deadbyte-mcp 0.15.74 → 0.15.76

package/test/r167-release-contract.test.mjs

@@ -8,7 +8,7 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.74';
+const VERSION='0.15.76';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
@@ -20,20 +20,20 @@ test('current package identity retains the immutable R167/R173 activation lineag
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
   assert.deepEqual(release.runtime_predecessor,{
-    version:'0.15.72',release_id:'v0.15.72-0a5d9436e06e2d9e',
-    manifest_sha256:'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90',
-    generation_manifest_sha256:'aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+    version:'0.15.75',release_id:'v0.15.75-9039fff265696091',
+    manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+    generation_manifest_sha256:'83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
   });
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.equal(release.r173.source_predecessor_version,'0.15.67');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
   assert.equal(provenance.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');

package/test/r168-release-contract.test.mjs

@@ -13,10 +13,10 @@ const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc
 
 test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
  const release=await read('RELEASE.json');
- assert.equal(release.runtime_predecessor.version,'0.15.72');
- assert.equal(release.parent.version,'0.15.72');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
- assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
+ assert.equal(release.runtime_predecessor.version,'0.15.75');
+ assert.equal(release.parent.version,'0.15.75');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.notEqual(release.runtime_predecessor.release_id,parent);
  assert.notEqual(release.parent.release_id,parent);
  assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');

package/test/r172-release-contract.test.mjs

@@ -16,12 +16,12 @@ test('R190 binds the published source predecessor separately from the active run
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.74');
-  assert.equal(release.train,'R194'); assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
+  for(const value of versions)assert.equal(value,'0.15.76');
+  assert.equal(release.train,'R207'); assert.equal(matrix.train,'R207');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
   assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });
 

package/test/r173-release-contract.test.mjs

@@ -13,21 +13,21 @@ test('R190 package identity binds the exact published R179 source and live runti
     json('package.json'),readReleaseLock(root),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.74');
-  assert.equal(lock.version,'0.15.74');
-  assert.equal(lock.packages[''].version,'0.15.74');
-  assert.equal(bridge.version,'0.15.74');
-  assert.equal(release.version,'0.15.74');
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.version,'0.15.74');
-  assert.equal(matrix.train,'R194');
-  assert.equal(sbom.metadata.component.version,'0.15.74');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
-  assert.equal(provenance.version,'0.15.74');
-  assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
+  assert.equal(pkg.version,'0.15.76');
+  assert.equal(lock.version,'0.15.76');
+  assert.equal(lock.packages[''].version,'0.15.76');
+  assert.equal(bridge.version,'0.15.76');
+  assert.equal(release.version,'0.15.76');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.version,'0.15.76');
+  assert.equal(matrix.train,'R207');
+  assert.equal(sbom.metadata.component.version,'0.15.76');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
+  assert.equal(provenance.version,'0.15.76');
+  assert.equal(provenance.parent_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
 });

package/test/r179-release-contract.test.mjs

@@ -7,27 +7,27 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 import {readReleaseLock} from './helpers/release-lock.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-const parent='v0.15.72-0a5d9436e06e2d9e';
-const manifest='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const generation='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0';
+const parent='v0.15.75-9039fff265696091';
+const manifest='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const generation='83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9';
 const tarball='1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf';
 test('R190 version, lock snapshot, bridge, matrix, SBOM and provenance identify exact 0.15.70 successor',async()=>{
  const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
   read('package.json'),readReleaseLock(root),read('bridge/package.json'),read('RELEASE.json'),
   read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,provenance.version,
-  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.74');
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.76');
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
  assert.equal(release.parent.release_id,parent);assert.equal(release.parent.manifest_sha256,manifest);
  assert.equal(release.parent.generation_manifest_sha256,generation);
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(provenance.runtime_predecessor.release_id,parent);
- assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
- assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
+ assert.equal(provenance.parent_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+ assert.equal(provenance.source_predecessor_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
 });
 test('R179 does not misrepresent owner Autonomous enrollment, protected regression or publication as finished',async()=>{
  const [release,prov,matrix]=await Promise.all(['RELEASE.json','PROVENANCE.json','TEST-MATRIX.json'].map(read));
@@ -48,7 +48,7 @@ test('R190 retains historical R179 and R173 source evidence without promoting it
  assert.equal(release.r173.source_predecessor_version,'0.15.67');
  assert.equal(release.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
  assert.equal(prov.r173.source_predecessor_version,'0.15.67');
- assert.equal(release.source_predecessor.version,'0.15.73');
+ assert.equal(release.source_predecessor.version,'0.15.75');
  assert.notEqual(release.source_predecessor.tarball_sha256,release.r173.source_predecessor_tarball_sha256);
 });
 test('R184 ships a semantic lock snapshot matching installed package identity and dependencies',async()=>{

