deadbyte-mcp 0.15.75 → 0.15.76

package/scripts/gate-windows-r207.ps1

@@ -0,0 +1,104 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$productionState=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.75-9039fff265696091'
+$parentSha='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248'
+$parentGen='83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
+$parentTarball='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Need([bool]$condition,[string]$message){if(-not $condition){throw $message}}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    Need ($null -ne $nodeArgs -and $nodeArgs.Count -gt 0) "R207_${label}_NO_NODE_ARGUMENTS"
+    Write-Output "R207_STAGE_START=$label"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R207_${label}_FAILED exit=$exit"}
+    Write-Output "R207_STAGE_PASS=$label"
+}
+Push-Location $repo
+$previousExpectedDevelopmentRoot=$env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    Need (-not [string]::IsNullOrWhiteSpace([string]$release.r207.development_policy_root)) 'R207_DEVELOPMENT_PROVENANCE_ROOT_MISSING'
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=[IO.Path]::GetFullPath([string]$release.r207.development_policy_root)
+    Need ($pkg.version -eq '0.15.76' -and $release.version -eq '0.15.76' -and $release.train -eq 'R207') 'R207_CANDIDATE_VERSION_DRIFT'
+    Need ($release.source_predecessor.version -eq '0.15.75' -and $release.source_predecessor.train -eq 'R206') 'R207_SOURCE_PREDECESSOR_VERSION_DRIFT'
+    Need ($release.source_predecessor.manifest_sha256 -eq $parentSha -and $release.source_predecessor.tarball_sha256 -eq $parentTarball) 'R207_SOURCE_PREDECESSOR_IDENTITY_DRIFT'
+    Need ($release.runtime_predecessor.release_id -eq $parentId -and $release.runtime_predecessor.manifest_sha256 -eq $parentSha -and $release.runtime_predecessor.generation_manifest_sha256 -eq $parentGen) 'R207_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'
+    $active=Get-Content -LiteralPath (Join-Path $productionState 'active-release.json') -Raw | ConvertFrom-Json
+    Need ($active.version -eq '0.15.75' -and $active.release_id -eq $parentId -and $active.manifest_sha256 -eq $parentSha -and $active.generation_manifest_sha256 -eq $parentGen) 'R207_ACTIVE_RUNTIME_DRIFT'
+    Need ((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -eq $parentSha) 'R207_ACTIVE_MANIFEST_MISMATCH'
+    Write-Output 'R207_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        $focused=@(
+            'test/r70-owner-approval.test.mjs',
+            'test/r89-privileged-install-boundary.test.mjs',
+            'test/r186-controller-owner-grant.test.mjs',
+            'test/r186-owner-consent-preflight.test.mjs',
+            'test/r186-owner-enrollment.test.mjs',
+            'test/r186-owner-grant-broker.test.mjs',
+            'test/r186-owner-local-signing.test.mjs',
+            'test/r186-owner-request.test.mjs',
+            'test/r186-owner-review-export.test.mjs',
+            'test/r188-owner-uac.test.mjs',
+            'test/r188-uac-boundary.test.mjs',
+            'test/r193-live-owner-subject.test.mjs',
+            'test/r193-owner-enrollment-entrypoint.test.mjs',
+            'test/r193-owner-secret-acl.test.mjs',
+            'test/r193-owner-uac-broker.test.mjs',
+            'test/r193-owner-uac-entrypoint.test.mjs',
+            'test/r195-canonical-owner-observation.test.mjs',
+            'test/r207-owner-enrollment-io.test.mjs',
+            'test/r207-release-contract.test.mjs'
+        )
+        Run-Node -label 'focused' -nodeArgs (@('--test','--test-reporter=tap','--test-concurrency=1')+$focused)
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        $previousCrossVolume=$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT
+        $tempDrive=[IO.Path]::GetPathRoot([IO.Path]::GetFullPath($env:TEMP))
+        $scratchDrive=if($tempDrive -ieq 'D:\'){'C:\'}else{'D:\'}
+        Need (Test-Path -LiteralPath $scratchDrive -PathType Container) 'R207_CROSS_VOLUME_DRIVE_UNAVAILABLE'
+        $crossVolume=Join-Path $scratchDrive 'DEADBYTE-R207-CrossVolume'
+        try{
+            [IO.Directory]::CreateDirectory($crossVolume)|Out-Null
+            $env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$crossVolume
+            Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        }finally{$env:DEADBYTE_TEST_CROSS_VOLUME_ROOT=$previousCrossVolume}
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previousStateRoot=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r207-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{
+            [IO.Directory]::CreateDirectory($isolated)|Out-Null
+            $env:DEADBYTE_STATE_ROOT=$isolated
+            Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')
+        }finally{
+            $env:DEADBYTE_STATE_ROOT=$previousStateRoot
+            Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    Write-Output 'R207_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{
+    $env:DEADBYTE_EXPECTED_DEVELOPMENT_ROOT=$previousExpectedDevelopmentRoot
+    Pop-Location
+}

