deadbyte-mcp 0.15.72 → 0.15.75

package/scripts/npm-release-r48.mjs

@@ -1,6 +1,7 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { reconcileNpmPublication } from './npm-publication-r65.mjs';
+import { classifyNpmPublishFailure } from './npm-interactive-r194.mjs';
 import { mkdtemp, readFile, rm, unlink, mkdir } from 'node:fs/promises';
 import {preserveNpmTarball,assertVacantPackDestination} from './npm-preserve-artifact-r67.mjs';
 import {assertR67NpmPublishReady} from './npm-release-readiness-r67.mjs';
@@ -12,8 +13,12 @@ import {assertR165NpmPublishReady} from './npm-release-readiness-r165.mjs';
 import {assertR166NpmPublishReady} from './npm-release-readiness-r166.mjs';
 import {assertR167NpmPublishReady,assertR167PackedIdentity} from './npm-release-readiness-r167.mjs';
 import {assertR168NpmPublishReady,assertR168PackedIdentity} from './npm-release-readiness-r168.mjs';
+import {assertR193NpmPublishReady,assertR193PackedIdentity} from './npm-release-readiness-r193.mjs';
+import {assertR194NpmPublishReady,assertR194PackedIdentity} from './npm-release-readiness-r194.mjs';
+import {assertR195NpmPublishReady,assertR195PackedIdentity} from './npm-release-readiness-r195.mjs';
+import {assertR206NpmPublishReady,assertR206PackedIdentity} from './npm-release-readiness-r206.mjs';
 import {resumePackRecord} from '../src/npm-publication-resume-r168.mjs';
-import { existsSync } from 'node:fs';
+import { existsSync,mkdtempSync,readdirSync,readFileSync,rmSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
 import os from 'node:os';
@@ -46,18 +51,39 @@ function runNpm(args, options = {}) {
   return run(node, [npmCli, ...args], options);
 }
 
+function verifyNpmOwnerPreflight(){
+  try{
+    const registry=runNpm(['config','get','registry'],{timeout:30000}).trim();
+    if(registry!=='https://registry.npmjs.org/')return false;
+    const name=runNpm(['whoami','--registry=https://registry.npmjs.org/'],{timeout:30000}).trim();
+    if(name!=='deadbytes')return false;
+    const owners=runNpm(['owner','ls','deadbyte-mcp','--registry=https://registry.npmjs.org/'],{timeout:30000});
+    return owners.split(/\r?\n/).some(line=>/^\s*deadbytes(?:\s|$)/.test(line));
+  }catch{return false;}
+}
+
 function runNpmInteractive(args, options = {}) {
   const { cwd = root, timeout = 300000 } = options;
-  const r = spawnSync(node, [npmCli, ...args], {
-    cwd,
-    timeout,
-    stdio: 'inherit',
-    shell: false,
-    windowsHide: false,
-  });
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw new Error('Interactive npm command failed (exit=' + r.status + ', cwd=' + cwd + ')');
-  return '';
+  const logDir=mkdtempSync(path.join(os.tmpdir(),'deadbyte-r194-npm-diagnostic-'));
+  try{
+    // Preserve interactive browser/2FA prompts; classify failures from the
+    // isolated npm debug log without printing or preserving credential data.
+    const r=spawnSync(node,[npmCli,...args,'--logs-dir',logDir],{
+      cwd,timeout,stdio:'inherit',shell:false,windowsHide:false
+    });
+    if(r.error)throw r.error;
+    if(r.status!==0){
+      const debug=readdirSync(logDir).filter(name=>name.endsWith('-debug-0.log')).slice(-3)
+        .map(name=>readFileSync(path.join(logDir,name),'utf8').slice(-16000)).join('\n');
+      const reason=classifyNpmPublishFailure({exitCode:r.status,output:debug});
+      const error=new Error('Interactive npm publish did not complete; classified '+reason);
+      error.code=reason;
+      throw error;
+    }
+    return '';
+  }finally{
+    rmSync(logDir,{recursive:true,force:true});
+  }
 }
 
