deadbyte-mcp 0.8.7

package/src/contained-cli.mjs

@@ -0,0 +1,30 @@
+import path from 'node:path';
+import { executeContainedTransform } from './contained-executor.mjs';
+import { defaultPrivateKeyPath } from './trust.mjs';
+
+const [workspaceArg = 'workspaces/demo', input = 'input.txt', output = `contained-output.${Date.now().toString(16)}.txt`, operation = 'uppercase_ascii'] = process.argv.slice(2);
+
+try {
+  const result = await executeContainedTransform({
+    workspacePath: path.resolve(workspaceArg),
+    input,
+    output,
+    operation,
+    signingKeyPath: process.env.DEADBYTE_SIGNING_KEY ?? defaultPrivateKeyPath()
+  });
+  console.log(JSON.stringify({
+    status: 'passed',
+    operation,
+    output,
+    receipt: result.receiptRelativePath,
+    receipt_sha256: result.receipt.receipt_sha256,
+    key_id: result.receipt.attestation.key_id,
+    worker_id: result.receipt.worker.id,
+    worker_sha256: result.receipt.worker.sha256,
+    output_sha256: result.receipt.output.sha256,
+    containment: result.execution
+  }, null, 2));
+} catch (error) {
+  console.error(error instanceof Error ? error.stack : String(error));
+  process.exitCode = 1;
+}

package/src/contained-executor.mjs

@@ -0,0 +1,276 @@
+import { spawn } from 'node:child_process';
+import { open, readFile, realpath, rm } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { validateContainedExecutionResult } from './contained-result.mjs';
+import { CONTAINED_EXECUTION_REGISTRY, CONTAINED_TRANSFORM_OPERATIONS, expectedWorkerSpec, loadVerifiedWorkerRegistry } from './worker-registry.mjs';
+export { CONTAINED_EXECUTION_REGISTRY, CONTAINED_TRANSFORM_OPERATIONS } from './worker-registry.mjs';
+import { sha256Bytes, sha256File } from './hash.mjs';
+import { createInvocation, invocationRequestSha256, INVOCATION_SCHEMA } from './invocation.mjs';
+import { isInside, resolveExistingInside, resolveWritableInside, resolveWorkspace } from './path-policy.mjs';
+import { writeReceipt } from './receipt.mjs';
+import { loadPrivateSigningKey } from './trust.mjs';
+import { operationPolicy } from './operation-policy.mjs';
+import { createRequestIdentity } from './request-identity.mjs';
+
+const projectRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const launcherPath = path.join(projectRoot, 'bin', 'deadbyte-exec.exe');
+const MAX_LAUNCHER_STDOUT_BYTES = 2 * 1024 * 1024;
+const MAX_LAUNCHER_STDERR_BYTES = 128 * 1024;
+const containedOperationSet = new Set(CONTAINED_TRANSFORM_OPERATIONS);
+function containedWorkerSpec(operation, registry) {
+  const spec = expectedWorkerSpec(operation);
+  const runtime = registry.workers[spec.workerId];
+  if (!runtime || runtime.executable !== spec.executable) throw new Error('verified worker registry operation mapping mismatch');
+  return { ...spec, workerPath: runtime.workerPath, workerSha256: runtime.sha256 };
+}
+
+
+
+
+function expectedOutputBytes(inputBytes, operation) {
+  const out = Buffer.from(inputBytes);
+  if (operation === 'uppercase_ascii') {
+    for (let i = 0; i < out.length; i += 1) if (out[i] >= 0x61 && out[i] <= 0x7a) out[i] -= 0x20;
+    return out;
+  }
+  if (operation === 'lowercase_ascii') {
+    for (let i = 0; i < out.length; i += 1) if (out[i] >= 0x41 && out[i] <= 0x5a) out[i] += 0x20;
+    return out;
+  }
+  if (operation === 'reverse_bytes') return Buffer.from(inputBytes).reverse();
+  throw new Error('unsupported contained transform operation');
+}
+
+function verifyPreExportSemantics(inputBytes, outputBytes, operation) {
+  const expected = expectedOutputBytes(inputBytes, operation);
+  if (!expected.equals(outputBytes)) throw new Error('contained pre-export semantic verification failed');
+}
+
+function collectBounded(child, stream, limit, onLimit) {
+  const chunks = [];
+  let bytes = 0;
+  stream.on('data', chunk => {
+    bytes += chunk.length;
+    if (bytes > limit) {
+      onLimit();
+      child.kill('SIGKILL');
+      return;
+    }
+    chunks.push(chunk);
+  });
+  return () => Buffer.concat(chunks);
+}
+
