deadbyte-mcp 0.15.74 → 0.15.76

package/src/desktop-uia-identity-r199.mjs

@@ -0,0 +1,51 @@
+import {createHash} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const sha=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
+function insist(ok,message){if(!ok)throw new Error(message);}
+export function normalizeUiaRuntimeIdR199(value){
+ insist(Array.isArray(value)&&value.length>=1&&value.length<=64,'R199 UIA RuntimeId missing or unbounded');
+ insist(value.every(x=>Number.isInteger(x)&&x>=-2147483648&&x<=2147483647),
+   'R199 UIA RuntimeId component invalid');
+ return Object.freeze([...value]);
+}
+function eqArray(a,b){return a.length===b.length&&a.every((v,i)=>v===b[i]);}
+function eqRect(a,b){return ['left','top','width','height'].every(k=>a?.[k]===b?.[k]);}
+export function bindUiaElementR199({frame,grounded,candidate,query}={}){
+ insist(frame?.frame_id&&HEX64.test(frame.frame_id),'R199 UIA frame identity missing');
+ insist(typeof grounded?.query_sha256==='string'&&HEX64.test(grounded.query_sha256),'R199 UIA query hash invalid');
+ insist(grounded.truncated===false,'R199 UIA scan truncated');
+ const runtimeId=normalizeUiaRuntimeIdR199(candidate?.runtime_id);
+ insist(candidate.enabled===true&&!candidate.offscreen,'R199 UIA element not actionable');
+ const q=Object.freeze({
+   kind:query.kind,value:query.value,
+   max_results:query.max_results??8,ordinal:query.ordinal??0
+ });
+ const tokenSha256=sha({schema:'deadbyte.uia-element-binding-r199.v1',
+   frame_id:frame.frame_id,desktop_epoch:frame.desktop_epoch,
+   active_window:frame.active_window,query_sha256:grounded.query_sha256,
+   runtime_id:runtimeId,control_type:candidate.control_type,rect:candidate.rect});
+ return Object.freeze({
+   schema:'deadbyte.uia-element-binding-r199.v1',
+   query:q,query_sha256:grounded.query_sha256,ordinal:grounded.ordinal,
+   runtime_id:runtimeId,control_type:candidate.control_type,
+   rect:Object.freeze({...candidate.rect}),token_sha256:tokenSha256
+ });
+}
+export function assertFreshUiaElementR199(binding,grounded){
+ insist(binding?.schema==='deadbyte.uia-element-binding-r199.v1','R199 UIA binding missing');
+ insist(grounded?.status==='ok'&&grounded.truncated===false,'R199 UIA reground scan invalid or incomplete');
+ insist(grounded.query_sha256===binding.query_sha256 &&
+   grounded.ordinal===binding.ordinal,'R199 UIA query identity changed');
+ insist(Array.isArray(grounded.matches)&&binding.ordinal<grounded.matches.length,
+   'R199 UIA stale target no longer found');
+ const candidate=grounded.matches[binding.ordinal];
+ const current=normalizeUiaRuntimeIdR199(candidate?.runtime_id);
+ insist(eqArray(binding.runtime_id,current),'R199 UIA element identity changed');
+ insist(candidate.control_type===binding.control_type&&candidate.enabled===true&&!candidate.offscreen,
+   'R199 UIA control state changed');
+ insist(eqRect(candidate.rect,binding.rect),'R199 UIA element rectangle changed');
+ return Object.freeze({token_sha256:binding.token_sha256,
+   runtime_id_sha256:sha(current),verified:true});
+}

package/src/desktop-uia-r40.mjs

@@ -73,10 +73,18 @@ export function parseDesktopUiaResponse(bytes,{expectedWindow,query,expectedBoun
     };
     const inside=rect.left>=left&&rect.top>=top&&rect.left+rect.width<=left+width&&rect.top+rect.height<=top+height;
     if(!inside) continue;
+    let runtimeId=null;
+    if(item.runtime_id!==undefined){
+      insist(Array.isArray(item.runtime_id)&&item.runtime_id.length<=64,'desktop UIA RuntimeId shape invalid');
+      if(item.runtime_id.length===0)insist(q.kind==='root','desktop UIA RuntimeId missing for non-root');
+      else runtimeId=Object.freeze(item.runtime_id.map(v=>
+        integer(v,'desktop UIA RuntimeId component',{min:-2147483648,max:2147483647})));
+    }
     matches.push(Object.freeze({
       rect:Object.freeze(rect),
       control_type:integer(item.control_type,'desktop UIA control_type',{min:0,max:100000}),
-      enabled:item.enabled===true,offscreen:item.offscreen===true
+      enabled:item.enabled===true,offscreen:item.offscreen===true,
+      runtime_id:runtimeId
     }));
   }
   return Object.freeze({

