deadbyte-mcp 0.8.7

package/test/contained.test.mjs

@@ -0,0 +1,931 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { writeReceipt } from '../src/receipt.mjs';
+import { verifyReceipt } from '../src/verifier.mjs';
+import { generateTrustKeypair, loadPrivateSigningKey, signReceiptBytes } from '../src/trust.mjs';
+import { sha256Bytes, sha256File } from '../src/hash.mjs';
+import { validateContainedExecutionResult } from '../src/contained-result.mjs';
+import { loadVerifiedWorkerRegistry } from '../src/worker-registry.mjs';
+import { invocationRequestSha256, INVOCATION_SCHEMA } from '../src/invocation.mjs';
+import { createRequestIdentity } from '../src/request-identity.mjs';
+import { operationPolicy } from '../src/operation-policy.mjs';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { relativeFromRoot } from '../src/path-policy.mjs';
+
+
+async function writeLegacyReceiptV1(args) {
+  const { rootReal, operation, inputSourcePath, inputBytes, outputPath, workerPath,
+    workerId = 'proof-worker-v1', exitCode, stdout, stderr, execution, signingKey } = args;
+  const evidenceDir = path.join(rootReal, 'evidence');
+  await mkdir(evidenceDir, { recursive: true });
+  const id = randomBytes(12).toString('hex');
+  const inputSnapshotRel = `evidence/${id}.input`;
+  const stdoutRel = `evidence/${id}.stdout`;
+  const stderrRel = `evidence/${id}.stderr`;
+  const receiptRel = `evidence/${id}.json`;
+  await writeFile(path.join(rootReal, inputSnapshotRel), inputBytes, { flag: 'wx' });
+  await writeFile(path.join(rootReal, stdoutRel), stdout, { flag: 'wx' });
+  await writeFile(path.join(rootReal, stderrRel), stderr, { flag: 'wx' });
+  const body = {
+    schema: 'deadbyte.receipt.v1', receipt_id: id, operation, exit_code: exitCode,
+    input: { source_path: relativeFromRoot(rootReal, inputSourcePath), snapshot_path: inputSnapshotRel, sha256: sha256Bytes(inputBytes) },
+    output: { path: relativeFromRoot(rootReal, outputPath), sha256: await sha256File(outputPath) },
+    worker: { id: workerId, sha256: await sha256File(workerPath) },
+    stdout: { path: stdoutRel, sha256: sha256Bytes(stdout) },
+    stderr: { path: stderrRel, sha256: sha256Bytes(stderr) },
+    ...(execution === undefined ? {} : { execution })
+  };
+  const receiptSha256 = sha256Bytes(Buffer.from(canonicalJson(body), 'utf8'));
+  const signedBody = { ...body, receipt_sha256: receiptSha256 };
+  const receipt = { ...signedBody, attestation: { algorithm: 'ed25519', key_id: signingKey.keyId,
+    signature_base64: signReceiptBytes(signingKey.privateKey, Buffer.from(canonicalJson(signedBody), 'utf8')).toString('base64') } };
+  const text = `${canonicalJson(receipt)}\n`;
+  await writeFile(path.join(rootReal, receiptRel), text, { flag: 'wx' });
+  return { receipt, receiptPath: path.join(rootReal, receiptRel), receiptRelativePath: receiptRel };
+}
+
+async function writeTestReceipt(args) {
+  if (args.operation === 'contained_transform' && args.execution?.invocation_schema === undefined) {
+    return writeLegacyReceiptV1(args);
+  }
+  let execution = args.execution;
+  if (args.operation === 'contained_transform') {
+    const policy = operationPolicy(execution.operation);
+    execution = {
+      ...execution,
+      operation_policy: {
+        max_input_bytes: policy.maxInputBytes,
+        max_output_bytes: policy.maxOutputBytes,
+        launcher_timeout_ms: policy.launcherTimeoutMs
+      },
+      pre_export_semantic_verified: true
+    };
+  }
+  const workerSha256 = await sha256File(args.workerPath);
+  const completeInvocation = execution?.invocation_schema && execution?.invocation_challenge && execution?.invocation_request_sha256;
+  const request = createRequestIdentity({
+    operation: args.operation,
+    inputSha256: sha256Bytes(args.inputBytes),
+    workerId: args.workerId ?? 'proof-worker-v1',
+    workerSha256,
+    ...(completeInvocation ? { containedInvocation: {
+      schema: execution.invocation_schema,
+      challenge: execution.invocation_challenge,
+      requestSha256: execution.invocation_request_sha256
+    } } : {})
+  });
+  return writeReceipt({ ...args, execution, request });
+}
+
+function valid() {
+  return {
+    status: 'passed',
+    backend: 'windows-appcontainer',
+    mode: 'appcontainer',
+    operation: 'uppercase_ascii',
+    invocation_schema: 'deadbyte.invocation.v1',
+    invocation_challenge: '1111111111111111111111111111111111111111111111111111111111111111',
+    invocation_request_sha256: '2222222222222222222222222222222222222222222222222222222222222222',
+    worker_registry: 'compile-time-operation-to-executable',
+    worker_id: 'contained-transform-v1',
+    worker_executable: 'contained-transform-worker.exe',
+    worker_manifest: 'WORKER-REGISTRY.txt',
+    worker_manifest_sha256: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    worker_manifest_verified: true,
+    worker_source_sha256: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+    appcontainer_sid: 'S-1-15-2-test',
+    network_capabilities: 0,
+    network_policy: 'zero-capabilities-plus-active-loopback-denial',
+    network_probe_schema: 'deadbyte.network.loopback.v1',
+    network_probe_target: '127.0.0.1',
+    network_probe_port: 49152,
+    network_probe_host_control_ok: true,
+    active_network_denial_ok: true,
+    job_assignment: 'atomic-attribute',
+    job_breakaway_enabled: false,
+    active_process_limit: 1,
+    process_memory_limit_bytes: 134217728,
+    child_control: 'job-active-process-limit',
+    child_process_policy: 'not-used',
+    import_transport: 'host-stdin-to-profile-copy',
+    export_transport: 'profile-copy-to-host-json',
+    workspace_mounted: false,
+    worker_environment: 'appcontainer-bootstrap-allowlist-plus-drive-cwd',
+    worker_localappdata_present: true,
+    worker_environment_allowlist_exact: true,
+    worker_drive_current_directory_set: true,
+    timed_out: false,
+    child_exit_code: 0,
+    profile_cleanup_ok: true,
+    input_bytes: 12,
+    output_bytes: 12,
+    output_base64: 'SEVMTE8gV09STEQK',
+    proof: {
