deadbyte-mcp 0.15.74 → 0.15.76

package/test/r200-remote-reconcile.test.mjs

@@ -0,0 +1,106 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createRemoteDevicePlaneR44} from '../src/remote-device-r44.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {REMOTE_TERMINAL_DOMAIN,REMOTE_TERMINAL_EVIDENCE_SCHEMA} from '../src/remote-terminal-evidence-r200.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function fixture(t){
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r200-terminal-'));
+ t.after(()=>rm(dir,{recursive:true,force:true}));
+ const keys=generateKeyPairSync('ed25519');
+ const der=Buffer.from(keys.publicKey.export({type:'spki',format:'der'}));
+ const owner={id:sha(der),spki:der.toString('base64'),privateKey:keys.privateKey};
+ let requestCalls=0,lookupCalls=0,latestProof=null;
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(){requestCalls++;return null;},
+  async lookupTerminal(){lookupCalls++;return latestProof;}
+ };
+ const makePlane=()=>createRemoteDevicePlaneR44({stateDir:dir,relay,authorizeCapability:async()=>true,
+  relayTimeoutMs:1000,probeRetries:0,reachableTtlMs:10000});
+ const plane=await makePlane();
+ await plane.pair({publicKeySpkiBase64:owner.spki,displayName:'R200 fixture'});
+ await plane.reportOnline({deviceId:owner.id,epoch:1,connectionId:'r200-virtual'});
+ await plane.probe({deviceId:owner.id,epoch:1});
+ const req={deviceId:owner.id,epoch:1,capabilityId:'machine.fs.write',
+  payload:{path:'file.bin',data:'one'},requestId:'a'.repeat(64)};
+ const initial=await plane.dispatch(req);
+ assert.equal(initial.effect_state,'unknown');
+ const proofFor=(terminal,bodyOverrides={})=>{
+   const evidence={schema:REMOTE_TERMINAL_EVIDENCE_SCHEMA,
+    device_id:owner.id,epoch:1,request_id:req.requestId,
+    request_sha256:initial.request_sha256,capability_id:req.capabilityId,
+    terminal,...bodyOverrides};
+   const signature=sign(null,Buffer.concat([REMOTE_TERMINAL_DOMAIN,
+    Buffer.from(canonicalJson(evidence),'utf8')]),owner.privateKey).toString('base64');
+   return {evidence,attestation:{algorithm:'ed25519',key_id:owner.id,signature_base64:signature}};
+ };
+ return {plane,makePlane,owner,req,initial,relay,proofFor,
+  setProof:p=>latestProof=p,
+  calls:()=>({requestCalls,lookupCalls})};
+}
+test('R200 signed terminal reconciles a lost ACK without sending mutation again',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'completed',result_sha256:'b'.repeat(64)}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.state,'completed');assert.equal(r.effect_state,'confirmed');
+ assert.equal(r.transport_state,'reconciled');
+ assert.equal(r.reconciliation_state,'signed_terminal');
+ assert.match(r.terminal_evidence_sha256,/^[0-9a-f]{64}$/);
+ assert.deepEqual(f.calls(),{requestCalls:1,lookupCalls:1});
+ const restarted=await f.makePlane();
+ const again=await restarted.dispatch(f.req);
+ assert.equal(again.replay,true);assert.equal(again.effect_state,'confirmed');
+ assert.deepEqual(f.calls(),{requestCalls:1,lookupCalls:1},'no duplicate remote mutation');
+});
+test('R200 unavailable signed journal entry remains UNKNOWN and cannot be called success',async t=>{
+ const f=await fixture(t);
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.reconciliation,'unresolved');
+ assert.equal(r.effect_state,'unknown');
+ assert.equal(f.calls().requestCalls,1);
+ const snap=(await f.plane.list()).requests[f.req.requestId];
+ assert.equal(snap.effect_state,'unknown');assert.equal(snap.transport_state,'ack_missing');
+});
+test('R200 invalid Ed25519 and mismatched request hashes never alter original outcome',async t=>{
+ const f=await fixture(t);
+ const proper=f.proofFor({status:'completed',result_sha256:'d'.repeat(64)});
+ proper.evidence.terminal.result_sha256='e'.repeat(64);
+ f.setProof(proper);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/signature invalid/);
+ const wrong=f.proofFor({status:'completed',result_sha256:'d'.repeat(64)},
+  {request_sha256:'f'.repeat(64)});
+ f.setProof(wrong);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/request hash mismatch/);
+ assert.equal((await f.plane.list()).requests[f.req.requestId].effect_state,'unknown');
+ assert.equal(f.calls().requestCalls,1);
+});
+test('R200 signed failure with unresolved side effects stays UNKNOWN',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'failed',error_code:'process_exit',effect_state:'unknown'}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.state,'failed');assert.equal(r.effect_state,'unknown');
+ assert.equal(r.reconciliation_state,'signed_terminal_effect_unknown');
+ assert.equal(r.transport_state,'reconciled');