package/src/machine-fs-handle-read-r196.mjs

@@ -0,0 +1,43 @@
+import {createHash} from 'node:crypto';
+
+function sameMetadata(a,b){
+ return a.dev===b.dev&&a.ino===b.ino&&a.size===b.size&&
+  a.mtimeNs===b.mtimeNs&&a.ctimeNs===b.ctimeNs;
+}
+
+// Hash bytes through the same open FileHandle used for the range read.
+// This does not prove that the pathname was safe before open, or that
+// concurrent in-place writes cannot alter data between individual reads.
+export async function readRangeFromHandle(handle,{offset,length,hashFile=false,signal}){
+ if(!handle||typeof handle.read!=='function'||typeof handle.stat!=='function'||
+    typeof handle.createReadStream!=='function')throw new TypeError('R196 requires a live FileHandle');
+ if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(length)||length<0||length>4194304)
+  throw new RangeError('R196 invalid bounded file range');
+ const before=await handle.stat({bigint:true});
+ if(!before.isFile())throw new Error('R196 read requires a regular file');
+ if(before.size>BigInt(Number.MAX_SAFE_INTEGER))throw new Error('R196 file size exceeds safe integer');
+ const fileSize=Number(before.size);
+ if(offset>fileSize)throw new Error('R196 offset exceeds opened file size');
+ const buffer=Buffer.alloc(Math.min(length,fileSize-offset));
+ const read=buffer.length?await handle.read(buffer,0,buffer.length,offset):{bytesRead:0};
+ let digest=null;
+ if(hashFile){
+  const hash=createHash('sha256');
+  await new Promise((resolve,reject)=>{
+   const stream=handle.createReadStream({start:0,autoClose:false,signal});
+   stream.on('data',chunk=>hash.update(chunk));
+   stream.once('error',reject);
+   stream.once('end',resolve);
+  });
+  digest=hash.digest('hex');
+ }
+ const after=await handle.stat({bigint:true});
+ if(!sameMetadata(before,after))throw new Error('R196 opened file changed during read/hash');
+ return {
+  schema:'deadbyte.machine-fs-read-worker.v1',
+  bytes_read:read.bytesRead,
+  data_base64:buffer.subarray(0,read.bytesRead).toString('base64'),
+  file_sha256:digest,file_size:fileSize,
+  file_dev:String(before.dev),file_ino:String(before.ino)
+ };
+}