 function parseJson(text) {
@@ -123,6 +149,23 @@ async function main() {
     if (!publishOnly) throw new Error('PUBLISH_BLOCKED R168 requires --publish-only; activation is separate');
     r168Readiness=await assertR168NpmPublishReady(release,{root});
   }
+  let r193Readiness=null;
+  if (!isVerifyOnly && version==='0.15.73') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R193 requires --publish-only; owner enrollment, runtime migration, and activation are separate authority boundaries');
+    r193Readiness=await assertR193NpmPublishReady(release,{root});
+  }
+  let r194Readiness=null;
+  if (!isVerifyOnly && version==='0.15.74') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R194 requires --publish-only; activation remains separately authorized');
+    r194Readiness=await assertR194NpmPublishReady(release,{root});
+  }
+  let r195Readiness=null;
+  let r206Readiness=null;
+  if (!isVerifyOnly && version==='0.15.75') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R206 requires --publish-only; owner enrollment and activation remain separate');
+    if(release.train==='R206')r206Readiness=await assertR206NpmPublishReady(release,{root});
+    else r195Readiness=await assertR195NpmPublishReady(release,{root});
+  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
@@ -262,10 +305,31 @@ async function main() {
       ...r168Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
       observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
     });
+    if(r193Readiness)assertR193PackedIdentity({
+      ...r193Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
+    if(r194Readiness)assertR194PackedIdentity({
+      ...r194Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
+    if(r195Readiness)assertR195PackedIdentity({
+      ...r195Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
+    if(r206Readiness)assertR206PackedIdentity({
+      ...r206Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
 
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;
+    const ownerAuth=async subject=>
+      subject.version===version&&subject.manifest_sha256===manifestSha256&&
+      subject.tarball_sha256===createHash('sha256').update(localBytes).digest('hex')&&
+      verifyNpmOwnerPreflight();
     const reconciliation=await reconcileNpmPublication({recordPath:publicationDir,version,manifestSha256,localBytes,
+      authorizePublish:ownerAuth,authorizeAuthRetry:ownerAuth,
       publish:async()=>runNpmInteractive(['publish',publishTarball,'--access','public','--auth-type=web'],{timeout:300000}),
       lookup:async()=>{
         try{

package/scripts/npm-release-readiness-r193.mjs

@@ -0,0 +1,80 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex64=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const fail=message=>{throw new Error(`PUBLISH_BLOCKED R193 ${message}`);};
+const required=(value,message)=>{if(!value)fail(message);};
+
+async function checkedFile(file,expected,{maxBytes=64*1024*1024}={}){
+  required(hex64(expected),'evidence digest missing');
+  let info;try{info=await lstat(file);}catch{fail('evidence file absent');}
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<=maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+function tapSummary(text,label){
+  const summaries=[...text.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,`${label} TAP summary absent`);
+  const last=summaries.at(-1);
+  return {tests:Number(last[1]),passes:Number(last[3]),fails:Number(last[4]),cancelled:Number(last[5]),skips:Number(last[6])};
+}
+
+export function assertR193PackedIdentity({tarball_sha256,tarball_integrity,tarball_shasum,observedSha256,observedIntegrity,observedShasum}={}){
+  required(hex64(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR193NpmPublishReady(release,{root,closureRoot=process.env.DEADBYTE_R193_CLOSURE_ROOT}={}){
+  required(release?.version==='0.15.73'&&release?.train==='R193'&&
+    release?.r193?.scope==='PROTECTED_OWNER_AUTHORIZATION_AND_LIMITED_RUNTIME_MIGRATION','candidate metadata invalid');
+  required(release?.r193?.public_tool_delta===0&&release?.r193?.authority_scope_delta===0,'public authority surface widened');
+  required(release?.parent?.version==='0.15.72'&&
+    release?.parent?.release_id==='v0.15.72-0a5d9436e06e2d9e'&&
+    release?.parent?.manifest_sha256==='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90'&&
+    release?.parent?.generation_manifest_sha256==='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0','lineage mismatch');
+  required(root&&path.isAbsolute(root)&&closureRoot&&path.isAbsolute(closureRoot),'closure root absent');
+  const expected=path.resolve(root,'..','..','testing','r193-final-closure');
+  required(path.resolve(closureRoot).toLowerCase()===expected.toLowerCase(),'closure root outside scoped testing folder');
+
+  let closure;try{closure=JSON.parse(await readFile(path.join(closureRoot,'closure.json'),'utf8'));}catch{fail('closure unreadable');}
+  required(closure?.schema==='deadbyte.r193-release-closure.v1'&&closure.status==='RELEASE_READY'&&
+    closure.version==='0.15.73'&&closure.train==='R193','closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&
+    closure.production_manifest_sha256===release.parent.manifest_sha256&&
+    closure.production_generation_manifest_sha256===release.parent.generation_manifest_sha256,'production predecessor mismatch');
+  required(hex64(closure.manifest_sha256)&&closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  required(closure.compact_tools===43&&closure.full_tools===117,'catalog count mismatch');
+  required(closure.owner_enrollment==='NOT_RUN'&&closure.limited_runtime_migration==='NOT_RUN'&&
+    closure.production_activation==='NOT_RUN','prepublication closure crossed production authority boundary');
+
+  const receipt=JSON.parse((await checkedFile(path.join(closureRoot,'protected-install-receipt.json'),closure.protected_receipt_sha256)).toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.73'&&
+    receipt.source_manifest_sha256===closure.manifest_sha256&&receipt.protected_manifest_sha256===closure.manifest_sha256,
+    'protected exact-byte receipt mismatch');
+  const focused=(await checkedFile(path.join(closureRoot,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(closureRoot,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(closureRoot,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R193_STAGE_PASS=focused'),'focused protected gate incomplete');
+  const focusedSummary=tapSummary(focused,'focused');
+  required(focusedSummary.fails===0&&focusedSummary.cancelled===0&&focusedSummary.passes>=60&&focusedSummary.skips<=2,'focused regression count mismatch');
+  required(full.includes('R193_STAGE_PASS=full'),'full protected gate incomplete');
+  const summary=tapSummary(full,'full');
+  required(summary.tests>=2150&&summary.passes>=2100&&summary.fails===0&&summary.cancelled===0&&summary.skips<=70&&summary.passes+summary.skips===summary.tests,
+    'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),
+    'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{fail('tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.73.tgz'&&artifact.bytes>0&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum,'tarball identity mismatch');
+  return Object.freeze({status:'R193_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,
+    tests:summary.tests,passes:summary.passes,skips:summary.skips});
+}

