deadbyte-mcp 0.15.75 → 0.15.76

package/test/r191-release-contract.test.mjs

@@ -6,23 +6,23 @@ import path from 'node:path';
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const json=async f=>JSON.parse(await readFile(path.join(root,f),'utf8'));
-const predecessor='v0.15.74-e84bf4eed16e9443';
-const publishedManifest='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
-const publishedTarball='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c';
+const predecessor='v0.15.75-9039fff265696091';
+const publishedManifest='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const publishedTarball='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 test('R191 exact version identity includes bundled bridge, lock snapshot, SBOM, provenance and matrix',async()=>{
  const [pkg,bridge,lock,release,provenance,matrix,bom]=await Promise.all(['package.json','bridge/package.json','docs/R184-package-lock.json','RELEASE.json','PROVENANCE.json','TEST-MATRIX.json','SBOM.cdx.json'].map(json));
- for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.75');
- for(const train of [release.train,matrix.train])assert.equal(train,'R206');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
+ for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.76');
+ for(const train of [release.train,matrix.train])assert.equal(train,'R207');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
  assert.equal(release.parent.release_id,predecessor);
  assert.equal(provenance.parent_release_id,predecessor);
  assert.equal(release.source_predecessor.version,'0.15.75');
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
- assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(release.source_predecessor.manifest_sha256,publishedManifest);
+ assert.equal(release.source_predecessor.tarball_sha256,publishedTarball);
  assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.parent_tarball_sha256,publishedTarball);
- assert.equal(provenance.source_predecessor_tarball_sha256,null);
- assert.equal(provenance.source_predecessor_manifest_file_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+ assert.equal(provenance.source_predecessor_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,publishedManifest);
  assert.equal(release.r191_activation_repair.npm_publish,'NOT_RUN');
  assert.equal(release.r191_activation_repair.production_activation,'NOT_RUN');
  assert.equal(release.r190_foreground_recovery.status,'PREPUBLISH_VERIFIED');

package/test/r192-release-identity.test.mjs

@@ -3,21 +3,21 @@ import {readFile} from 'node:fs/promises';import {createHash} from 'node:crypto'
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
-const prevHash='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
-const prevTar='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c';
+const prevHash='9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248';
+const prevTar='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 test('R193 current identity retains exact published R192 predecessor evidence',async()=>{
  const [pkg,bridge,lock,release,prov,matrix,bom]=await Promise.all([
  read('package.json'),read('bridge/package.json'),read('docs/R184-package-lock.json'),
  read('RELEASE.json'),read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const actual of [pkg.version,bridge.version,lock.version,lock.packages[''].version,
  release.version,prov.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])
-   assert.equal(actual,'0.15.75');
- assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
- assert.equal(release.parent.release_id,'v0.15.74-e84bf4eed16e9443');
+   assert.equal(actual,'0.15.76');
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.equal(release.parent.manifest_sha256,prevHash);
- assert.equal(release.source_predecessor.tarball_sha256,null);
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+ assert.equal(release.source_predecessor.tarball_sha256,prevTar);
+ assert.equal(release.source_predecessor.manifest_sha256,prevHash);
  assert.equal(prov.parent_tarball_sha256,prevTar);
  assert.equal(prov.parent_manifest_sha256,prevHash);
  assert.equal(release.r192.production_activation,'NOT_RUN');
@@ -33,7 +33,7 @@ test('R192 foreground reader enforces caller-safe telemetry rather than changing
  assert.match(log,/sanitizeAuditArgs\(compact\[6\]\)/);
  const [policy,release]=await Promise.all([
  read('controller/deadbyte-process-policy.json'),read('RELEASE.json')]);
- const approved=release.r206.development_policy_root;
+ const approved=release.r207.development_policy_root;
  assert.equal(typeof approved,'string');
  assert.ok(path.isAbsolute(approved));
  assert.equal(path.resolve(policy.roots.core.path),path.resolve(approved));

package/test/r193-release-identity.test.mjs

@@ -7,41 +7,41 @@ import path from 'node:path';
 const root=fileURLToPath(new URL('..',import.meta.url));
 const json=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
 const parent={
- version:'0.15.74',
- release_id:'v0.15.74-e84bf4eed16e9443',
- manifest_sha256:'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47',
- generation_manifest_sha256:'598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'
+ version:'0.15.75',
+ release_id:'v0.15.75-9039fff265696091',
+ manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+ generation_manifest_sha256:'83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
 };
-const parentTarball='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c';
+const parentTarball='c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9';
 