+async function runContainedLauncher({ inputBytes, operation, timeoutMs, workerPath, invocation }) {
+  await Promise.all([realpath(launcherPath), realpath(workerPath)]).catch(() => {
+    throw new Error('contained execution binaries missing; run npm run containment:build first');
+  });
+
+  return await new Promise((resolve, reject) => {
+    const child = spawn(launcherPath, ['--operation', operation, '--challenge', invocation.challenge, '--request-digest', invocation.requestSha256], {
+      cwd: projectRoot,
+      shell: false,
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+
+    let stdoutLimit = false;
+    let stderrLimit = false;
+    let timedOut = false;
+    const stdoutValue = collectBounded(child, child.stdout, MAX_LAUNCHER_STDOUT_BYTES, () => { stdoutLimit = true; });
+    const stderrValue = collectBounded(child, child.stderr, MAX_LAUNCHER_STDERR_BYTES, () => { stderrLimit = true; });
+
+    child.once('error', reject);
+    child.stdin.once('error', error => {
+      if (error?.code !== 'EPIPE') reject(error);
+    });
+    child.stdin.end(inputBytes);
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill('SIGKILL');
+    }, timeoutMs);
+
+    child.once('close', (code, signal) => {
+      clearTimeout(timer);
+      resolve({
+        exitCode: Number.isInteger(code) ? code : 128,
+        signal,
+        timedOut,
+        stdoutLimit,
+        stderrLimit,
+        stdout: stdoutValue(),
+        stderr: stderrValue()
+      });
+    });
+  });
+}
+
+export async function executeContainedTransform({
+  workspacePath,
+  input,
+  output,
+  operation = 'uppercase_ascii',
+  timeoutMs = undefined,
+  signingKeyPath,
+  receiptId = undefined
+}) {
+  if (process.platform !== 'win32') throw new Error('contained execution requires Windows AppContainer backend');
+  if (!containedOperationSet.has(operation)) throw new Error('unsupported contained transform operation');
+  const policy = operationPolicy(operation);
+  const effectiveTimeoutMs = timeoutMs ?? policy.launcherTimeoutMs;
+  if (!Number.isInteger(effectiveTimeoutMs) || effectiveTimeoutMs < 1000 || effectiveTimeoutMs > policy.launcherTimeoutMs) {
+    throw new Error(`timeoutMs must be an integer between 1000 and ${policy.launcherTimeoutMs}`);
+  }
+
+  const rootReal = await resolveWorkspace(workspacePath);
+  const signingKey = await loadPrivateSigningKey(signingKeyPath);
+  const signingKeyReal = await realpath(signingKey.keyPath);
+  if (isInside(rootReal, signingKeyReal)) throw new Error('signing key must be outside workspace');
+
+  const inputPath = await resolveExistingInside(rootReal, input);
+  const outputPath = await resolveWritableInside(rootReal, output);
+  const inputBytes = await readFile(inputPath);
+  if (inputBytes.length > policy.maxInputBytes) throw new Error(`input exceeds ${policy.maxInputBytes} byte contained execution limit`);
+
+  const verifiedRegistry = await loadVerifiedWorkerRegistry();
+  const worker = containedWorkerSpec(operation, verifiedRegistry);
+  const inputSha256 = sha256Bytes(inputBytes);
+  const invocation = createInvocation({
+    operation,
+    inputSha256,
+    workerManifestSha256: verifiedRegistry.manifestSha256,
+    workerId: worker.workerId,
+    workerSourceSha256: worker.workerSha256
+  });
+  const request = createRequestIdentity({
+    operation: 'contained_transform',
+    inputSha256,
+    workerId: worker.workerId,
+    workerSha256: worker.workerSha256,
+    containedInvocation: invocation
+  });
+  const launch = await runContainedLauncher({ inputBytes, operation, timeoutMs: effectiveTimeoutMs, workerPath: worker.workerPath, invocation });
+  if (launch.timedOut || launch.stdoutLimit || launch.stderrLimit) {
+    throw new Error(`contained launcher failed: timeout=${launch.timedOut} stdout_limit=${launch.stdoutLimit} stderr_limit=${launch.stderrLimit}`);
+  }
+
+  let rawResult;
+  try {
+    rawResult = JSON.parse(launch.stdout.toString('utf8'));
+  } catch {
+    throw new Error(
+      `contained launcher returned non-JSON: exit=${launch.exitCode} stderr=${launch.stderr.toString('utf8') || '<empty>'}`