+      status: 'passed',
+      token_appcontainer_query_ok: true,
+      token_is_appcontainer: true,
+      capability_query_ok: true,
+      capability_count: 0,
+      aap_canary_readable: true,
+      aap_mode_evidence_ok: true,
+      outside_read_denied: true,
+      inside_write_ok: true,
+      in_job: true,
+      normal_child_execution_denied: true,
+      breakaway_child_execution_denied: true,
+      network_probe_schema: 'deadbyte.network.loopback.v1',
+      network_probe_attempted: true,
+      network_probe_target: '127.0.0.1',
+      network_probe_port: 49152,
+      network_connect_succeeded: false,
+      network_connect_error: 10013,
+      network_connect_timed_out: false,
+      active_network_denial_ok: true,
+      input_read_ok: true,
+      transform_ok: true,
+      output_write_ok: true,
+      input_bytes: 12,
+      output_bytes: 12,
+      operation: 'uppercase_ascii',
+      invocation_schema: 'deadbyte.invocation.v1',
+      invocation_challenge: '1111111111111111111111111111111111111111111111111111111111111111',
+      invocation_request_sha256: '2222222222222222222222222222222222222222222222222222222222222222'
+    }
+  };
+}
+
+function bindInvocation(raw, { inputBytes, manifestSha256, workerSourceSha256, challenge = '11'.repeat(32) }) {
+  raw.invocation_schema = INVOCATION_SCHEMA;
+  raw.invocation_challenge = challenge;
+  raw.proof.invocation_schema = INVOCATION_SCHEMA;
+  raw.proof.invocation_challenge = challenge;
+  raw.invocation_request_sha256 = invocationRequestSha256({
+    challenge, operation: raw.operation, inputSha256: sha256Bytes(inputBytes),
+    workerManifestSha256: manifestSha256, workerId: raw.worker_id, workerSourceSha256
+  });
+  raw.proof.invocation_request_sha256 = raw.invocation_request_sha256;
+  return raw;
+}
+
+async function writeRuntimeRegistry(runtime) {
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  const transformWorkerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  const launcherSha = await sha256File(launcherPath);
+  const transformSha = await sha256File(transformWorkerPath);
+  const reverseSha = await sha256File(reverseWorkerPath);
+  const text = [
+    'schema=deadbyte.worker-registry.v1',
+    'version=0.6.0',
+    'policy=compile-time-operation-to-executable',
+    'launcher.executable=deadbyte-exec.exe',
+    `launcher.sha256=${launcherSha}`,
+    'operation.lowercase_ascii=contained-transform-v1',
+    'operation.reverse_bytes=contained-reverse-v1',
+    'operation.uppercase_ascii=contained-transform-v1',
+    'worker.contained-reverse-v1.executable=contained-reverse-worker.exe',
+    `worker.contained-reverse-v1.sha256=${reverseSha}`,
+    'worker.contained-transform-v1.executable=contained-transform-worker.exe',
+    `worker.contained-transform-v1.sha256=${transformSha}`
+  ].join('\n') + '\n';
+  const manifestPath = path.join(runtime, 'WORKER-REGISTRY.txt');
+  await writeFile(manifestPath, text);
+  return {
+    manifestPath, manifestSha256: sha256Bytes(Buffer.from(text, 'utf8')),
+    launcherPath, transformWorkerPath, reverseWorkerPath,
+    transformSha, reverseSha
+  };
+}
+
+
+test('contained launcher treats anonymous-pipe ERROR_BROKEN_PIPE as normal stdin EOF', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /if \(error == ERROR_BROKEN_PIPE\) break;/);
+  assert.match(source, /throw WinError\("ReadFile\(stdin\)", error\)/);
+});
+
+test('contained executor rejects a launcher-reported truncated stdin import', async () => {
+  const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  assert.match(executor, /rawResult\.input_bytes !== inputBytes\.length/);
+  assert.match(executor, /contained input byte count mismatch/);
+});
+
+
+test('contained invocation request digest binds challenge input operation manifest and worker identity', () => {
+  const digestA = invocationRequestSha256({
+    challenge: '11'.repeat(32), operation: 'uppercase_ascii', inputSha256: 'aa'.repeat(32),
+    workerManifestSha256: 'bb'.repeat(32), workerId: 'contained-transform-v1', workerSourceSha256: 'cc'.repeat(32)
+  });
+  const digestB = invocationRequestSha256({
+    challenge: '12'.repeat(32), operation: 'uppercase_ascii', inputSha256: 'aa'.repeat(32),
+    workerManifestSha256: 'bb'.repeat(32), workerId: 'contained-transform-v1', workerSourceSha256: 'cc'.repeat(32)
+  });
+  assert.equal(digestA, '2ac6df58e73603634b4ba611053708a7b58958ccd9e3f6716365f0411cc4ae72');
+  assert.notEqual(digestA, digestB);
+  assert.equal(INVOCATION_SCHEMA, 'deadbyte.invocation.v1');
+});
+
+test('contained result rejects stale invocation challenge or request digest', () => {
+  const r = valid();
+  assert.throws(() => validateContainedExecutionResult(r, 'uppercase_ascii', { challenge: '33'.repeat(32), requestSha256: r.invocation_request_sha256 }), /invocation challenge mismatch/);
+  assert.throws(() => validateContainedExecutionResult(r, 'uppercase_ascii', { challenge: r.invocation_challenge, requestSha256: '44'.repeat(32) }), /invocation request hash mismatch/);
+});
+
+test('native launcher independently recomputes invocation digest before worker launch and workers echo it', async () => {
+  const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  const transform = await readFile(fileURLToPath(new URL('../native/contained-transform-worker.cpp', import.meta.url)), 'utf8');
+  const reverse = await readFile(fileURLToPath(new URL('../native/contained-reverse-worker.cpp', import.meta.url)), 'utf8');
+  assert.match(launcher, /InvocationRequestSha256/);
+  assert.match(launcher, /invocation request digest mismatch before worker launch/);
+  assert.match(launcher, /--challenge/);
+  assert.match(launcher, /--request-digest/);
+  for (const worker of [transform, reverse]) {
+    assert.match(worker, /deadbyte\.invocation\.v1/);
+    assert.match(worker, /invocationChallenge/);
+    assert.match(worker, /invocationRequestSha256/);
+  }
+});
+
+test('contained executor cross-checks native manifest and selected-worker hashes before signing receipt', async () => {
