT'
+    Need ($release.runtime_predecessor.release_id -eq $parentId -and $release.runtime_predecessor.manifest_sha256 -eq $parentSha -and $release.runtime_predecessor.generation_manifest_sha256 -eq $parentGen) 'R194_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'
+    $active=Get-Content -LiteralPath (Join-Path $productionState 'active-release.json') -Raw | ConvertFrom-Json
+    Need ($active.version -eq '0.15.72' -and $active.release_id -eq $parentId -and $active.manifest_sha256 -eq $parentSha -and $active.generation_manifest_sha256 -eq $parentGen) 'R194_ACTIVE_RUNTIME_DRIFT'
+    Need ((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -eq $parentSha) 'R194_ACTIVE_MANIFEST_MISMATCH'
+    Write-Output 'R194_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        $focused=@(
+            'test/r70-owner-approval.test.mjs',
+            'test/r89-privileged-install-boundary.test.mjs',
+            'test/r186-controller-owner-grant.test.mjs',
+            'test/r186-owner-consent-preflight.test.mjs',
+            'test/r186-owner-enrollment.test.mjs',
+            'test/r186-owner-grant-broker.test.mjs',
+            'test/r186-owner-local-signing.test.mjs',
+            'test/r186-owner-request.test.mjs',
+            'test/r186-owner-review-export.test.mjs',
+            'test/r188-owner-uac.test.mjs',
+            'test/r188-uac-boundary.test.mjs',
+            'test/r193-limited-migration-contract.test.mjs',
+            'test/r193-live-owner-subject.test.mjs',
+            'test/r193-native-process-observer.test.mjs',
+            'test/r193-native-token.test.mjs',
+            'test/r193-owner-enrollment-entrypoint.test.mjs',
+            'test/r193-owner-secret-acl.test.mjs',
+            'test/r193-owner-uac-broker.test.mjs',
+            'test/r193-owner-uac-entrypoint.test.mjs',
+            'test/r193-release-readiness.test.mjs',
+            'test/r193-release-identity.test.mjs',
+            'test/r194-release-identity.test.mjs',
+            'test/r194-release-readiness.test.mjs',
+            'test/r193-uac-r70-bridge.test.mjs',
+            'test/r194-windows-gate.test.mjs',
+            'test/r194-npm-auth-recovery.test.mjs',
+            'test/r194-npm-preauth.test.mjs'
+        )
+        Run-Node -label 'focused' -nodeArgs (@('--test','--test-reporter=tap','--test-concurrency=1')+$focused)
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        Need (Test-Path -LiteralPath $scratchDrive -PathType Container) 'R194_CROSS_VOLUME_DRIVE_UNAVAILABLE'
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R194-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previousStateRoot=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r194-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            [IO.Directory]::CreateDirectory($isolated)|Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previousStateRoot
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R194_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot
+    Pop-Location
+}

package/scripts/gate-windows-r195.ps1

@@ -0,0 +1,114 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$productionState=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.74-e84bf4eed16e9443'
+$parentSha='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47'
+$parentGen='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'
+$parentTarball='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Need([bool]$condition,[string]$message){if(-not $condition){throw $message}}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    Need ($null -ne $nodeArgs -and $nodeArgs.Count -gt 0) "R195_${label}_NO_NODE_ARGUMENTS"
+    Write-Output "R195_STAGE_START=$label"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R195_${label}_FAILED exit=$exit"}
+    Write-Output "R195_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    Need (-not [string]::IsNullOrWhiteSpace([string]$release.r195.development_policy_root)) 'R195_DEVELOPMENT_PROVENANCE_ROOT_MISSING'
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=[IO.Path]::GetFullPath([string]$release.r195.development_policy_root)