-test('R206 package identity preserves the R193 owner boundary and separates R205 source from active R194 runtime',async()=>{
+test('R207 package identity preserves the R193 owner boundary and separates R206 source from active R206 runtime',async()=>{
  const [pkg,bridge,release,provenance,matrix,sbom,versionSource]=await Promise.all([
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(path.join(root,'src','version.mjs'),'utf8')]);
- assert.equal(pkg.version,'0.15.75');
- assert.equal(bridge.version,'0.15.75');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.75'/);
- assert.equal(release.version,'0.15.75');
- assert.equal(release.train,'R206');
+ assert.equal(pkg.version,'0.15.76');
+ assert.equal(bridge.version,'0.15.76');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.version,'0.15.76');
+ assert.equal(release.train,'R207');
  for(const key of Object.keys(parent)){
   assert.equal(release.parent[key],parent[key]);
   assert.equal(release.runtime_predecessor[key],parent[key]);
  }
  assert.equal(release.source_predecessor.version,'0.15.75');
- assert.equal(release.source_predecessor.train,'R205');
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
- assert.equal(release.source_predecessor.tarball_sha256,null);
- assert.equal(provenance.version,'0.15.75');
+ assert.equal(release.source_predecessor.train,'R206');
+ assert.equal(release.source_predecessor.manifest_sha256,parent.manifest_sha256);
+ assert.equal(release.source_predecessor.tarball_sha256,parentTarball);
+ assert.equal(provenance.version,'0.15.76');
  assert.equal(provenance.parent_release_id,parent.release_id);
  assert.equal(provenance.parent_manifest_sha256,parent.manifest_sha256);
  assert.equal(provenance.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
  assert.equal(provenance.source_predecessor_version,'0.15.75');
- assert.equal(provenance.source_predecessor_train,'R205');
- assert.equal(provenance.source_predecessor_tarball_sha256,null);
- assert.equal(matrix.version,'0.15.75');
- assert.equal(matrix.train,'R206');
- assert.equal(sbom.metadata.component.version,'0.15.75');
- assert.match(sbom.serialNumber,/r206:0\.15\.75$/);
+ assert.equal(provenance.source_predecessor_train,'R206');
+ assert.equal(provenance.source_predecessor_tarball_sha256,parentTarball);
+ assert.equal(matrix.version,'0.15.76');
+ assert.equal(matrix.train,'R207');
+ assert.equal(sbom.metadata.component.version,'0.15.76');
+ assert.match(sbom.serialNumber,/r207:0\.15\.76$/);
 });
 
 test('R193 manifest binds every protected owner-boundary implementation file',async()=>{

package/test/r193-release-readiness.test.mjs

@@ -77,11 +77,11 @@ test('R193 publisher refuses a repacked artifact that differs from closure bytes
     observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R193.*repacked tarball/);
 });
 
-test('canonical npm release entrypoint enforces current R195 closure before registry or pack work',async()=>{
+test('canonical npm release entrypoint enforces current R207 closure before registry or pack work',async()=>{
   const root=fileURLToPath(new URL('..',import.meta.url));
   const env={...process.env};delete env.DEADBYTE_R193_CLOSURE_ROOT;
   const result=spawnSync(process.execPath,[path.join(root,'scripts','npm-release-r48.mjs'),'--publish-only'],{cwd:root,env,encoding:'utf8',windowsHide:true});
   assert.notEqual(result.status,0);
-  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R206.*closure root absent/);
+  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R207.*closure root absent/);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/npm publish|Packing artifact/);
 });

package/test/r193-windows-gate.test.mjs

@@ -6,19 +6,19 @@ import path from 'node:path';
 
 const root=fileURLToPath(new URL('..',import.meta.url));
 