+    );
+  }
+
+  let execution;
+  try {
+    execution = validateContainedExecutionResult(rawResult, operation, {
+      challenge: invocation.challenge,
+      requestSha256: invocation.requestSha256
+    });
+  } catch (error) {
+    throw new Error(
+      `${error instanceof Error ? error.message : String(error)}; launcher_exit=${launch.exitCode}; result=${JSON.stringify(rawResult)}; stderr=${launch.stderr.toString('utf8') || '<empty>'}`
+    );
+  }
+  if (launch.exitCode !== 0) throw new Error(`contained launcher exit=${launch.exitCode} despite passed measurement`);
+  if (execution.worker_manifest_sha256 !== verifiedRegistry.manifestSha256) {
+    throw new Error('contained worker manifest hash disagrees with independently verified manifest');
+  }
+  if (execution.worker_source_sha256 !== worker.workerSha256) {
+    throw new Error('contained worker source hash disagrees with independently verified binary');
+  }
+  const recomputedRequestSha256 = invocationRequestSha256({
+    challenge: invocation.challenge,
+    operation,
+    inputSha256,
+    workerManifestSha256: verifiedRegistry.manifestSha256,
+    workerId: worker.workerId,
+    workerSourceSha256: worker.workerSha256
+  });
+  if (execution.invocation_schema !== INVOCATION_SCHEMA ||
+      execution.invocation_challenge !== invocation.challenge ||
+      execution.invocation_request_sha256 !== invocation.requestSha256 ||
+      recomputedRequestSha256 !== invocation.requestSha256) {
+    throw new Error('contained invocation binding mismatch');
+  }
+
+  let outputBytes;
+  try {
+    outputBytes = Buffer.from(rawResult.output_base64, 'base64');
+  } catch {
+    throw new Error('contained launcher output is not valid base64');
+  }
+  if (outputBytes.toString('base64') !== rawResult.output_base64) throw new Error('contained launcher output is not canonical base64');
+  if (rawResult.input_bytes !== inputBytes.length) throw new Error('contained input byte count mismatch');
+  if (outputBytes.length !== rawResult.output_bytes) throw new Error('contained output byte count mismatch');
+  if (outputBytes.length > policy.maxOutputBytes) throw new Error(`contained output exceeds ${policy.maxOutputBytes} byte limit`);
+  verifyPreExportSemantics(inputBytes, outputBytes, operation);
+
+  let outputHandle;
+  try {
+    outputHandle = await open(outputPath, 'wx', 0o600);
+    await outputHandle.writeFile(outputBytes);
+  } catch (error) {
+    if (outputHandle) await outputHandle.close().catch(() => {});
+    await rm(outputPath, { force: true }).catch(() => {});
+    throw error;
+  }
+  await outputHandle.close();
+
+  try {
+    const receiptResult = await writeReceipt({
+      rootReal,
+      operation: 'contained_transform',
+      inputSourcePath: inputPath,
+      inputBytes,
+      outputPath,
+      workerPath: worker.workerPath,
+      workerId: worker.workerId,
+      exitCode: launch.exitCode,
+      stdout: launch.stdout,
+      stderr: launch.stderr,
+      execution: {
+        ...execution,
+        launcher_sha256: await sha256File(launcherPath),
+        worker_manifest: verifiedRegistry.basename,
+        worker_manifest_sha256: verifiedRegistry.manifestSha256,
+        worker_manifest_verified: true,
+        worker_source_sha256: worker.workerSha256,
+        output_sha256: sha256Bytes(outputBytes),
+        operation_policy: {
+          max_input_bytes: policy.maxInputBytes,
+          max_output_bytes: policy.maxOutputBytes,
+          launcher_timeout_ms: policy.launcherTimeoutMs
+        },
+        pre_export_semantic_verified: true
+      },
+      request,
+      signingKey,
+      receiptId
+    });
+
+    return {
+      workspace: rootReal,
+      output: outputPath,
+      outputBytes,
+      launcher: rawResult,
+      execution,
+      ...receiptResult
+    };
+  } catch (error) {
+    await rm(outputPath, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+export const containedPaths = Object.freeze({
+  launcherPath,