package/test/r190-release-contract.test.mjs

@@ -8,17 +8,17 @@ test('R190 candidate identity separates published source 0.15.69 from active run
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
  for(const value of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
-  sbom.metadata.component.version])assert.equal(value,'0.15.74');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.74'/);
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.runtime_predecessor.version,'0.15.72');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
- assert.equal(provenance.source_predecessor_version,'0.15.73');
+  sbom.metadata.component.version])assert.equal(value,'0.15.76');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.runtime_predecessor.version,'0.15.75');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
- assert.match(sbom.serialNumber,/r194:0\.15\.74$/);
+ assert.match(sbom.serialNumber,/r207:0\.15\.76$/);
 });
 
 test('R190 release metadata records verified recovery without claiming publication or activation',async()=>{

package/test/r191-release-contract.test.mjs

@@ -6,23 +6,23 @@ import path from 'node:path';
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const json=async f=>JSON.parse(await readFile(path.join(root,f),'utf8'));
-const predecessor='v0.15.72-0a5d9436e06e2d9e';
-const publishedManifest='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const publishedTarball='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d';
+const predecessor='v0.15.75-9039fff265696091';
+const publishedManifest='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const publishedTarball='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 test('R191 exact version identity includes bundled bridge, lock snapshot, SBOM, provenance and matrix',async()=>{
  const [pkg,bridge,lock,release,provenance,matrix,bom]=await Promise.all(['package.json','bridge/package.json','docs/R184-package-lock.json','RELEASE.json','PROVENANCE.json','TEST-MATRIX.json','SBOM.cdx.json'].map(json));
- for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.74');
- for(const train of [release.train,matrix.train])assert.equal(train,'R194');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+ for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.76');
+ for(const train of [release.train,matrix.train])assert.equal(train,'R207');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
  assert.equal(release.parent.release_id,predecessor);
  assert.equal(provenance.parent_release_id,predecessor);
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.source_predecessor_version,'0.15.73');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.manifest_sha256,publishedManifest);
+ assert.equal(release.source_predecessor.tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.parent_tarball_sha256,publishedTarball);
- assert.equal(provenance.source_predecessor_tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.source_predecessor_manifest_file_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+ assert.equal(provenance.source_predecessor_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,publishedManifest);
  assert.equal(release.r191_activation_repair.npm_publish,'NOT_RUN');
  assert.equal(release.r191_activation_repair.production_activation,'NOT_RUN');
  assert.equal(release.r190_foreground_recovery.status,'PREPUBLISH_VERIFIED');

