deadbyte-mcp 0.8.7

package/test/controller-r24.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+const example = fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url));
+test('R24 controller feature-gates autonomous runtime into Bridge child environment', async () => {
+  const source = await readFile(controller, 'utf8');
+  const cfg = await readFile(example, 'utf8');
+  assert.match(source, /AutonomousRuntimeEnabled/);
+  assert.match(source, /DEADBYTE_AUTONOMOUS_RUNTIME/);
+  assert.match(source, /DEADBYTE_AUTONOMOUS_POLICY/);
+  assert.match(cfg, /AutonomousRuntimeEnabled = \$false/);
+});
+test('R24 controller owns separate autonomous standing grant and requires coding authority', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /deadbyte\.autonomous-policy\.v1/);
+  assert.match(source, /deadbyte\.autonomous-grant\.v2/);
+  assert.doesNotMatch(source, /AddMinutes\(30\)/);
+  assert.match(source, /Get-CodingLeaseStatus/);
+  assert.match(source, /autonomous plane requires an active coding lease/);
+  assert.match(source, /Disarm-Autonomous/);
+});
+test('R24 controller exposes autonomous lifecycle commands and menu entries 17-20', async () => {
+  const source = await readFile(controller, 'utf8');
+  for (const name of ['armautonomous','disarmautonomous','autonomousstatus','autonomoustest']) assert.match(source, new RegExp(name));
+  assert.match(source, /\[17\] Enable autonomous plane \(standing grant\)/);
+  assert.match(source, /\[18\] Revoke autonomous plane/);
+  assert.match(source, /\[19\] Autonomous plane status/);
+  assert.match(source, /\[20\] Autonomous production LIVE gate/);
+});

package/test/controller-r27.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+const source = () => readFile(controller, 'utf8');
+
+test('R27 controller binds Bridge downstream core to configured CoreRoot', async () => {
+  const text = await source();
+  assert.match(text, /\$hadCoreRootEnv = Test-Path Env:DEADBYTE_CORE_ROOT/);
+  assert.match(text, /\$previousCoreRootEnv = \$env:DEADBYTE_CORE_ROOT/);
+  assert.match(text, /\$env:DEADBYTE_CORE_ROOT = \[string\]\$Cfg\.CoreRoot/);
+  assert.match(text, /if \(\$hadCoreRootEnv\) \{ \$env:DEADBYTE_CORE_ROOT = \$previousCoreRootEnv \}/);
+  assert.match(text, /Remove-Item Env:DEADBYTE_CORE_ROOT -ErrorAction SilentlyContinue/);
+});
+
+test('R27 controller can externalize mutable controller runtime state', async () => {
+  const text = await source();
+  assert.match(text, /DEADBYTE_CONTROLLER_RUNTIME_ROOT/);
+  assert.match(text, /\$RuntimeDir = if \(\$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT\)/);
+  assert.match(text, /System\.IO\.Path\]::GetFullPath\(\[string\]\$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT\)/);
+});
+
+test('R27 controller supports a trusted stable WorkspaceRoot independent of release CoreRoot', async () => {
+  const text = await source();
+  assert.match(text, /WorkspaceRoot/);
+  assert.match(text, /\$cfg\['WorkspaceRoot'\] = \$workspaceRoot/);
+  assert.match(text, /\$env:DEADBYTE_WORKSPACE_ROOT = \[string\]\$Cfg\.WorkspaceRoot/);
+});
+
+test('R27 controller pins external Bridge script bytes into owned runtime identity', async () => {
+  const text = await source();
+  assert.match(text,/Bridge ScriptPath missing/);
+  assert.match(text,/Bridge ScriptSha256 invalid/);
+  assert.match(text,/bridge script hash mismatch/i);
+  assert.match(text,/\$body\['script_path'\] = \[string\]\$Spec\.ScriptPath/);
+  assert.match(text,/\$body\['script_sha256'\] = \[string\]\$Spec\.ScriptSha256/);
+  assert.match(text,/script-hash-mismatch/);
+});
+
+test('R27 controller pins Bridge and Cloud executable bytes before launch', async () => {
+  const text=await source();
+  assert.match(text,/\$name FileSha256 invalid/);
+  assert.match(text,/executable hash mismatch/);
+  assert.match(text,/\$componentExecutableHash = Get-ExecutableHash/);
+  assert.match(text,/\$componentExecutableHash -ne \[string\]\$Spec\.FileSha256/);
+});
+
+test('R28 controller hash-pins the stable MCP URL file for named tunnel v2', async () => {
+  const text=await source();
+  assert.match(text,/McpUrlFileSha256/);
+  assert.match(text,/McpUrlFile SHA-256 mismatch/);
+  assert.match(text,/Get-ExecutableHash \$fullFile/);
+  assert.match(text,/trycloudflare.*forbidden|forbidden.*trycloudflare/i);