+  workerPaths: Object.freeze(Object.fromEntries(
+    Object.entries(CONTAINED_EXECUTION_REGISTRY).map(([operation, spec]) => [operation, path.join(projectRoot, 'bin', spec.executable)])
+  ))
+});
+

package/src/contained-result.mjs

@@ -0,0 +1,149 @@
+import { CONTAINED_EXECUTION_REGISTRY as workerRegistry, CONTAINED_TRANSFORM_OPERATIONS } from './worker-registry.mjs';
+const allowedOperations = new Set(CONTAINED_TRANSFORM_OPERATIONS);
+
+function invariant(condition, message) {
+  if (!condition) throw new Error(`contained execution invariant failed: ${message}`);
+}
+
+export function validateContainedExecutionResult(result, expectedOperation = 'uppercase_ascii', expectedInvocation = undefined) {
+  invariant(result && typeof result === 'object', 'result is not an object');
+  invariant(result.status === 'passed', `launcher status is ${String(result.status)}`);
+  invariant(result.backend === 'windows-appcontainer', 'backend is not windows-appcontainer');
+  invariant(result.mode === 'appcontainer', 'mode is not regular AppContainer');
+  invariant(allowedOperations.has(expectedOperation), 'unsupported expected operation');
+  invariant(result.operation === expectedOperation, 'operation mismatch');
+  invariant(result.invocation_schema === 'deadbyte.invocation.v1', 'invocation schema mismatch');
+  invariant(typeof result.invocation_challenge === 'string' && /^[0-9a-f]{64}$/.test(result.invocation_challenge), 'invocation challenge missing');
+  invariant(typeof result.invocation_request_sha256 === 'string' && /^[0-9a-f]{64}$/.test(result.invocation_request_sha256), 'invocation request hash missing');
+  if (expectedInvocation) {
+    invariant(result.invocation_challenge === expectedInvocation.challenge, 'invocation challenge mismatch');
+    invariant(result.invocation_request_sha256 === expectedInvocation.requestSha256, 'invocation request hash mismatch');
+  }
+  const workerSpec = workerRegistry[expectedOperation];
+  invariant(result.worker_registry === 'compile-time-operation-to-executable', 'unexpected worker registry policy');
+  invariant(result.worker_id === workerSpec.workerId, 'worker id mismatch');
+  invariant(result.worker_executable === workerSpec.executable, 'worker executable mismatch');
+  invariant(result.worker_manifest === 'WORKER-REGISTRY.txt', 'worker manifest basename mismatch');
+  invariant(typeof result.worker_manifest_sha256 === 'string' && /^[0-9a-f]{64}$/.test(result.worker_manifest_sha256), 'worker manifest hash missing');
+  invariant(result.worker_manifest_verified === true, 'worker manifest was not verified');
+  invariant(typeof result.worker_source_sha256 === 'string' && /^[0-9a-f]{64}$/.test(result.worker_source_sha256), 'worker source hash missing');
+  invariant(typeof result.appcontainer_sid === 'string' && result.appcontainer_sid.startsWith('S-1-15-2-'), 'missing AppContainer SID');
+  invariant(result.network_capabilities === 0, 'capabilities were granted');
+  invariant(result.network_policy === 'zero-capabilities-plus-active-loopback-denial', 'unexpected network policy');
+  invariant(result.network_probe_schema === 'deadbyte.network.loopback.v1', 'network probe schema mismatch');
+  invariant(result.network_probe_target === '127.0.0.1', 'network probe target mismatch');
+  invariant(Number.isInteger(result.network_probe_port) && result.network_probe_port >= 1 && result.network_probe_port <= 65535, 'network probe port invalid');
+  invariant(result.network_probe_host_control_ok === true, 'host loopback positive control failed');
+  invariant(result.job_assignment === 'atomic-attribute', 'Job assignment is not atomic');
+  invariant(result.job_breakaway_enabled === false, 'Job breakaway is enabled');
+  invariant(result.active_process_limit === 1, 'active process limit is not one');
+  invariant(result.process_memory_limit_bytes === 134217728, 'process memory limit mismatch');
+  invariant(result.child_control === 'job-active-process-limit', 'unexpected child-control mechanism');
+  invariant(result.child_process_policy === 'not-used', 'broken token child-policy mechanism was used');