package/test/r192-release-identity.test.mjs

@@ -3,21 +3,21 @@ import {readFile} from 'node:fs/promises';import {createHash} from 'node:crypto'
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
-const prevHash='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const prevTar='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d';
+const prevHash='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const prevTar='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 test('R193 current identity retains exact published R192 predecessor evidence',async()=>{
  const [pkg,bridge,lock,release,prov,matrix,bom]=await Promise.all([
  read('package.json'),read('bridge/package.json'),read('docs/R184-package-lock.json'),
  read('RELEASE.json'),read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const actual of [pkg.version,bridge.version,lock.version,lock.packages[''].version,
  release.version,prov.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])
-   assert.equal(actual,'0.15.74');
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
- assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
+   assert.equal(actual,'0.15.76');
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.equal(release.parent.manifest_sha256,prevHash);
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+ assert.equal(release.source_predecessor.tarball_sha256,prevTar);
+ assert.equal(release.source_predecessor.manifest_sha256,prevHash);
  assert.equal(prov.parent_tarball_sha256,prevTar);
  assert.equal(prov.parent_manifest_sha256,prevHash);
  assert.equal(release.r192.production_activation,'NOT_RUN');
@@ -33,7 +33,7 @@ test('R192 foreground reader enforces caller-safe telemetry rather than changing
  assert.match(log,/sanitizeAuditArgs\(compact\[6\]\)/);
  const [policy,release]=await Promise.all([
  read('controller/deadbyte-process-policy.json'),read('RELEASE.json')]);
- const approved=release.r194.development_policy_root;
+ const approved=release.r207.development_policy_root;
  assert.equal(typeof approved,'string');
  assert.ok(path.isAbsolute(approved));
  assert.equal(path.resolve(policy.roots.core.path),path.resolve(approved));

package/test/r193-release-identity.test.mjs

@@ -7,40 +7,41 @@ import path from 'node:path';
 const root=fileURLToPath(new URL('..',import.meta.url));
 const json=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
 const parent={
- version:'0.15.72',
- release_id:'v0.15.72-0a5d9436e06e2d9e',
- manifest_sha256:'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90',
- generation_manifest_sha256:'aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+ version:'0.15.75',
+ release_id:'v0.15.75-9039fff265696091',
+ manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+ generation_manifest_sha256:'83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
 };
-const parentTarball='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d';
+const parentTarball='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 
-test('R193 package identity binds exact active and published 0.15.72 predecessor',async()=>{
+test('R207 package identity preserves the R193 owner boundary and separates R206 source from active R206 runtime',async()=>{
  const [pkg,bridge,release,provenance,matrix,sbom,versionSource]=await Promise.all([
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(path.join(root,'src','version.mjs'),'utf8')]);
- assert.equal(pkg.version,'0.15.74');
- assert.equal(bridge.version,'0.15.74');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.74'/);
- assert.equal(release.version,'0.15.74');
- assert.equal(release.train,'R194');
+ assert.equal(pkg.version,'0.15.76');
+ assert.equal(bridge.version,'0.15.76');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.version,'0.15.76');
+ assert.equal(release.train,'R207');
  for(const key of Object.keys(parent)){
   assert.equal(release.parent[key],parent[key]);
   assert.equal(release.runtime_predecessor[key],parent[key]);
  }
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.train,'R193');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.version,'0.15.74');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.train,'R206');
+ assert.equal(release.source_predecessor.manifest_sha256,parent.manifest_sha256);
+ assert.equal(release.source_predecessor.tarball_sha256,parentTarball);
+ assert.equal(provenance.version,'0.15.76');
  assert.equal(provenance.parent_release_id,parent.release_id);
  assert.equal(provenance.parent_manifest_sha256,parent.manifest_sha256);
  assert.equal(provenance.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
- assert.equal(provenance.source_predecessor_version,'0.15.73');
- assert.equal(provenance.source_predecessor_tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(matrix.version,'0.15.74');
- assert.equal(matrix.train,'R194');
- assert.equal(sbom.metadata.component.version,'0.15.74');
- assert.match(sbom.serialNumber,/r194:0\.15\.74$/);
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
+ assert.equal(provenance.source_predecessor_train,'R206');
+ assert.equal(provenance.source_predecessor_tarball_sha256,parentTarball);
+ assert.equal(matrix.version,'0.15.76');
+ assert.equal(matrix.train,'R207');
+ assert.equal(sbom.metadata.component.version,'0.15.76');
+ assert.match(sbom.serialNumber,/r207:0\.15\.76$/);
 });
 