-test('R206 Windows gate is the canonical exact-identity prepublication gate',async()=>{
+test('R207 Windows gate is the canonical exact-identity prepublication gate',async()=>{
  const [pkg,gate]=await Promise.all([
   readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
-  readFile(path.join(root,'scripts','gate-windows-r206.ps1'),'utf8')
+  readFile(path.join(root,'scripts','gate-windows-r207.ps1'),'utf8')
  ]);
- assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r206.ps1 -Stage all');
- assert.match(gate,/0\.15\.75/);
- assert.match(gate,/R206/);
- assert.match(gate,/v0\.15\.74-e84bf4eed16e9443/);
- assert.match(gate,/e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47/);
- assert.match(gate,/598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7/);
- assert.match(gate,/test\/r193-release-identity\.test\.mjs/);
- assert.match(gate,/test\/r193-release-readiness\.test\.mjs/);
+ assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r207.ps1 -Stage all');
+ assert.match(gate,/0\.15\.76/);
+ assert.match(gate,/R207/);
+ assert.match(gate,/v0\.15\.75-9039fff265696091/);
+ assert.match(gate,/9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248/);
+ assert.match(gate,/83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9/);
+ assert.match(gate,/test\/r207-release-contract\.test\.mjs/);
+ assert.match(gate,/test\/r207-owner-enrollment-io\.test\.mjs/);
  assert.match(gate,/test\/r193-owner-uac-broker\.test\.mjs/);
  assert.match(gate,/test\/r70-owner-approval\.test\.mjs/);
  assert.match(gate,/test\/r89-privileged-install-boundary\.test\.mjs/);

package/test/r194-release-identity.test.mjs

@@ -5,23 +5,23 @@ import{fileURLToPath}from'node:url';
 import path from'node:path';
 const root=fileURLToPath(new URL('..',import.meta.url));
 const json=async n=>JSON.parse(await readFile(path.join(root,n),'utf8'));
-test('R206 exact release identity binds R205 source separately from active R194 runtime',async()=>{
+test('R207 exact release identity binds R206 source separately from active R206 runtime',async()=>{
  const [pkg,bridge,release,provenance,matrix,sbom,lock,ver]=await Promise.all([
  json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
  json('TEST-MATRIX.json'),json('SBOM.cdx.json'),json('docs/R184-package-lock.json'),
  readFile(path.join(root,'src','version.mjs'),'utf8')]);
  for(const v of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
- sbom.metadata.component.version,lock.version,lock.packages[''].version])assert.equal(v,'0.15.75');
- assert.match(ver,/DEADBYTE_VERSION = '0\.15\.75'/);
- assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
- assert.equal(release.parent.release_id,'v0.15.74-e84bf4eed16e9443');
+ sbom.metadata.component.version,lock.version,lock.packages[''].version])assert.equal(v,'0.15.76');
+ assert.match(ver,/DEADBYTE_VERSION = '0\.15\.76'/);
+ assert.equal(release.train,'R207');assert.equal(matrix.train,'R207');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
+ assert.equal(release.parent.release_id,'v0.15.75-9039fff265696091');
  assert.equal(release.runtime_predecessor.release_id,release.parent.release_id);
  assert.equal(release.source_predecessor.version,'0.15.75');
- assert.equal(release.source_predecessor.train,'R205');
- assert.equal(release.source_predecessor.release_status,'DEVELOPMENT_VERIFIED_RELEASE_BLOCKED');
- assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
- assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(release.source_predecessor.train,'R206');
+ assert.equal(release.source_predecessor.release_status,'RELEASED');
+ assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+ assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
  assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
  assert.equal(release.r195.scope,'CANONICAL_PROTECTED_OWNER_OBSERVATION');

package/test/r194-release-readiness.test.mjs

@@ -77,11 +77,11 @@ test('R194 publisher refuses a repacked artifact that differs from closure bytes
     observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R194.*repacked tarball/);
 });
 