package/src/machine-fs-native-read-r197.mjs

@@ -0,0 +1,73 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {validatePortableRelativePath} from './path-policy.mjs';
+
+const SHA=/^[0-9a-f]{64}$/;
+const DECIMAL=/^(?:0|[1-9][0-9]{0,19})$/;
+const EXECUTABLE=fileURLToPath(new URL('../bin/deadbyte-fs-read-r197-fixed.exe',import.meta.url));
+export const R197_NATIVE_READ_EXE_SHA256='7477ca3d94168c8b75711b734df5b9c20a43ecbd9338cfc234700d7e27982b63';
+const hash=b=>createHash('sha256').update(b).digest('hex');
+let pinnedInfo=null;
+async function verifyExecutable(){
+ const info=await lstat(EXECUTABLE);
+ if(!info.isFile()||info.isSymbolicLink()||info.size<1024||info.size>4*1024*1024)
+  throw new Error('R197 native file reader binary is not a regular bounded executable');
+ // Only a trust-state fast path, NOT a general same-user tamper sandbox.
+ const current=hash(await readFile(EXECUTABLE));
+ if(current!==R197_NATIVE_READ_EXE_SHA256)throw new Error('R197 native reader executable SHA-256 mismatch');
+ pinnedInfo={sha256:current,bytes:info.size};
+ return pinnedInfo;
+}
+export async function boundedNativeReadR197({rootPath,relativePath,offset,length,hashFile=false,timeoutMs=30000}={}){
+ if(process.platform!=='win32')throw new Error('R197 native root-relative reader requires Windows');
+ if(typeof rootPath!=='string'||!path.win32.isAbsolute(rootPath)||!path.isAbsolute(rootPath))
+  throw new Error('R197 native root path invalid');
+ validatePortableRelativePath(relativePath);
+ if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(length)||length<0||length>4*1024*1024)
+  throw new Error('R197 native bounded range invalid');
+ if(!Number.isInteger(timeoutMs)||timeoutMs<100||timeoutMs>180000)
+  throw new Error('R197 native timeout invalid');
+ await verifyExecutable();
+ return await new Promise((resolve,reject)=>{
+  const args=[rootPath,relativePath,String(offset),String(length),hashFile?'1':'0'];
+  const child=spawn(EXECUTABLE,args,{windowsHide:true,shell:false,stdio:['ignore','pipe','pipe']});
+  const chunks=[];let byteCount=0,stderr='',settled=false,timer=null;
+  const finish=(error,value)=>{
+   if(settled)return;
+   settled=true;if(timer!==null)clearTimeout(timer);
+   error?reject(error):resolve(value);
+  };
+  child.stdout.on('data',chunk=>{
+   byteCount+=chunk.length;
+   if(byteCount>8*1024*1024){child.kill();finish(new Error('R197 native read stdout exceeds bound'));return;}
+   chunks.push(Buffer.from(chunk));
+  });
+  child.stderr.on('data',chunk=>{
+   stderr=(stderr+chunk.toString('utf8')).slice(-16384);
+  });
+  child.on('error',error=>finish(error));
+  child.on('close',(code,signal)=>{
+   if(settled)return;
+   if(code!==0)return finish(new Error('R197 native root-relative read refused exit='+code+' signal='+(signal??'none')+' '+stderr.slice(-512)));
+   let response;
+   try{response=JSON.parse(Buffer.concat(chunks).toString('utf8'));}
+   catch{return finish(new Error('R197 native read response invalid JSON'));}
+   const data=typeof response?.data_base64==='string'?Buffer.from(response.data_base64,'base64'):null;
+   if(response?.schema!=='deadbyte.machine-fs-read-worker.v1'||!data||
+      response.bytes_read!==data.length||data.length>length||
+      !Number.isSafeInteger(response.file_size)||!DECIMAL.test(response.file_dev??'')||
+      !DECIMAL.test(response.file_ino??'')||
+      (hashFile?!SHA.test(response.file_sha256??''):response.file_sha256!==null))
+    return finish(new Error('R197 native read response contract mismatch'));
+   return finish(null,response);
+  });
+  timer=setTimeout(()=>{
+   child.kill();
+   finish(new Error('R197 native read timed out after '+timeoutMs+'ms'));
+  },timeoutMs);
+  timer.unref?.();
+ });
+}