package/scripts/npm-release-readiness-r194.mjs

@@ -0,0 +1,80 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex64=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const fail=message=>{throw new Error(`PUBLISH_BLOCKED R194 ${message}`);};
+const required=(value,message)=>{if(!value)fail(message);};
+
+async function checkedFile(file,expected,{maxBytes=64*1024*1024}={}){
+  required(hex64(expected),'evidence digest missing');
+  let info;try{info=await lstat(file);}catch{fail('evidence file absent');}
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<=maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+function tapSummary(text,label){
+  const summaries=[...text.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,`${label} TAP summary absent`);
+  const last=summaries.at(-1);
+  return {tests:Number(last[1]),passes:Number(last[3]),fails:Number(last[4]),cancelled:Number(last[5]),skips:Number(last[6])};
+}
+
+export function assertR194PackedIdentity({tarball_sha256,tarball_integrity,tarball_shasum,observedSha256,observedIntegrity,observedShasum}={}){
+  required(hex64(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR194NpmPublishReady(release,{root,closureRoot=process.env.DEADBYTE_R194_CLOSURE_ROOT}={}){
+  required(release?.version==='0.15.74'&&release?.train==='R194'&&
+    release?.r194?.scope==='NPM_AUTH_RECOVERY_AND_OWNER_AUTHORIZATION','candidate metadata invalid');
+  required(release?.r194?.public_tool_delta===0&&release?.r194?.authority_scope_delta===0,'public authority surface widened');
+  required(release?.parent?.version==='0.15.72'&&
+    release?.parent?.release_id==='v0.15.72-0a5d9436e06e2d9e'&&
+    release?.parent?.manifest_sha256==='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90'&&
+    release?.parent?.generation_manifest_sha256==='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0','lineage mismatch');
+  required(root&&path.isAbsolute(root)&&closureRoot&&path.isAbsolute(closureRoot),'closure root absent');
+  const expected=path.resolve(root,'..','..','testing','r194-final-closure');
+  required(path.resolve(closureRoot).toLowerCase()===expected.toLowerCase(),'closure root outside scoped testing folder');
+
+  let closure;try{closure=JSON.parse(await readFile(path.join(closureRoot,'closure.json'),'utf8'));}catch{fail('closure unreadable');}
+  required(closure?.schema==='deadbyte.r194-release-closure.v1'&&closure.status==='RELEASE_READY'&&
+    closure.version==='0.15.74'&&closure.train==='R194','closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&
+    closure.production_manifest_sha256===release.parent.manifest_sha256&&
+    closure.production_generation_manifest_sha256===release.parent.generation_manifest_sha256,'production predecessor mismatch');
+  required(hex64(closure.manifest_sha256)&&closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  required(closure.compact_tools===43&&closure.full_tools===117,'catalog count mismatch');
+  required(closure.owner_enrollment==='NOT_RUN'&&closure.limited_runtime_migration==='NOT_RUN'&&
+    closure.production_activation==='NOT_RUN','prepublication closure crossed production authority boundary');
+
+  const receipt=JSON.parse((await checkedFile(path.join(closureRoot,'protected-install-receipt.json'),closure.protected_receipt_sha256)).toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.74'&&
+    receipt.source_manifest_sha256===closure.manifest_sha256&&receipt.protected_manifest_sha256===closure.manifest_sha256,
+    'protected exact-byte receipt mismatch');
+  const focused=(await checkedFile(path.join(closureRoot,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(closureRoot,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(closureRoot,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R194_STAGE_PASS=focused'),'focused protected gate incomplete');
+  const focusedSummary=tapSummary(focused,'focused');
+  required(focusedSummary.fails===0&&focusedSummary.cancelled===0&&focusedSummary.passes>=60&&focusedSummary.skips<=2,'focused regression count mismatch');
+  required(full.includes('R194_STAGE_PASS=full'),'full protected gate incomplete');
+  const summary=tapSummary(full,'full');
+  required(summary.tests>=2150&&summary.passes>=2100&&summary.fails===0&&summary.cancelled===0&&summary.skips<=70&&summary.passes+summary.skips===summary.tests,
+    'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),
+    'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{fail('tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.74.tgz'&&artifact.bytes>0&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum,'tarball identity mismatch');
+  return Object.freeze({status:'R194_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,
+    tests:summary.tests,passes:summary.passes,skips:summary.skips});
+}