-test('canonical npm release entrypoint enforces current R195 closure before registry or pack work',async()=>{
+test('canonical npm release entrypoint enforces current R207 closure before registry or pack work',async()=>{
   const root=fileURLToPath(new URL('..',import.meta.url));
-  const env={...process.env};delete env.DEADBYTE_R194_CLOSURE_ROOT;
+  const env={...process.env};delete env.DEADBYTE_R207_CLOSURE_ROOT;
   const result=spawnSync(process.execPath,[path.join(root,'scripts','npm-release-r48.mjs'),'--publish-only'],{cwd:root,env,encoding:'utf8',windowsHide:true});
   assert.notEqual(result.status,0);
-  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R206.*closure root absent/);
+  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R207.*closure root absent/);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/npm publish|Packing artifact/);
 });

package/test/r194-windows-gate.test.mjs

@@ -4,17 +4,17 @@ import {readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 const root=fileURLToPath(new URL('..',import.meta.url));
-test('R206 prepublication Windows gate keeps active R194 runtime parent pinned',async()=>{
+test('R207 prepublication Windows gate keeps active R206 runtime parent pinned',async()=>{
  const [pkg,gate]=await Promise.all([
   readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
-  readFile(path.join(root,'scripts/gate-windows-r206.ps1'),'utf8')]);
+  readFile(path.join(root,'scripts/gate-windows-r207.ps1'),'utf8')]);
  assert.equal(pkg.scripts['gate:windows'],
- 'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r206.ps1 -Stage all');
- assert.match(gate,/0\.15\.75/);assert.match(gate,/R206/);
- assert.match(gate,/v0\.15\.74-e84bf4eed16e9443/);
- assert.match(gate,/598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7/);
- assert.match(gate,/test\/r194-release-identity\.test\.mjs/);
- assert.match(gate,/test\/r194-npm-auth-recovery\.test\.mjs/);
+ 'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r207.ps1 -Stage all');
+ assert.match(gate,/0\.15\.76/);assert.match(gate,/R207/);
+ assert.match(gate,/v0\.15\.75-9039fff265696091/);
+ assert.match(gate,/83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9/);
+ assert.match(gate,/test\/r207-release-contract\.test\.mjs/);
+ assert.match(gate,/test\/r207-owner-enrollment-io\.test\.mjs/);
  assert.match(gate,/test\/r195-canonical-owner-observation\.test\.mjs/);
  assert.match(gate,/test\/r193-owner-uac-broker\.test\.mjs/);
  assert.doesNotMatch(gate,/arm(process|coding|autonomous|desktop|host)/i);

package/test/r206-release-contract.test.mjs

@@ -7,24 +7,24 @@ import path from 'node:path';
 const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const json=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
 
-test('R206 identity binds R205 source separately from active 0.15.74 runtime',async()=>{
+test('R207 retains R206 evidence while binding R206 source separately from active 0.15.75 runtime',async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
     json('package.json'),json('docs/R184-package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.75');
-  assert.equal(lock.version,'0.15.75');
-  assert.equal(lock.packages[''].version,'0.15.75');
-  assert.equal(bridge.version,'0.15.75');
-  assert.equal(release.version,'0.15.75');assert.equal(release.train,'R206');
-  assert.equal(release.source_predecessor.train,'R205');
-  assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
-  assert.equal(provenance.builder,'deadbyte-r206-release-closure');
-  assert.equal(provenance.source_predecessor_train,'R205');
-  assert.equal(provenance.source_predecessor_manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
-  assert.equal(matrix.train,'R206');
-  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
+  assert.equal(pkg.version,'0.15.76');
+  assert.equal(lock.version,'0.15.76');
+  assert.equal(lock.packages[''].version,'0.15.76');
+  assert.equal(bridge.version,'0.15.76');
+  assert.equal(release.version,'0.15.76');assert.equal(release.train,'R207');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.equal(release.source_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+  assert.equal(provenance.builder,'deadbyte-r207-owner-enrollment-fix');
+  assert.equal(provenance.source_predecessor_train,'R206');
+  assert.equal(provenance.source_predecessor_manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
+  assert.equal(matrix.train,'R207');
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r207:0.15.76');
 });
 