+});

package/test/controller-r29.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { renderStableLauncherPs1 } from '../src/release-slot.mjs';
+
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+const configExample = fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url));
+
+test('R29 controller defaults machine runtime on and forwards stable state-root identity', async () => {
+  const text = await readFile(controller, 'utf8');
+  assert.match(text, /MachineRuntimeEnabled/);
+  assert.match(text, /\$cfg\['MachineRuntimeEnabled'\] = \$true/);
+  assert.match(text, /DEADBYTE_MACHINE_RUNTIME/);
+  assert.match(text, /\$env:DEADBYTE_MACHINE_RUNTIME = if \(\[bool\]\$Cfg\.MachineRuntimeEnabled\)/);
+  assert.match(text, /Remove-Item Env:DEADBYTE_MACHINE_RUNTIME/);
+});
+
+test('R29 stable launcher exports canonical state root and example config enables machine runtime', async () => {
+  const launcher = renderStableLauncherPs1();
+  assert.match(launcher, /DEADBYTE_STATE_ROOT/);
+  assert.match(launcher, /\$env:DEADBYTE_STATE_ROOT = \$StateRoot/);
+  const example = await readFile(configExample, 'utf8');
+  assert.match(example, /MachineRuntimeEnabled = \$true/);
+});

package/test/controller-r30.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+const config = fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url));
+
+test('R30 controller feature-gates process runtime and policy into Bridge only', async () => {
+  const source = await readFile(controller, 'utf8');
+  const example = await readFile(config, 'utf8');
+  assert.match(source, /ProcessRuntimeEnabled/);
+  assert.match(source, /DEADBYTE_PROCESS_RUNTIME/);
+  assert.match(source, /DEADBYTE_PROCESS_POLICY/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_PROCESS_RUNTIME/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_PROCESS_POLICY/);
+  assert.match(example, /ProcessRuntimeEnabled = \$false/);
+  assert.match(example, /ProcessPolicyFile = ''/);
+});
+
+test('R30 controller owns a separate process standing-grant lifecycle', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /deadbyte\.process-policy\.v1/);
+  assert.match(source, /deadbyte\.process-grant\.v1/);
+  assert.match(source, /armprocess/);
+  assert.match(source, /disarmprocess/);
+  assert.match(source, /processstatus/);
+  assert.match(source, /Process plane\s+: \{0\}/);
+  assert.doesNotMatch(source, /process.*AddMinutes/i);
+});

package/test/controller.test.mjs

@@ -0,0 +1,165 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+const cmd = fileURLToPath(new URL('../controller/DEADBYTE-MCP.cmd', import.meta.url));
+
+test('controller derives runtime state from observed identities and readiness', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /Get-ObservedState/);
+  assert.match(source, /'OFFLINE'/);
+  assert.match(source, /'PARKED'/);
+  assert.match(source, /'ONLINE'/);
+  assert.match(source, /'DEGRADED'/);
+  assert.doesNotMatch(source, /state\.txt/i);
+});
+
+test('controller ownership resists PID reuse and executable substitution', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /creation_time_utc/);
+  assert.match(source, /image_path/);
+  assert.match(source, /image_sha256/);
+  assert.match(source, /instance_nonce/);
+  assert.match(source, /pid-reused/);
+  assert.match(source, /refusing Stop-Process/);
+  assert.match(source, /\$p\.Path/);
+  assert.match(source, /MainModule\.FileName/);
+  assert.match(source, /Get-CimInstance Win32_Process/);
+});
+
+test('controller starts detached processes and exit does not imply stop', async () => {
+  const source = await readFile(controller, 'utf8');
+  const wrapper = await readFile(cmd, 'utf8');
+  assert.match(source, /Start-Process @start/);
+  assert.match(source, /'0' \{ exit 0 \}/);
+  assert.match(source, /Exit controller \(runtime stays as-is\)/);
+  assert.match(wrapper, /powershell\.exe .*deadbyte-controller\.ps1/i);
+});
+
+test('controller public smoke uses a real modern MCP client and fulltest adds canonical contained gate', async () => {
+  const source = await readFile(controller, 'utf8');
+  const remote = await readFile(fileURLToPath(new URL('../src/remote-mcp-smoke-client.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /remote-mcp-smoke-client\.mjs/);
+  assert.match(source, /mcp-contained-smoke-client\.mjs/);