+    Need ($pkg.version -eq '0.15.75' -and $release.version -eq '0.15.75' -and $release.train -eq 'R195') 'R195_CANDIDATE_VERSION_DRIFT'
+    Need ($release.source_predecessor.version -eq '0.15.74' -and $release.source_predecessor.train -eq 'R194') 'R195_SOURCE_PREDECESSOR_VERSION_DRIFT'
+    Need ($release.source_predecessor.manifest_sha256 -eq $parentSha -and $release.source_predecessor.tarball_sha256 -eq $parentTarball) 'R195_SOURCE_PREDECESSOR_IDENTITY_DRIFT'
+    Need ($release.runtime_predecessor.release_id -eq $parentId -and $release.runtime_predecessor.manifest_sha256 -eq $parentSha -and $release.runtime_predecessor.generation_manifest_sha256 -eq $parentGen) 'R195_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'
+    $active=Get-Content -LiteralPath (Join-Path $productionState 'active-release.json') -Raw | ConvertFrom-Json
+    Need ($active.version -eq '0.15.74' -and $active.release_id -eq $parentId -and $active.manifest_sha256 -eq $parentSha -and $active.generation_manifest_sha256 -eq $parentGen) 'R195_ACTIVE_RUNTIME_DRIFT'
+    Need ((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -eq $parentSha) 'R195_ACTIVE_MANIFEST_MISMATCH'
+    Write-Output 'R195_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        $focused=@(
+            'test/r70-owner-approval.test.mjs',
+            'test/r89-privileged-install-boundary.test.mjs',
+            'test/r186-controller-owner-grant.test.mjs',
+            'test/r186-owner-consent-preflight.test.mjs',
+            'test/r186-owner-enrollment.test.mjs',
+            'test/r186-owner-grant-broker.test.mjs',
+            'test/r186-owner-local-signing.test.mjs',
+            'test/r186-owner-request.test.mjs',
+            'test/r186-owner-review-export.test.mjs',
+            'test/r188-owner-uac.test.mjs',
+            'test/r188-uac-boundary.test.mjs',
+            'test/r193-limited-migration-contract.test.mjs',
+            'test/r193-live-owner-subject.test.mjs',
+            'test/r193-native-process-observer.test.mjs',
+            'test/r193-native-token.test.mjs',
+            'test/r193-owner-enrollment-entrypoint.test.mjs',
+            'test/r193-owner-secret-acl.test.mjs',
+            'test/r193-owner-uac-broker.test.mjs',
+            'test/r193-owner-uac-entrypoint.test.mjs',
+            'test/r193-release-readiness.test.mjs',
+            'test/r193-release-identity.test.mjs',
+            'test/r194-release-identity.test.mjs',
+            'test/r194-release-readiness.test.mjs',
+            'test/r193-uac-r70-bridge.test.mjs',
+            'test/r194-windows-gate.test.mjs',
+            'test/r194-npm-auth-recovery.test.mjs',
+            'test/r194-npm-preauth.test.mjs'
+            'test/r195-canonical-owner-observation.test.mjs'
+            'test/r195-release-readiness.test.mjs'
+        )
+        Run-Node -label 'focused' -nodeArgs (@('--test','--test-reporter=tap','--test-concurrency=1')+$focused)
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        Need (Test-Path -LiteralPath $scratchDrive -PathType Container) 'R195_CROSS_VOLUME_DRIVE_UNAVAILABLE'
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R195-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previousStateRoot=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r195-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            [IO.Directory]::CreateDirectory($isolated)|Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previousStateRoot
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R195_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot
+    Pop-Location
+}

package/scripts/gate-windows-r206.ps1

@@ -0,0 +1,116 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$productionState=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.74-e84bf4eed16e9443'
+$parentSha='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47'
+$parentGen='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'
+$parentTarball='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Need([bool]$condition,[string]$message){if(-not $condition){throw $message}}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    Need ($null -ne $nodeArgs -and $nodeArgs.Count -gt 0) "R206_${label}_NO_NODE_ARGUMENTS"