 test('R206 release contract keeps public surface stable and deferred work truthful',async()=>{

package/test/r207-owner-enrollment-io.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,rm,symlink,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {ensureOwnerConsentDirectory,parseOwnerEnrollmentJson} from '../src/r207-owner-enrollment-io.mjs';
+
+test('R207 parses Windows PowerShell UTF-8 BOM supervisor ledgers',()=>{
+  const value=parseOwnerEnrollmentJson(Buffer.concat([Buffer.from([0xef,0xbb,0xbf]),Buffer.from('{"schema":"deadbyte.supervisor.instance.v1","pid":17}')]),'supervisor ledger');
+  assert.equal(value.schema,'deadbyte.supervisor.instance.v1');
+  assert.equal(value.pid,17);
+  assert.throws(()=>parseOwnerEnrollmentJson(Buffer.from('\uFEFF[]'),'supervisor ledger'),/must be an object/);
+});
+
+test('R207 initializes the bounded owner-consent state directory before no-clobber request creation',async()=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r207-owner-'));
+  try{
+    const runtime=path.join(base,'runtime');await mkdir(runtime);
+    const consent=await ensureOwnerConsentDirectory(runtime);
+    assert.equal(consent.toLowerCase(),path.join(runtime,'owner-consent').toLowerCase());
+    const request=path.join(consent,'request.json');
+    await writeFile(request,'{}\n',{flag:'wx'});
+    await assert.rejects(writeFile(request,'{}\n',{flag:'wx'}),error=>error?.code==='EEXIST');
+    assert.equal(await readFile(request,'utf8'),'{}\n');
+  }finally{await rm(base,{recursive:true,force:true});}
+});
+
+test('R207 rejects an owner-consent junction or symlink escape',async t=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r207-owner-link-'));
+  try{
+    const runtime=path.join(base,'runtime'),outside=path.join(base,'outside');
+    await mkdir(runtime);await mkdir(outside);
+    try{await symlink(outside,path.join(runtime,'owner-consent'),process.platform==='win32'?'junction':'dir');}
+    catch(error){if(error?.code==='EPERM'){t.skip('Windows symlink privilege unavailable');return;}throw error;}
+    await assert.rejects(ensureOwnerConsentDirectory(runtime),/real directory|escapes/);
+  }finally{await rm(base,{recursive:true,force:true});}
+});