package/scripts/npm-release-readiness-r195.mjs

@@ -0,0 +1,72 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex64=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const fail=message=>{throw new Error(`PUBLISH_BLOCKED R195 ${message}`);};
+const required=(value,message)=>{if(!value)fail(message);};
+
+async function checkedFile(file,expected,{maxBytes=64*1024*1024}={}){
+  required(hex64(expected),'evidence digest missing');
+  let info;try{info=await lstat(file);}catch{fail('evidence file absent');}
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<=maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+function tapSummary(text,label){
+  const summaries=[...text.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,`${label} TAP summary absent`);
+  const last=summaries.at(-1);
+  return {tests:Number(last[1]),passes:Number(last[3]),fails:Number(last[4]),cancelled:Number(last[5]),skips:Number(last[6])};
+}
+
+export function assertR195PackedIdentity({tarball_sha256,tarball_integrity,tarball_shasum,observedSha256,observedIntegrity,observedShasum}={}){
+  required(hex64(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR195NpmPublishReady(release,{root,closureRoot=process.env.DEADBYTE_R195_CLOSURE_ROOT}={}){
+  required(release?.version==='0.15.75'&&release?.train==='R195'&&
+    release?.r195?.scope==='CANONICAL_PROTECTED_OWNER_OBSERVATION','candidate metadata invalid');
+  required(release?.r195?.public_tool_delta===0&&release?.r195?.authority_scope_delta===0,'public authority surface widened');
+  required(release?.parent?.version==='0.15.74'&&release?.parent?.release_id==='v0.15.74-e84bf4eed16e9443'&&
+    release?.parent?.manifest_sha256==='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47'&&
+    release?.parent?.generation_manifest_sha256==='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7','lineage mismatch');
+  required(root&&path.isAbsolute(root)&&closureRoot&&path.isAbsolute(closureRoot),'closure root absent');
+  const expected=path.resolve(root,'..','..','testing','r195-final-closure');
+  required(path.resolve(closureRoot).toLowerCase()===expected.toLowerCase(),'closure root outside scoped testing folder');
+  let closure;try{closure=JSON.parse(await readFile(path.join(closureRoot,'closure.json'),'utf8'));}catch{fail('closure unreadable');}
+  required(closure?.schema==='deadbyte.r195-release-closure.v1'&&closure.status==='RELEASE_READY'&&
+    closure.version==='0.15.75'&&closure.train==='R195','closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&closure.production_manifest_sha256===release.parent.manifest_sha256&&
+    closure.production_generation_manifest_sha256===release.parent.generation_manifest_sha256,'production predecessor mismatch');
+  required(hex64(closure.manifest_sha256)&&closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  required(closure.compact_tools===43&&closure.full_tools===117,'catalog count mismatch');
+  required(closure.owner_enrollment==='NOT_RUN'&&closure.production_activation==='NOT_RUN','prepublication closure crossed authority boundary');
+  const receipt=JSON.parse((await checkedFile(path.join(closureRoot,'protected-install-receipt.json'),closure.protected_receipt_sha256)).toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.75'&&receipt.source_manifest_sha256===closure.manifest_sha256&&
+    receipt.protected_manifest_sha256===closure.manifest_sha256,'protected exact-byte receipt mismatch');
+  const focused=(await checkedFile(path.join(closureRoot,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(closureRoot,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(closureRoot,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R195_STAGE_PASS=focused'),'focused protected gate incomplete');
+  const focusedSummary=tapSummary(focused,'focused');
+  required(focusedSummary.fails===0&&focusedSummary.cancelled===0&&focusedSummary.passes>=70&&focusedSummary.skips<=3,'focused regression count mismatch');
+  required(full.includes('R195_STAGE_PASS=full'),'full protected gate incomplete');
+  const summary=tapSummary(full,'full');
+  required(summary.tests>=2200&&summary.passes>=2100&&summary.fails===0&&summary.cancelled===0&&summary.skips<=70&&summary.passes+summary.skips===summary.tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{fail('tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.75.tgz'&&artifact.bytes>0&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum,'tarball identity mismatch');
+  return Object.freeze({status:'R195_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,
+    tests:summary.tests,passes:summary.passes,skips:summary.skips});
+}