package/scripts/npm-release-r48.mjs

@@ -17,6 +17,7 @@ import {assertR193NpmPublishReady,assertR193PackedIdentity} from './npm-release-
 import {assertR194NpmPublishReady,assertR194PackedIdentity} from './npm-release-readiness-r194.mjs';
 import {assertR195NpmPublishReady,assertR195PackedIdentity} from './npm-release-readiness-r195.mjs';
 import {assertR206NpmPublishReady,assertR206PackedIdentity} from './npm-release-readiness-r206.mjs';
+import {assertR207NpmPublishReady,assertR207PackedIdentity} from './npm-release-readiness-r207.mjs';
 import {resumePackRecord} from '../src/npm-publication-resume-r168.mjs';
 import { existsSync,mkdtempSync,readdirSync,readFileSync,rmSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
@@ -166,6 +167,11 @@ async function main() {
     if(release.train==='R206')r206Readiness=await assertR206NpmPublishReady(release,{root});
     else r195Readiness=await assertR195NpmPublishReady(release,{root});
   }
+  let r207Readiness=null;
+  if (!isVerifyOnly && version==='0.15.76') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R207 requires --publish-only; owner enrollment and activation remain separate');
+    r207Readiness=await assertR207NpmPublishReady(release,{root});
+  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
@@ -322,6 +328,10 @@ async function main() {
       observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
     });
 
+    if(r207Readiness)assertR207PackedIdentity({
+      ...r207Readiness,observedSha256:createHash('sha256').update(localBytes).digest('hex'),
+      observedIntegrity:localIntegrity,observedShasum:packRecord.shasum
+    });
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;
     const ownerAuth=async subject=>