+    Write-Output "R206_STAGE_START=$label"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R206_${label}_FAILED exit=$exit"}
+    Write-Output "R206_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    Need (-not [string]::IsNullOrWhiteSpace([string]$release.r206.development_policy_root)) 'R206_DEVELOPMENT_PROVENANCE_ROOT_MISSING'
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=[IO.Path]::GetFullPath([string]$release.r206.development_policy_root)
+    Need ($pkg.version -eq '0.15.75' -and $release.version -eq '0.15.75' -and $release.train -eq 'R206') 'R206_CANDIDATE_VERSION_DRIFT'
+    Need ($release.source_predecessor.version -eq '0.15.75' -and $release.source_predecessor.train -eq 'R205') 'R206_SOURCE_PREDECESSOR_VERSION_DRIFT'
+    Need ($release.source_predecessor.manifest_sha256 -eq '166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92' -and $null -eq $release.source_predecessor.tarball_sha256) 'R206_SOURCE_PREDECESSOR_IDENTITY_DRIFT'
+    Need ($release.runtime_predecessor.release_id -eq $parentId -and $release.runtime_predecessor.manifest_sha256 -eq $parentSha -and $release.runtime_predecessor.generation_manifest_sha256 -eq $parentGen) 'R206_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'
+    $active=Get-Content -LiteralPath (Join-Path $productionState 'active-release.json') -Raw | ConvertFrom-Json
+    Need ($active.version -eq '0.15.74' -and $active.release_id -eq $parentId -and $active.manifest_sha256 -eq $parentSha -and $active.generation_manifest_sha256 -eq $parentGen) 'R206_ACTIVE_RUNTIME_DRIFT'
+    Need ((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -eq $parentSha) 'R206_ACTIVE_MANIFEST_MISMATCH'
+    Write-Output 'R206_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        $focused=@(
+            'test/r70-owner-approval.test.mjs',
+            'test/r89-privileged-install-boundary.test.mjs',
+            'test/r186-controller-owner-grant.test.mjs',
+            'test/r186-owner-consent-preflight.test.mjs',
+            'test/r186-owner-enrollment.test.mjs',
+            'test/r186-owner-grant-broker.test.mjs',
+            'test/r186-owner-local-signing.test.mjs',
+            'test/r186-owner-request.test.mjs',
+            'test/r186-owner-review-export.test.mjs',
+            'test/r188-owner-uac.test.mjs',
+            'test/r188-uac-boundary.test.mjs',
+            'test/r193-limited-migration-contract.test.mjs',
+            'test/r193-live-owner-subject.test.mjs',
+            'test/r193-native-process-observer.test.mjs',
+            'test/r193-native-token.test.mjs',
+            'test/r193-owner-enrollment-entrypoint.test.mjs',
+            'test/r193-owner-secret-acl.test.mjs',
+            'test/r193-owner-uac-broker.test.mjs',
+            'test/r193-owner-uac-entrypoint.test.mjs',
+            'test/r193-release-readiness.test.mjs',
+            'test/r193-release-identity.test.mjs',
+            'test/r194-release-identity.test.mjs',
+            'test/r194-release-readiness.test.mjs',
+            'test/r193-uac-r70-bridge.test.mjs',
+            'test/r194-windows-gate.test.mjs',
+            'test/r194-npm-auth-recovery.test.mjs',
+            'test/r194-npm-preauth.test.mjs'
+            'test/r195-canonical-owner-observation.test.mjs'
+            'test/r206-candidate-evidence.test.mjs'
+            'test/r206-release-contract.test.mjs'
+            'test/r206-release-readiness.test.mjs'
+        )
+        Run-Node -label 'focused' -nodeArgs (@('--test','--test-reporter=tap','--test-concurrency=1')+$focused)
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        Need (Test-Path -LiteralPath $scratchDrive -PathType Container) 'R206_CROSS_VOLUME_DRIVE_UNAVAILABLE'
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R206-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previousStateRoot=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r206-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            [IO.Directory]::CreateDirectory($isolated)|Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previousStateRoot