package/scripts/npm-release-readiness-r206.mjs

@@ -0,0 +1,76 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex64=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const fail=message=>{throw new Error(`PUBLISH_BLOCKED R206 ${message}`);};
+const required=(value,message)=>{if(!value)fail(message);};
+
+async function checkedFile(file,expected,{maxBytes=64*1024*1024}={}){
+  required(hex64(expected),'evidence digest missing');
+  let info;try{info=await lstat(file);}catch{fail('evidence file absent');}
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<=maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+function tapSummary(text,label){
+  const summaries=[...text.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,`${label} TAP summary absent`);
+  const last=summaries.at(-1);
+  return {tests:Number(last[1]),passes:Number(last[3]),fails:Number(last[4]),cancelled:Number(last[5]),skips:Number(last[6])};
+}
+
+export function assertR206PackedIdentity({tarball_sha256,tarball_integrity,tarball_shasum,observedSha256,observedIntegrity,observedShasum}={}){
+  required(hex64(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR206NpmPublishReady(release,{root,closureRoot=process.env.DEADBYTE_R206_CLOSURE_ROOT}={}){
+  required(release?.version==='0.15.75'&&release?.train==='R206'&&
+    release?.r206?.scope==='EVIDENCE_BOUND_CANDIDATE_SELECTION_RELEASE_CLOSURE','candidate metadata invalid');
+  required(release?.r206?.public_tool_delta===0&&release?.r206?.authority_scope_delta===0&&
+    release?.r206?.selector_release_authority===false,'public authority surface widened');
+  required(release?.source_predecessor?.train==='R205'&&
+    release?.source_predecessor?.manifest_sha256==='166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92',
+    'source predecessor mismatch');
+  required(release?.parent?.version==='0.15.74'&&release?.parent?.release_id==='v0.15.74-e84bf4eed16e9443'&&
+    release?.parent?.manifest_sha256==='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47'&&
+    release?.parent?.generation_manifest_sha256==='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7','lineage mismatch');
+  required(root&&path.isAbsolute(root)&&closureRoot&&path.isAbsolute(closureRoot),'closure root absent');
+  const expected=path.resolve(root,'..','..','testing','r206-final-closure');
+  required(path.resolve(closureRoot).toLowerCase()===expected.toLowerCase(),'closure root outside scoped testing folder');
+  let closure;try{closure=JSON.parse(await readFile(path.join(closureRoot,'closure.json'),'utf8'));}catch{fail('closure unreadable');}
+  required(closure?.schema==='deadbyte.r206-release-closure.v1'&&closure.status==='RELEASE_READY'&&
+    closure.version==='0.15.75'&&closure.train==='R206','closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&closure.production_manifest_sha256===release.parent.manifest_sha256&&
+    closure.production_generation_manifest_sha256===release.parent.generation_manifest_sha256,'production predecessor mismatch');
+  required(hex64(closure.manifest_sha256)&&closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  required(closure.compact_tools===43&&closure.full_tools===117,'catalog count mismatch');
+  required(closure.owner_enrollment==='NOT_RUN'&&closure.production_activation==='NOT_RUN','prepublication closure crossed authority boundary');
+  const receipt=JSON.parse((await checkedFile(path.join(closureRoot,'protected-install-receipt.json'),closure.protected_receipt_sha256)).toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.75'&&receipt.source_manifest_sha256===closure.manifest_sha256&&
+    receipt.protected_manifest_sha256===closure.manifest_sha256,'protected exact-byte receipt mismatch');
+  const focused=(await checkedFile(path.join(closureRoot,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(closureRoot,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(closureRoot,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R206_STAGE_PASS=focused'),'focused protected gate incomplete');
+  const focusedSummary=tapSummary(focused,'focused');
+  required(focusedSummary.fails===0&&focusedSummary.cancelled===0&&focusedSummary.passes>=70&&focusedSummary.skips<=3,'focused regression count mismatch');
+  required(full.includes('R206_STAGE_PASS=full'),'full protected gate incomplete');
+  const summary=tapSummary(full,'full');
+  required(summary.tests>=2200&&summary.passes>=2100&&summary.fails===0&&summary.cancelled===0&&summary.skips<=70&&summary.passes+summary.skips===summary.tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{fail('tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.75.tgz'&&artifact.bytes>0&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum,'tarball identity mismatch');
+  return Object.freeze({status:'R206_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,
+    tests:summary.tests,passes:summary.passes,skips:summary.skips});
+}