package/scripts/npm-release-readiness-r207.mjs

@@ -0,0 +1,76 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const hex64=value=>typeof value==='string'&&/^[0-9a-f]{64}$/.test(value);
+const fail=message=>{throw new Error(`PUBLISH_BLOCKED R207 ${message}`);};
+const required=(value,message)=>{if(!value)fail(message);};
+
+async function checkedFile(file,expected,{maxBytes=64*1024*1024}={}){
+  required(hex64(expected),'evidence digest missing');
+  let info;try{info=await lstat(file);}catch{fail('evidence file absent');}
+  required(info.isFile()&&!info.isSymbolicLink()&&info.size>0&&info.size<=maxBytes,'evidence file invalid');
+  const bytes=await readFile(file);
+  required(sha256(bytes)===expected,'evidence digest differs');
+  return bytes;
+}
+
+function tapSummary(text,label){
+  const summaries=[...text.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(summaries.length>0,`${label} TAP summary absent`);
+  const last=summaries.at(-1);
+  return {tests:Number(last[1]),passes:Number(last[3]),fails:Number(last[4]),cancelled:Number(last[5]),skips:Number(last[6])};
+}
+
+export function assertR207PackedIdentity({tarball_sha256,tarball_integrity,tarball_shasum,observedSha256,observedIntegrity,observedShasum}={}){
+  required(hex64(tarball_sha256)&&typeof tarball_integrity==='string'&&tarball_integrity.startsWith('sha512-')&&
+    typeof tarball_shasum==='string'&&/^[0-9a-f]{40}$/.test(tarball_shasum),'verified tarball identity invalid');
+  required(observedSha256===tarball_sha256&&observedIntegrity===tarball_integrity&&observedShasum===tarball_shasum,
+    'repacked tarball differs from verified closure bytes');
+  return true;
+}
+
+export async function assertR207NpmPublishReady(release,{root,closureRoot=process.env.DEADBYTE_R207_CLOSURE_ROOT}={}){
+  required(release?.version==='0.15.76'&&release?.train==='R207'&&
+    release?.r207?.scope==='PROTECTED_OWNER_ENROLLMENT_IO_RECOVERY','candidate metadata invalid');
+  required(release?.r207?.public_tool_delta===0&&release?.r207?.authority_scope_delta===0&&
+    release?.r207?.owner_private_key_access===false&&release?.r207?.r70_weakened===false&&release?.r207?.r89_weakened===false,'public authority surface widened');
+  required(release?.source_predecessor?.train==='R206'&&
+    release?.source_predecessor?.manifest_sha256==='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+    'source predecessor mismatch');
+  required(release?.parent?.version==='0.15.75'&&release?.parent?.release_id==='v0.15.75-9039fff265696091'&&
+    release?.parent?.manifest_sha256==='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248'&&
+    release?.parent?.generation_manifest_sha256==='83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9','lineage mismatch');
+  required(root&&path.isAbsolute(root)&&closureRoot&&path.isAbsolute(closureRoot),'closure root absent');
+  const expected=path.resolve(root,'..','..','testing','r207-final-closure');
+  required(path.resolve(closureRoot).toLowerCase()===expected.toLowerCase(),'closure root outside scoped testing folder');
+  let closure;try{closure=JSON.parse(await readFile(path.join(closureRoot,'closure.json'),'utf8'));}catch{fail('closure unreadable');}
+  required(closure?.schema==='deadbyte.r207-release-closure.v1'&&closure.status==='RELEASE_READY'&&
+    closure.version==='0.15.76'&&closure.train==='R207','closure status mismatch');
+  required(closure.production_release_id===release.parent.release_id&&closure.production_manifest_sha256===release.parent.manifest_sha256&&
+    closure.production_generation_manifest_sha256===release.parent.generation_manifest_sha256,'production predecessor mismatch');
+  required(hex64(closure.manifest_sha256)&&closure.manifest_sha256===sha256(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  required(closure.compact_tools===43&&closure.full_tools===117,'catalog count mismatch');
+  required(closure.owner_enrollment==='NOT_RUN'&&closure.production_activation==='NOT_RUN','prepublication closure crossed authority boundary');
+  const receipt=JSON.parse((await checkedFile(path.join(closureRoot,'protected-install-receipt.json'),closure.protected_receipt_sha256)).toString('utf8'));
+  required(receipt?.status==='PASS'&&receipt.package_version==='0.15.76'&&receipt.source_manifest_sha256===closure.manifest_sha256&&
+    receipt.protected_manifest_sha256===closure.manifest_sha256,'protected exact-byte receipt mismatch');
+  const focused=(await checkedFile(path.join(closureRoot,'windows-focused.stdout.log'),closure.focused_stdout_sha256)).toString('utf8');
+  const full=(await checkedFile(path.join(closureRoot,'windows-full.stdout.log'),closure.full_stdout_sha256)).toString('utf8');
+  const verify=(await checkedFile(path.join(closureRoot,'npm-verify.stdout.log'),closure.verify_stdout_sha256)).toString('utf8');
+  required(focused.includes('R207_STAGE_PASS=focused'),'focused protected gate incomplete');
+  const focusedSummary=tapSummary(focused,'focused');
+  required(focusedSummary.tests>=55&&focusedSummary.fails===0&&focusedSummary.cancelled===0&&focusedSummary.passes>=54&&focusedSummary.skips<=1&&focusedSummary.passes+focusedSummary.skips===focusedSummary.tests,'focused regression count mismatch');
+  required(full.includes('R207_STAGE_PASS=full'),'full protected gate incomplete');
+  const summary=tapSummary(full,'full');
+  required(summary.tests>=2200&&summary.passes>=2100&&summary.fails===0&&summary.cancelled===0&&summary.skips<=70&&summary.passes+summary.skips===summary.tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),'npm exact-artifact verification incomplete');
+  const line=verify.split(/\r?\n/).find(value=>value.startsWith('VERIFIED_TARBALL '));
+  let artifact;try{artifact=JSON.parse(line.slice('VERIFIED_TARBALL '.length));}catch{fail('tarball evidence malformed');}
+  required(artifact.filename==='deadbyte-mcp-0.15.76.tgz'&&artifact.bytes>0&&artifact.sha256===closure.tarball_sha256&&
+    artifact.integrity===closure.tarball_integrity&&artifact.shasum===closure.tarball_shasum,'tarball identity mismatch');
+  return Object.freeze({status:'R207_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:closure.manifest_sha256,
+    tarball_sha256:artifact.sha256,tarball_integrity:artifact.integrity,tarball_shasum:artifact.shasum,
+    tests:summary.tests,passes:summary.passes,skips:summary.skips});
+}