+  const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  assert.match(executor, /execution\.worker_manifest_sha256 !== verifiedRegistry\.manifestSha256/);
+  assert.match(executor, /execution\.worker_source_sha256 !== worker\.workerSha256/);
+  assert.match(executor, /independently verified manifest/);
+  assert.match(executor, /independently verified binary/);
+});
+
+test('trusted contained host launcher inherits Windows host environment instead of a lossy hand-picked subset', async () => {
+  const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  assert.doesNotMatch(executor, /minimalEnvironment/);
+  assert.doesNotMatch(executor, /env:\s*\{/);
+  assert.doesNotMatch(executor, /env:\s*minimalEnvironment/);
+});
+
+test('AppContainer worker receives only the fixed bootstrap allowlist plus drive current-directory state', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /GetEnvironmentStringsW\(\)/);
+  for (const name of ['Path', 'SystemDrive', 'SystemRoot', 'TEMP', 'TMP', 'LOCALAPPDATA']) {
+    assert.match(source, new RegExp(`L\"${name}\"`));
+  }
+  assert.match(source, /bootstrap environment missing LOCALAPPDATA/);
+  assert.match(source, /drivePrefix = std::wstring\(L"="\) \+ driveLetter \+ L":="/);
+  assert.match(source, /environmentEntries\.push_back\(drivePrefix \+ runDirText\)/);
+  assert.match(source, /std::sort\(environmentEntries/);
+  assert.match(source, /CreateProcessW\(workerCopy\.c_str\(\), mutableCommand\.data\(\)/);
+  assert.match(source, /creationFlags, workerEnvironment\.data\(\), runDir\.c_str\(\)/);
+  assert.doesNotMatch(source, /CreateEnvironmentBlock\(&rawWorkerEnvironment, nullptr, FALSE\)/);
+});
+
+test('contained launcher reports the exact bootstrap environment policy in runtime evidence', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  assert.ok(source.includes('\\"worker_environment\\":\\"appcontainer-bootstrap-allowlist-plus-drive-cwd'));
+  assert.ok(source.includes('\\"worker_localappdata_present\\":true'));
+  assert.ok(source.includes('\\"worker_environment_allowlist_exact\\":true'));
+});
+
+test('contained execution validator rejects a missing LOCALAPPDATA bootstrap marker', () => {
+  const r = valid();
+  r.worker_localappdata_present = false;
+  assert.throws(() => validateContainedExecutionResult(r), /missing LOCALAPPDATA/);
+});
+
+test('contained execution validator rejects a non-exact worker environment allowlist', () => {
+  const r = valid();
+  r.worker_environment_allowlist_exact = false;
+  assert.throws(() => validateContainedExecutionResult(r), /allowlist was not exact/);
+});
+
+test('contained execution validator rejects a missing drive-current-directory environment entry', () => {
+  const r = valid();
+  r.worker_drive_current_directory_set = false;
+  assert.throws(() => validateContainedExecutionResult(r), /drive current-directory entry missing/);
+});
+test('contained execution validator accepts the complete fixed-transform invariant set', () => {
+  const result = validateContainedExecutionResult(valid());
+  assert.equal(result.job_assignment, 'atomic-attribute');
+  assert.equal(result.workspace_mounted, false);
+  assert.equal(result.proof.transform_ok, true);
+});
+
+test('contained execution validator rejects any granted capability', () => {
+  const r = valid();
+  r.network_capabilities = 1;
+  assert.throws(() => validateContainedExecutionResult(r), /capabilities were granted/);
+});
+
+test('contained execution validator rejects host workspace mounting', () => {
+  const r = valid();
+  r.workspace_mounted = true;
+  assert.throws(() => validateContainedExecutionResult(r), /workspace was mounted/);
+});
+
+test('contained execution validator rejects non-atomic Job assignment', () => {
+  const r = valid();
+  r.job_assignment = 'post-create';
+  assert.throws(() => validateContainedExecutionResult(r), /Job assignment is not atomic/);
+});
+
+test('contained execution validator rejects normal child payload execution', () => {
+  const r = valid();
+  r.proof.normal_child_execution_denied = false;
+  assert.throws(() => validateContainedExecutionResult(r), /normal child payload executed/);
+});
+
+test('contained execution validator rejects explicit breakaway payload execution', () => {
+  const r = valid();
+  r.proof.breakaway_child_execution_denied = false;
+  assert.throws(() => validateContainedExecutionResult(r), /breakaway child payload executed/);
+});
+
+test('contained execution validator rejects a non-AppContainer worker', () => {
+  const r = valid();
+  r.proof.token_is_appcontainer = false;
+  assert.throws(() => validateContainedExecutionResult(r), /worker token is not AppContainer/);
+});
+
+test('contained execution source has a compile-time worker registry and no user executable parameter', async () => {
+  const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  const registry = await readFile(fileURLToPath(new URL('../src/worker-registry.mjs', import.meta.url)), 'utf8');
+  const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  assert.match(registry, /contained-transform-worker\.exe/);
+  assert.match(registry, /contained-reverse-worker\.exe/);
+  assert.match(registry, /CONTAINED_EXECUTION_REGISTRY/);
+  assert.match(registry, /CONTAINED_TRANSFORM_OPERATIONS/);
+  assert.match(registry, /uppercase_ascii/);
+  assert.match(registry, /lowercase_ascii/);
+  assert.match(registry, /reverse_bytes/);
+  assert.match(executor, /loadVerifiedWorkerRegistry/);
+  assert.match(server, /'contained_transform'/);
+  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.doesNotMatch(server, /executable:\s*z\./);
+  assert.doesNotMatch(executor, /--worker/);
+  assert.doesNotMatch(server, /command_run|shell_execute|powershell_run/);
+});
+
+test('contained launcher imports by stdin/profile copy and never mounts a host workspace', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /ReadStdinBounded/);
+  assert.match(source, /WriteBytesNew\(inputPath/);
+  assert.match(source, /PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES/);
+  assert.match(source, /PROC_THREAD_ATTRIBUTE_JOB_LIST/);
+  assert.match(source, /CapabilityCount = 0/);