+});
+test('R200 signed not_started failure is a terminal failed effect',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'failed',error_code:'rejected_before_dispatch',effect_state:'not_started'}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.effect_state,'failed');
+ assert.equal(r.reconciliation_state,'signed_terminal');
+ assert.equal(r.error_code,'rejected_before_dispatch');
+});
+test('R200 malformed terminal envelope and unexpected fields fail closed',async t=>{
+ const f=await fixture(t);
+ const proof=f.proofFor({status:'completed',result_sha256:'c'.repeat(64)});
+ proof.evidence.untrusted_internal=true;
+ f.setProof(proof);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/unexpected or missing fields/);
+ assert.equal((await f.plane.list()).requests[f.req.requestId].effect_state,'unknown');
+});

package/test/r201-payload-boundary.test.mjs

@@ -0,0 +1,78 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createRemoteDevicePlaneR44,payloadHash} from '../src/remote-device-r44.mjs';
+
+const hash=b=>createHash('sha256').update(b).digest('hex');
+const context={deviceId:'a'.repeat(64),epoch:1,capabilityId:'machine.fs.write'};
+const digest=payload=>payloadHash({...context,payload});
+
+test('R201 remote canonical payload rejects non-finite numbers rather than aliasing null',()=>{
+  assert.throws(()=>digest({n:NaN}),/remote payload/i);
+  assert.throws(()=>digest({n:Infinity}),/remote payload/i);
+  assert.throws(()=>digest({n:-Infinity}),/remote payload/i);
+  assert.notEqual(digest({n:null}),digest({n:0}));
+});
+test('R201 remote canonical payload rejects undefined, sparse arrays and unsupported values',()=>{
+  assert.throws(()=>digest({n:undefined}),/remote payload/i);
+  assert.throws(()=>digest({n:()=>{}}),/remote payload/i);
+  assert.throws(()=>digest({n:Symbol('x')}),/remote payload/i);
+  assert.throws(()=>digest({n:1n}),/remote payload/i);
+  assert.throws(()=>digest({a:[,]}),/remote payload/i);
+  assert.throws(()=>digest({a:new Date(0)}),/remote payload/i);
+  assert.throws(()=>digest({a:new Map()}),/remote payload/i);
+});
+test('R201 remote canonical payload rejects getters, toJSON hooks, cycles before evaluation',()=>{
+  let getters=0,serializers=0;
+  const tricky={};Object.defineProperty(tricky,'x',{enumerable:true,get(){getters++;return 1;}});
+  assert.throws(()=>digest(tricky),/remote payload/i);
+  assert.equal(getters,0,'untrusted getter ran inside remote request hashing');
+  const hook={toJSON(){serializers++;return {x:1};}};
+  assert.throws(()=>digest({hook}),/remote payload/i);
+  assert.equal(serializers,0,'untrusted toJSON ran inside remote request hashing');
+  const cycle={};cycle.loop=cycle;
+  assert.throws(()=>digest(cycle),/remote payload/i);
+});
+test('R201 remote canonical payload enforces depth, byte and node budgets',()=>{
+  let deeply={end:true};for(let i=0;i<45;i++)deeply={child:deeply};
+  assert.throws(()=>digest(deeply),/remote payload/i);
+  assert.throws(()=>digest({string:'z'.repeat(1024*1024+1)}),/remote payload/i);
+  assert.throws(()=>digest({array:Array.from({length:4100},(_,i)=>i)}),/remote payload/i);
+});
+test('R201 plain JSON payload stays order-stable and distinguishes nested contents',()=>{
+  assert.equal(digest({a:1,b:{x:true,y:[1,null,'ok']}}),digest({b:{y:[1,null,'ok'],x:true},a:1}));
+  assert.notEqual(digest({a:1}),digest({a:2}));
+});
+test('R201 caller mutation during async authorization cannot alter payload sent to relay',async t=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r201-payload-'));
+  t.after(()=>rm(dir,{recursive:true,force:true}));
+  const {publicKey}=generateKeyPairSync('ed25519');
+  const der=Buffer.from(publicKey.export({type:'spki',format:'der'}));
+  const id=hash(der),seen=[];
+  let entered,release;
+  const atAuth=new Promise(resolve=>entered=resolve);
+  const gate=new Promise(resolve=>release=resolve);
+  const relay={
+    async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+    async request(x){seen.push(structuredClone(x));return {ack:'accepted',request_id:x.request_id,terminal:{status:'completed',result_sha256:'b'.repeat(64)}};}
+  };
+  const plane=await createRemoteDevicePlaneR44({stateDir:dir,relay,authorizeCapability:async()=>{entered();await gate;return true;},probeRetries:0,reachableTtlMs:10000});
+  await plane.pair({publicKeySpkiBase64:der.toString('base64'),displayName:'R201 fake'});
+  await plane.reportOnline({deviceId:id,epoch:1,connectionId:'fixture'});
+  await plane.probe({deviceId:id,epoch:1});
+  const payload={path:'allowed.txt',nested:{value:'old'}};