+  invariant(result.import_transport === 'host-stdin-to-profile-copy', 'unexpected import transport');
+  invariant(result.export_transport === 'profile-copy-to-host-json', 'unexpected export transport');
+  invariant(result.workspace_mounted === false, 'host workspace was mounted into sandbox');
+  invariant(result.worker_environment === 'appcontainer-bootstrap-allowlist-plus-drive-cwd', 'unexpected worker environment policy');
+  invariant(result.worker_localappdata_present === true, 'worker bootstrap environment missing LOCALAPPDATA');
+  invariant(result.worker_environment_allowlist_exact === true, 'worker environment allowlist was not exact');
+  invariant(result.worker_drive_current_directory_set === true, 'worker drive current-directory entry missing');
+  invariant(result.timed_out === false, 'worker timed out');
+  invariant(result.child_exit_code === 0, 'worker exit code is not zero');
+  invariant(result.profile_cleanup_ok === true, 'AppContainer profile cleanup failed');
+
+  const proof = result.proof;
+  invariant(proof && typeof proof === 'object', 'missing worker proof');
+  invariant(proof.status === 'passed', `worker proof status is ${String(proof.status)}`);
+  invariant(proof.token_appcontainer_query_ok === true, 'TokenIsAppContainer query failed');
+  invariant(proof.token_is_appcontainer === true, 'worker token is not AppContainer');
+  invariant(proof.capability_query_ok === true, 'TokenCapabilities query failed');
+  invariant(proof.capability_count === 0, 'worker token has capabilities');
+  invariant(proof.aap_canary_readable === true, 'AAP canary was not readable by regular AppContainer');
+  invariant(proof.aap_mode_evidence_ok === true, 'AAP behavioral mode evidence failed');
+  invariant(proof.outside_read_denied === true, 'host-only canary was readable');
+  invariant(proof.inside_write_ok === true, 'sandbox output write failed');
+  invariant(proof.in_job === true, 'worker is not associated with a Job');
+  invariant(proof.normal_child_execution_denied === true, 'normal child payload executed');
+  invariant(proof.breakaway_child_execution_denied === true, 'breakaway child payload executed');
+  invariant(proof.network_probe_schema === result.network_probe_schema, 'worker network probe schema mismatch');
+  invariant(proof.network_probe_attempted === true, 'worker network probe was not attempted');
+  invariant(proof.network_probe_target === result.network_probe_target, 'worker network probe target mismatch');
+  invariant(proof.network_probe_port === result.network_probe_port, 'worker network probe port mismatch');
+  invariant(proof.network_connect_succeeded === false, 'worker established forbidden loopback network connection');
+  invariant(Number.isInteger(proof.network_connect_error) && proof.network_connect_error > 0, 'worker network denial error missing');
+  invariant(typeof proof.network_connect_timed_out === 'boolean', 'worker network timeout evidence missing');
+  invariant(proof.active_network_denial_ok === true, 'active loopback network denial was not observed');
+  invariant(proof.input_read_ok === true, 'sandbox import read failed');
+  invariant(proof.transform_ok === true, 'worker transform failed');
+  invariant(proof.output_write_ok === true, 'sandbox export write failed');
+  invariant(proof.operation === expectedOperation, 'worker operation mismatch');
+  invariant(proof.invocation_schema === result.invocation_schema, 'worker invocation schema mismatch');
+  invariant(proof.invocation_challenge === result.invocation_challenge, 'worker invocation challenge mismatch');
+  invariant(proof.invocation_request_sha256 === result.invocation_request_sha256, 'worker invocation request hash mismatch');
+  invariant(Number.isInteger(result.input_bytes) && result.input_bytes >= 0 && result.input_bytes <= 1024 * 1024, 'input byte count out of range');
+  invariant(Number.isInteger(result.output_bytes) && result.output_bytes >= 0 && result.output_bytes <= 1024 * 1024, 'output byte count out of range');