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R206_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot
+    Pop-Location
+}

package/scripts/init-desktop-policy-r199.ps1

@@ -0,0 +1,85 @@
+[CmdletBinding()]
+param(
+    [string]$RuntimeRoot = '',
+    [string]$OutputPath = '',
+    [string[]]$AllowedActions = @('pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input')
+)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+function Get-Sha256Hex {
+    param([Parameter(Mandatory=$true)][string]$Path)
+    $Stream=[System.IO.File]::OpenRead([System.IO.Path]::GetFullPath($Path))
+    try{$Hasher=[System.Security.Cryptography.SHA256]::Create();try{return ([System.BitConverter]::ToString($Hasher.ComputeHash($Stream))).Replace('-','').ToLowerInvariant()}finally{$Hasher.Dispose()}}
+    finally{$Stream.Dispose()}
+}
+
+$Root=Split-Path -Parent $PSScriptRoot
+$Controller=Join-Path $Root 'controller'
+if([string]::IsNullOrWhiteSpace($RuntimeRoot)){ $RuntimeRoot=Join-Path $Controller 'runtime' }
+if([string]::IsNullOrWhiteSpace($OutputPath)){ $OutputPath=Join-Path $Controller 'deadbyte-desktop-policy.json' }
+$RuntimeRoot=[System.IO.Path]::GetFullPath($RuntimeRoot)
+$OutputPath=[System.IO.Path]::GetFullPath($OutputPath)
+$Observer=[System.IO.Path]::GetFullPath((Join-Path $Root 'bin\deadbyte-desktop-observer-r40.exe'))
+$Input=[System.IO.Path]::GetFullPath((Join-Path $Root 'bin\deadbyte-desktop-input-r40.exe'))
+$Grounder=[System.IO.Path]::GetFullPath((Join-Path $Root 'bin\deadbyte-desktop-uia-r199-fixed.exe'))
+if(-not (Test-Path -LiteralPath $Observer -PathType Leaf)){throw "observer binary missing: $Observer"}
+if(-not (Test-Path -LiteralPath $Input -PathType Leaf)){throw "input binary missing: $Input"}
+if(-not (Test-Path -LiteralPath $Grounder -PathType Leaf)){throw "UIA grounder binary missing: $Grounder"}
+$Known=@('pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input')
+if($AllowedActions.Count -lt 1){throw 'AllowedActions cannot be empty'}
+$Unique=@($AllowedActions | Sort-Object -Unique)
+if($Unique.Count -ne $AllowedActions.Count -or @($AllowedActions | Where-Object { $_ -notin $Known }).Count -gt 0){throw 'AllowedActions invalid'}
+New-Item -ItemType Directory -Force -Path $RuntimeRoot | Out-Null
+$Evidence=Join-Path $RuntimeRoot 'desktop-evidence'
+New-Item -ItemType Directory -Force -Path $Evidence | Out-Null
+$Grant=Join-Path $RuntimeRoot 'desktop-grant.json'
+Remove-Item -LiteralPath $Grant -Force -ErrorAction SilentlyContinue
+$Policy=[ordered]@{
+    schema='deadbyte.desktop-policy.v1'
+    enabled=$true
+    grant_file=$Grant
+    evidence_dir=$Evidence
+    observer=[ordered]@{
+        executable=$Observer
+        sha256=Get-Sha256Hex -Path $Observer
+        backend='gdi-bitblt-fallback'
+    }
+    input=[ordered]@{
+        executable=$Input
+        sha256=Get-Sha256Hex -Path $Input
+    }
+    grounder=[ordered]@{
+        executable=$Grounder
+        sha256=Get-Sha256Hex -Path $Grounder
+    }
+    allowed_input_desktops=@('Default')
+    allowed_actions=@($AllowedActions)
+    limits=[ordered]@{
+        max_frame_age_ms=2000
+        max_frame_bytes=134217728
+        capture_timeout_ms=10000
+        input_timeout_ms=5000
+        ground_timeout_ms=5000
+        post_observe_timeout_ms=10000
+        max_preview_bytes=1048576
+        max_text_bytes=4096
+    }
+}
+$Parent=Split-Path -Parent $OutputPath
+New-Item -ItemType Directory -Force -Path $Parent | Out-Null
+$Json=$Policy | ConvertTo-Json -Depth 8
+$Utf8=New-Object System.Text.UTF8Encoding($false)
+$Tmp=$OutputPath+'.tmp'
+[System.IO.File]::WriteAllText($Tmp,$Json,$Utf8)
+Move-Item -LiteralPath $Tmp -Destination $OutputPath -Force
+[pscustomobject]@{
+    status='created'
+    policy_path=$OutputPath
+    policy_sha256=Get-Sha256Hex -Path $OutputPath
+    observer_sha256=$Policy.observer.sha256
+    input_sha256=$Policy.input.sha256
+    grounder_sha256=$Policy.grounder.sha256
+    grant_file=$Grant
+    grant_state='DISARMED'
+    action_kinds=@($AllowedActions)
+}|ConvertTo-Json -Depth 6

package/scripts/npm-interactive-r194.mjs

@@ -0,0 +1,13 @@
+// R194 publication failure boundary: do not infer auth failure from a generic 404.
