deadbyte-mcp 0.15.72 → 0.15.75

package/src/machine-fs.mjs

@@ -10,6 +10,8 @@ import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { atomicMutation } from './atomic-mutation.mjs';
+import { readRangeFromHandle } from './machine-fs-handle-read-r196.mjs';
+import { boundedNativeReadR198 } from './machine-fs-native-read-r198.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -48,14 +50,7 @@ async function boundedReadInProcess({ file, offset, length, hashFile, timeoutMs
     timer.unref?.();
   });
   try {
-    const operation = (async () => {
-      const buffer = Buffer.alloc(length);
-      const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
-      let fileSha256 = null;
-      if (hashFile) fileSha256 = await sha256File(file, abortController.signal);
-      return { schema: 'deadbyte.machine-fs-read-worker.v1', bytes_read: result.bytesRead,
-        data_base64: buffer.subarray(0, result.bytesRead).toString('base64'), file_sha256: fileSha256 };
-    })();
+    const operation = readRangeFromHandle(handle, { offset, length, hashFile, signal: abortController.signal });
     operation.catch(() => {});
     return await Promise.race([operation, abort]);
   } finally {
@@ -414,22 +409,42 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingReadAllowed(policy, rootId);
+    // Capture the root object before path validation. The native worker must
+    // compare its opened root HANDLE identity before resolving any child.
+    const authorizedRoot = getRoot(policy, rootId, 'read');
+    const rootBefore = await lstat(authorizedRoot.real_path, { bigint: true });
+    if (rootBefore.isSymbolicLink() || !rootBefore.isDirectory() || rootBefore.ino === 0n)
+      throw new Error('R198 root directory identity unavailable');
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
-    const info = await lstat(found.resolved);
+    // Node's numeric ino can round NTFS file IDs above 2^53.
+    // Keep the pre-open identity as BigInt and compare exact strings from the worker's fstat.
+    const info = await lstat(found.resolved, { bigint: true });
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
-    if (!Number.isSafeInteger(info.size)) throw new Error('machine fs read file size exceeds safe integer range');
-    const effectiveOffset = offset < 0 ? Math.max(0, info.size + offset) : offset;
-    if (effectiveOffset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const length = Math.min(maxBytes, info.size - effectiveOffset);
+    if (info.size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('machine fs read file size exceeds safe integer range');
+    if (info.ino === 0n) throw new Error('R196 file object identity unavailable');
+    const fileSize = Number(info.size);
+    const effectiveOffset = offset < 0 ? Math.max(0, fileSize + offset) : offset;
+    if (effectiveOffset > fileSize) throw new Error('machine fs read offset exceeds file size');
+    const length = Math.min(maxBytes, fileSize - effectiveOffset);
     await recheckCodingReadAuthority(policy, grant, rootId);
-    const worker = await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const worker = process.platform === 'win32' && readWorkerPath === machineFsReadWorkerPath
+      ? await boundedNativeReadR198({
+          rootPath: found.root.real_path, relativePath: found.relative,
+          offset: effectiveOffset, length, hashFile, timeoutMs,
+          expectedRootDev: String(rootBefore.dev), expectedRootIno: String(rootBefore.ino)
+        })
+      : await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
     const buffer = Buffer.from(worker.data_base64, 'base64');
     if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    if (!Number.isSafeInteger(worker.file_size) || worker.file_size !== fileSize)
+      throw new Error('R196 opened file size drifted after precheck');
+    if (worker.file_dev !== String(info.dev) || worker.file_ino !== String(info.ino))
+      throw new Error('R196 opened file object identity differs from precheck');
     await recheckCodingReadAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: info.size,
-      eof: effectiveOffset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: fileSize,
+      eof: effectiveOffset + buffer.length >= fileSize, data_base64: buffer.toString('base64'),
       data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
       timeout_ms: timeoutMs
     };