+  invariant(proof.input_bytes === result.input_bytes, 'worker/launcher input byte count mismatch');
+  invariant(proof.output_bytes === result.output_bytes, 'worker/launcher output byte count mismatch');
+  invariant(typeof result.output_base64 === 'string', 'missing exported output');
+
+  return {
+    backend: result.backend,
+    mode: result.mode,
+    operation: result.operation,
+    invocation_schema: result.invocation_schema,
+    invocation_challenge: result.invocation_challenge,
+    invocation_request_sha256: result.invocation_request_sha256,
+    worker_registry: result.worker_registry,
+    worker_id: result.worker_id,
+    worker_executable: result.worker_executable,
+    worker_manifest: result.worker_manifest,
+    worker_manifest_sha256: result.worker_manifest_sha256,
+    worker_manifest_verified: result.worker_manifest_verified,
+    worker_source_sha256: result.worker_source_sha256,
+    appcontainer_sid: result.appcontainer_sid,
+    network_capabilities: result.network_capabilities,
+    network_policy: result.network_policy,
+    network_probe_schema: result.network_probe_schema,
+    network_probe_target: result.network_probe_target,
+    network_probe_port: result.network_probe_port,
+    network_probe_host_control_ok: result.network_probe_host_control_ok,
+    active_network_denial_ok: proof.active_network_denial_ok,
+    job_assignment: result.job_assignment,
+    job_breakaway_enabled: result.job_breakaway_enabled,
+    active_process_limit: result.active_process_limit,
+    process_memory_limit_bytes: result.process_memory_limit_bytes,
+    child_control: result.child_control,
+    import_transport: result.import_transport,
+    export_transport: result.export_transport,
+    workspace_mounted: result.workspace_mounted,
+    worker_environment: result.worker_environment,
+    worker_localappdata_present: result.worker_localappdata_present,
+    worker_environment_allowlist_exact: result.worker_environment_allowlist_exact,
+    worker_drive_current_directory_set: result.worker_drive_current_directory_set,
+    input_bytes: result.input_bytes,
+    output_bytes: result.output_bytes,
+    profile_cleanup_ok: result.profile_cleanup_ok,
+    proof: {
+      token_is_appcontainer: proof.token_is_appcontainer,
+      capability_count: proof.capability_count,
+      aap_mode_evidence_ok: proof.aap_mode_evidence_ok,
+      outside_read_denied: proof.outside_read_denied,
+      inside_write_ok: proof.inside_write_ok,
+      in_job: proof.in_job,
+      normal_child_execution_denied: proof.normal_child_execution_denied,
+      breakaway_child_execution_denied: proof.breakaway_child_execution_denied,
+      network_probe_schema: proof.network_probe_schema,
+      network_probe_attempted: proof.network_probe_attempted,
+      network_probe_target: proof.network_probe_target,
+      network_probe_port: proof.network_probe_port,
+      network_connect_succeeded: proof.network_connect_succeeded,
+      network_connect_error: proof.network_connect_error,
+      network_connect_timed_out: proof.network_connect_timed_out,
+      active_network_denial_ok: proof.active_network_denial_ok,
+      transform_ok: proof.transform_ok,
+      invocation_schema: proof.invocation_schema,
+      invocation_challenge: proof.invocation_challenge,
+      invocation_request_sha256: proof.invocation_request_sha256
+    }
+  };
+}

package/src/contained-smoke.mjs

@@ -0,0 +1,101 @@
+import { copyFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { executeContainedTransform } from './contained-executor.mjs';
+import { generateTrustKeypair } from './trust.mjs';
+import { verifyReceipt } from './verifier.mjs';
+
+const repoRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const workspaceRoot = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-contained-smoke-workspace-'));
+const workspace = path.join(workspaceRoot, 'demo');
+try {
+  await mkdir(workspace, { recursive: true });
+  await copyFile(path.join(repoRoot, 'workspaces', 'demo', 'input.txt'), path.join(workspace, 'input.txt'));