 test('R193 manifest binds every protected owner-boundary implementation file',async()=>{
@@ -50,6 +51,7 @@ test('R193 manifest binds every protected owner-boundary implementation file',as
   'scripts/r193-migrate-runtime-limited.ps1','scripts/r193-owner-keygen.mjs',
   'scripts/r193-owner-request-live.mjs','scripts/r193-owner-uac-approve.ps1',
   'scripts/r193-owner-uac-broker.mjs','scripts/r193-owner-uac-enroll-and-approve.ps1',
+  'src/r195-canonical-owner-observation.mjs',
   'src/r193-live-owner-subject.mjs','src/r193-owner-secret-acl.mjs',
   'src/r193-owner-uac-broker.mjs','test/r193-release-identity.test.mjs'
  ]) assert.match(manifest,new RegExp('  '+file.replaceAll('.','\\.')+'(?:\\r?\\n|$)'));

package/test/r193-release-readiness.test.mjs

@@ -77,11 +77,11 @@ test('R193 publisher refuses a repacked artifact that differs from closure bytes
     observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R193.*repacked tarball/);
 });
 
-test('canonical npm release entrypoint enforces R193 closure before registry or pack work',async()=>{
+test('canonical npm release entrypoint enforces current R207 closure before registry or pack work',async()=>{
   const root=fileURLToPath(new URL('..',import.meta.url));
   const env={...process.env};delete env.DEADBYTE_R193_CLOSURE_ROOT;
   const result=spawnSync(process.execPath,[path.join(root,'scripts','npm-release-r48.mjs'),'--publish-only'],{cwd:root,env,encoding:'utf8',windowsHide:true});
   assert.notEqual(result.status,0);
-  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R194.*closure root absent/);
+  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R207.*closure root absent/);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/npm publish|Packing artifact/);
 });

package/test/r193-windows-gate.test.mjs

@@ -6,19 +6,19 @@ import path from 'node:path';
 
 const root=fileURLToPath(new URL('..',import.meta.url));
 
-test('R194 Windows gate is the canonical exact-identity prepublication gate',async()=>{
+test('R207 Windows gate is the canonical exact-identity prepublication gate',async()=>{
  const [pkg,gate]=await Promise.all([
   readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
-  readFile(path.join(root,'scripts','gate-windows-r194.ps1'),'utf8')
+  readFile(path.join(root,'scripts','gate-windows-r207.ps1'),'utf8')
  ]);
- assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r194.ps1 -Stage all');
- assert.match(gate,/0\.15\.74/);
- assert.match(gate,/R194/);
- assert.match(gate,/v0\.15\.72-0a5d9436e06e2d9e/);
- assert.match(gate,/0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90/);
- assert.match(gate,/aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0/);
- assert.match(gate,/test\/r193-release-identity\.test\.mjs/);
- assert.match(gate,/test\/r193-release-readiness\.test\.mjs/);
+ assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r207.ps1 -Stage all');
+ assert.match(gate,/0\.15\.76/);
+ assert.match(gate,/R207/);
+ assert.match(gate,/v0\.15\.75-9039fff265696091/);
+ assert.match(gate,/9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248/);
+ assert.match(gate,/83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9/);
+ assert.match(gate,/test\/r207-release-contract\.test\.mjs/);
+ assert.match(gate,/test\/r207-owner-enrollment-io\.test\.mjs/);
  assert.match(gate,/test\/r193-owner-uac-broker\.test\.mjs/);
  assert.match(gate,/test\/r70-owner-approval\.test\.mjs/);
  assert.match(gate,/test\/r89-privileged-install-boundary\.test\.mjs/);