package/src/machine-fs-native-read-r198.mjs

@@ -0,0 +1,76 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {validatePortableRelativePath} from './path-policy.mjs';
+
+const SHA=/^[0-9a-f]{64}$/;
+const DECIMAL=/^(?:0|[1-9][0-9]{0,19})$/;
+const EXECUTABLE=fileURLToPath(new URL('../bin/deadbyte-fs-read-r198.exe',import.meta.url));
+export const R198_NATIVE_READ_EXE_SHA256='4325ae4f033bba195b34d2c49b48493a1a468f3443e369a9bb887a7a129eac16';
+const hash=b=>createHash('sha256').update(b).digest('hex');
+let pinnedInfo=null;
+async function verifyExecutable(){
+ const info=await lstat(EXECUTABLE);
+ if(!info.isFile()||info.isSymbolicLink()||info.size<1024||info.size>4*1024*1024)
+  throw new Error('R198 native file reader binary is not a regular bounded executable');
+ // Only a trust-state fast path, NOT a general same-user tamper sandbox.
+ const current=hash(await readFile(EXECUTABLE));
+ if(current!==R198_NATIVE_READ_EXE_SHA256)throw new Error('R198 native reader executable SHA-256 mismatch');
+ pinnedInfo={sha256:current,bytes:info.size};
+ return pinnedInfo;
+}
+export async function boundedNativeReadR198({rootPath,relativePath,offset,length,hashFile=false,timeoutMs=30000,expectedRootDev,expectedRootIno}={}){
+ if(process.platform!=='win32')throw new Error('R198 native root-relative reader requires Windows');
+ if(typeof rootPath!=='string'||!path.win32.isAbsolute(rootPath)||!path.isAbsolute(rootPath))
+  throw new Error('R198 native root path invalid');
+ validatePortableRelativePath(relativePath);
+ if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(length)||length<0||length>4*1024*1024)
+  throw new Error('R198 native bounded range invalid');
+ if(!Number.isInteger(timeoutMs)||timeoutMs<100||timeoutMs>180000)
+  throw new Error('R198 native timeout invalid');
+ if(typeof expectedRootDev!=='string'||!DECIMAL.test(expectedRootDev)||
+    typeof expectedRootIno!=='string'||!DECIMAL.test(expectedRootIno)||expectedRootIno==='0')
+  throw new Error('R198 expected root identity missing or invalid');
+ await verifyExecutable();
+ return await new Promise((resolve,reject)=>{
+  const args=[rootPath,relativePath,String(offset),String(length),hashFile?'1':'0',expectedRootDev,expectedRootIno];
+  const child=spawn(EXECUTABLE,args,{windowsHide:true,shell:false,stdio:['ignore','pipe','pipe']});
+  const chunks=[];let byteCount=0,stderr='',settled=false,timer=null;
+  const finish=(error,value)=>{
+   if(settled)return;
+   settled=true;if(timer!==null)clearTimeout(timer);
+   error?reject(error):resolve(value);
+  };
+  child.stdout.on('data',chunk=>{
+   byteCount+=chunk.length;
+   if(byteCount>8*1024*1024){child.kill();finish(new Error('R198 native read stdout exceeds bound'));return;}
+   chunks.push(Buffer.from(chunk));
+  });
+  child.stderr.on('data',chunk=>{
+   stderr=(stderr+chunk.toString('utf8')).slice(-16384);
+  });
+  child.on('error',error=>finish(error));
+  child.on('close',(code,signal)=>{
+   if(settled)return;
+   if(code!==0)return finish(new Error('R198 native root-relative read refused exit='+code+' signal='+(signal??'none')+' '+stderr.slice(-512)));
+   let response;
+   try{response=JSON.parse(Buffer.concat(chunks).toString('utf8'));}
+   catch{return finish(new Error('R198 native read response invalid JSON'));}
+   const data=typeof response?.data_base64==='string'?Buffer.from(response.data_base64,'base64'):null;
+   if(response?.schema!=='deadbyte.machine-fs-read-worker.v1'||!data||
+      response.bytes_read!==data.length||data.length>length||
+      !Number.isSafeInteger(response.file_size)||!DECIMAL.test(response.file_dev??'')||
+      !DECIMAL.test(response.file_ino??'')||
+      (hashFile?!SHA.test(response.file_sha256??''):response.file_sha256!==null))
+    return finish(new Error('R198 native read response contract mismatch'));
+   return finish(null,response);
+  });
+  timer=setTimeout(()=>{
+   child.kill();
+   finish(new Error('R198 native read timed out after '+timeoutMs+'ms'));
+  },timeoutMs);
+  timer.unref?.();
+ });
+}

package/src/machine-fs-read-worker.mjs

@@ -1,5 +1,5 @@
-import { createHash } from 'node:crypto';
-import { createReadStream, promises as fs } from 'node:fs';
+import { promises as fs } from 'node:fs';
+import { readRangeFromHandle } from './machine-fs-handle-read-r196.mjs';
 
 const [file, offsetText, lengthText, hashText] = process.argv.slice(2);
 const offset = Number(offsetText);
@@ -13,33 +13,13 @@ if (typeof file !== 'string' || !Number.isSafeInteger(offset) || offset < 0 ||
 
 try {
   const handle = await fs.open(file, 'r');
-  let bytes;
+  let result;
   try {
-    const buffer = Buffer.alloc(length);
-    const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
-    bytes = buffer.subarray(0, result.bytesRead);
+    result = await readRangeFromHandle(handle,{offset,length,hashFile:hashText==='1'});
   } finally {
     await handle.close();
   }
-
-  let fileSha256 = null;
-  if (hashText === '1') {
-    const hash = createHash('sha256');
-    await new Promise((resolve, reject) => {
-      const stream = createReadStream(file);
-      stream.on('data', chunk => hash.update(chunk));
-      stream.once('error', reject);
-      stream.once('end', resolve);
-    });
-    fileSha256 = hash.digest('hex');
-  }
-
-  process.stdout.write(JSON.stringify({
-    schema: 'deadbyte.machine-fs-read-worker.v1',
-    bytes_read: bytes.length,
-    data_base64: bytes.toString('base64'),
-    file_sha256: fileSha256
-  }));
+  process.stdout.write(JSON.stringify(result));
 } catch (error) {
   process.stderr.write(String(error?.stack ?? error));
   process.exit(1);