+  const req={deviceId:id,epoch:1,capabilityId:'machine.fs.write',payload,requestId:'c'.repeat(64)};
+  const expectedHash=payloadHash({deviceId:id,epoch:1,capabilityId:'machine.fs.write',payload});
+  const resultPromise=plane.dispatch(req);
+  await atAuth;
+  payload.path='other.txt';payload.nested.value='new';
+  release();
+  const result=await resultPromise;
+  assert.equal(result.request_sha256,expectedHash);
+  assert.equal(seen.length,1);
+  assert.deepEqual(seen[0].payload,{path:'allowed.txt',nested:{value:'old'}});
+  assert.equal(result.state,'completed');
+});

package/test/r201-payload-fuzz.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {payloadHash} from '../src/remote-device-r44.mjs';
+
+const ctx={deviceId:'b'.repeat(64),epoch:1,capabilityId:'coding.file_write'};
+const hash=payload=>payloadHash({...ctx,payload});
+test('R201 symbol keys, negative zero and unsafe integers are rejected at the typed boundary',()=>{
+ const withSymbol={x:1};withSymbol[Symbol('shadow')]=42;
+ assert.throws(()=>hash(withSymbol),/remote payload/i);
+ assert.throws(()=>hash({offset:-0}),/remote payload/i);
+ assert.throws(()=>hash({offset:Number.MAX_SAFE_INTEGER+1}),/remote payload/i);
+});
+test('R201 deterministic malformed-boundary corpus is fully rejected',()=>{
+ const cases=[
+  Object.create({inherited:true}),
+  {x:NaN},{x:Infinity},{x:undefined},{x:()=>0},{x:1n},{x:Symbol('x')},
+  {x:new Date(0)},{x:new Uint8Array([1])},{x:new Map([[1,1]])},
+  {x:[]},{x:[,1]},{x:[1,,2]},{x:Array(4097).fill(1)},
+  {x:{constructor:0}},{x:{prototype:0}},{x:{toJSON:0}},
+  {x:{get y(){throw Error('must not execute')}}}
+ ];
+ // A dense array is legal; all other fixture values must be invalid.
+ for(let i=0;i<cases.length;i++){
+  if(i===10)continue;
+  assert.throws(()=>hash(cases[i]),/remote payload/i,'case '+i);
+ }
+});
+test('R201 seeded valid JSON corpus is deterministic independent of key ordering',()=>{
+ let seed=0x6db201;const rand=()=>{seed^=seed<<13;seed^=seed>>>17;seed^=seed<<5;return seed>>>0;};
+ for(let i=0;i<200;i++){
+  const n=rand()%100000,flag=(rand()&1)!==0,word='v'+(rand()%9999);
+  const a={left:n,right:{enabled:flag,name:word,items:[0,1,null,'ok']}};
+  const b={right:{items:[0,1,null,'ok'],name:word,enabled:flag},left:n};
+  assert.equal(hash(a),hash(b),'semantic hash mismatch case '+i);
+  assert.notEqual(hash(a),hash({...a,left:n+1}),'hash collision case '+i);
+ }
+});

package/test/r201-tool-boundary-fuzz.test.mjs

@@ -0,0 +1,120 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {registerDesktopTools} from '../src/desktop-mcp-tools-r40.mjs';
+import {registerMachineFsTools} from '../src/machine-fs-mcp-tools.mjs';
+import {registerProcessTools} from '../src/process-mcp-tools.mjs';
+
+const H=c=>c.repeat(64);
+const frame=H('a'),intent=H('b'),session=H('c'),digest=H('d');
+class FakeServer{
+ constructor(){this.tools=new Map();}
+ registerTool(name,definition,handler){
+   assert.equal(this.tools.has(name),false,'duplicate tool '+name);
+   this.tools.set(name,{schema:definition.inputSchema,handler});
+ }
+}
+const server=new FakeServer();
+const runtime=new Proxy({}, {get(_,field){return ()=>{throw new Error('R201_PROVIDER_MUST_NOT_BE_CALLED '+String(field));};}});
+registerDesktopTools(server,{runtime});
+registerMachineFsTools(server,{runtime});
+registerProcessTools(server,{runtime});
+
+const fixtures={
+ desktop_status:{},desktop_observe:{preview:false},
+ desktop_wait:{baseline_frame_id:frame,until:'frame_changed'},
+ desktop_target:{frame_id:frame,uia_query:{kind:'name_exact',value:'Save',ordinal:0,max_results:8}},
+ desktop_action:{intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:10,y:20}},
+ machine_fs_stat:{root_id:'projects',path:'.'},
+ machine_fs_list:{root_id:'projects',path:'.'},
+ machine_fs_read:{root_id:'projects',path:'test.bin',offset:0,max_bytes:32},
+ machine_fs_write:{root_id:'projects',path:'test.bin',content:'x',expected_sha256:'absent'},
+ machine_fs_edit_exact:{root_id:'projects',path:'test.bin',old_string:'x',new_string:'y',expected_sha256:digest},
+ machine_fs_mkdir:{root_id:'projects',path:'tmp-dir'},
+ machine_fs_move:{root_id:'projects',source_path:'old',destination_path:'new',expected_source_identity:digest},
+ machine_fs_delete:{root_id:'projects',path:'test.bin',expected_source_identity:digest},
+ process_session_start:{profile_id:'node',root_id:'projects'},
+ process_session_read:{session_id:session},
+ process_session_write:{session_id:session,input:'x'},
+ process_session_status:{session_id:session},
+ process_session_list:{},
+ process_session_cancel:{session_id:session},
+ process_session_terminate:{session_id:session},