package/src/r188-owner-uac.mjs

@@ -0,0 +1,105 @@
+// R188 - no Windows Hello, no PEM owner key, no grant issuance.
+// Unprivileged challenge creation and read-only owner-review validation.
+// Only an independently launched, R89-protected native elevated broker
+// may record an actual approval. Do not turn this into a grant primitive.
+import {createHash,randomBytes} from 'node:crypto';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+const SHA=/^[a-f0-9]{64}$/;
+const CHALLENGE=/^[A-Za-z0-9_-]{43}$/;
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const digest=x=>createHash('sha256').update(Buffer.from(canonicalJson(x),'utf8')).digest('hex');
+function invalid(msg){throw Error('R188 '+msg);}
+function exact(value,fields,label){
+ if(!value||typeof value!=='object'||Array.isArray(value)||
+   Object.keys(value).length!==fields.length||
+   fields.some(f=>!Object.hasOwn(value,f)))invalid(label+' schema mismatch');
+}
+function project(p){
+ if(typeof p!=='string'||!path.win32.isAbsolute(p)||p.startsWith('\\\\')||
+   path.win32.normalize(p).toLowerCase()===path.win32.parse(p).root.toLowerCase())
+  invalid('project root must be a bounded local Windows path');
+ return path.win32.normalize(p);
+}
+function fields(o){
+ for(const k of ['machineEpoch','releaseManifestSha256','codingPolicySha256','autonomousPolicySha256']){
+  if(typeof o?.[k]!=='string'||!SHA.test(o[k]))invalid('invalid '+k);
+ }
+ if(o.rootId!=='core'||!ID.test(o.rootId))invalid('root scope must be core');
+ const root=project(o.projectRoot);
+ if(!Number.isSafeInteger(o.maxSeconds)||o.maxSeconds<1||o.maxSeconds>3600)
+  invalid('maxSeconds outside owner-reviewed window');
+ return root;
+}
+const scopeKeys=['schema','machine_epoch','release_manifest_sha256',
+ 'coding_policy_sha256','autonomous_policy_sha256','root_id','project_root',
+ 'operation','max_seconds','issued_at_utc','expires_at_utc'];
+const requestKeys=['schema','challenge','subject','request_sha256','review_phrase',
+ 'owner_approved','authority_granted','require_interactive_uac'];
+function iso(v){
+ if(typeof v!=='string'||!/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(v)||
+   !Number.isFinite(Date.parse(v))||new Date(v).toISOString()!==v)
+  invalid('UTC time not canonical');
+ return Date.parse(v);
+}
+function hashFor(challenge,subject){return digest({schema:'deadbyte.r188-owner-uac-request.v1',challenge,subject});}
+function phrase(hash){return 'APPROVE-'+hash.slice(0,12).toUpperCase();}
+export function createR188OwnerUacRequest({
+ machineEpoch,releaseManifestSha256,codingPolicySha256,autonomousPolicySha256,
+ rootId,projectRoot,maxSeconds,now=new Date(),expiresInMs=120000
+}={}){
+ const input={machineEpoch,releaseManifestSha256,codingPolicySha256,
+  autonomousPolicySha256,rootId,projectRoot,maxSeconds};
+ const normalized=fields(input);
+ if(!(now instanceof Date)||!Number.isFinite(now.getTime())||
+   !Number.isSafeInteger(expiresInMs)||expiresInMs<1000||expiresInMs>300000)
+  invalid('request lifetime invalid');
+ const subject=Object.freeze({
+  schema:'deadbyte.r188-owner-uac-subject.v1',machine_epoch:machineEpoch,
+  release_manifest_sha256:releaseManifestSha256,
+  coding_policy_sha256:codingPolicySha256,
+  autonomous_policy_sha256:autonomousPolicySha256,
+  root_id:rootId,project_root:normalized,
+  operation:'autonomous_goal_run',max_seconds:maxSeconds,
+  issued_at_utc:now.toISOString(),
+  expires_at_utc:new Date(now.getTime()+expiresInMs).toISOString()
+ });
+ const challenge=randomBytes(32).toString('base64url');
+ const request_sha256=hashFor(challenge,subject);
+ return Object.freeze({schema:'deadbyte.r188-owner-uac-request.v1',
+  challenge,subject,request_sha256,review_phrase:phrase(request_sha256),
+  owner_approved:false,authority_granted:false,require_interactive_uac:true});
+}
+export function verifyR188OwnerUacRequest({request,expected,now=new Date()}={}){
+ exact(request,requestKeys,'request');exact(request.subject,scopeKeys,'subject');
+ const subject=request.subject;
+ const root=fields(expected);
+ if(request.schema!=='deadbyte.r188-owner-uac-request.v1'||
+    subject.schema!=='deadbyte.r188-owner-uac-subject.v1'||
+    request.owner_approved!==false||request.authority_granted!==false||
+    request.require_interactive_uac!==true||
+    typeof request.challenge!=='string'||!CHALLENGE.test(request.challenge)||
+    Buffer.from(request.challenge,'base64url').length!==32||
+    Buffer.from(request.challenge,'base64url').toString('base64url')!==request.challenge)
+   invalid('request shape or challenge invalid');
+ const expectedBindings={
+  machine_epoch:expected.machineEpoch,release_manifest_sha256:expected.releaseManifestSha256,
+  coding_policy_sha256:expected.codingPolicySha256,
+  autonomous_policy_sha256:expected.autonomousPolicySha256,root_id:expected.rootId,
+  project_root:root,operation:'autonomous_goal_run',max_seconds:expected.maxSeconds
+ };
+ for(const [k,v] of Object.entries(expectedBindings)){
+  if(subject[k]!==v)invalid('request scope mismatch: '+k);
+ }
+ if(!(now instanceof Date)||!Number.isFinite(now.getTime()))invalid('current time invalid');
+ const issued=iso(subject.issued_at_utc),expires=iso(subject.expires_at_utc);
+ if(expires<=issued||expires-issued>300000||
+   now.getTime()<issued||now.getTime()>=expires)invalid('request expired or not yet valid');
+ if(typeof request.request_sha256!=='string'||!SHA.test(request.request_sha256)||
+    request.request_sha256!==hashFor(request.challenge,subject)||
+    request.review_phrase!==phrase(request.request_sha256))
+   invalid('request digest or owner phrase altered');
+ return Object.freeze({status:'VERIFIED_FOR_REVIEW_ONLY',request_sha256:request.request_sha256,
+  review_phrase:request.review_phrase,authority_granted:false,owner_approved:false,
+  next_gate:'PROTECTED_INTERACTIVE_UAC_WITH_EXACT_REQUEST_AND_EPOCH'});
+}