package/test/r194-release-identity.test.mjs

@@ -5,28 +5,28 @@ import{fileURLToPath}from'node:url';
 import path from'node:path';
 const root=fileURLToPath(new URL('..',import.meta.url));
 const json=async n=>JSON.parse(await readFile(path.join(root,n),'utf8'));
-test('R194 exact release version and predecessor bind active R192 but frozen local R193 source',async()=>{
+test('R207 exact release identity binds R206 source separately from active R206 runtime',async()=>{
  const [pkg,bridge,release,provenance,matrix,sbom,lock,ver]=await Promise.all([
  json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
  json('TEST-MATRIX.json'),json('SBOM.cdx.json'),json('docs/R184-package-lock.json'),
  readFile(path.join(root,'src','version.mjs'),'utf8')]);
  for(const v of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
- sbom.metadata.component.version,lock.version,lock.packages[''].version])assert.equal(v,'0.15.74');
- assert.match(ver,/DEADBYTE_VERSION = '0\.15\.74'/);
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
- assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
+ sbom.metadata.component.version,lock.version,lock.packages[''].version])assert.equal(v,'0.15.76');
+ assert.match(ver,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.equal(release.runtime_predecessor.release_id,release.parent.release_id);
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.train,'R193');
- assert.equal(release.source_predecessor.release_status,'FROZEN_R193_RELEASE_READY_NOT_PUBLISHED');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.source_predecessor_version,'0.15.73');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.train,'R206');
+ assert.equal(release.source_predecessor.release_status,'RELEASED');
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
- assert.equal(release.r194.scope,'NPM_AUTH_RECOVERY_AND_OWNER_AUTHORIZATION');
- assert.equal(release.r194.npm_publish,'NOT_RUN');
- assert.equal(release.r194.production_activation,'NOT_RUN');
+ assert.equal(release.r195.scope,'CANONICAL_PROTECTED_OWNER_OBSERVATION');
+ assert.equal(release.r195.npm_publish,'NOT_RUN');
+ assert.equal(release.r195.production_activation,'NOT_RUN');
 });
 test('R194 canonical publisher binds R194 readiness before registry/pack effects',async()=>{
  const [entry,readiness]=await Promise.all([
@@ -34,6 +34,10 @@ test('R194 canonical publisher binds R194 readiness before registry/pack effects
  readFile(path.join(root,'scripts/npm-release-readiness-r194.mjs'),'utf8')]);
  assert.match(entry,/assertR194NpmPublishReady/);
  assert.match(entry,/if\(r194Readiness\)assertR194PackedIdentity/);
+ assert.match(entry,/assertR195NpmPublishReady/);
+ assert.match(entry,/if\(r195Readiness\)assertR195PackedIdentity/);
+ assert.match(entry,/assertR206NpmPublishReady/);
+ assert.match(entry,/if\(r206Readiness\)assertR206PackedIdentity/);
  assert.match(entry,/authorizePublish:ownerAuth,authorizeAuthRetry:ownerAuth/);
  assert.match(entry,/version==='0\.15\.74'/);
  assert.match(entry,/if \(!publishOnly\)/);

package/test/r194-release-readiness.test.mjs

@@ -77,11 +77,11 @@ test('R194 publisher refuses a repacked artifact that differs from closure bytes
     observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R194.*repacked tarball/);
 });
 
-test('canonical npm release entrypoint enforces R194 closure before registry or pack work',async()=>{
+test('canonical npm release entrypoint enforces current R207 closure before registry or pack work',async()=>{
   const root=fileURLToPath(new URL('..',import.meta.url));
-  const env={...process.env};delete env.DEADBYTE_R194_CLOSURE_ROOT;
+  const env={...process.env};delete env.DEADBYTE_R207_CLOSURE_ROOT;
   const result=spawnSync(process.execPath,[path.join(root,'scripts','npm-release-r48.mjs'),'--publish-only'],{cwd:root,env,encoding:'utf8',windowsHide:true});
   assert.notEqual(result.status,0);
-  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R194.*closure root absent/);
+  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R207.*closure root absent/);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/npm publish|Packing artifact/);
 });