+// Only an explicit npm auth code, or the exact npm registry PUT permission refusal,
+// can be treated as a definitively rejected submission.
+const AUTH_CODE = /(?:^|\s)(?:E401|E403|EOTP|ENEEDAUTH|EAUTH)(?:\s|$)/i;
+const PERMISSION = /(?:you do not have permission to access it|you (?:don't|do not) have permission to publish|permission denied|forbidden|not authorized)/i;
+const REGISTRY_PUT = /\b404\s+Not\s+Found\s+-\s+PUT\s+https:\/\/registry\.npmjs\.org\/deadbyte-mcp(?:\s|\?|\b)/i;
+export function classifyNpmPublishFailure({exitCode,output}={}){
+ if(exitCode===0)return 'SUBMISSION_ACCEPTED';
+ const text=typeof output==='string'?output.slice(-65536):'';
+ if(AUTH_CODE.test(text))return 'EAUTH';
+ if(REGISTRY_PUT.test(text)&&PERMISSION.test(text))return 'EAUTH';
+ return 'OUTCOME_UNKNOWN';
+}

package/scripts/npm-publication-r65.mjs

@@ -55,7 +55,7 @@ function result(state,extra={}){return Object.freeze({state,...extra});}
 // The no-clobber claim is the dispatch fence: once it exists, no invocation may
 // submit the same immutable npm version again, even if the first process dies.
 export async function reconcileNpmPublication({recordPath,version,manifestSha256,localBytes,publish,lookup,tags,fetchTarball,
-  timeoutMs=180000,pollMs=1500,sleep=pause,now=()=>performance.now()}){
+  timeoutMs=180000,pollMs=1500,sleep=pause,now=()=>performance.now(),authorizeAuthRetry=null,authorizePublish=null}){
   if(!path.isAbsolute(recordPath)||!/^\d+\.\d+\.\d+$/.test(version)||!HEX64.test(String(manifestSha256))||!Buffer.isBuffer(localBytes)||
     !Number.isSafeInteger(timeoutMs)||timeoutMs<0||timeoutMs>900000||!Number.isSafeInteger(pollMs)||pollMs<1||pollMs>30000||
     [publish,lookup,tags,fetchTarball,sleep,now].some(fn=>typeof fn!=='function'))throw new Error('npm publication reconciliation inputs invalid');
@@ -97,6 +97,14 @@ export async function reconcileNpmPublication({recordPath,version,manifestSha256
   }
   if(!claim){
     if(observed)return observed; // Registry outage: do not submit while identity is unknown.
+    // R194: check authenticated package ownership before creating the irreversible claim.