package/src/r188-uac-boundary.mjs

@@ -0,0 +1,21 @@
+// R188: pure fail-closed decision gate, NOT proof of a Windows UAC action.
+// A privileged native broker MUST determine these facts independently using
+// token and ACL inspection. Never accept a caller's self-reported booleans.
+export function assessR188UacBoundary(e={}){
+ const finish=(reason)=>Object.freeze({schema:'deadbyte.r188-uac-boundary.v1',
+  status:'BLOCKED',reason,authority_granted:false,grant_issued:false});
+ if(e.codingElevation!=='standard')return finish('CODING_ALREADY_ELEVATED');
+ if(e.privilegedParentReachable!==false)return finish('ELEVATED_PARENT_STILL_REACHABLE');
+ if(e.ownerElevation!=='elevated')return finish('OWNER_NOT_ELEVATED');
+ if(e.protectedBroker!==true)return finish('BROKER_NOT_PROTECTED');
+ if(e.enableUac!==true||e.secureDesktop!==true||
+   e.promptMode!=='explicit_secure_desktop')
+  return finish('UAC_NOT_INTERACTIVE_AND_SECURE');
+ if(e.nativeEpochPinned!==true||e.releaseAndPoliciesPinned!==true)
+  return finish('AUTHORITY_EPOCH_OR_POLICY_NOT_PINNED');
+ if(e.ownerGesture!=='approved')return finish('OWNER_NOT_APPROVED');
+ return Object.freeze({schema:'deadbyte.r188-uac-boundary.v1',
+  status:'ELIGIBLE_FOR_PROTECTED_OWNER_REVIEW',reason:null,
+  authority_granted:false,grant_issued:false,
+  next_gate:'SIGNED_EPOCH_ONE_TIME_GRANT_TRANSACTION'});
+}