package/scripts/r188-owner-uac-review.ps1

@@ -0,0 +1,91 @@
+#requires -Version 5.1
+#requires -RunAsAdministrator
+# R188: owner-operated elevated REVIEW receipt only. Never issues an agent grant.
+# Invoke by hand from a trusted interactive desktop; not through an agent or MCP.
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$RequestPath)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+$program=[IO.Path]::GetFullPath($env:ProgramFiles).TrimEnd('\')+'\'
+if(-not ($root.TrimEnd('\')+'\').StartsWith($program,[StringComparison]::OrdinalIgnoreCase)){
+ throw 'R188 must run from an installed Program Files release, not a writable development directory'
+}
+$settings=Get-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+if([int]$settings.EnableLUA -ne 1 -or [int]$settings.PromptOnSecureDesktop -ne 1 -or
+   [int]$settings.ConsentPromptBehaviorAdmin -eq 0){
+ throw 'R188 UAC secure desktop and nonautomatic admin consent must be enabled'
+}
+if(-not [Environment]::UserInteractive){throw 'R188 requires a local interactive owner session'}
+$node='C:\Program Files\nodejs\node.exe'
+if(-not (Test-Path -LiteralPath $node -PathType Leaf)){throw 'R188 trusted Node executable missing'}
+$request=[IO.Path]::GetFullPath($RequestPath)
+$preflight=Join-Path $root 'scripts\r188-uac-review-preview.mjs'
+$raw=(& $node $preflight $request 2>&1 | Out-String)
+if($LASTEXITCODE -ne 0){throw ('R188 preflight blocked: '+$raw.Substring(0,[Math]::Min(300,$raw.Length)))}
+$preview=$raw|ConvertFrom-Json
+if([string]$preview.status -cne 'R188_PROTECTED_REVIEW_PREVIEW_ONLY' -or
+  [bool]$preview.authority_granted -or [bool]$preview.owner_approved -or
+  [bool]$preview.live_epoch_verified -or [bool]$preview.live_policies_verified){
+ throw 'R188 preview unexpectedly claims grant/authorization'
+}
+$phrase=[string]$preview.review_phrase
+if($phrase -cnotmatch '^APPROVE-[A-F0-9]{12}$'){throw 'R188 owner review phrase invalid'}
+Write-Host ''
+Write-Host 'DEADBYTE R188 / OWNER UAC REVIEW' -ForegroundColor Yellow
+Write-Host 'This is a read-only scope REVIEW. It will NOT arm Autonomous.'
+Write-Host ('Request SHA-256: '+[string]$preview.request_sha256)
+Write-Host ('Project: '+[string]$preview.project_root)
+Write-Host ('Action: '+[string]$preview.operation)
+Write-Host ('Duration cap seconds: '+[string]$preview.max_seconds)
+Write-Host ('Expires UTC: '+[string]$preview.expires_at_utc)
+Write-Host ('Release manifest SHA-256: '+[string]$preview.installed_manifest_sha256)
+Write-Host 'Coding policy and live machine epoch still require an independent trusted runtime read.'
+Write-Host 'Do not approve requests you did not initiate and inspect yourself.'
+$entered=Read-Host ('If you recognize this exact request, type '+$phrase+' (anything else rejects)')
+if($entered -cne $phrase){throw 'R188 owner rejected request'}
+$target='C:\Program Files\DEADBYTE-R188-OwnerReview'
+if(-not (Test-Path -LiteralPath $target -PathType Container)){
+ $admins=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')
+ $system=New-Object Security.Principal.SecurityIdentifier('S-1-5-18')
+ $users=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-545')
+ New-Item -ItemType Directory -Path $target -ErrorAction Stop | Out-Null
+ $acl=New-Object Security.AccessControl.DirectorySecurity
+ $acl.SetAccessRuleProtection($true,$false)
+ $acl.SetOwner($admins)
+ $inherit=[Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+ $none=[Security.AccessControl.PropagationFlags]::None
+ $allow=[Security.AccessControl.AccessControlType]::Allow
+ $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($admins,'FullControl',$inherit,$none,$allow)))
+ $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($system,'FullControl',$inherit,$none,$allow)))
+ $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($users,'ReadAndExecute',$inherit,$none,$allow)))
+ Set-Acl -LiteralPath $target -AclObject $acl
+}
+$receipt=[ordered]@{
+ schema='deadbyte.r188-uac-owner-review.v1'
+ status='REVIEWED_NO_GRANT'
+ request_sha256=[string]$preview.request_sha256
+ release_manifest_sha256=[string]$preview.installed_manifest_sha256
+ reviewed_scope=[string]$preview.operation
+ project_root=[string]$preview.project_root
+ duration_cap_seconds=[int]$preview.max_seconds
+ reviewed_at_utc=[DateTime]::UtcNow.ToString('o')
+ live_epoch_verified=$false
+ live_policies_verified=$false
+ owner_reviewed=$true
+ authority_granted=$false
+ grant_issued=$false
+}
+$name=([string]$preview.request_sha256)+'.review.json'
+$dest=Join-Path $target $name
+$text=$receipt|ConvertTo-Json -Compress
+$utf8=New-Object Text.UTF8Encoding($false)
+$stream=[IO.File]::Open($dest,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+try{
+ $bytes=$utf8.GetBytes($text+[Environment]::NewLine)
+ $stream.Write($bytes,0,$bytes.Length)
+ $stream.Flush($true)
+}finally{$stream.Dispose()}
+Write-Host 'R188_OWNER_REVIEWED_NO_GRANT' -ForegroundColor Yellow
+Write-Host ('Receipt: '+$dest)
+Write-Host 'No PEM, Windows Hello, Autonomous grant, npm publish, or production activation performed.'