+  assert.match(remote, /StreamableHTTPClientTransport/);
+  assert.match(remote, /pin: '2026-07-28'/);
+  assert.match(remote, /contained_transform/);
+  assert.match(remote, /active_network_denial_verified/);
+});
+
+test('package exposes one top-level CMD entry and controller supports explicit CoreRoot when deployed beside bridge', async () => {
+  const top = await readFile(fileURLToPath(new URL('../DEADBYTE-MCP.cmd', import.meta.url)), 'utf8');
+  const source = await readFile(controller, 'utf8');
+  assert.match(top, /controller\\DEADBYTE-MCP\.cmd/);
+  assert.match(source, /CoreRoot/);
+  assert.match(source, /V0\.7 package|DEADBYTE MCP package/);
+});
+
+
+test('controller exposes an explicit standing grant and revoke for the optional privileged host plane', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /armhost/);
+  assert.match(source, /disarmhost/);
+  assert.match(source, /deadbyte\.host-grant\.v2/);
+  assert.match(source, /standing-grant/);
+  assert.doesNotMatch(source, /AddMinutes\(15\)/);
+  assert.match(source, /policy_sha256/);
+  assert.match(source, /DEADBYTE_PRIVILEGED_POLICY/);
+});
+
+test('controller keeps privileged policy optional and propagates it only to the bridge process', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /HostPolicyFile/);
+  assert.match(source, /Name -eq 'Bridge'/);
+  assert.match(source, /DEADBYTE_WORKSPACE_ROOT/);
+  assert.match(source, /\$env:DEADBYTE_WORKSPACE_ROOT = \[string\]\$Cfg\.WorkspaceRoot/);
+  assert.match(source, /Join-Path \$coreRoot 'workspaces'/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_WORKSPACE_ROOT/);
+});
+
+test('Windows host policy bootstrap pins executables and creates only explicit local roots', async () => {
+  const init = await readFile(fileURLToPath(new URL('../scripts/init-host-policy.ps1', import.meta.url)), 'utf8');
+  assert.match(init, /deadbyte\.host-policy\.v1/);
+  assert.match(init, /Get-FileHash/);
+  assert.match(init, /powershell_script/);
+  assert.match(init, /cmd_script/);
+  assert.match(init, /node_script/);
+  assert.match(init, /D:\\Projects/);
+  assert.match(init, /State\s+: DISARMED/);
+});
+
+
+test('controller hosttest requires an armed lease and uses the public remote host smoke client', async () => {
+  const source = await readFile(controller, 'utf8');
+  const remote = await readFile(fileURLToPath(new URL('../src/remote-mcp-host-smoke-client.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /hosttest/);
+  assert.match(source, /remote-mcp-host-smoke-client\.mjs/);
+  assert.match(source, /requires an active local arm lease/);
+  assert.match(remote, /host_file_write/);
+  assert.match(remote, /host_file_read/);
+  assert.match(remote, /host_exec/);
+  assert.match(remote, /cleanup_by_executed_script/);
+});
+
+test('controller feature-gates agent runtime only into the Bridge child environment', async () => {
+  const source = await readFile(controller, 'utf8');
+  const example = await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)), 'utf8');
+  assert.match(source, /AgentRuntimeEnabled/);
+  assert.match(source, /AgentRuntimeEnabled must be boolean/);
+  assert.match(source, /\$env:DEADBYTE_AGENT_RUNTIME = if \(\[bool\]\$Cfg\.AgentRuntimeEnabled\) \{ '1' \} else \{ '0' \}/);
+  assert.match(source, /if \(\$Name -eq 'Bridge' -and \$Cfg\)/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_AGENT_RUNTIME/);
+  assert.match(source, /\$env:DEADBYTE_AGENT_RUNTIME = \$previousAgentRuntimeEnv/);
+  assert.match(example, /AgentRuntimeEnabled = \$false/);
+});
+
+test('controller status exposes the trusted agent-runtime mode explicitly', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /Agent runtime\s+: \{0\}/);
+  assert.match(source, /AgentRuntimeEnabled\) \{ 'ENABLED' \} else \{ 'DISABLED' \}/);
+});
+
+test('controller feature-gates coding runtime and policy only into the Bridge child environment', async () => {
+  const source = await readFile(controller, 'utf8');
+  const example = await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)), 'utf8');
+  assert.match(source, /CodingRuntimeEnabled/);
+  assert.match(source, /CodingRuntimeEnabled must be boolean/);
+  assert.match(source, /DEADBYTE_CODING_RUNTIME/);