package/src/r193-live-owner-subject.mjs

@@ -0,0 +1,110 @@
+// Build the R193 owner-signing subject from independently observed live state.
+// No caller-supplied digest is trusted until it matches these exact bytes.
+import {createHash} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR188OwnerUacRequest} from './r188-owner-uac.mjs';
+
+const SHA=/^[a-f0-9]{64}$/;
+const FILETIME=/^[a-f0-9]{16}$/;
+const COMPONENTS=Object.freeze(['bridge','cloud','core','supervisor']);
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function block(reason){throw new Error('R193 live owner subject blocked: '+reason);}
+function record(value,label){if(!value||typeof value!=='object'||Array.isArray(value))block(label+' invalid');return value;}
+function digest(value,label){if(typeof value!=='string'||!SHA.test(value))block(label+' invalid');return value;}
+function samePath(a,b){return typeof a==='string'&&typeof b==='string'&&
+ a.replaceAll('/','\\').toLowerCase()===b.replaceAll('/','\\').toLowerCase();}
+function isoFiletime(value){
+ const match=/^(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d)\.(\d{1,7})Z$/.exec(value??'');
+ if(!match)block('process creation UTC invalid');
+ const base=Date.parse(match[1]+'.000Z');
+ if(!Number.isFinite(base))block('process creation UTC invalid');
+ return (BigInt(base+11644473600000)*10000n+
+  BigInt(match[2].padEnd(7,'0'))).toString(16).padStart(16,'0');
+}
+function authorityVector(observation){
+ const authority=record(observation.authority,'authority observation');
+ const out={};
+ for(const plane of PLANES){
+  const item=record(authority[plane],plane+' authority');
+  if(typeof item.configured!=='boolean'||typeof item.armed!=='boolean'||
+     typeof item.reason!=='string'||item.reason.length<1||item.reason.length>64)
+   block(plane+' authority fields invalid');
+  const seq=item.epoch_seq??null,head=item.epoch_sha256??null;
+  if((seq!==null&&(!Number.isSafeInteger(seq)||seq<0))||
+     (head!==null&&!SHA.test(head)))block(plane+' epoch identity invalid');
+  if(item.armed===true&&(seq===null||head===null))block(plane+' armed epoch missing');
+  out[plane]={configured:item.configured,armed:item.armed,reason:item.reason,
+   epoch_seq:seq,epoch_sha256:head};
+ }
+ return out;
+}
+
+export function createR193LiveMachineEpoch({activePointer,controllerObservation}={}){
+ const pointer=record(activePointer,'active pointer');
+ const observation=record(controllerObservation,'controller observation');
+ for(const field of ['release_id','version','manifest_sha256','generation_manifest_sha256'])
+  if(typeof pointer[field]!=='string'||!pointer[field])block('active pointer '+field+' invalid');
+ digest(pointer.manifest_sha256,'release manifest SHA-256');
+ digest(pointer.generation_manifest_sha256,'generation manifest SHA-256');
+ if(observation.schema!=='deadbyte.controller-observation.v1'||
+    !samePath(observation.core_root,pointer.release_root))
+  block('controller does not match active release');
+ return sha(Buffer.from(canonicalJson({
+  schema:'deadbyte.r193-live-machine-epoch.v1',
+  release_id:pointer.release_id,version:pointer.version,
+  manifest_sha256:pointer.manifest_sha256,
+  generation_manifest_sha256:pointer.generation_manifest_sha256,
+  authority:authorityVector(observation)
+ }),'utf8'));
+}
+