package/scripts/r188-uac-review-preview.mjs

@@ -0,0 +1,65 @@
+// Protected owner's manual UAC review: verify a request without granting.
+// Requested policy / epoch hashes are UNTRUSTED previews until a protected
+// runtime reader binds them; never interpret this as an authorization token.
+import {readFile,lstat} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {verifyR188OwnerUacRequest} from '../src/r188-owner-uac.mjs';
+const thisFile=fileURLToPath(import.meta.url);
+const root=path.resolve(path.dirname(thisFile),'..');
+const args=process.argv.slice(2);
+function block(reason){throw Error('R188_UAC_REVIEW_BLOCKED '+reason);}
+async function bounded(file,max){
+ const st=await lstat(file);
+ if(!st.isFile()||st.isSymbolicLink()||st.size<1||st.size>max)block('UNSAFE_FILE');
+ return readFile(file);
+}
+async function main(){
+ if(process.platform!=='win32'||process.arch!=='x64')block('WINDOWS_X64_REQUIRED');
+ if(args.length!==1||!path.win32.isAbsolute(args[0]))block('ABSOLUTE_REQUEST_REQUIRED');
+ const os=await inspectTrustedInstallation([
+   process.execPath,thisFile,
+   path.join(root,'MANIFEST.SHA256'),
+   path.join(root,'src','r188-owner-uac.mjs'),
+   path.join(root,'src','canonical-json.mjs'),
+   path.join(root,'src','privileged-install-trust-r89.mjs')
+ ]);
+ if(!os.trusted)block('R89_PROTECTED_INSTALLATION_REQUIRED');
+ const manifestBytes=await bounded(path.join(root,'MANIFEST.SHA256'),512*1024);
+ const manifest=parseManifest(manifestBytes.toString('utf8'));
+ await verifyManifestTreeExact(root,manifest);
+ const request=JSON.parse((await bounded(args[0],64*1024)).toString('utf8'));
+ const subject=request.subject;
+ if(!subject||typeof subject!=='object')block('SUBJECT_MISSING');
+ const expected={
+  machineEpoch:subject.machine_epoch,
+  releaseManifestSha256:subject.release_manifest_sha256,
+  codingPolicySha256:subject.coding_policy_sha256,
+  autonomousPolicySha256:subject.autonomous_policy_sha256,
+  rootId:subject.root_id,projectRoot:subject.project_root,
+  maxSeconds:subject.max_seconds
+ };
+ // Strict self-consistency proof, NOT yet verification of the live epoch/policy.
+ const verified=verifyR188OwnerUacRequest({request,expected,now:new Date()});
+ const {createHash}=await import('node:crypto');
+ const actualManifest=createHash('sha256').update(manifestBytes).digest('hex');
+ if(subject.release_manifest_sha256!==actualManifest)block('INSTALLED_RELEASE_NOT_REVIEWED_RELEASE');
+ process.stdout.write(JSON.stringify({
+   status:'R188_PROTECTED_REVIEW_PREVIEW_ONLY',
+   request_sha256:verified.request_sha256,
+   review_phrase:verified.review_phrase,
+   root_id:subject.root_id,project_root:subject.project_root,
+   max_seconds:subject.max_seconds,operation:subject.operation,
+   expires_at_utc:subject.expires_at_utc,
+   requested_machine_epoch:subject.machine_epoch,
+   requested_coding_policy_sha256:subject.coding_policy_sha256,
+   requested_autonomous_policy_sha256:subject.autonomous_policy_sha256,
+   installed_manifest_sha256:actualManifest,
+   os_acl_trusted:true,
+   live_epoch_verified:false,live_policies_verified:false,
+   authority_granted:false,owner_approved:false
+ })+'\n');
+}
+main().catch(e=>{console.error(String(e?.message||e).slice(0,320));process.exitCode=2;});