+  assert.match(source, /JOB_OBJECT_LIMIT_ACTIVE_PROCESS/);
+  assert.match(source, /workspace_mounted\\\":false/);
+  assert.doesNotMatch(source, /PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY/);
+  assert.doesNotMatch(source, /PROCESS_CREATION_CHILD_PROCESS_RESTRICTED/);
+});
+
+test('contained workers recheck AppContainer, zero capabilities, canaries, Job and child denial', async () => {
+  const transformSource = await readFile(fileURLToPath(new URL('../native/contained-transform-worker.cpp', import.meta.url)), 'utf8');
+  const reverseSource = await readFile(fileURLToPath(new URL('../native/contained-reverse-worker.cpp', import.meta.url)), 'utf8');
+  for (const source of [transformSource, reverseSource]) for (const token of [
+    'TokenIsAppContainer',
+    'TokenCapabilities',
+    'aapCanary',
+    'outsideDenied',
+    'IsProcessInJob',
+    'CREATE_BREAKAWAY_FROM_JOB',
+    'normalDenied',
+    'breakawayDenied',
+  ]) assert.match(source, new RegExp(token));
+  assert.match(transformSource, /TransformAscii/);
+  assert.match(reverseSource, /TransformBytes/);
+  assert.match(reverseSource, /std::reverse/);
+});
+
+test('native build produces the contained launcher and worker with static runtime', async () => {
+  const build = await readFile(fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url)), 'utf8');
+  assert.match(build, /contained-launcher/);
+  assert.match(build, /contained-worker/);
+  assert.match(build, /deadbyte-exec\.exe/);
+  assert.match(build, /contained-transform-worker\.exe/);
+  assert.match(build, /contained-reverse-worker\.exe/);
+  assert.match(build, /\$ContainedLauncherCommand = 'cl \{0\} \/MT/);
+  assert.match(build, /\$ContainedWorkerCommand = 'cl \{0\} \/MT/);
+  assert.match(build, /\$ContainedReverseWorkerCommand = 'cl \{0\} \/MT/);
+  assert.match(build, /Assert-NoDynamicRuntime -Name 'contained-launcher'/);
+  assert.match(build, /Assert-NoDynamicRuntime -Name 'contained-worker'/);
+  assert.match(build, /Assert-NoDynamicRuntime -Name 'contained-reverse-worker'/);
+});
+
+test('native build emits a deterministic worker registry manifest and launcher verifies it before execution', async () => {
+  const build = await readFile(fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url)), 'utf8');
+  const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  assert.match(build, /WORKER-REGISTRY\.txt/);
+  assert.match(build, /schema=deadbyte\.worker-registry\.v1/);
+  assert.match(build, /worker_registry_manifest_sha256/);
+  assert.match(build, /bcrypt\.lib/);
+  assert.match(launcher, /VerifyWorkerRegistryManifest/);
+  assert.match(launcher, /BCryptHashData/);
+  assert.match(launcher, /copied worker hash does not match verified worker registry manifest/);
+  assert.match(launcher, /worker_manifest_sha256/);
+});
+
+test('V0.7 contained execution has compile-time budgets and a pre-export semantic gate', async () => {
+  const policy = await readFile(fileURLToPath(new URL('../src/operation-policy.mjs', import.meta.url)), 'utf8');
+  const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  assert.match(policy, /maxInputBytes: 1024 \* 1024/);
+  assert.match(policy, /maxOutputBytes: 1024 \* 1024/);
+  assert.match(policy, /launcherTimeoutMs: 15000/);
+  assert.match(executor, /verifyPreExportSemantics/);
+  assert.match(executor, /contained pre-export semantic verification failed/);
+  assert.match(executor, /pre_export_semantic_verified: true/);
+  assert.match(executor, /operation_policy/);
+});
+
+test('receipt and verifier bind contained worker, launcher and independent transform semantics', async () => {
+  const receipt = await readFile(fileURLToPath(new URL('../src/receipt.mjs', import.meta.url)), 'utf8');
+  const verifier = await readFile(fileURLToPath(new URL('../src/verifier.mjs', import.meta.url)), 'utf8');
+  assert.match(receipt, /workerId/);
+  assert.match(receipt, /execution/);
+  assert.match(verifier, /contained-transform-v1/);
+  assert.match(verifier, /contained-reverse-v1/);
+  assert.match(verifier, /reverse_bytes/);
+  assert.match(verifier, /launcher hash mismatch/);
+  assert.match(verifier, /transformAscii/);
+  assert.match(verifier, /lowercase_ascii/);
+  assert.match(verifier, /contained transform semantic mismatch/);
+});
+
+test('MCP protocol smoke accepts only the base or base-plus-host catalog and excludes agent tools', async () => {
+  const smoke = await readFile(fileURLToPath(new URL('../src/mcp-smoke-client.mjs', import.meta.url)), 'utf8');
+  for (const name of ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open']) assert.match(smoke, new RegExp(name));
+  for (const name of ['host_exec', 'host_file_read', 'host_file_write']) assert.match(smoke, new RegExp(name));
+  assert.match(smoke, /allowedCatalogs/);
+  assert.match(smoke, /baseTools/);
+  assert.match(smoke, /privilegedTools/);
+  assert.doesNotMatch(smoke, /agent_task_/);
+});
+
+
+test('contained receipt verifies fixed runtime hashes and independently recomputed transform semantics', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v04-contained-receipt-'));
+  const runtime = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v04-runtime-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v04-trust-'));
+  const inputPath = path.join(root, 'input.txt');
+  const outputPath = path.join(root, 'output.txt');
+  const workerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  await writeFile(inputPath, 'hello world\n');
+  await writeFile(outputPath, 'HELLO WORLD\n');
+  await writeFile(workerPath, 'FAKE-CONTAINED-WORKER\n');
+  await writeFile(reverseWorkerPath, 'FAKE-REVERSE-WORKER\n');
+  await writeFile(launcherPath, 'FAKE-CONTAINED-LAUNCHER\n');
+  const registry = await writeRuntimeRegistry(runtime);
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  const signingKey = await loadPrivateSigningKey(keys.privateKeyPath);
+  const inputBytes = Buffer.from('hello world\n');
+  const raw = valid();
+  raw.worker_manifest_sha256 = registry.manifestSha256;
+  raw.worker_source_sha256 = registry.transformSha;