package/src/machine-fs.mjs

@@ -10,6 +10,8 @@ import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { atomicMutation } from './atomic-mutation.mjs';
+import { readRangeFromHandle } from './machine-fs-handle-read-r196.mjs';
+import { boundedNativeReadR198 } from './machine-fs-native-read-r198.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -48,14 +50,7 @@ async function boundedReadInProcess({ file, offset, length, hashFile, timeoutMs
     timer.unref?.();
   });
   try {
-    const operation = (async () => {
-      const buffer = Buffer.alloc(length);
-      const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
-      let fileSha256 = null;
-      if (hashFile) fileSha256 = await sha256File(file, abortController.signal);
-      return { schema: 'deadbyte.machine-fs-read-worker.v1', bytes_read: result.bytesRead,
-        data_base64: buffer.subarray(0, result.bytesRead).toString('base64'), file_sha256: fileSha256 };
-    })();
+    const operation = readRangeFromHandle(handle, { offset, length, hashFile, signal: abortController.signal });
     operation.catch(() => {});
     return await Promise.race([operation, abort]);
   } finally {
@@ -414,22 +409,42 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingReadAllowed(policy, rootId);
+    // Capture the root object before path validation. The native worker must
+    // compare its opened root HANDLE identity before resolving any child.
+    const authorizedRoot = getRoot(policy, rootId, 'read');
+    const rootBefore = await lstat(authorizedRoot.real_path, { bigint: true });
+    if (rootBefore.isSymbolicLink() || !rootBefore.isDirectory() || rootBefore.ino === 0n)
+      throw new Error('R198 root directory identity unavailable');
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
-    const info = await lstat(found.resolved);
+    // Node's numeric ino can round NTFS file IDs above 2^53.
+    // Keep the pre-open identity as BigInt and compare exact strings from the worker's fstat.
+    const info = await lstat(found.resolved, { bigint: true });
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
-    if (!Number.isSafeInteger(info.size)) throw new Error('machine fs read file size exceeds safe integer range');
-    const effectiveOffset = offset < 0 ? Math.max(0, info.size + offset) : offset;
-    if (effectiveOffset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const length = Math.min(maxBytes, info.size - effectiveOffset);
+    if (info.size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('machine fs read file size exceeds safe integer range');
+    if (info.ino === 0n) throw new Error('R196 file object identity unavailable');
+    const fileSize = Number(info.size);
+    const effectiveOffset = offset < 0 ? Math.max(0, fileSize + offset) : offset;
+    if (effectiveOffset > fileSize) throw new Error('machine fs read offset exceeds file size');
+    const length = Math.min(maxBytes, fileSize - effectiveOffset);
     await recheckCodingReadAuthority(policy, grant, rootId);
-    const worker = await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const worker = process.platform === 'win32' && readWorkerPath === machineFsReadWorkerPath
+      ? await boundedNativeReadR198({
+          rootPath: found.root.real_path, relativePath: found.relative,
+          offset: effectiveOffset, length, hashFile, timeoutMs,
+          expectedRootDev: String(rootBefore.dev), expectedRootIno: String(rootBefore.ino)
+        })
+      : await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
     const buffer = Buffer.from(worker.data_base64, 'base64');
     if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    if (!Number.isSafeInteger(worker.file_size) || worker.file_size !== fileSize)
+      throw new Error('R196 opened file size drifted after precheck');
+    if (worker.file_dev !== String(info.dev) || worker.file_ino !== String(info.ino))
+      throw new Error('R196 opened file object identity differs from precheck');
     await recheckCodingReadAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: info.size,
-      eof: effectiveOffset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: fileSize,
+      eof: effectiveOffset + buffer.length >= fileSize, data_base64: buffer.toString('base64'),
       data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
       timeout_ms: timeoutMs
     };