package/scripts/r193-compile-token.ps1

@@ -0,0 +1,22 @@
+$ErrorActionPreference='Stop'
+$root=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+$source=Join-Path $root 'native\deadbyte-owner-token-r193.cpp'
+$dest=Join-Path $root 'bin\deadbyte-owner-token-r193.exe'
+$sourceDigest='99d1ec196e3e3242a9d44a6445d60abd1b3fbbd53dc9be126d4cc5bb91074099'
+if ((Get-FileHash $source).Hash.ToLowerInvariant() -cne $sourceDigest) { throw 'R193_SOURCE_DRIFT' }
+$gpp='C:\Users\DEADBYTE\scoop\apps\w64devkit\current\bin\g++.exe'
+if(-not(Test-Path $gpp -PathType Leaf)){throw 'R193_TOOLCHAIN_MISSING'}
+if(Test-Path $dest){throw 'R193_BINARY_EXISTS - do not overwrite without explicit inspection'}
+& $gpp -std=c++17 -O2 -Wall -Wextra -Werror -static -s -o $dest $source -ladvapi32
+if($LASTEXITCODE -ne 0){throw "R193_COMPILER_FAILED exit=$LASTEXITCODE"}
+$raw=@(& $dest --report)
+if($LASTEXITCODE -ne 0){throw "R193_REPORT_FAILED exit=$LASTEXITCODE"}
+$report=($raw -join [Environment]::NewLine)|ConvertFrom-Json
+if($report.schema -cne 'deadbyte.r193-native-token.v1' -or $report.authority_granted -or $report.owner_approved -or $report.parent_independence_verified){throw 'R193_INVALID_TOKEN_REPORT'}
+$strictRaw=@(& $dest --require-standard)
+$strictExit=$LASTEXITCODE
+$strict=($strictRaw -join [Environment]::NewLine) | ConvertFrom-Json
+if($report.status -cne $strict.status){throw 'R193_SUBJECT_STATUS_CHANGED'}
+if($report.status -eq 'BLOCKED' -and $strictExit -ne 3){throw 'R193_FAIL_CLOSED_EXPECTED_EXIT3'}
+if($report.status -eq 'STANDARD_TOKEN_OBSERVED' -and $strictExit -ne 0){throw 'R193_STANDARD_EXPECTED_EXIT0'}
+[pscustomobject]@{schema='deadbyte.r193-native-token-acceptance.v1';status='PASS';source_sha256=$sourceDigest;binary_sha256=(Get-FileHash $dest).Hash.ToLowerInvariant();binary_bytes=(Get-Item $dest).Length;native_report=$report;strict_exit=$strictExit;no_grant=$true}|ConvertTo-Json -Depth 7 -Compress