+  bindInvocation(raw, { inputBytes, manifestSha256: registry.manifestSha256, workerSourceSha256: registry.transformSha, challenge: '21'.repeat(32) });
+  const execution = validateContainedExecutionResult(raw);
+  execution.launcher_sha256 = await sha256File(launcherPath);
+  execution.output_sha256 = sha256Bytes(Buffer.from('HELLO WORLD\n'));
+
+  const receipt = await writeTestReceipt({
+    rootReal: root,
+    operation: 'contained_transform',
+    inputSourcePath: inputPath,
+    inputBytes,
+    outputPath,
+    workerPath,
+    workerId: 'contained-transform-v1',
+    exitCode: 0,
+    stdout: Buffer.from('{"status":"passed"}\n'),
+    stderr: Buffer.alloc(0),
+    execution,
+    signingKey
+  });
+
+  const checked = await verifyReceipt({
+    workspacePath: root,
+    receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath,
+    _runtimePaths: {
+      proofWorkerPath: workerPath,
+      containedTransformWorkerPath: workerPath,
+      containedReverseWorkerPath: reverseWorkerPath,
+      containedLauncherPath: launcherPath
+    }
+  });
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+  assert.equal(checked.containment_verified, true);
+
+  await writeFile(outputPath, 'HELLO world\n');
+  const tampered = await verifyReceipt({
+    workspacePath: root,
+    receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath,
+    _runtimePaths: {
+      proofWorkerPath: workerPath,
+      containedTransformWorkerPath: workerPath,
+      containedReverseWorkerPath: reverseWorkerPath,
+      containedLauncherPath: launcherPath
+    }
+  });
+  assert.deepEqual(tampered, { ok: false, reason: 'contained transform semantic mismatch' });
+});
+
+
+test('independent verifier rejects invocation digest tamper and partial invocation evidence', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v050-invocation-receipt-'));
+  const runtime = path.join(root, 'runtime');
+  await (await import('node:fs/promises')).mkdir(runtime, { recursive: true });
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  const workerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  await writeFile(launcherPath, 'LAUNCHER\n');
+  await writeFile(workerPath, 'WORKER\n');
+  await writeFile(reverseWorkerPath, 'REVERSE\n');
+  const registry = await writeRuntimeRegistry(runtime);
+  const inputPath = path.join(root, 'input.txt');
+  const outputPath = path.join(root, 'output.txt');
+  const inputBytes = Buffer.from('Hello\n');
+  const outputBytes = Buffer.from('HELLO\n');
+  await writeFile(inputPath, inputBytes);
+  await writeFile(outputPath, outputBytes);
+  const keys = await generateTrustKeypair({ privateKeyPath: path.join(root, 'private.pem'), publicKeyPath: path.join(root, 'public.pem') });
+  const signing = await loadPrivateSigningKey(keys.privateKeyPath);
+  const raw = valid();
+  raw.input_bytes = inputBytes.length; raw.output_bytes = outputBytes.length;
+  raw.proof.input_bytes = inputBytes.length; raw.proof.output_bytes = outputBytes.length;
+  raw.worker_manifest_sha256 = registry.manifestSha256; raw.worker_source_sha256 = registry.transformSha;
+  raw.invocation_challenge = 'ab'.repeat(32); raw.proof.invocation_challenge = raw.invocation_challenge;
+  raw.invocation_request_sha256 = invocationRequestSha256({ challenge: raw.invocation_challenge, operation: raw.operation, inputSha256: sha256Bytes(inputBytes), workerManifestSha256: registry.manifestSha256, workerId: raw.worker_id, workerSourceSha256: registry.transformSha });
+  raw.proof.invocation_request_sha256 = raw.invocation_request_sha256;
+  const execution = validateContainedExecutionResult(raw);
+  execution.launcher_sha256 = await sha256File(launcherPath); execution.output_sha256 = sha256Bytes(outputBytes);
+  const receiptResult = await writeTestReceipt({ rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath, inputBytes, outputPath, workerPath, workerId: raw.worker_id, exitCode: 0, stdout: Buffer.from('{}\n'), stderr: Buffer.alloc(0), execution, signingKey: signing });
+  const runtimePaths = { proofWorkerPath: workerPath, containedTransformWorkerPath: workerPath, containedReverseWorkerPath: reverseWorkerPath, containedLauncherPath: launcherPath };
+  const checked = await verifyReceipt({ workspacePath: root, receiptPath: receiptResult.receiptRelativePath, verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths });
+  assert.equal(checked.ok, true);
+
+  const tamperedExecution = { ...execution, invocation_request_sha256: 'ff'.repeat(32), proof: { ...execution.proof, invocation_request_sha256: 'ff'.repeat(32) } };
+  const tamperedReceipt = await writeTestReceipt({ rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath, inputBytes, outputPath, workerPath, workerId: raw.worker_id, exitCode: 0, stdout: Buffer.from('{}\n'), stderr: Buffer.alloc(0), execution: tamperedExecution, signingKey: signing });
+  const bad = await verifyReceipt({ workspacePath: root, receiptPath: tamperedReceipt.receiptRelativePath, verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths });
+  assert.deepEqual(bad, { ok: false, reason: 'invocation request digest mismatch' });
+
+  const partialExecution = { ...execution }; delete partialExecution.invocation_request_sha256;
+  await assert.rejects(
+    () => writeTestReceipt({ rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath, inputBytes, outputPath, workerPath, workerId: raw.worker_id, exitCode: 0, stdout: Buffer.from('{}\n'), stderr: Buffer.alloc(0), execution: partialExecution, signingKey: signing }),
+    /request contained invocation binding mismatch/
+  );
+});
+
+test('independent verifier preserves pre-V0.4.7 contained receipt compatibility but rejects partial manifest evidence', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v047-legacy-receipt-'));
+  const runtime = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v047-legacy-runtime-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v047-legacy-trust-'));
+  const inputPath = path.join(root, 'input.txt');
+  const outputPath = path.join(root, 'output.txt');