+ process_session_action:{session_id:session,action_id:'ping'}
+};
+const reserved=[
+ '_internal','__internal','__proto__','constructor','prototype',
+ 'authority','grant','grant_token','policy_override','allow_unsafe',
+ 'exec','executable','shell','command','pid','process_id','host_root_id',
+ 'endpoint','network','capability_override','admin','on_behalf_of','proof'
+];
+function polluted(base,key,value){
+ const obj=Object.create(null);
+ for(const [k,v] of Object.entries(base))obj[k]=structuredClone(v);
+ obj[key]=value;
+ return obj;
+}
+test('R201 entire native tool catalog stays 21 strict schemas with valid defaults',()=>{
+ assert.deepEqual([...server.tools.keys()].sort(),Object.keys(fixtures).sort());
+ for(const [name,value] of Object.entries(fixtures)){
+  const parsed=server.tools.get(name).schema.safeParse(value);
+  assert.equal(parsed.success,true,name+' valid input was incorrectly rejected: '+JSON.stringify(parsed.error?.issues));
+ }
+});
+test('R201 deterministic reserved-field forgery corpus rejects before provider dispatch',()=>{
+ let rejected=0;
+ for(const [name,{schema}] of server.tools){
+  for(const k of reserved){
+   const forged=polluted(fixtures[name],k,k==='__proto__'?{isAdmin:true}:true);
+   const result=schema.safeParse(forged);
+   if(k==='__proto__'&&result.success){
+     // Some Zod versions safely discard this hostile own property rather
+     // than rejecting it. Sanitization must never leak to provider output.
+     assert.equal(Object.hasOwn(result.data,'__proto__'),false,name+' leaked __proto__');
+     assert.equal(Object.getPrototypeOf(result.data),Object.prototype,name+' changed parsed prototype');
+     assert.equal(({}).isAdmin,undefined,'global prototype was polluted');
+   }else{
+     assert.equal(result.success,false,name+' accepted forged key '+k);
+   }
+   rejected++;
+  }
+ }
+ assert.equal(rejected,21*reserved.length);
+});
+test('R201 malformed type corpus and unknown nested fields fail closed',()=>{
+ const invalidValues=[null,undefined,false,true,0,-1,1.5,'',[],[1],{},Object.create(null),Number.NaN,Infinity,-Infinity];
+ let covered=0;
+ for(const [name,{schema}] of server.tools){
+  const base=fixtures[name];
+  for(const field of Object.keys(base)){
+   for(const value of invalidValues){
+    const altered={...base,[field]:value};
+    const result=schema.safeParse(altered);
+    if(value===undefined || field==='preview')continue; // some schema defaults/boolean are intentional
+    if(result.success)continue; // schema-specific legitimate optionality, not a security failure
+    covered++;
+   }
+  }
+ }
+ assert.ok(covered>=400,'R201 malformed-input corpus insufficient '+covered);
+ const target=server.tools.get('desktop_target').schema;
+ assert.equal(target.safeParse({frame_id:frame,uia_query:{kind:'name_exact',value:'Save',__internal:true}}).success,false);
+ assert.equal(target.safeParse({frame_id:frame,rect:{left:1,top:1,width:10,height:10,admin:true},source:'visual',confidence:1}).success,false);
+ const action=server.tools.get('desktop_action').schema;
+ assert.equal(action.safeParse({intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:1,y:2,pid:123}}).success,false);
+ assert.equal(action.safeParse({intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'hello\0world'}).success,false);
+});
+test('R201 incomplete or wrong authority preconditions cannot be normalized into valid mutations',()=>{
+ const checks=[
+  ['machine_fs_write',{root_id:'projects',path:'x',content:'y'}],
+  ['machine_fs_delete',{root_id:'projects',path:'x'}],
+  ['machine_fs_move',{root_id:'projects',source_path:'a',destination_path:'b'}],
+  ['machine_fs_edit_exact',{root_id:'projects',path:'x',expected_sha256:'absent',old_string:'a',new_string:'b'}],
+  ['desktop_action',{intent_id:intent,kind:'click_primary',expected_frame_id:frame}],
+  ['desktop_action',{intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'x',target_id:session}],
+  ['process_session_terminate',{pid:123}],
+  ['process_session_start',{profile_id:'node',root_id:'projects',executable:'cmd.exe'}]
+ ];
+ for(const [name,input] of checks){
+  assert.equal(server.tools.get(name).schema.safeParse(input).success,false,name+' bypass accepted');
+ }
+});

package/test/r202-destination-journal.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import {mkdtemp,readFile,rm,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {openRemoteDestinationJournalR202} from '../src/remote-destination-journal-r202.mjs';