+  assert.match(source, /DEADBYTE_CODING_POLICY/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_CODING_RUNTIME/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_CODING_POLICY/);
+  assert.match(example, /CodingRuntimeEnabled = \$false/);
+});
+
+test('R31 controller feature-gates machine filesystem only into the Bridge child and requires coding runtime', async () => {
+  const source = await readFile(controller, 'utf8');
+  const example = await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)), 'utf8');
+  assert.match(source, /MachineFsRuntimeEnabled/);
+  assert.match(source, /MachineFsRuntimeEnabled must be boolean/);
+  assert.match(source, /MachineFsRuntimeEnabled requires CodingRuntimeEnabled/);
+  assert.match(source, /DEADBYTE_MACHINE_FS_RUNTIME/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME/);
+  assert.match(example, /MachineFsRuntimeEnabled = \$false/);
+});
+
+test('controller owns a separate coding standing-grant lifecycle and exposes it in status', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /deadbyte\.coding-policy\.v1/);
+  assert.match(source, /deadbyte\.coding-grant\.v2/);
+  assert.doesNotMatch(source, /AddMinutes\(60\)/);
+  assert.match(source, /armcoding/);
+  assert.match(source, /disarmcoding/);
+  assert.match(source, /codingstatus/);
+  assert.match(source, /Coding plane\s+: \{0\}/);
+  assert.ok(source.includes("TrimEnd('\\') + '\\'"), 'coding grant prefix must use one Windows separator');
+});
+
+test('R29 controller exposes a non-mutating public machine identity live gate', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /machinetest/);
+  assert.match(source, /remote-mcp-machine-smoke-client\.mjs/);
+  assert.match(source, /MACHINE IDENTITY LIVE GATE PASS/);
+});

package/test/core.test.mjs

@@ -0,0 +1,305 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, symlink, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import os from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { executeProof } from '../src/executor.mjs';
+import { sha256Bytes } from '../src/hash.mjs';
+import { resolveExistingInside, resolveWorkspace, validatePortableRelativePath } from '../src/path-policy.mjs';
+import { decodeUtf8Strict } from '../src/text-policy.mjs';
+import { PROOF_EXECUTION_POLICY } from '../src/operation-policy.mjs';
+import { createRequestIdentity, validateRequestIdentity } from '../src/request-identity.mjs';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { verifyReceipt } from '../src/verifier.mjs';
+
+const verifierCli = fileURLToPath(new URL('../src/verifier-cli.mjs', import.meta.url));
+
+async function fixture() {
+  const dir = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-mcp-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-trust-'));
+  await writeFile(path.join(dir, 'input.txt'), 'machine truth\n');
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  return { dir, trust, keys };
+}
+
+function execute(f, options = {}) {
+  return executeProof({ workspacePath: f.dir, signingKeyPath: f.keys.privateKeyPath, ...options });
+}
+
+function verify(f, receiptPath) {
+  return verifyReceipt({ workspacePath: f.dir, receiptPath, verifyKeyPath: f.keys.publicKeyPath });
+}
+
+function runVerifierProcess(f, receipt) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [verifierCli, f.dir, receipt], {
+      shell: false,
+      env: { ...process.env, DEADBYTE_VERIFY_KEY: f.keys.publicKeyPath },
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on('data', c => stdout.push(c));
+    child.stderr.on('data', c => stderr.push(c));
+    child.on('error', reject);
+    child.on('close', code => resolve({
+      code,
+      stdout: Buffer.concat(stdout).toString('utf8'),
+      stderr: Buffer.concat(stderr).toString('utf8')
+    }));
+  });
+}
+
+test('path traversal is denied', async () => {
+  const f = await fixture();
+  const root = await resolveWorkspace(f.dir);
+  await assert.rejects(() => resolveExistingInside(root, '../outside.txt'), /escapes workspace/);
+});
+
+test('absolute path is denied', async () => {
+  const f = await fixture();
+  const root = await resolveWorkspace(f.dir);
+  await assert.rejects(() => resolveExistingInside(root, path.resolve(f.dir, 'input.txt')), /absolute paths are denied/);
+});
+
+
+test('Windows ADS, device aliases and trailing-dot paths are denied portably', () => {