+export function buildR193LiveOwnerBoundary({request,activePointer,installedManifestBytes,
+ codingPolicyBytes,autonomousPolicyBytes,controllerObservation,supervisorLedger,
+ processReports,brokerR89Trusted,keyAclTrusted,uac,ownerGesture,now=new Date()}={}){
+ if(!Buffer.isBuffer(installedManifestBytes)||installedManifestBytes.length<1)block('manifest bytes missing');
+ if(!Buffer.isBuffer(codingPolicyBytes)||codingPolicyBytes.length<1)block('Coding policy bytes missing');
+ if(!Buffer.isBuffer(autonomousPolicyBytes)||autonomousPolicyBytes.length<1)block('Autonomous policy bytes missing');
+ const pointer=record(activePointer,'active pointer');
+ const observation=record(controllerObservation,'controller observation');
+ const manifestSha=sha(installedManifestBytes),codingSha=sha(codingPolicyBytes),autonomousSha=sha(autonomousPolicyBytes);
+ if(pointer.manifest_sha256!==manifestSha)block('active release manifest drift');
+ if(request?.subject?.release_manifest_sha256!==manifestSha||
+    request?.subject?.coding_policy_sha256!==codingSha||
+    request?.subject?.autonomous_policy_sha256!==autonomousSha)
+  block('request release or policy drift');
+ const machineEpoch=createR193LiveMachineEpoch({activePointer:pointer,controllerObservation:observation});
+ const expected={machineEpoch,releaseManifestSha256:manifestSha,codingPolicySha256:codingSha,
+  autonomousPolicySha256:autonomousSha,rootId:request?.subject?.root_id,
+  projectRoot:request?.subject?.project_root,maxSeconds:request?.subject?.max_seconds};
+ verifyR188OwnerUacRequest({request,expected,now});
+ const supervisor=record(supervisorLedger,'supervisor ledger');
+ const sources={bridge:observation.bridge,core:observation.core,cloud:observation.cloud,supervisor};
+ const reports=record(processReports,'native process reports');
+ const agent_processes=[];
+ for(const component of COMPONENTS){
+  const source=record(sources[component],component+' identity');
+  const report=record(reports[component],component+' token report');
+  if(source.alive!==true&&component!=='supervisor')block(component+' is not alive');
+  if(component==='supervisor'&&observation.supervisor?.running!==true)block('supervisor is not running');
+  if(report.schema!=='deadbyte.r193-native-process-token.v1'||report.alive!==true||
+     report.identity_verified!==true||report.pid!==source.pid||
+     !FILETIME.test(report.creation_filetime_hex)||
+     report.creation_filetime_hex!==isoFiletime(source.creation_time_utc))
+   block(component+' native process identity mismatch');
+  agent_processes.push({component,pid:report.pid,
+   creation_time_utc:new Date(Date.parse(source.creation_time_utc)).toISOString(),
+   alive:true,identity_verified:true,elevated:report.elevated,
+   admin_enabled:report.admin_enabled,integrity_rid:report.integrity_rid,
+   token_type:report.token_type});
+ }
+ const u=record(uac,'UAC policy');
+ return Object.freeze({expected:Object.freeze(expected),boundary:Object.freeze({
+  schema:'deadbyte.r193-owner-runtime-boundary.v1',
+  broker_r89_trusted:brokerR89Trusted===true,key_acl_trusted:keyAclTrusted===true,
+  enable_uac:u.enable_uac===true,secure_desktop:u.secure_desktop===true,
+  prompt_mode:u.prompt_mode,owner_gesture:ownerGesture,
+  live_epoch_verified:true,live_policies_verified:true,live_release_verified:true,
+  agent_processes:Object.freeze(agent_processes)
+ })});
+}