+} catch (error) {
+  await rm(workspaceRoot, { recursive: true, force: true }).catch(() => {});
+  throw error;
+}
+const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v060-contained-trust-'));
+const keys = await generateTrustKeypair({
+  privateKeyPath: path.join(trust, 'private.pem'),
+  publicKeyPath: path.join(trust, 'public.pem')
+});
+const cases = [
+  ['uppercase_ascii', '3e740f6fcf2c6659bc5f99e0706b09f3c127407bbabe74d05285d2e3276946c2'],
+  ['lowercase_ascii', '8f3be3d122218dc1663c2fd4ea72e6634a7bd624b3ce18f178312cbe78aae78c'],
+  ['reverse_bytes', 'dbba1e2133ea799e500f5b3056734e6db3712e63b277835999c9cd6c5cf5d520']
+];
+
+try {
+  const results = [];
+  const invocationChallenges = new Set();
+  for (const [operation, expectedOutputSha256] of cases) {
+    const output = `contained-smoke.${operation}.${randomBytes(8).toString('hex')}.txt`;
+    const result = await executeContainedTransform({
+      workspacePath: workspace,
+      input: 'input.txt',
+      output,
+      operation,
+      signingKeyPath: keys.privateKeyPath
+    });
+    if (result.receipt.output.sha256 !== expectedOutputSha256) {
+      throw new Error(`${operation} output hash mismatch: ${result.receipt.output.sha256}`);
+    }
+    const checked = await verifyReceipt({
+      workspacePath: workspace,
+      receiptPath: result.receiptRelativePath,
+      verifyKeyPath: keys.publicKeyPath
+    });
+    if (!checked.ok || checked.containment_verified !== true || checked.active_network_denial_verified !== true) {
+      throw new Error(`${operation} independent verification failed: ${JSON.stringify(checked)}`);
+    }
+    if (result.execution.network_policy !== 'zero-capabilities-plus-active-loopback-denial' ||
+        result.execution.network_probe_host_control_ok !== true ||
+        result.execution.active_network_denial_ok !== true ||
+        result.execution.proof?.network_connect_succeeded !== false ||
+        !(result.execution.proof?.network_connect_error > 0)) {
+      throw new Error(`${operation} active network-denial evidence missing: ${JSON.stringify(result.execution)}`);
+    }
+    if (result.execution.invocation_schema !== 'deadbyte.invocation.v1' ||
+        !/^[0-9a-f]{64}$/.test(result.execution.invocation_challenge) ||
+        !/^[0-9a-f]{64}$/.test(result.execution.invocation_request_sha256)) {
+      throw new Error(`${operation} invocation evidence missing`);
+    }
+    if (invocationChallenges.has(result.execution.invocation_challenge)) throw new Error('invocation challenge replay/collision observed');
+    invocationChallenges.add(result.execution.invocation_challenge);
+    results.push({
+      operation, output, receipt_path: result.receiptRelativePath,
+      receipt_sha256: result.receipt.receipt_sha256, worker_id: result.receipt.worker.id,
+      worker_sha256: result.receipt.worker.sha256, output_sha256: result.receipt.output.sha256,
+      containment: result.execution, independent_verify: true
+    });
+  }
+  const firstUpper = results.find(item => item.operation === 'uppercase_ascii');
+  const replayOutput = `contained-smoke.replay-probe.${randomBytes(8).toString('hex')}.txt`;
+  const replay = await executeContainedTransform({
+    workspacePath: workspace, input: 'input.txt', output: replayOutput,
+    operation: 'uppercase_ascii', signingKeyPath: keys.privateKeyPath
+  });
+  const replayChecked = await verifyReceipt({ workspacePath: workspace, receiptPath: replay.receiptRelativePath, verifyKeyPath: keys.publicKeyPath });
+  if (!replayChecked.ok || replayChecked.containment_verified !== true || replayChecked.active_network_denial_verified !== true) throw new Error('same-operation replay probe verification failed');
+  if (replay.receipt.output.sha256 !== cases[0][1]) throw new Error('same-operation replay probe output hash mismatch');
+  if (replay.execution.invocation_challenge === firstUpper?.containment?.invocation_challenge) throw new Error('same-operation invocation challenge was reused');