+  assert.throws(() => validatePortableRelativePath('file.txt:secret'), /alternate data streams/);
+  assert.throws(() => validatePortableRelativePath('NUL.txt'), /device paths/);
+  assert.throws(() => validatePortableRelativePath('dir/COM1.log'), /device paths/);
+  assert.throws(() => validatePortableRelativePath('dir/COM1 .log'), /device paths/);
+  assert.throws(() => validatePortableRelativePath('alias. '), /trailing-dot\/space/);
+  assert.throws(() => validatePortableRelativePath('dir\\..\\secret.txt'), /escapes workspace/);
+});
+
+test('symlink escape is denied where symlinks are permitted', async t => {
+  const f = await fixture();
+  const outside = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-outside-'));
+  await writeFile(path.join(outside, 'secret.txt'), 'nope');
+  const link = path.join(f.dir, 'escape');
+  try {
+    await symlink(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
+  } catch (error) {
+    if (['EPERM', 'EACCES'].includes(error?.code)) {
+      t.skip('symlink creation is not permitted in this environment');
+      return;
+    }
+    throw error;
+  }
+  const root = await resolveWorkspace(f.dir);
+  await assert.rejects(() => resolveExistingInside(root, 'escape/secret.txt'), /symlink escapes workspace/);
+});
+
+test('proof execution creates deterministic output and signed verifiable receipt', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  const output = await readFile(path.join(f.dir, 'output.txt'), 'utf8');
+  assert.equal(output, 'DEADBYTE-MCP-V0\nmachine truth\n');
+  assert.equal(result.receipt.schema, 'deadbyte.receipt.v2');
+  assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
+  assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
+  assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
+  assert.equal(result.receipt.runtime.package_version, '0.8.7');
+  assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
+  assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
+  assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);
+  assert.match(result.receipt.runtime.instance_nonce, /^[0-9a-f]{64}$/);
+  assert.equal(result.receipt.attestation.algorithm, 'ed25519');
+  assert.equal(result.receipt.attestation.key_id, f.keys.keyId);
+
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+  assert.equal(checked.signature_valid, true);
+});
+
+test('independent verifier process accepts valid signed evidence', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  const checked = await runVerifierProcess(f, result.receiptRelativePath);
+  assert.equal(checked.code, 0, checked.stderr || checked.stdout);
+  const parsed = JSON.parse(checked.stdout);
+  assert.equal(parsed.ok, true);
+  assert.equal(parsed.signature_valid, true);
+});
+
+test('input source may change later because receipt preserves exact input snapshot', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  await writeFile(path.join(f.dir, 'input.txt'), 'new revision\n');
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.equal(checked.ok, true, JSON.stringify(checked));
+});
+
+test('tampered output fails independent verification', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  await writeFile(path.join(f.dir, 'output.txt'), 'tampered\n');
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.deepEqual(checked, { ok: false, reason: 'output hash mismatch' });
+});
+
+test('tampered input snapshot fails independent verification', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  await writeFile(path.join(f.dir, result.receipt.input.snapshot_path), 'tampered snapshot\n');
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.deepEqual(checked, { ok: false, reason: 'input snapshot hash mismatch' });
+});
+
+test('tampered receipt fails its canonical self hash', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  const receiptPath = path.join(f.dir, result.receiptRelativePath);
+  const receipt = JSON.parse(await readFile(receiptPath, 'utf8'));
+  receipt.output.sha256 = '0'.repeat(64);
+  await writeFile(receiptPath, JSON.stringify(receipt));
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.deepEqual(checked, { ok: false, reason: 'receipt hash mismatch' });
+});
+
+test('recomputed self hash cannot forge Ed25519 attestation', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  const receiptPath = path.join(f.dir, result.receiptRelativePath);