package/src/r193-owner-secret-acl.mjs

@@ -0,0 +1,67 @@
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import path from 'node:path';
+
+const execFileAsync=promisify(execFile);
+const TRUSTED=new Set(['S-1-5-18','S-1-5-32-544',
+ 'S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464']);
+function blocked(reason,pathValue=null){return Object.freeze({trusted:false,reason,path:pathValue});}
+export function evaluateR193OwnerSecretAcl(records,files){
+ if(!Array.isArray(files)||files.length!==2||!Array.isArray(records)||records.length!==2)
+  return blocked('INCOMPLETE_OWNER_SECRET_ACL');
+ const expected=new Set(files.map(file=>path.win32.normalize(file).toLowerCase()));
+ const seen=new Set();
+ for(const record of records){
+  const key=typeof record?.path==='string'?path.win32.normalize(record.path).toLowerCase():'';
+  if(!expected.has(key)||seen.has(key))return blocked('OWNER_SECRET_ACL_PATH_MISMATCH',key);
+  seen.add(key);
+  if(record.reparse!==false||record.protected!==true||!TRUSTED.has(record.owner)||
+     typeof record.directory!=='boolean'||!Array.isArray(record.aces))
+   return blocked('OWNER_SECRET_ACL_UNTRUSTED',key);
+  for(const ace of record.aces){
+   if(!ace||!['Allow','Deny'].includes(ace.type)||typeof ace.sid!=='string'||
+      typeof ace.inherited!=='boolean'||!Number.isSafeInteger(ace.mask))
+    return blocked('OWNER_SECRET_ACL_UNKNOWN_RULE',key);
+   if(ace.inherited===true)return blocked('OWNER_SECRET_ACL_INHERITED_RULE',key);
+   if(ace.type==='Allow'&&!TRUSTED.has(ace.sid))
+    return blocked('OWNER_SECRET_READABLE_BY_AGENT_PRINCIPAL',key);
+  }
+ }
+ return Object.freeze({trusted:true,reason:'OWNER_SECRET_ADMIN_SYSTEM_ONLY'});
+}
+
+const probe=String.raw`
+$ErrorActionPreference='Stop';Set-StrictMode -Version Latest
+try{
+ $files=ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__FILES__')))
+ $out=@()
+ foreach($p in @($files)){
+  $item=Get-Item -LiteralPath $p -Force -ErrorAction Stop
+  $acl=Get-Acl -LiteralPath $p -ErrorAction Stop
+  $rules=@()
+  foreach($entry in $acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){
+   $rules+=@{sid=$entry.IdentityReference.Value;type=$entry.AccessControlType.ToString();
+    mask=([int64]$entry.FileSystemRights -band [int64]4294967295);inherited=[bool]$entry.IsInherited}
+  }
+  $out+=@{path=$item.FullName;owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;
+   reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);
+   protected=[bool]$acl.AreAccessRulesProtected;directory=[bool]$item.PSIsContainer;aces=$rules}
+ }
+ ConvertTo-Json @($out) -Depth 7 -Compress
+}catch{[Console]::Error.WriteLine('R193_OWNER_SECRET_ACL_PROBE_FAILED');exit 12}
+`;
+export async function inspectR193OwnerSecretAcl(files){
+ if(process.platform!=='win32'||process.arch!=='x64')
+  throw new Error('R193 owner secret ACL requires Windows x64');
+ const ps='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+ const encodedFiles=Buffer.from(JSON.stringify(files),'utf8').toString('base64');
+ const encoded=Buffer.from(probe.replace('__FILES__',encodedFiles),'utf16le').toString('base64');
+ let stdout;
+ try{({stdout}=await execFileAsync(ps,['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+  {windowsHide:true,timeout:12000,maxBuffer:128*1024,encoding:'utf8'}));}
+ catch{throw new Error('R193 owner secret ACL inspection failed closed');}
+ let records;try{records=JSON.parse(stdout);}catch{throw new Error('R193 owner secret ACL response invalid');}
+ const decision=evaluateR193OwnerSecretAcl(records,files);
+ if(!decision.trusted)throw new Error('R193 owner secret ACL untrusted: '+decision.reason);
+ return decision;
+}