+  const workerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  await writeFile(inputPath, 'legacy\n');
+  await writeFile(outputPath, 'LEGACY\n');
+  await writeFile(workerPath, 'LEGACY-TRANSFORM-WORKER\n');
+  await writeFile(reverseWorkerPath, 'LEGACY-REVERSE-WORKER\n');
+  await writeFile(launcherPath, 'LEGACY-LAUNCHER\n');
+  const keys = await generateTrustKeypair({ privateKeyPath: path.join(trust, 'private.pem'), publicKeyPath: path.join(trust, 'public.pem') });
+  const signingKey = await loadPrivateSigningKey(keys.privateKeyPath);
+  const execution = validateContainedExecutionResult(valid());
+  delete execution.worker_manifest;
+  delete execution.worker_manifest_sha256;
+  delete execution.worker_manifest_verified;
+  delete execution.worker_source_sha256;
+  delete execution.invocation_schema;
+  delete execution.invocation_challenge;
+  delete execution.invocation_request_sha256;
+  delete execution.proof.invocation_schema;
+  delete execution.proof.invocation_challenge;
+  delete execution.proof.invocation_request_sha256;
+  for (const field of ['network_policy', 'network_probe_schema', 'network_probe_target', 'network_probe_port', 'network_probe_host_control_ok', 'active_network_denial_ok']) delete execution[field];
+  for (const field of ['network_probe_schema', 'network_probe_attempted', 'network_probe_target', 'network_probe_port', 'network_connect_succeeded', 'network_connect_error', 'network_connect_timed_out', 'active_network_denial_ok']) delete execution.proof[field];
+  execution.launcher_sha256 = await sha256File(launcherPath);
+  execution.output_sha256 = sha256Bytes(Buffer.from('LEGACY\n'));
+  const receipt = await writeTestReceipt({
+    rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath,
+    inputBytes: Buffer.from('legacy\n'), outputPath, workerPath, workerId: 'contained-transform-v1',
+    exitCode: 0, stdout: Buffer.from('{\"status\":\"passed\"}\n'), stderr: Buffer.alloc(0), execution, signingKey
+  });
+  const runtimePaths = { proofWorkerPath: workerPath, containedTransformWorkerPath: workerPath, containedReverseWorkerPath: reverseWorkerPath, containedLauncherPath: launcherPath };
+  const checked = await verifyReceipt({ workspacePath: root, receiptPath: receipt.receiptRelativePath, verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths });
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+  assert.equal(checked.active_network_denial_verified, false);
+
+  const partialExecution = { ...execution, worker_manifest: 'WORKER-REGISTRY.txt' };
+  const partialReceipt = await writeTestReceipt({
+    rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath,
+    inputBytes: Buffer.from('legacy\n'), outputPath, workerPath, workerId: 'contained-transform-v1',
+    exitCode: 0, stdout: Buffer.from('{\"status\":\"passed\"}\n'), stderr: Buffer.alloc(0), execution: partialExecution, signingKey
+  });
+  const partial = await verifyReceipt({ workspacePath: root, receiptPath: partialReceipt.receiptRelativePath, verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths });
+  assert.deepEqual(partial, { ok: false, reason: 'partial worker manifest evidence' });
+
+  const partialNetworkExecution = { ...execution, network_policy: 'zero-capabilities-plus-active-loopback-denial' };
+  const partialNetworkReceipt = await writeTestReceipt({
+    rootReal: root, operation: 'contained_transform', inputSourcePath: inputPath,
+    inputBytes: Buffer.from('legacy\n'), outputPath, workerPath, workerId: 'contained-transform-v1',
+    exitCode: 0, stdout: Buffer.from('{"status":"passed"}\n'), stderr: Buffer.alloc(0), execution: partialNetworkExecution, signingKey
+  });
+  const partialNetwork = await verifyReceipt({ workspacePath: root, receiptPath: partialNetworkReceipt.receiptRelativePath, verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths });
+  assert.deepEqual(partialNetwork, { ok: false, reason: 'partial active network evidence' });
+});
+
+test('contained operation registry accepts lowercase_ascii and rejects unknown operations', () => {
+  const lower = valid();
+  lower.operation = 'lowercase_ascii';
+  lower.proof.operation = 'lowercase_ascii';
+  assert.equal(validateContainedExecutionResult(lower, 'lowercase_ascii').operation, 'lowercase_ascii');
+  assert.throws(() => validateContainedExecutionResult(lower, 'rot13'), /unsupported expected operation/);
+});
+
+test('native launcher uses a compile-time operation-to-executable registry', async () => {
+  const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  const transformWorker = await readFile(fileURLToPath(new URL('../native/contained-transform-worker.cpp', import.meta.url)), 'utf8');
+  const reverseWorker = await readFile(fileURLToPath(new URL('../native/contained-reverse-worker.cpp', import.meta.url)), 'utf8');
+  assert.match(launcher, /ResolveWorkerSpec/);
+  assert.match(launcher, /contained-transform-v1/);
+  assert.match(launcher, /contained-reverse-v1/);
+  assert.match(launcher, /contained-transform-worker\.exe/);
+  assert.match(launcher, /contained-reverse-worker\.exe/);
+  assert.match(transformWorker, /uppercase_ascii/);
+  assert.match(transformWorker, /lowercase_ascii/);
+  assert.match(reverseWorker, /reverse_bytes/);
+});
+
+test('contained execution validator binds operation to fixed worker identity and executable', () => {
+  const wrongId = valid();
+  wrongId.worker_id = 'contained-reverse-v1';
+  assert.throws(() => validateContainedExecutionResult(wrongId), /worker id mismatch/);
+
+  const wrongExe = valid();
+  wrongExe.worker_executable = 'contained-reverse-worker.exe';
+  assert.throws(() => validateContainedExecutionResult(wrongExe), /worker executable mismatch/);
+
+  const reverse = valid();
+  reverse.operation = 'reverse_bytes';
+  reverse.worker_id = 'contained-reverse-v1';
+  reverse.worker_executable = 'contained-reverse-worker.exe';
+  reverse.proof.operation = 'reverse_bytes';
+  assert.equal(validateContainedExecutionResult(reverse, 'reverse_bytes').worker_id, 'contained-reverse-v1');
+});
+
+test('build-generated worker registry manifest binds launcher and both worker hashes and rejects tamper', async () => {