package/scripts/r193-owner-request-live.mjs

@@ -9,6 +9,7 @@ import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
 import {createR188OwnerUacRequest} from '../src/r188-owner-uac.mjs';
 import {createR193LiveMachineEpoch} from '../src/r193-live-owner-subject.mjs';
 import {observeCanonicalController} from '../src/r195-canonical-owner-observation.mjs';
+import {ensureOwnerConsentDirectory} from '../src/r207-owner-enrollment-io.mjs';
 import {execFile} from 'node:child_process';
 import {promisify} from 'node:util';
 const execFileAsync=promisify(execFile);
@@ -40,7 +41,8 @@ async function main(){
  const request=createR188OwnerUacRequest({machineEpoch,releaseManifestSha256:sha(manifestBytes),
   codingPolicySha256:sha(codingBytes),autonomousPolicySha256:sha(autonomousBytes),
   rootId:'core',projectRoot:coding.roots.core.path,maxSeconds:600,now:new Date(),expiresInMs:300000});
- const out=path.win32.join(RUNTIME,'owner-consent','r193-request-'+request.request_sha256+'.json');
+ const consentDir=await ensureOwnerConsentDirectory(RUNTIME);
+ const out=path.win32.join(consentDir,'r193-request-'+request.request_sha256+'.json');
  const handle=await open(out,'wx',0o600);try{await handle.writeFile(canonicalJson(request)+'\n');await handle.sync();}finally{await handle.close();}
  process.stdout.write(JSON.stringify({status:'R193_OWNER_REQUEST_CREATED',request_path:out,
   request_sha256:request.request_sha256,review_phrase:request.review_phrase,

package/scripts/r193-owner-uac-broker.mjs

@@ -16,6 +16,7 @@ import {approveR193OwnerRequest} from '../src/r193-owner-uac-broker.mjs';
 import {createR186OwnerAnchor} from '../src/r186-owner-anchor.mjs';
 import {inspectR193OwnerSecretAcl} from '../src/r193-owner-secret-acl.mjs';
 import {observeCanonicalController} from '../src/r195-canonical-owner-observation.mjs';
+import {parseOwnerEnrollmentJson} from '../src/r207-owner-enrollment-io.mjs';
 