package/src/r193-owner-uac-broker.mjs

@@ -0,0 +1,85 @@
+// R193 protected owner decision boundary.
+//
+// This module is deliberately pure. It cannot launch UAC, enroll a key, write
+// an approval, issue a grant, or mutate an epoch. A protected interactive host
+// must independently observe the Windows token/process vector and R89/key ACLs
+// before calling it. The returned R70 approval remains single-use input to the
+// existing R186 transaction; it is not authority by itself.
+import {createPublicKey} from 'node:crypto';
+import {signR193R70ApprovalFromOwnerReview} from './r193-uac-r70-bridge.mjs';
+
+const COMPONENTS=Object.freeze(['bridge','cloud','core','supervisor']);
+const BOUNDARY_FIELDS=Object.freeze([
+ 'schema','broker_r89_trusted','key_acl_trusted','enable_uac','secure_desktop',
+ 'prompt_mode','owner_gesture','live_epoch_verified','live_policies_verified',
+ 'live_release_verified','agent_processes'
+]);
+const PROCESS_FIELDS=Object.freeze([
+ 'component','pid','creation_time_utc','alive','identity_verified','elevated',
+ 'admin_enabled','integrity_rid','token_type'
+]);
+
+function block(reason){throw new Error(`R193 owner UAC broker blocked: ${reason}`);}
+function exact(value,fields,label){
+ if(!value||typeof value!=='object'||Array.isArray(value)||
+    Object.keys(value).length!==fields.length||
+    fields.some(field=>!Object.hasOwn(value,field)))block(`${label} schema mismatch`);
+}
+function canonicalUtc(value,label){
+ if(typeof value!=='string'||
+    !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value)||
+    !Number.isFinite(Date.parse(value))||new Date(value).toISOString()!==value)
+  block(`${label} creation identity invalid`);
+}
+function verifyProcesses(processes){
+ if(!Array.isArray(processes)||processes.length!==COMPONENTS.length)
+  block('complete agent process vector required');
+ const observed=[];
+ for(const process of processes){
+  exact(process,PROCESS_FIELDS,'agent process');
+  if(!COMPONENTS.includes(process.component)||observed.includes(process.component))
+   block('agent process component missing or duplicated');
+  observed.push(process.component);
+  if(!Number.isSafeInteger(process.pid)||process.pid<1||process.pid>0x7fffffff)
+   block('agent process PID invalid');
+  canonicalUtc(process.creation_time_utc,process.component);
+  if(process.alive!==true||process.identity_verified!==true)
+   block(`${process.component} process identity unverified`);
+  if(process.elevated!==false||process.admin_enabled!==false||
+     process.integrity_rid<8192||process.integrity_rid>=12288||
+     process.token_type!=='primary')
+   block(`${process.component} process is not a verified Limited primary token`);
+ }
+ if(COMPONENTS.some(component=>!observed.includes(component)))
+  block('complete agent process vector required');
+}
+
+export function approveR193OwnerRequest({request,expected,privateKeyDer,boundary,now=new Date()}={}){
+ exact(boundary,BOUNDARY_FIELDS,'runtime boundary');
+ if(boundary.schema!=='deadbyte.r193-owner-runtime-boundary.v1')
+  block('runtime boundary schema invalid');
+ if(boundary.broker_r89_trusted!==true)block('R89 protected broker not verified');
+ if(boundary.key_acl_trusted!==true)block('owner signing key ACL not verified');
+ if(boundary.enable_uac!==true||boundary.secure_desktop!==true||
+    boundary.prompt_mode!=='explicit_secure_desktop')
+  block('secure interactive UAC policy not verified');
+ if(boundary.owner_gesture!=='approved')block('owner gesture absent or rejected');
+ if(boundary.live_epoch_verified!==true)block('live authority epoch not verified');
+ if(boundary.live_policies_verified!==true)block('live policy identities not verified');
+ if(boundary.live_release_verified!==true)block('live release identity not verified');
+ verifyProcesses(boundary.agent_processes);
+ const signed=signR193R70ApprovalFromOwnerReview({request,expected,privateKeyDer,now});
+ const publicPem=createPublicKey({key:signed.owner_public_key_spki_der,
+  format:'der',type:'spki'}).export({format:'pem',type:'spki'}).toString();
+ return Object.freeze({
+  status:'OWNER_APPROVED_FOR_SINGLE_USE_GRANT',
+  request_sha256:signed.request_sha256,
+  owner_key_id:signed.approval.owner_key_id,
+  owner_public_key_pem:publicPem,
+  approval:signed.approval,
+  owner_approved:true,
+  authority_granted:false,
+  private_key_material_returned:false,
+  next_gate:'R186_PROTECTED_SINGLE_USE_GRANT_TRANSACTION'
+ });
+}