+import {REMOTE_TERMINAL_DOMAIN,REMOTE_TERMINAL_EVIDENCE_SCHEMA} from '../src/remote-terminal-evidence-r200.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createRemoteDevicePlaneR44} from '../src/remote-device-r44.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function fixture(t){
+ const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r202-journal-'));
+ t.after(()=>rm(base,{recursive:true,force:true}));
+ const keys=generateKeyPairSync('ed25519');
+ const spki=Buffer.from(keys.publicKey.export({type:'spki',format:'der'}));
+ const device={device_id:sha(spki),epoch:1,public_key_spki_base64:spki.toString('base64')};
+ const dir=path.join(base,'terminal-journal');
+ const journal=await openRemoteDestinationJournalR202({directory:dir,device});
+ const request={device_id:device.device_id,epoch:1,request_id:'9'.repeat(64),
+  request_sha256:'a'.repeat(64),capability_id:'machine.fs.write'};
+ const envelope=(terminal,overrides={})=>{
+  const evidence={schema:REMOTE_TERMINAL_EVIDENCE_SCHEMA,...request,terminal,...overrides};
+  const sig=sign(null,Buffer.concat([REMOTE_TERMINAL_DOMAIN,Buffer.from(canonicalJson(evidence),'utf8')]),keys.privateKey).toString('base64');
+  return {evidence,attestation:{algorithm:'ed25519',key_id:device.device_id,signature_base64:sig}};
+ };
+ return {base,dir,journal,device,keys,request,envelope};
+}
+const terminal=(hex='b')=>({status:'completed',result_sha256:hex.repeat(64)});
+test('R202 stores only paired signed evidence; lookup survives restart and is idempotent',async t=>{
+ const f=await fixture(t),proof=f.envelope(terminal());
+ const r=await f.journal.commitSignedTerminal({request:f.request,envelope:proof});
+ assert.equal(r.status,'stored');assert.match(r.terminal_evidence_sha256,/^[a-f0-9]{64}$/);
+ const r2=await f.journal.commitSignedTerminal({request:f.request,envelope:proof});
+ assert.equal(r2.status,'existing');
+ const restarted=await openRemoteDestinationJournalR202({directory:f.dir,device:f.device});
+ assert.deepEqual(await restarted.lookupTerminal(f.request),proof);
+});
+test('R202 a second signed but conflicting terminal cannot overwrite committed evidence',async t=>{
+ const f=await fixture(t),one=f.envelope(terminal('b')),two=f.envelope(terminal('c'));
+ await f.journal.commitSignedTerminal({request:f.request,envelope:one});
+ await assert.rejects(f.journal.commitSignedTerminal({request:f.request,envelope:two}),/conflicting signed terminal/);
+ assert.deepEqual(await f.journal.lookupTerminal(f.request),one);
+});
+test('R202 unsigned, wrong request, epoch and corrupted stored evidence fail closed',async t=>{
+ const f=await fixture(t),proof=f.envelope(terminal());
+ const altered=structuredClone(proof);altered.evidence.terminal.result_sha256='d'.repeat(64);
+ await assert.rejects(f.journal.commitSignedTerminal({request:f.request,envelope:altered}),/signature invalid/);
+ await assert.rejects(f.journal.commitSignedTerminal({request:{...f.request,epoch:2},envelope:proof}),/request identity invalid/);
+ await f.journal.commitSignedTerminal({request:f.request,envelope:proof});
+ const file=path.join(f.dir,f.request.request_id+'.json');
+ await writeFile(file,JSON.stringify(altered)+'\n');
+ await assert.rejects(f.journal.lookupTerminal(f.request),/signature invalid/);
+});
+test('R202 missing or partially written journal remains UNKNOWN and denies bad selectors',async t=>{
+ const f=await fixture(t);
+ assert.equal(await f.journal.lookupTerminal(f.request),null);
+ await assert.rejects(f.journal.lookupTerminal({...f.request,request_id:'../evil'}),/request identity invalid/);
+ await assert.rejects(f.journal.lookupTerminal({...f.request,request_sha256:'f'.repeat(64),device_id:'b'.repeat(64)}),/lookup request identity invalid/);
+ const file=path.join(f.dir,f.request.request_id+'.json');
+ await writeFile(file,'');
+ await assert.rejects(f.journal.lookupTerminal(f.request),/record is not a bounded regular file/);
+});
+test('R202 local relay adapter recovers lost ACK with exactly one remote dispatch',async t=>{
+ const f=await fixture(t);
+ let calls=0;
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(){calls++;return null;},
+  lookupTerminal:args=>f.journal.lookupTerminal(args)
+ };
+ const stateDir=path.join(f.base,'sender');
+ const plane=await createRemoteDevicePlaneR44({stateDir,relay,authorizeCapability:async()=>true,
+  relayTimeoutMs:1000,probeRetries:0,reachableTtlMs:10000});
+ await plane.pair({publicKeySpkiBase64:f.device.public_key_spki_base64,displayName:'R202 simulated destination'});
+ await plane.reportOnline({deviceId:f.device.device_id,epoch:1,connectionId:'R202 local transport'});
+ await plane.probe({deviceId:f.device.device_id,epoch:1});
+ const args={deviceId:f.device.device_id,epoch:1,capabilityId:f.request.capability_id,