 const execFileAsync=promisify(execFile);
 const THIS=fileURLToPath(import.meta.url),ROOT=path.resolve(path.dirname(THIS),'..');
@@ -82,7 +83,7 @@ async function live(request){
  const env={...process.env,DEADBYTE_CONTROLLER_CONFIG:configPath,
   DEADBYTE_CONTROLLER_RUNTIME_ROOT:RUNTIME};
  const observation=await observeCanonicalController({stateRoot:STATE,powershell:PS,env,execFileAsync});
- const supervisor=JSON.parse((await bounded(path.win32.join(RUNTIME,'supervisor.instance.json'),64*1024)).toString('utf8'));
+ const supervisor=parseOwnerEnrollmentJson(await bounded(path.win32.join(RUNTIME,'supervisor.instance.json'),64*1024),'supervisor ledger');
  const sources={bridge:observation.bridge,core:observation.core,cloud:observation.cloud,supervisor};
  const processReports={};
  for(const component of ['bridge','core','cloud','supervisor'])
@@ -101,7 +102,7 @@ async function main(){
  if(!['preflight','approve'].includes(mode)||process.argv.slice(2).length!==2||
     !path.win32.isAbsolute(requestPath))block('usage: <preflight|approve> <absolute-request-json>');
  await inspectTrustedInstallation([NODE,THIS,path.join(ROOT,'MANIFEST.SHA256'),NATIVE]);
- const request=JSON.parse((await bounded(requestPath,64*1024)).toString('utf8'));
+ const request=parseOwnerEnrollmentJson(await bounded(requestPath,64*1024),'owner request');
  const state=await live(request);
  if(mode==='preflight'){
   process.stdout.write(JSON.stringify({status:'READY_FOR_OWNER_GESTURE',

package/src/r207-owner-enrollment-io.mjs

@@ -0,0 +1,30 @@
+import {lstat,mkdir,realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+export function parseOwnerEnrollmentJson(bytes,label='owner enrollment JSON'){
+  const text=Buffer.isBuffer(bytes)?bytes.toString('utf8'):String(bytes);
+  let value;
+  try{value=JSON.parse(text.replace(/^\uFEFF/,''));}
+  catch(error){throw new Error(`${label} is invalid JSON: ${String(error?.message??error)}`);}
+  if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} must be an object`);
+  return value;
+}
+
+export async function ensureOwnerConsentDirectory(runtimeDir){
+  if(typeof runtimeDir!=='string'||!path.win32.isAbsolute(runtimeDir))
+    throw new Error('owner consent runtime root must be an absolute Windows path');
+  const runtime=path.win32.resolve(runtimeDir);
+  const runtimeInfo=await lstat(runtime);
+  if(!runtimeInfo.isDirectory()||runtimeInfo.isSymbolicLink())
+    throw new Error('owner consent runtime root must be a real directory');
+  const runtimeReal=path.win32.resolve(await realpath(runtime));
+  const consent=path.win32.join(runtime,'owner-consent');
+  await mkdir(consent,{recursive:true});
+  const consentInfo=await lstat(consent);
+  if(!consentInfo.isDirectory()||consentInfo.isSymbolicLink())
+    throw new Error('owner consent path must be a real directory');
+  const consentReal=path.win32.resolve(await realpath(consent));
+  if(path.win32.dirname(consentReal).toLowerCase()!==runtimeReal.toLowerCase())
+    throw new Error('owner consent path escapes the runtime root');
+  return consentReal;
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.75';
+export const DEADBYTE_VERSION = '0.15.76';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/process-policy-refresh.test.mjs

@@ -70,13 +70,13 @@ test('R167 process policy binds coherently to the explicit development root', as
   // The distributed policy is pinned to its explicit development provenance,
   // not to the physical extraction path of the exact immutable npm tarball.
   const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
-  const approvedRoot = release.r206?.development_policy_root;
-  assert.equal(typeof approvedRoot, 'string', 'R206 development policy root must be explicit in release metadata');
-  assert.ok(path.isAbsolute(approvedRoot), 'R206 development policy root must be absolute');
+  const approvedRoot = release.r207?.development_policy_root;
+  assert.equal(typeof approvedRoot, 'string', 'R207 development policy root must be explicit in release metadata');
+  assert.ok(path.isAbsolute(approvedRoot), 'R207 development policy root must be absolute');
   const expectedRoot = path.resolve(approvedRoot);
   if (process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT) {
     assert.equal(path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT), expectedRoot,
-      'caller-supplied development root cannot override R206 release provenance');
+      'caller-supplied development root cannot override R207 release provenance');
   }
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
   const policy = JSON.parse(await readFile(policyPath, 'utf8'));