+  if (replay.execution.invocation_request_sha256 === firstUpper?.containment?.invocation_request_sha256) throw new Error('same-operation invocation request digest was reused');
+
+  console.log(JSON.stringify({ status: 'passed', operations: results, replay_probe: {
+    operation: 'uppercase_ascii', same_input: true, same_output_sha256: true,
+    first_challenge: firstUpper?.containment?.invocation_challenge,
+    second_challenge: replay.execution.invocation_challenge,
+    first_request_sha256: firstUpper?.containment?.invocation_request_sha256,
+    second_request_sha256: replay.execution.invocation_request_sha256,
+    distinct_challenge: true, distinct_request_sha256: true, independent_verify: true
+  } }, null, 2));
+} catch (error) {
+  console.error(error instanceof Error ? error.stack : String(error));
+  process.exitCode = 1;
+} finally {
+  await rm(trust, { recursive: true, force: true }).catch(() => {});
+  await rm(workspaceRoot, { recursive: true, force: true }).catch(() => {});
+}

package/src/containment-bootstrap.mjs

@@ -0,0 +1,94 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+if (process.platform !== 'win32') {
+  throw new Error('containment:bootstrap requires Windows 10 or newer');
+}
+
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const launcher = path.join(root, 'bin', 'deadbyte-contain.exe');
+const probes = [
+  ['kernel32_only', path.join(root, 'bin', 'bootstrap-kernel32.exe')],
+  ['advapi32', path.join(root, 'bin', 'bootstrap-advapi32.exe')]
+];
+const modes = ['appcontainer', 'lpac'];
+
+function run(mode, probe) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(launcher, ['--mode', mode, probe], {
+      cwd: root,
+      shell: false,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on('data', c => stdout.push(c));
+    child.stderr.on('data', c => stderr.push(c));
+    child.on('error', reject);
+    child.on('close', code => resolve({
+      code,
+      stdout: Buffer.concat(stdout).toString('utf8').trim(),
+      stderr: Buffer.concat(stderr).toString('utf8').trim()
+    }));
+  });
+}
+
+function summarize(execution) {
+  let parsed = null;
+  if (execution.stdout.startsWith('{')) {
+    try { parsed = JSON.parse(execution.stdout); } catch { parsed = null; }
+  }
+  return {
+    launcher_exit: execution.code,
+    child_exit: parsed?.child_exit_code ?? null,
+    reached_entrypoint: parsed?.probe?.bootstrap_reached === true,
+    probe: parsed?.probe ?? null,
+    stderr: execution.stderr || null
+  };
+}
+
+const results = {};
+for (const mode of modes) {
+  results[mode] = {};
+  for (const [name, probe] of probes) {
+    results[mode][name] = summarize(await run(mode, probe));
+  }
+}
+
+const acKernel = results.appcontainer.kernel32_only.reached_entrypoint;
+const lpacKernel = results.lpac.kernel32_only.reached_entrypoint;
+const acAdvapi = results.appcontainer.advapi32.reached_entrypoint;
+const lpacAdvapi = results.lpac.advapi32.reached_entrypoint;
+
+let diagnosis;
+if (!acKernel && !lpacKernel) {
+  diagnosis = 'common-appcontainer-bootstrap-failed';
+} else if (acKernel && !lpacKernel) {
+  diagnosis = 'lpac-aap-optout-bootstrap-boundary';
+} else if (acKernel && lpacKernel && !acAdvapi && !lpacAdvapi) {
+  diagnosis = 'common-advapi32-bootstrap-failed';
+} else if (acAdvapi && !lpacAdvapi) {
+  diagnosis = 'lpac-advapi32-bootstrap-boundary';
+} else if (acKernel && acAdvapi) {
+  diagnosis = lpacKernel && lpacAdvapi
+    ? 'both-bootstrap-paths-pass-full-probes-next'
+    : 'regular-appcontainer-bootstrap-passes-lpac-does-not';
+} else {
+  diagnosis = 'mixed-bootstrap-result-review-required';
+}
+
+const out = {
+  status: 'diagnostic-complete',
+  variable_under_test: 'PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT',
+  capabilities_per_mode: 0,
+  diagnosis,
+  results
+};
+console.log(JSON.stringify(out, null, 2));
+
+// This command is a diagnostic. A regular AppContainer Kernel32 bootstrap is
+// the minimum useful baseline; LPAC failure is reported as evidence, not hidden
+// by an automatic fallback.
+if (!acKernel) process.exitCode = 2;