+  payload:{path:'readme.txt',content:'one'},requestId:f.request.request_id};
+ const first=await plane.dispatch(args);
+ assert.equal(first.effect_state,'unknown');
+ assert.equal(calls,1);
+ const proof=f.envelope(terminal(),{request_sha256:first.request_sha256});
+ await f.journal.commitSignedTerminal({request:{...f.request,request_sha256:first.request_sha256},envelope:proof});
+ const next=await plane.reconcile({requestId:args.requestId});
+ assert.equal(next.effect_state,'confirmed');assert.equal(next.state,'completed');
+ assert.equal(next.reconciliation_state,'signed_terminal');
+ assert.equal(calls,1,'lookup retried the mutation');
+ const replay=await plane.dispatch(args);
+ assert.equal(replay.replay,true);assert.equal(calls,1);
+});

package/test/r203-atomic-journal.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,readdir,rm,writeFile,stat} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import path from 'node:path';
+import os from 'node:os';
+import {fileURLToPath} from 'node:url';
+import {openRemoteDestinationJournalR202} from '../src/remote-destination-journal-r202.mjs';
+import {REMOTE_TERMINAL_DOMAIN,REMOTE_TERMINAL_EVIDENCE_SCHEMA} from '../src/remote-terminal-evidence-r200.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const worker=fileURLToPath(new URL('./fixtures/r203-journal-writer.mjs',import.meta.url));
+async function fixture(t){
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r203-journal-'));
+ t.after(()=>rm(dir,{recursive:true,force:true}));
+ const key=generateKeyPairSync('ed25519'),spki=Buffer.from(key.publicKey.export({format:'der',type:'spki'}));
+ const device={device_id:sha(spki),epoch:1,public_key_spki_base64:spki.toString('base64')};
+ const journalDir=path.join(dir,'journal');
+ const journal=await openRemoteDestinationJournalR202({directory:journalDir,device});
+ const request={device_id:device.device_id,epoch:1,request_id:'a'.repeat(64),request_sha256:'b'.repeat(64),capability_id:'machine.fs.write'};
+ const signEvidence=terminal=>{
+  const evidence={schema:REMOTE_TERMINAL_EVIDENCE_SCHEMA,...request,terminal};
+  const signature_base64=sign(null,Buffer.concat([REMOTE_TERMINAL_DOMAIN,Buffer.from(canonicalJson(evidence))]),key.privateKey).toString('base64');
+  return {evidence,attestation:{algorithm:'ed25519',key_id:device.device_id,signature_base64}};
+ };
+ return {dir,journalDir,journal,device,request,signEvidence};
+}
+const completed={status:'completed',result_sha256:'c'.repeat(64)};
+test('R203 orphan unpublished temp never poisons absent destination terminal',async t=>{
+ const f=await fixture(t);
+ const garbage=path.join(f.journalDir,'.'+f.request.request_id+'.1234567890abcdef12345678.tmp');
+ await writeFile(garbage,'{broken');
+ assert.equal(await f.journal.lookupTerminal(f.request),null);
+ const record=f.signEvidence(completed);
+ assert.equal((await f.journal.commitSignedTerminal({request:f.request,envelope:record})).status,'stored');
+ assert.deepEqual(await f.journal.lookupTerminal(f.request),record);
+ assert.equal((await readFile(garbage,'utf8')),'{broken','the orphan is left to explicit cleanup, not silently deleted');
+});
+test('R203 8 independent Windows processes race for the same terminal; exactly one publication',async t=>{
+ const f=await fixture(t),envelope=f.signEvidence(completed);
+ const fixturePath=path.join(f.dir,'case.json');
+ await writeFile(fixturePath,JSON.stringify({directory:f.journalDir,device:f.device,request:f.request,envelope}));
+ const spawnWorker=()=>new Promise((resolve,reject)=>{
+  const child=spawn(process.execPath,[worker,fixturePath],{shell:false,windowsHide:true,stdio:['ignore','pipe','pipe']});
+  let stdout='',stderr='';
+  child.stdout.setEncoding('utf8');child.stderr.setEncoding('utf8');
+  child.stdout.on('data',s=>stdout+=s);child.stderr.on('data',s=>stderr+=s);
+  child.once('error',reject);child.once('close',code=>code===0?resolve(JSON.parse(stdout.trim())):reject(Error('worker exit '+code+' '+stderr)));
+ });
+ const results=await Promise.all(Array.from({length:8},spawnWorker));
+ assert.equal(results.filter(r=>r.status==='stored').length,1);
+ assert.equal(results.filter(r=>r.status==='existing').length,7);
+ assert.deepEqual(await f.journal.lookupTerminal(f.request),envelope);
+ const children=(await readdir(f.journalDir)).filter(x=>x.endsWith('.tmp'));
+ assert.deepEqual(children,[],'all successful writers removed private temp files');
+});
+test('R203 competing distinct signed terminal results cannot overwrite a winner',async t=>{
+ const f=await fixture(t);
+ const first=f.signEvidence(completed);