package/src/r195-canonical-owner-observation.mjs

@@ -0,0 +1,15 @@
+import path from 'node:path';
+
+export async function observeCanonicalController({stateRoot,powershell,env,execFileAsync}={}){
+  if(typeof stateRoot!=='string'||!path.win32.isAbsolute(stateRoot))
+    throw new Error('R195 canonical owner observation requires an absolute state root');
+  if(typeof powershell!=='string'||powershell.length<1||typeof execFileAsync!=='function')
+    throw new Error('R195 canonical owner observation dependency invalid');
+  const launcher=path.win32.join(path.win32.resolve(stateRoot),'bin','DEADBYTE-MCP.ps1');
+  const {stdout}=await execFileAsync(powershell,[
+    '-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',
+    launcher,'status','-Json'
+  ],{env,windowsHide:true,shell:false,timeout:20000,maxBuffer:1024*1024,encoding:'utf8'});
+  try{return JSON.parse(stdout);}
+  catch{throw new Error('R195 canonical owner observation returned invalid JSON');}
+}

package/src/r207-owner-enrollment-io.mjs

@@ -0,0 +1,30 @@
+import {lstat,mkdir,realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+export function parseOwnerEnrollmentJson(bytes,label='owner enrollment JSON'){
+  const text=Buffer.isBuffer(bytes)?bytes.toString('utf8'):String(bytes);
+  let value;
+  try{value=JSON.parse(text.replace(/^\uFEFF/,''));}
+  catch(error){throw new Error(`${label} is invalid JSON: ${String(error?.message??error)}`);}
+  if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} must be an object`);
+  return value;
+}
+
+export async function ensureOwnerConsentDirectory(runtimeDir){
+  if(typeof runtimeDir!=='string'||!path.win32.isAbsolute(runtimeDir))
+    throw new Error('owner consent runtime root must be an absolute Windows path');
+  const runtime=path.win32.resolve(runtimeDir);
+  const runtimeInfo=await lstat(runtime);
+  if(!runtimeInfo.isDirectory()||runtimeInfo.isSymbolicLink())
+    throw new Error('owner consent runtime root must be a real directory');
+  const runtimeReal=path.win32.resolve(await realpath(runtime));
+  const consent=path.win32.join(runtime,'owner-consent');
+  await mkdir(consent,{recursive:true});
+  const consentInfo=await lstat(consent);
+  if(!consentInfo.isDirectory()||consentInfo.isSymbolicLink())
+    throw new Error('owner consent path must be a real directory');
+  const consentReal=path.win32.resolve(await realpath(consent));
+  if(path.win32.dirname(consentReal).toLowerCase()!==runtimeReal.toLowerCase())
+    throw new Error('owner consent path escapes the runtime root');
+  return consentReal;
+}