package/src/r193-uac-r70-bridge.mjs

@@ -0,0 +1,54 @@
+// R193 bridge: translate a short-lived, exact R188 scope review into the
+// already-supported R70 signed approval format. This function is NOT consent,
+// UAC evidence, protected-key enrollment, epoch issuance or a grant. Its caller
+// must be an independently elevated, R89-protected owner broker and must never
+// expose the owner's private DER or the signing operation to an agent process.
+import {createHash,createPrivateKey,createPublicKey,sign} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+import {verifyR188OwnerUacRequest} from './r188-owner-uac.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const encode=x=>Buffer.from(canonicalJson(x),'utf8');
+const DOMAIN=Buffer.from('DEADBYTE-R70-PROJECT-OWNER-APPROVAL\0','utf8');
+
+export function signR193R70ApprovalFromOwnerReview({
+  request,expected,privateKeyDer,now=new Date()
+}={}){
+  // The supplied private key is data for an already-trusted protected caller.
+  // Never read it from an agent-accessible path inside this module.
+  if(!Buffer.isBuffer(privateKeyDer)||privateKeyDer.length<32||privateKeyDer.length>8192)
+    throw Error('R193 protected owner signing material missing');
+  if(!(now instanceof Date)||!Number.isFinite(now.getTime()))
+    throw Error('R193 invalid review time');
+  const verified=verifyR188OwnerUacRequest({request,expected,now});
+  if(verified.status!=='VERIFIED_FOR_REVIEW_ONLY'||verified.authority_granted!==false)
+    throw Error('R193 unexpected owner-review contract');
+  let privateKey;
+  try{privateKey=createPrivateKey({key:privateKeyDer,format:'der',type:'pkcs8'});}
+  catch{throw Error('R193 protected Ed25519 key invalid');}
+  if(privateKey.asymmetricKeyType!=='ed25519')
+    throw Error('R193 protected signing key must be Ed25519');
+  const publicKey=createPublicKey(privateKey);
+  const ownerKeyId=sha(publicKey.export({format:'der',type:'spki'}));
+  const s=request.subject;
+  // Preserve the exact request expiry: signing does not extend authority.
+  const subject=Object.freeze({
+    schema:'deadbyte.project-authority-subject.r70.v1',
+    scope:'coding_autonomous_native_diff',
+    root_id:s.root_id,project_root:s.project_root,
+    coding_policy_sha256:s.coding_policy_sha256,
+    autonomous_policy_sha256:s.autonomous_policy_sha256,
+    reviewed_artifact_sha256:s.release_manifest_sha256,
+    issued_at_utc:s.issued_at_utc,expires_at_utc:s.expires_at_utc
+  });
+  const digest=sha(encode(subject));
+  const signed=Object.freeze({schema:'deadbyte.project-owner-approval.r70.v1',
+    subject_sha256:digest,owner_key_id:ownerKeyId});
+  const signature=sign(null,Buffer.concat([DOMAIN,encode(signed)]),privateKey);
+  return Object.freeze({
+    status:'PROTECTED_SIGNATURE_FORMAT_ONLY',authority_granted:false,owner_approved:false,
+    request_sha256:verified.request_sha256,
+    owner_public_key_spki_der:publicKey.export({format:'der',type:'spki'}),
+    approval:Object.freeze({...signed,subject,signature_base64:signature.toString('base64')})
+  });
+}

package/src/r195-canonical-owner-observation.mjs

@@ -0,0 +1,15 @@
+import path from 'node:path';
+
+export async function observeCanonicalController({stateRoot,powershell,env,execFileAsync}={}){
+  if(typeof stateRoot!=='string'||!path.win32.isAbsolute(stateRoot))
+    throw new Error('R195 canonical owner observation requires an absolute state root');
+  if(typeof powershell!=='string'||powershell.length<1||typeof execFileAsync!=='function')
+    throw new Error('R195 canonical owner observation dependency invalid');
+  const launcher=path.win32.join(path.win32.resolve(stateRoot),'bin','DEADBYTE-MCP.ps1');
+  const {stdout}=await execFileAsync(powershell,[
+    '-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',
+    launcher,'status','-Json'
+  ],{env,windowsHide:true,shell:false,timeout:20000,maxBuffer:1024*1024,encoding:'utf8'});
+  try{return JSON.parse(stdout);}
+  catch{throw new Error('R195 canonical owner observation returned invalid JSON');}
+}