package/test/r207-release-contract.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const root = new URL('../', import.meta.url);
+const json = async name => JSON.parse(await readFile(new URL(name, root), 'utf8'));
+
+test('R207 identity binds exact R206 source and active 0.15.75 runtime predecessors', async () => {
+  const [pkg, lock, bridge, release, provenance, matrix, sbom, versionSource] = await Promise.all([
+    json('package.json'), json('docs/R184-package-lock.json'), json('bridge/package.json'), json('RELEASE.json'),
+    json('PROVENANCE.json'), json('TEST-MATRIX.json'), json('SBOM.cdx.json'),
+    readFile(new URL('src/version.mjs', root), 'utf8')
+  ]);
+  for (const value of [pkg.version, lock.version, lock.packages[''].version, bridge.version,
+    release.version, provenance.version, matrix.version, sbom.metadata.component.version]) {
+    assert.equal(value, '0.15.76');
+  }
+  assert.match(versionSource, /DEADBYTE_VERSION = '0\.15\.76'/);
+  assert.equal(release.train, 'R207');
+  assert.equal(matrix.train, 'R207');
+  assert.equal(sbom.serialNumber, 'urn:cdx:deadbyte-mcp:r207:0.15.76');
+  assert.deepEqual(release.source_predecessor, {
+    version: '0.15.75',
+    train: 'R206',
+    source_path: 'D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.75-r206-release-closure',
+    release_status: 'RELEASED',
+    manifest_status: 'R206_MANIFEST_VERIFIED',
+    manifest_sha256: '9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+    tarball_sha256: 'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9'
+  });
+  assert.deepEqual(release.runtime_predecessor, {
+    version: '0.15.75',
+    release_id: 'v0.15.75-9039fff265696091',
+    manifest_sha256: '9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',
+    generation_manifest_sha256: '83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'
+  });
+});
+
+test('R207 keeps authority surface stable and fixes only protected owner-enrollment IO', async () => {
+  const release = await json('RELEASE.json');
+  assert.equal(release.capabilities.compact_tool_count, 43);
+  assert.equal(release.capabilities.full_tool_count, 117);
+  assert.equal(release.r207.scope, 'PROTECTED_OWNER_ENROLLMENT_IO_RECOVERY');
+  assert.equal(release.r207.public_tool_delta, 0);
+  assert.equal(release.r207.authority_scope_delta, 0);
+  assert.equal(release.r207.r70_weakened, false);
+  assert.equal(release.r207.r89_weakened, false);
+  assert.equal(release.r207.owner_private_key_access, false);
+  assert.equal(release.r207.owner_consent_directory_initialization, 'FAIL_CLOSED_CONTAINED_NON_REPARSE');
+  assert.equal(release.r207.supervisor_ledger_utf8_bom, 'ACCEPT_ONE_LEADING_BOM_ONLY');
+});

package/test/r207-release-readiness.test.mjs

@@ -0,0 +1,23 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {assertR207NpmPublishReady,assertR207PackedIdentity} from '../scripts/npm-release-readiness-r207.mjs';
+const base={version:'0.15.76',train:'R207',
+ parent:{version:'0.15.75',release_id:'v0.15.75-9039fff265696091',manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248',generation_manifest_sha256:'83a212e01173c73f78cff2a6d26e6f3f50f476a8c0ea3cbbf592a466071909e9'},
+ source_predecessor:{train:'R206',manifest_sha256:'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248'},
+ r207:{scope:'PROTECTED_OWNER_ENROLLMENT_IO_RECOVERY',public_tool_delta:0,authority_scope_delta:0,owner_private_key_access:false,r70_weakened:false,r89_weakened:false}};
+test('R207 refuses publish absent independently verified closure',async()=>{
+ await assert.rejects(assertR207NpmPublishReady(base,{root:'D:\\candidate'}),/PUBLISH_BLOCKED R207.*closure root absent/);
+});
+test('R207 refuses any authority increase or private-key access',async()=>{
+ for(const key of ['owner_private_key_access','r70_weakened','r89_weakened']){
+  const altered=structuredClone(base);altered.r207[key]=true;
+  await assert.rejects(assertR207NpmPublishReady(altered,{root:'D:\\candidate'}),/PUBLISH_BLOCKED R207.*public authority surface widened/);
+ }
+});
+test('R207 rejects mismatched parent release before reading any closure',async()=>{
+ const altered=structuredClone(base);altered.parent.release_id='v0.15.74-e84bf4eed16e9443';
+ await assert.rejects(assertR207NpmPublishReady(altered,{root:'D:\\candidate'}),/PUBLISH_BLOCKED R207.*lineage mismatch/);
+});
+test('R207 refuses repacked artifact identity drift',()=>{
+ assert.throws(()=>assertR207PackedIdentity({tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-proof',tarball_shasum:'b'.repeat(40),observedSha256:'c'.repeat(64),observedIntegrity:'sha512-another',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R207.*repacked tarball/);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71','0.15.72','0.15.73','0.15.74','0.15.75'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71','0.15.72','0.15.73','0.15.74','0.15.75','0.15.76'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');