package/test/r130-release-security-contract.test.mjs

@@ -14,14 +14,14 @@ test('current successor retains the R130 security baseline with truthful R190 id
     read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.75');
-  assert.equal(release.train,'R206');
-  assert.equal(matrix.train,'R206');
+    assert.equal(actual,'0.15.76');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
   assert.equal(release.source_predecessor.version,'0.15.75');
-  assert.equal(release.source_predecessor.train,'R205');
-  assert.match(release.source_predecessor.source_path,/r205-evidence-selection-dev/i);
-  assert.equal(release.source_predecessor.manifest_status,'R205_MANIFEST_VERIFIED');
-  assert.equal(release.runtime_predecessor.version,'0.15.74');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.match(release.source_predecessor.source_path,/r206-release-closure/i);
+  assert.equal(release.source_predecessor.manifest_status,'R206_MANIFEST_VERIFIED');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -16,17 +16,17 @@ test('R190 package identity preserves R132 evidence and published R179 source pr
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R206');
-  assert.equal(matrix.train,'R206');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
   assert.equal(release.source_predecessor.version,'0.15.75');
-  assert.equal(release.source_predecessor.train,'R205');
-  assert.match(release.source_predecessor.source_path,/r205-evidence-selection-dev/i);
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.match(release.source_predecessor.source_path,/r206-release-closure/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,null);
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.notEqual(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(release.runtime_predecessor.version,'0.15.74');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
   assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.75');
+ assert.equal(state.pkg.version,'0.15.76');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -8,9 +8,9 @@ const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
 test('R160 historical contract remains distinct from the current package identity',async()=>{
   const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
-  assert.equal(release.runtime_predecessor.version,'0.15.74');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
-  assert.equal(release.runtime_predecessor.manifest_sha256,'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
   assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
   assert.equal(release.r160.source_predecessor_train,'R159');
   assert.equal(release.r160.public_tool_delta,0);

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.75');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.76');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');

package/test/r167-release-contract.test.mjs

@@ -8,7 +8,7 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.75';
+const VERSION='0.15.76';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
@@ -20,20 +20,20 @@ test('current package identity retains the immutable R167/R173 activation lineag
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R206');
-  assert.equal(matrix.train,'R206');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
   assert.deepEqual(release.runtime_predecessor,{
-    version:'0.15.74',release_id:'v0.15.74-e84bf4eed16e9443',
-    manifest_sha256:'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47',
-    generation_manifest_sha256:'598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'
+    version:'0.15.75',release_id:'v0.15.75-9039fff265696091',
+    manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+    generation_manifest_sha256:'83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
   });
   assert.equal(release.source_predecessor.version,'0.15.75');
-  assert.equal(release.source_predecessor.train,'R205');
-  assert.equal(release.source_predecessor.tarball_sha256,null);
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.equal(release.r173.source_predecessor_version,'0.15.67');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
   assert.equal(provenance.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');

package/test/r168-release-contract.test.mjs

@@ -13,10 +13,10 @@ const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc
 
 test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
  const release=await read('RELEASE.json');
- assert.equal(release.runtime_predecessor.version,'0.15.74');
- assert.equal(release.parent.version,'0.15.74');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
- assert.equal(release.parent.release_id,'v0.15.74-e84bf4eed16e9443');
+ assert.equal(release.runtime_predecessor.version,'0.15.75');
+ assert.equal(release.parent.version,'0.15.75');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.notEqual(release.runtime_predecessor.release_id,parent);
  assert.notEqual(release.parent.release_id,parent);
  assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');

package/test/r172-release-contract.test.mjs

@@ -16,12 +16,12 @@ test('R190 binds the published source predecessor separately from the active run
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.75');
-  assert.equal(release.train,'R206'); assert.equal(matrix.train,'R206');
+  for(const value of versions)assert.equal(value,'0.15.76');
+  assert.equal(release.train,'R207'); assert.equal(matrix.train,'R207');
   assert.equal(release.source_predecessor.version,'0.15.75');
-  assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
-  assert.equal(release.source_predecessor.tarball_sha256,null);
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
+  assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
   assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });
 