+ const second=f.signEvidence({status:'completed',result_sha256:'d'.repeat(64)});
+ const results=await Promise.allSettled([f.journal.commitSignedTerminal({request:f.request,envelope:first}),
+  f.journal.commitSignedTerminal({request:f.request,envelope:second})]);
+ assert.equal(results.filter(r=>r.status==='fulfilled').length,1);
+ assert.equal(results.filter(r=>r.status==='rejected'&&/conflicting signed terminal/.test(r.reason?.message)).length,1);
+ const actual=await f.journal.lookupTerminal(f.request);
+ assert.ok([first,second].some(p=>p.evidence.terminal.result_sha256===actual.evidence.terminal.result_sha256));
+});
+test('R203 preexisting directory or oversized forged final record is never overwritten',async t=>{
+ const f=await fixture(t),file=path.join(f.journalDir,f.request.request_id+'.json');
+ await mkdir(file);
+ await assert.rejects(f.journal.commitSignedTerminal({request:f.request,envelope:f.signEvidence(completed)}),/bounded regular file/);
+ await rm(file,{recursive:true});
+ await writeFile(file,' '.repeat(17000));
+ await assert.rejects(f.journal.lookupTerminal(f.request),/bounded regular file/);
+});
+test('R203 signed record read uses bounded handle and detects invalid mutable payload',async t=>{
+ const f=await fixture(t),envelope=f.signEvidence(completed);
+ await f.journal.commitSignedTerminal({request:f.request,envelope});
+ const file=path.join(f.journalDir,f.request.request_id+'.json');
+ const initial=await stat(file);
+ assert.ok(initial.size>64);
+ const bad={...envelope,evidence:{...envelope.evidence,terminal:{...completed,result_sha256:'d'.repeat(64)}}};
+ await writeFile(file,JSON.stringify(bad));
+ await assert.rejects(f.journal.lookupTerminal(f.request),/signature invalid/);
+});

package/test/r205-candidate-selection-cli.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const cli=fileURLToPath(new URL('../scripts/r205-candidate-selection.mjs',import.meta.url));
+const H=c=>c.repeat(64);
+const fixture=H('a'),env=H('b');
+function input(status='PASS'){
+ const artifact=H('4');
+ const correct=(h,s)=>({status:s,artifact_sha256:h,fixture_sha256:fixture,receipt_sha256:H('2')});
+ const benchmark=(h,samples)=>({artifact_sha256:h,fixture_sha256:fixture,environment_sha256:env,receipt_sha256:H('3'),samples_ms:samples});
+ return {schema:'deadbyte.candidate-selection.r205.v1',fixture_sha256:fixture,environment_sha256:env,
+  baseline:{artifact_sha256:H('1'),correctness:correct(H('1'),'PASS'),benchmark:benchmark(H('1'),Array(7).fill(100))},
+  candidates:[{candidate_id:'candidate',artifact_sha256:artifact,correctness:correct(artifact,status),...(status==='PASS'?{benchmark:benchmark(artifact,Array(7).fill(75))}:{})}]};
+}
+const run=stdin=>spawnSync(process.execPath,[cli],{input:stdin,encoding:'utf8',windowsHide:true,timeout:10000,stdio:['pipe','pipe','pipe']});
+test('R205 CLI returns provisional evidence only, no release authorization',()=>{
+ const r=run(JSON.stringify(input()));assert.equal(r.status,0,r.stderr);
+ const j=JSON.parse(r.stdout);assert.equal(j.state,'PROVISIONAL_CANDIDATE');assert.equal(j.release_authorized,false);assert.equal(j.evidence_verified,false);
+});
+test('R205 CLI exits 2 for ungraded result without turning uncertainty into failure score',()=>{
+ const r=run(JSON.stringify(input('UNKNOWN')));assert.equal(r.status,2,r.stderr);
+ const j=JSON.parse(r.stdout);assert.equal(j.candidates[0].verdict,'UNGRADED');assert.equal(j.state,'NO_QUALIFIED_CANDIDATE');
+});
+test('R205 CLI refuses malformed JSON with exit 3',()=>{
+ const r=run('{invalid');assert.equal(r.status,3);assert.match(r.stderr,/R205_SELECTION_REFUSED/);
+});
+test('R205 CLI refuses oversized stdin before evaluation',()=>{
+ const r=run('x'.repeat(65537));assert.equal(r.status,3);assert.match(r.stderr,/R205_INPUT_LIMIT_EXCEEDED/);
+});

package/test/r205-candidate-selection.test.mjs

@@ -0,0 +1,83 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {CANDIDATE_SELECTION_SCHEMA,buildBlindCandidateViewR205,evaluateCandidateSelectionR205} from '../src/candidate-selection-r205.mjs';
+const H=c=>c.repeat(64);
+const fixture=H('a'),environment=H('b');
+const evidence=(status,artifact,tag)=>({status,artifact_sha256:artifact,fixture_sha256:fixture,receipt_sha256:H(tag)});
+const bench=(artifact,times,tag,env=environment)=>({artifact_sha256:artifact,fixture_sha256:fixture,environment_sha256:env,receipt_sha256:H(tag),samples_ms:times});
+const candidate=(id,artifact,status,times,tag='5')=>({candidate_id:id,artifact_sha256:artifact,correctness:evidence(status,artifact,tag),...(times?{benchmark:bench(artifact,times,'6')}:{})});