package/test/r194-windows-gate.test.mjs

@@ -4,17 +4,18 @@ import {readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 const root=fileURLToPath(new URL('..',import.meta.url));
-test('R194 prepublication Windows gate keeps parent pinned and current R194 identity',async()=>{
+test('R207 prepublication Windows gate keeps active R206 runtime parent pinned',async()=>{
  const [pkg,gate]=await Promise.all([
   readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
-  readFile(path.join(root,'scripts/gate-windows-r194.ps1'),'utf8')]);
+  readFile(path.join(root,'scripts/gate-windows-r207.ps1'),'utf8')]);
  assert.equal(pkg.scripts['gate:windows'],
- 'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r194.ps1 -Stage all');
- assert.match(gate,/0\.15\.74/);assert.match(gate,/R194/);
- assert.match(gate,/v0\.15\.72-0a5d9436e06e2d9e/);
- assert.match(gate,/aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0/);
- assert.match(gate,/test\/r194-release-identity\.test\.mjs/);
- assert.match(gate,/test\/r194-npm-auth-recovery\.test\.mjs/);
+ 'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r207.ps1 -Stage all');
+ assert.match(gate,/0\.15\.76/);assert.match(gate,/R207/);
+ assert.match(gate,/v0\.15\.75-9039fff265696091/);
+ assert.match(gate,/83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9/);
+ assert.match(gate,/test\/r207-release-contract\.test\.mjs/);
+ assert.match(gate,/test\/r207-owner-enrollment-io\.test\.mjs/);
+ assert.match(gate,/test\/r195-canonical-owner-observation\.test\.mjs/);
  assert.match(gate,/test\/r193-owner-uac-broker\.test\.mjs/);
  assert.doesNotMatch(gate,/arm(process|coding|autonomous|desktop|host)/i);
  assert.doesNotMatch(gate,/deploy|activate|npm publish/i);

package/test/r195-canonical-owner-observation.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {observeCanonicalController} from '../src/r195-canonical-owner-observation.mjs';
+
+test('R195 protected owner flow observes the active controller through the canonical launcher',async()=>{
+  const calls=[];
+  const result=await observeCanonicalController({
+    stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',
+    powershell:'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe',
+    env:{PATH:'fixture'},
+    execFileAsync:async(file,args,options)=>{
+      calls.push({file,args,options});
+      return {stdout:'{"state":"ONLINE","supervisor":{"running":true}}\n'};
+    }
+  });
+  assert.deepEqual(result,{state:'ONLINE',supervisor:{running:true}});
+  assert.equal(calls.length,1);
+  assert.equal(calls[0].file,'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+  assert.deepEqual(calls[0].args,[
+    '-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',
+    'C:\\Users\\DEADBYTE\\.deadbyte-mcp\\bin\\DEADBYTE-MCP.ps1','status','-Json'
+  ]);
+  assert.equal(calls[0].options.shell,false);
+  assert.equal(calls[0].options.windowsHide,true);
+});
+
+test('R195 canonical owner observation rejects caller-selected relative state roots',async()=>{
+  await assert.rejects(()=>observeCanonicalController({
+    stateRoot:'.\\state',powershell:'powershell.exe',env:{},
+    execFileAsync:async()=>({stdout:'{}'})
+  }),/absolute state root/);
+});

package/test/r195-release-readiness.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {assertR195NpmPublishReady,assertR195PackedIdentity} from '../scripts/npm-release-readiness-r195.mjs';
+
+const release={
+  version:'0.15.75',train:'R195',
+  parent:{version:'0.15.74',release_id:'v0.15.74-e84bf4eed16e9443',
+    manifest_sha256:'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47',
+    generation_manifest_sha256:'598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'},
+  r195:{scope:'CANONICAL_PROTECTED_OWNER_OBSERVATION',public_tool_delta:0,authority_scope_delta:0}
+};
+
+test('R195 publication refuses an absent exact-byte closure before pack or registry effects',async()=>{
+  await assert.rejects(assertR195NpmPublishReady(release,{root:'D:\\candidate'}),/PUBLISH_BLOCKED R195.*closure root absent/);
+});
+
+test('R195 packed identity refuses any artifact differing from the protected closure',()=>{
+  assert.throws(()=>assertR195PackedIdentity({
+    tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-expected',tarball_shasum:'b'.repeat(40),
+    observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)
+  }),/PUBLISH_BLOCKED R195.*repacked tarball/);
+});