+    if(authorizePublish!==null){
+      if(typeof authorizePublish!=='function')throw new Error('npm owner preflight invalid');
+      let authorized=false;
+      try{authorized=(await authorizePublish(Object.freeze({version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256})))===true;}
+      catch{return result('AUTH_REQUIRED',{reason:'owner authentication preflight failed before submission'});}
+      if(!authorized)return result('AUTH_REQUIRED',{reason:'owner authentication preflight is not confirmed'});
+    }
     let created=false;
     try{
       await publishClaim(claimFile,{schema:'deadbyte.npm-publication-claim.r65.v1',version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256,created_at_utc:new Date().toISOString()});
@@ -114,15 +122,67 @@ export async function reconcileNpmPublication({recordPath,version,manifestSha256
         await publish();
         await event(recordPath,'SUBMISSION_ACCEPTED',{tarball_sha256:tarballSha256});
       }catch(error){
-        const auth=/E401|E403|EOTP|authentication|one-time password|2FA/i.test(String(error?.code??'')+' '+String(error?.message??''));
+        const auth=/E401|E403|EOTP|EAUTH|ENEEDAUTH|authentication|one-time password|2FA/i.test(String(error?.code??'')+' '+String(error?.message??''));
         await event(recordPath,auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{error_code:String(error?.code??'UNKNOWN').slice(0,64)});
         return result(auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{reason:String(error?.code??error?.message??error)});
       }
     }
   }
   const states=await priorState(recordPath);
-  if(states.some(item=>item.state==='AUTH_REQUIRED'))return result('AUTH_REQUIRED');
-  const accepted=states.some(item=>item.state==='SUBMISSION_ACCEPTED');
+  const authRejected=states.some(item=>item.state==='AUTH_REQUIRED');
+  let accepted=states.some(item=>item.state==='SUBMISSION_ACCEPTED');
+  if(authRejected&&!accepted){
+    // An original ambiguous outcome cannot become retryable via a later login.
+    if(states.some(item=>item.state==='OUTCOME_UNKNOWN'))
+      return result('OUTCOME_UNKNOWN',{reason:'submission outcome is ambiguous; original claim retained'});
+    const retryFile=path.join(recordPath,'auth-retry-claim.json');
+    const retry=await readClaim(retryFile);
+    if(retry?.incomplete)return result('OUTCOME_UNKNOWN',{reason:'incomplete auth retry claim'});
+    if(retry){
+      if(retry.schema!=='deadbyte.npm-auth-retry-claim.r194.v1'||retry.version!==version||
+         retry.manifest_sha256!==manifestSha256||retry.tarball_sha256!==tarballSha256)
+        return result('REGISTRY_REJECTED',{reason:'auth retry claim artifact mismatch'});
+      return result('AUTH_REQUIRED',{reason:'one-time auth retry was already dispatched or claimed; do not retry'});
+    }
+    if(typeof authorizeAuthRetry!=='function')return result('AUTH_REQUIRED');
+    let allowed=false;
+    try{
+      allowed=(await authorizeAuthRetry(Object.freeze({
+        version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256
+      })))===true;
+    }catch{return result('AUTH_REQUIRED',{reason:'fresh authenticated owner check failed'});}
+    if(!allowed)return result('AUTH_REQUIRED',{reason:'authenticated owner preflight not confirmed'});
+    // Re-read registry just before the one-time retry fence.
+    const beforeRetry=await check();
+    if(beforeRetry?.state==='REGISTRY_IDENTITY_VERIFIED'||beforeRetry?.state==='REGISTRY_REJECTED')return beforeRetry;
+    if(beforeRetry?.state==='OUTCOME_UNKNOWN')return beforeRetry;
+    try{
+      await writeExclusive(retryFile,{
+        schema:'deadbyte.npm-auth-retry-claim.r194.v1',version,
+        manifest_sha256:manifestSha256,tarball_sha256:tarballSha256,
+        created_at_utc:new Date().toISOString()
+      });
+    }catch(error){
+      if(error?.code==='EEXIST')return result('AUTH_REQUIRED',{reason:'concurrent auth retry already claimed; do not dispatch'});
+      throw error;
+    }
+    // A durable retry claim is written BEFORE any additional network effect.
+    await event(recordPath,'AUTH_RETRY_STARTED',{tarball_sha256:tarballSha256});
+    try{
+      await publish();
+      await event(recordPath,'SUBMISSION_ACCEPTED',{tarball_sha256:tarballSha256,retry:'auth-only'});
+      accepted=true;
+    }catch(error){
+      const auth=/E401|E403|EOTP|EAUTH|ENEEDAUTH|authentication|one-time password|2FA/i.test(
+        String(error?.code??'')+' '+String(error?.message??''));
+      await event(recordPath,auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{
+        error_code:String(error?.code??'UNKNOWN').slice(0,64),retry:'auth-only'
+      });
+      return result(auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{
+        reason:'one-time auth retry rejected or unverified; retry claim retained'
+      });
+    }
+  }
   const started=now();
   do{
     observed=await check();