+const input=()=>({schema:CANDIDATE_SELECTION_SCHEMA,fixture_sha256:fixture,environment_sha256:environment,
+ baseline:{artifact_sha256:H('1'),correctness:evidence('PASS',H('1'),'2'),benchmark:bench(H('1'),[100,100,100,100,100,100,100],'3')},
+ candidates:[candidate('fast',H('4'),'PASS',[80,81,79,80,81,79,80]) ]});
+test('R205 fast and correct candidate is provisional, never a release authorization',()=>{
+ const r=evaluateCandidateSelectionR205(input());
+ assert.equal(r.state,'PROVISIONAL_CANDIDATE');assert.equal(r.winner_candidate_id,'fast');
+ assert.equal(r.evidence_verified,false);assert.equal(r.release_authorized,false);assert.match(r.report_sha256,/^[0-9a-f]{64}$/);
+});
+test('R205 faster incorrect candidate is rejected even if its benchmark looks good',()=>{
+ const i=input();i.candidates.push(candidate('bad',H('7'),'FAIL',[1,1,1,1,1,1,1]));
+ const r=evaluateCandidateSelectionR205(i);
+ assert.equal(r.candidates.find(x=>x.candidate_id==='bad').verdict,'REJECT_CORRECTNESS');
+ assert.equal(r.winner_candidate_id,'fast');
+});
+test('R205 unknown grader verdict stays UNGRADED not score zero',()=>{
+ const i=input();i.candidates=[candidate('unknown',H('7'),'UNKNOWN',null)];
+ const r=evaluateCandidateSelectionR205(i);
+ assert.equal(r.state,'NO_QUALIFIED_CANDIDATE');assert.equal(r.candidates[0].verdict,'UNGRADED');
+});
+test('R205 invalid and untested grader status stay UNGRADED',()=>{
+ for(const state of ['INVALID','UNTESTED']){
+  const i=input();i.candidates=[candidate(state,H('7'),state,null)];
+  assert.equal(evaluateCandidateSelectionR205(i).candidates[0].verdict,'UNGRADED');
+ }
+});
+test('R205 unstable or noisy benchmark cannot win',()=>{
+ const i=input();i.candidates=[candidate('noisy',H('7'),'PASS',[75,75,75,75,150,150,150])];
+ assert.equal(evaluateCandidateSelectionR205(i).state,'NO_QUALIFIED_CANDIDATE');
+});
+test('R205 no meaningful speedup cannot win',()=>{
+ const i=input();i.candidates=[candidate('tiny',H('7'),'PASS',[98,98,98,98,98,98,98])];
+ assert.equal(evaluateCandidateSelectionR205(i).state,'NO_QUALIFIED_CANDIDATE');
+});
+test('R205 close candidates produce AMBIGUOUS, never arbitrary promotion',()=>{
+ const i=input();i.candidates.push(candidate('near',H('7'),'PASS',[81,81,81,81,81,81,81]));
+ const r=evaluateCandidateSelectionR205(i);
+ assert.equal(r.state,'AMBIGUOUS');assert.equal(r.winner_candidate_id,null);
+});
+test('R205 candidate ordering and names do not alter blind evaluation hash',()=>{
+ const i=input();i.candidates.push(candidate('other',H('7'),'FAIL',null));
+ const hash1=evaluateCandidateSelectionR205(i).blind_evaluation_sha256;
+ i.candidates.reverse();i.candidates[0].candidate_id='new_other';i.candidates[1].candidate_id='new_fast';
+ assert.equal(evaluateCandidateSelectionR205(i).blind_evaluation_sha256,hash1);
+ assert.equal(JSON.stringify(buildBlindCandidateViewR205(i)).includes('new_fast'),false);
+});
+test('R205 disallows proposer identity and hidden metadata from evaluation',()=>{
+ const i=input();i.candidates[0].proposer='model-b';
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/unexpected field proposer/);
+});
+test('R205 refuses forged correctness artifact identity',()=>{
+ const i=input();i.candidates[0].correctness.artifact_sha256=H('f');
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/identity mismatch/);
+});
+test('R205 refuses benchmark environment drift',()=>{
+ const i=input();i.candidates[0].benchmark.environment_sha256=H('f');
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/identity mismatch/);
+});
+test('R205 refuses duplicate candidate artifact or baseline artifact',()=>{
+ const i=input();i.candidates.push(candidate('copy',H('4'),'PASS',[90,90,90,90,90,90,90]));
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/duplicated/);
+ i.candidates=[candidate('base',H('1'),'PASS',[70,70,70,70,70,70,70])];
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/duplicated/);
+});
+test('R205 refuses missing/insufficient samples rather than accepting ungraded benchmark',()=>{
+ const i=input();i.candidates[0].benchmark.samples_ms=[80,80];
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/samples invalid/);
+ i.candidates=[candidate('no',H('5'),'PASS',null)];
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/benchmark missing/);
+});
+test('R205 refuses mismatched paired sample counts and malformed values',()=>{
+ const i=input();i.candidates[0].benchmark.samples_ms=[80,80,80,80,80,80,80,80];
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/length mismatch/);
+ i.candidates[0].benchmark.samples_ms=[80,80,80,80,80,80,NaN];
+ assert.throws(()=>evaluateCandidateSelectionR205(i),/samples invalid/);
+});