+  const runtime = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v047-registry-'));
+  await writeFile(path.join(runtime, 'deadbyte-exec.exe'), 'LAUNCHER\n');
+  await writeFile(path.join(runtime, 'contained-transform-worker.exe'), 'TRANSFORM\n');
+  await writeFile(path.join(runtime, 'contained-reverse-worker.exe'), 'REVERSE\n');
+  const expected = await writeRuntimeRegistry(runtime);
+  const checked = await loadVerifiedWorkerRegistry({ binDir: runtime });
+  assert.equal(checked.manifestSha256, expected.manifestSha256);
+  assert.equal(checked.workers['contained-transform-v1'].sha256, expected.transformSha);
+  assert.equal(checked.workers['contained-reverse-v1'].sha256, expected.reverseSha);
+  await writeFile(path.join(runtime, 'contained-reverse-worker.exe'), 'REVERSE-TAMPERED\n');
+  await assert.rejects(() => loadVerifiedWorkerRegistry({ binDir: runtime }), /worker\.contained-reverse-v1\.sha256/);
+});
+
+test('contained execution validator rejects missing or altered worker manifest evidence', () => {
+  const missing = valid();
+  missing.worker_manifest_verified = false;
+  assert.throws(() => validateContainedExecutionResult(missing), /worker manifest was not verified/);
+  const badHash = valid();
+  badHash.worker_manifest_sha256 = 'xyz';
+  assert.throws(() => validateContainedExecutionResult(badHash), /worker manifest hash missing/);
+});
+
+test('MCP contained_transform schema is a compile-time operation enum with no executable or invocation-control surface', async () => {
+  const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.equal((server.match(/inputSchema: z\.strictObject\(\{/g) ?? []).length, 8);
+  assert.match(server, /if \(hostPolicy\)/);
+  for (const name of ['host_file_read', 'host_file_write', 'host_exec']) assert.match(server, new RegExp(`'${name}'`));
+  assert.doesNotMatch(server, /inputSchema: z\.object\(\{/);
+  assert.doesNotMatch(server, /executable:\s*z\.|argv:\s*z\.|environment:\s*z\.|challenge:\s*z\.|request_digest:\s*z\.|worker_id:\s*z\./);
+});
+
+test('R27 Windows batch gate builds native payload before freezing and verifying the candidate', async () => {
+  const gate = await readFile(fileURLToPath(new URL('../scripts/gate-windows.ps1', import.meta.url)), 'utf8');
+  for (const stage of ['test', 'mcp:smoke', 'mcp:agent:smoke', 'containment:build', 'manifest:write', 'manifest:verify', 'authority:smoke', 'containment:smoke', 'contained:smoke', 'mcp:contained:smoke']) assert.match(gate, new RegExp(stage.replace(':', '\\:')));
+  assert.ok(gate.indexOf("'containment-build'") < gate.indexOf("'release-manifest-write'"));
+  assert.ok(gate.indexOf("'release-manifest-write'") < gate.indexOf("'tests'"));
+  assert.match(gate, /npm\.cmd/);
+  assert.doesNotMatch(gate, /&&|\|\|/);
+  assert.match(gate, /WINDOWS BATCH GATE: PASS/);
+});
+
+
+test('contained receipt verifies lowercase_ascii semantics and rejects semantic tamper', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v045-contained-lower-receipt-'));
+  const runtime = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v045-runtime-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v045-trust-'));
+  const inputPath = path.join(root, 'input.txt');
+  const outputPath = path.join(root, 'output.txt');
+  const workerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  await writeFile(inputPath, 'HELLO WORLD\n');
+  await writeFile(outputPath, 'hello world\n');
+  await writeFile(workerPath, 'FAKE-CONTAINED-WORKER\n');
+  await writeFile(reverseWorkerPath, 'FAKE-REVERSE-WORKER\n');
+  await writeFile(launcherPath, 'FAKE-CONTAINED-LAUNCHER\n');
+  const registry = await writeRuntimeRegistry(runtime);
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  const signingKey = await loadPrivateSigningKey(keys.privateKeyPath);
+  const inputBytes = Buffer.from('HELLO WORLD\n');
+  const lower = valid();
+  lower.operation = 'lowercase_ascii';
+  lower.proof.operation = 'lowercase_ascii';
+  lower.worker_manifest_sha256 = registry.manifestSha256;
+  lower.worker_source_sha256 = registry.transformSha;
+  bindInvocation(lower, { inputBytes, manifestSha256: registry.manifestSha256, workerSourceSha256: registry.transformSha, challenge: '31'.repeat(32) });
+  const execution = validateContainedExecutionResult(lower, 'lowercase_ascii');
+  execution.launcher_sha256 = await sha256File(launcherPath);
+  execution.output_sha256 = sha256Bytes(Buffer.from('hello world\n'));
+
+  const receipt = await writeTestReceipt({
+    rootReal: root,
+    operation: 'contained_transform',
+    inputSourcePath: inputPath,
+    inputBytes,
+    outputPath,
+    workerPath,
+    workerId: 'contained-transform-v1',
+    exitCode: 0,
+    stdout: Buffer.from('{"status":"passed"}\n'),
+    stderr: Buffer.alloc(0),
+    execution,
+    signingKey
+  });
+
+  const checked = await verifyReceipt({
+    workspacePath: root,
+    receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath,
+    _runtimePaths: {
+      proofWorkerPath: workerPath,
+      containedTransformWorkerPath: workerPath,
+      containedReverseWorkerPath: reverseWorkerPath,
+      containedLauncherPath: launcherPath
+    }
+  });
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+  assert.equal(checked.containment_verified, true);
+
+  await writeFile(outputPath, 'HELLO world\n');
+  const tampered = await verifyReceipt({
+    workspacePath: root,
+    receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath,
+    _runtimePaths: {
+      proofWorkerPath: workerPath,
+      containedTransformWorkerPath: workerPath,
+      containedReverseWorkerPath: reverseWorkerPath,
+      containedLauncherPath: launcherPath
+    }
+  });
+  assert.deepEqual(tampered, { ok: false, reason: 'contained transform semantic mismatch' });
+});
+
+
+test('contained receipt verifies reverse_bytes through the fixed reverse worker and rejects tamper', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v046-contained-reverse-receipt-'));