package/src/remote-destination-journal-r202.mjs

@@ -0,0 +1,120 @@
+// R202 experimental destination-side storage for already-signed terminal evidence.
+// This does not execute effects, sign new claims, authorize a capability, or retry a request.
+import {createHash,randomBytes} from 'node:crypto';
+import {link,lstat,mkdir,open,realpath,unlink} from 'node:fs/promises';
+import path from 'node:path';
+import {verifySignedRemoteTerminalR200} from './remote-terminal-evidence-r200.mjs';
+import {canonicalJson} from './canonical-json.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const MAX_RECEIPT_BYTES=16*1024;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+function insist(ok,message){if(!ok)throw new Error('R202 destination journal '+message);}
+
+export async function openRemoteDestinationJournalR202({directory,device}={}){
+ insist(typeof directory==='string'&&path.isAbsolute(directory),'directory invalid');
+ insist(device&&HEX64.test(device.device_id??'')&&Number.isSafeInteger(device.epoch)&&
+   device.epoch>=1&&typeof device.public_key_spki_base64==='string','device identity invalid');
+ await mkdir(directory,{recursive:true});
+ const inputRootInfo=await lstat(directory);
+ insist(inputRootInfo.isDirectory()&&!inputRootInfo.isSymbolicLink(),'input root is a reparse point');
+ const dir=await realpath(directory);
+ const rootInfo=await lstat(dir);
+ insist(rootInfo.isDirectory()&&!rootInfo.isSymbolicLink(),'root is not a real directory');
+ const filename=requestId=>{
+  insist(HEX64.test(requestId??''),'request ID invalid');
+  return path.join(dir,requestId+'.json');
+ };
+ // The bytes and identity come from the same opened file object, not a new path lookup.
+ async function checkedRead(file){
+  let before;
+  try{before=await lstat(file,{bigint:true});}
+  catch(error){if(error?.code==='ENOENT')return null;throw error;}
+  insist(before.isFile()&&!before.isSymbolicLink()&&before.size>=1n&&
+    before.size<=BigInt(MAX_RECEIPT_BYTES),'record is not a bounded regular file');
+  const h=await open(file,'r');
+  let bytes;
+  try{
+   const initial=await h.stat({bigint:true});
+   insist(initial.isFile()&&initial.dev===before.dev&&initial.ino===before.ino,
+     'record namespace swapped before handle open');
+   insist(initial.size>=1n&&initial.size<=BigInt(MAX_RECEIPT_BYTES),
+     'record size changed before read');
+   const buffer=Buffer.alloc(MAX_RECEIPT_BYTES+1);
+   const {bytesRead}=await h.read(buffer,0,buffer.length,0);
+   bytes=buffer.subarray(0,bytesRead);
+   const after=await h.stat({bigint:true});
+   insist(after.size===initial.size&&after.mtimeNs===initial.mtimeNs&&
+     after.ctimeNs===initial.ctimeNs&&after.dev===initial.dev&&after.ino===initial.ino&&
+     BigInt(bytesRead)===initial.size,'record mutated during handle read');
+  }finally{await h.close();}
+  const pathAfter=await lstat(file,{bigint:true});
+  insist(pathAfter.isFile()&&!pathAfter.isSymbolicLink()&&
+    pathAfter.ino===before.ino&&pathAfter.dev===before.dev,
+    'record namespace swapped after handle read');
+  let envelope;
+  try{envelope=JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error('R203 destination journal stored terminal is corrupt');}
+  return {envelope,bytes,sha256:digest(bytes)};
+ }
+ function verify(envelope,request){
+  insist(request&&request.device_id===device.device_id&&request.epoch===device.epoch&&
+    HEX64.test(request.request_id??'')&&HEX64.test(request.request_sha256??'')&&
+    typeof request.capability_id==='string','request identity invalid');
+  return verifySignedRemoteTerminalR200(envelope,{request,device});
+ }
+ return Object.freeze({
+  directory:dir,
+  device_id:device.device_id,
+  async commitSignedTerminal({envelope,request}={}){
+   const proof=verify(envelope,request);
+   const body=Buffer.from(canonicalJson(envelope)+'\n','utf8');
+   insist(body.length<=MAX_RECEIPT_BYTES,'signed terminal exceeds bound');
+   const file=filename(request.request_id);
+   // fsync the complete temp before an atomic, create-only hardlink publication.
+   // No direct write to final name: a crash before link cannot poison it.
+   const temp=path.join(dir,'.'+request.request_id+'.'+randomBytes(12).toString('hex')+'.tmp');
+   let tempCreated=false, published=false;
+   try{
+    const h=await open(temp,'wx',0o600);
+    tempCreated=true;
+    try{await h.writeFile(body);await h.sync();}
+    finally{await h.close();}
+    try{
+     await link(temp,file);
+     published=true;
+    }catch(error){
+     if(error?.code!=='EEXIST')throw error;
+     const old=await checkedRead(file);
+     insist(old!==null,'record missing after conflict');
+     verify(old.envelope,request);
+     insist(old.sha256===digest(body),'conflicting signed terminal for one request');
+     return Object.freeze({status:'existing',replayed:true,request_id:request.request_id,
+       terminal_evidence_sha256:proof.terminal_evidence_sha256});
+    }
+   }finally{
+    if(tempCreated)await unlink(temp).catch(error=>{
+     if(error?.code!=='ENOENT' && !published)throw error;
+    });
+   }
+   const written=await checkedRead(file);
+   insist(written!==null&&written.sha256===digest(body),'postcommit bytes mismatch');
+   verify(written.envelope,request);
+   return Object.freeze({status:'stored',replayed:false,request_id:request.request_id,
+     terminal_evidence_sha256:proof.terminal_evidence_sha256});
+  },
+  async lookupTerminal({device_id,epoch,request_id,request_sha256}={}){
+   insist(device_id===device.device_id&&epoch===device.epoch&&
+     HEX64.test(request_id??'')&&HEX64.test(request_sha256??''),
+     'lookup request identity invalid');
+   const stored=await checkedRead(filename(request_id));
+   if(stored===null)return null;
+   const e=stored.envelope?.evidence;
+   insist(e&&e.request_sha256===request_sha256&&e.request_id===request_id,
+     'lookup request hash mismatch');
+   const request={device_id,epoch,request_id,request_sha256,capability_id:e.capability_id};
+   verify(stored.envelope,request);
+   return structuredClone(stored.envelope);
+  }
+ });
+}