package/test/r173-release-contract.test.mjs

@@ -13,21 +13,21 @@ test('R190 package identity binds the exact published R179 source and live runti
     json('package.json'),readReleaseLock(root),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.75');
-  assert.equal(lock.version,'0.15.75');
-  assert.equal(lock.packages[''].version,'0.15.75');
-  assert.equal(bridge.version,'0.15.75');
-  assert.equal(release.version,'0.15.75');
-  assert.equal(release.train,'R206');
-  assert.equal(matrix.version,'0.15.75');
-  assert.equal(matrix.train,'R206');
-  assert.equal(sbom.metadata.component.version,'0.15.75');
+  assert.equal(pkg.version,'0.15.76');
+  assert.equal(lock.version,'0.15.76');
+  assert.equal(lock.packages[''].version,'0.15.76');
+  assert.equal(bridge.version,'0.15.76');
+  assert.equal(release.version,'0.15.76');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.version,'0.15.76');
+  assert.equal(matrix.train,'R207');
+  assert.equal(sbom.metadata.component.version,'0.15.76');
   assert.equal(release.source_predecessor.version,'0.15.75');
-  assert.equal(release.source_predecessor.train,'R205');
-  assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
-  assert.equal(release.source_predecessor.tarball_sha256,null);
-  assert.equal(release.runtime_predecessor.version,'0.15.74');
-  assert.equal(provenance.version,'0.15.75');
-  assert.equal(provenance.parent_tarball_sha256,'5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
+  assert.equal(provenance.version,'0.15.76');
+  assert.equal(provenance.parent_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
 });

package/test/r179-release-contract.test.mjs

@@ -7,27 +7,27 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 import {readReleaseLock} from './helpers/release-lock.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-const parent='v0.15.74-e84bf4eed16e9443';
-const manifest='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
-const generation='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7';
+const parent='v0.15.75-9039fff265696091';
+const manifest='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const generation='83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9';
 const tarball='1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf';
 test('R190 version, lock snapshot, bridge, matrix, SBOM and provenance identify exact 0.15.70 successor',async()=>{
  const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
   read('package.json'),readReleaseLock(root),read('bridge/package.json'),read('RELEASE.json'),
   read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,provenance.version,
-  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.75');
- assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
+  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.76');
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
  assert.equal(release.parent.release_id,parent);assert.equal(release.parent.manifest_sha256,manifest);
  assert.equal(release.parent.generation_manifest_sha256,generation);
  assert.equal(release.source_predecessor.version,'0.15.75');
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
- assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(provenance.runtime_predecessor.release_id,parent);
- assert.equal(provenance.parent_tarball_sha256,'5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c');
- assert.equal(provenance.source_predecessor_tarball_sha256,null);
+ assert.equal(provenance.parent_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+ assert.equal(provenance.source_predecessor_tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
 });
 test('R179 does not misrepresent owner Autonomous enrollment, protected regression or publication as finished',async()=>{
  const [release,prov,matrix]=await Promise.all(['RELEASE.json','PROVENANCE.json','TEST-MATRIX.json'].map(read));

package/test/r190-release-contract.test.mjs

@@ -8,17 +8,17 @@ test('R190 candidate identity separates published source 0.15.69 from active run
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
  for(const value of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
-  sbom.metadata.component.version])assert.equal(value,'0.15.75');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.75'/);
- assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
+  sbom.metadata.component.version])assert.equal(value,'0.15.76');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
  assert.equal(release.source_predecessor.version,'0.15.75');
- assert.equal(release.source_predecessor.tarball_sha256,null);
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
- assert.equal(release.runtime_predecessor.version,'0.15.74');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.runtime_predecessor.version,'0.15.75');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
  assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
- assert.match(sbom.serialNumber,/r206:0\.15\.75$/);
+ assert.match(sbom.serialNumber,/r207:0\.15\.76$/);
 });
 
 test('R190 release metadata records verified recovery without claiming publication or activation',async()=>{