+  const runtime = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v046-runtime-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v046-trust-'));
+  const inputPath = path.join(root, 'input.bin');
+  const outputPath = path.join(root, 'output.bin');
+  const transformWorkerPath = path.join(runtime, 'contained-transform-worker.exe');
+  const reverseWorkerPath = path.join(runtime, 'contained-reverse-worker.exe');
+  const launcherPath = path.join(runtime, 'deadbyte-exec.exe');
+  const inputBytes = Buffer.from('abc123\n');
+  const outputBytes = Buffer.from(inputBytes).reverse();
+  await writeFile(inputPath, inputBytes);
+  await writeFile(outputPath, outputBytes);
+  await writeFile(transformWorkerPath, 'FAKE-TRANSFORM-WORKER\n');
+  await writeFile(reverseWorkerPath, 'FAKE-REVERSE-WORKER\n');
+  await writeFile(launcherPath, 'FAKE-CONTAINED-LAUNCHER\n');
+  const registry = await writeRuntimeRegistry(runtime);
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  const signingKey = await loadPrivateSigningKey(keys.privateKeyPath);
+  const reverse = valid();
+  reverse.operation = 'reverse_bytes';
+  reverse.worker_id = 'contained-reverse-v1';
+  reverse.worker_executable = 'contained-reverse-worker.exe';
+  reverse.proof.operation = 'reverse_bytes';
+  reverse.input_bytes = inputBytes.length;
+  reverse.output_bytes = outputBytes.length;
+  reverse.proof.input_bytes = inputBytes.length;
+  reverse.proof.output_bytes = outputBytes.length;
+  reverse.worker_manifest_sha256 = registry.manifestSha256;
+  reverse.worker_source_sha256 = registry.reverseSha;
+  bindInvocation(reverse, { inputBytes, manifestSha256: registry.manifestSha256, workerSourceSha256: registry.reverseSha, challenge: '41'.repeat(32) });
+  const execution = validateContainedExecutionResult(reverse, 'reverse_bytes');
+  execution.launcher_sha256 = await sha256File(launcherPath);
+  execution.output_sha256 = sha256Bytes(outputBytes);
+
+  const receipt = await writeTestReceipt({
+    rootReal: root,
+    operation: 'contained_transform',
+    inputSourcePath: inputPath,
+    inputBytes,
+    outputPath,
+    workerPath: reverseWorkerPath,
+    workerId: 'contained-reverse-v1',
+    exitCode: 0,
+    stdout: Buffer.from('{"status":"passed"}\n'),
+    stderr: Buffer.alloc(0),
+    execution,
+    signingKey
+  });
+
+  const runtimePaths = {
+    proofWorkerPath: transformWorkerPath,
+    containedTransformWorkerPath: transformWorkerPath,
+    containedReverseWorkerPath: reverseWorkerPath,
+    containedLauncherPath: launcherPath
+  };
+  const checked = await verifyReceipt({
+    workspacePath: root, receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths
+  });
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+  assert.equal(checked.containment_verified, true);
+
+  await writeFile(outputPath, Buffer.from('321cba\n'));
+  const tampered = await verifyReceipt({
+    workspacePath: root, receiptPath: receipt.receiptRelativePath,
+    verifyKeyPath: keys.publicKeyPath, _runtimePaths: runtimePaths
+  });
+  assert.deepEqual(tampered, { ok: false, reason: 'contained transform semantic mismatch' });
+});
+
+test('active network proof uses a host-positive-control loopback listener and requires AppContainer denial', async () => {
+  const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  const transform = await readFile(fileURLToPath(new URL('../native/contained-transform-worker.cpp', import.meta.url)), 'utf8');
+  const reverse = await readFile(fileURLToPath(new URL('../native/contained-reverse-worker.cpp', import.meta.url)), 'utf8');
+  const helper = await readFile(fileURLToPath(new URL('../native/contained-network-proof.h', import.meta.url)), 'utf8');
+  assert.match(launcher, /CreateLoopbackCanary/);
+  assert.match(launcher, /connect\(control\.get\(\)/);
+  assert.match(launcher, /accept\(out\.listener\.get\(\)/);
+  assert.match(launcher, /--network-probe-port/);
+  assert.match(launcher, /zero-capabilities-plus-active-loopback-denial/);
+  assert.match(helper, /ProbeLoopbackTcp/);
+  assert.match(helper, /INADDR_LOOPBACK/);
+  assert.match(helper, /out\.denial_ok = .* !out\.connect_succeeded/);
+  for (const worker of [transform, reverse]) {
+    assert.match(worker, /networkProbe\.denial_ok/);
+    assert.match(worker, /deadbyte\.network\.loopback\.v1/);
+    assert.match(worker, /network_connect_succeeded/);
+    assert.match(worker, /active_network_denial_ok/);
+  }
+});
+
+test('contained execution validator fails closed on active network evidence', () => {
+  const readable = valid();
+  readable.proof.network_connect_succeeded = true;
+  readable.proof.network_connect_error = 0;
+  readable.proof.active_network_denial_ok = false;
+  assert.throws(() => validateContainedExecutionResult(readable), /forbidden loopback network connection/);
+
+  const noControl = valid();
+  noControl.network_probe_host_control_ok = false;
+  assert.throws(() => validateContainedExecutionResult(noControl), /host loopback positive control failed/);
+
+  const wrongPort = valid();
+  wrongPort.proof.network_probe_port += 1;
+  assert.throws(() => validateContainedExecutionResult(wrongPort), /worker network probe port mismatch/);
+});
+
+test('execution authority is strict at MCP and native argv boundaries', async () => {
+  const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
+  const helper = await readFile(fileURLToPath(new URL('../native/contained-network-proof.h', import.meta.url)), 'utf8');
+  const authority = await readFile(fileURLToPath(new URL('../src/authority-smoke.mjs', import.meta.url)), 'utf8');
+  assert.match(server, /inputSchema: z\.strictObject\(/);
+  assert.doesNotMatch(server, /worker_id:\s*z\./);
+  assert.doesNotMatch(server, /executable:\s*z\./);
+  assert.doesNotMatch(server, /argv:\s*z\./);
+  assert.match(launcher, /argc != 7/);
+  assert.match(launcher, /invalid fixed argument contract/);
+  assert.match(helper, /HasExactContainedWorkerArguments/);
+  assert.match(authority, /--worker/);
+  assert.match(authority, /extra executable field/);
+  assert.match(authority, /extra argv field/);
+  assert.match(authority, /path-shaped operation/);
+});