+  const receipt = JSON.parse(await readFile(receiptPath, 'utf8'));
+  receipt.output.sha256 = '0'.repeat(64);
+  const { attestation, receipt_sha256: ignored, ...body } = receipt;
+  void ignored;
+  receipt.receipt_sha256 = sha256Bytes(Buffer.from(canonicalJson(body), 'utf8'));
+  receipt.attestation = attestation;
+  await writeFile(receiptPath, `${canonicalJson(receipt)}\n`);
+  const checked = await verify(f, result.receiptRelativePath);
+  assert.deepEqual(checked, { ok: false, reason: 'receipt signature mismatch' });
+});
+
+test('wrong public key cannot verify receipt', async () => {
+  const f = await fixture();
+  const result = await execute(f);
+  const otherTrust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-wrong-key-'));
+  const wrong = await generateTrustKeypair({
+    privateKeyPath: path.join(otherTrust, 'private.pem'),
+    publicKeyPath: path.join(otherTrust, 'public.pem')
+  });
+  const checked = await verifyReceipt({
+    workspacePath: f.dir,
+    receiptPath: result.receiptRelativePath,
+    verifyKeyPath: wrong.publicKeyPath
+  });
+  assert.deepEqual(checked, { ok: false, reason: 'attestation key id mismatch' });
+});
+
+test('signing key inside workspace is denied', async () => {
+  const f = await fixture();
+  const insidePrivate = path.join(f.dir, 'private.pem');
+  const insidePublic = path.join(f.dir, 'public.pem');
+  await generateTrustKeypair({ privateKeyPath: insidePrivate, publicKeyPath: insidePublic });
+  await assert.rejects(
+    () => executeProof({ workspacePath: f.dir, signingKeyPath: insidePrivate }),
+    /signing key must be outside workspace/
+  );
+});
+
+
+test('proof execution refuses to run without a signing key', async () => {
+  const f = await fixture();
+  await assert.rejects(
+    () => executeProof({ workspacePath: f.dir }),
+    /missing signing key path/
+  );
+});
+
+test('trust key generation refuses to overwrite an existing keypair', async () => {
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-keygen-once-'));
+  const privateKeyPath = path.join(trust, 'private.pem');
+  const publicKeyPath = path.join(trust, 'public.pem');
+  await generateTrustKeypair({ privateKeyPath, publicKeyPath });
+  await assert.rejects(
+    () => generateTrustKeypair({ privateKeyPath, publicKeyPath }),
+    error => error?.code === 'EEXIST'
+  );
+});
+
+test('pre-existing output is denied instead of overwritten', async () => {
+  const f = await fixture();
+  await writeFile(path.join(f.dir, 'output.txt'), 'KEEP\n');
+  await assert.rejects(() => execute(f), /EEXIST/);
+  assert.equal(await readFile(path.join(f.dir, 'output.txt'), 'utf8'), 'KEEP\n');
+});
+
+test('output parent symlink escape is denied', async t => {
+  const f = await fixture();
+  const outside = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-outside-write-'));
+  const link = path.join(f.dir, 'out');
+  try {
+    await symlink(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
+  } catch (error) {
+    if (['EPERM', 'EACCES'].includes(error?.code)) {
+      t.skip('symlink creation is not permitted in this environment');
+      return;
+    }
+    throw error;
+  }
+  await assert.rejects(() => execute(f, { output: 'out/evil.txt' }), /escapes workspace/);
+});
+
+test('distinct output names allow repeated signed proofs without weakening no-overwrite', async () => {
+  const f = await fixture();
+  const first = await execute(f, { output: 'output.1.txt' });
+  const second = await execute(f, { output: 'output.2.txt' });
+
+  const verifyFirst = await verify(f, first.receiptRelativePath);
+  const verifySecond = await verify(f, second.receiptRelativePath);
+
+  assert.equal(verifyFirst.ok, true, JSON.stringify(verifyFirst));
+  assert.equal(verifySecond.ok, true, JSON.stringify(verifySecond));
+  assert.notEqual(first.receiptRelativePath, second.receiptRelativePath);
+});
+
+test('V0.7 creates request identity before worker process execution and authenticates before V2 interpretation', async () => {
+  const executorSource = await readFile(fileURLToPath(new URL('../src/executor.mjs', import.meta.url)), 'utf8');
+  const containedSource = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
+  const verifierSource = await readFile(fileURLToPath(new URL('../src/verifier.mjs', import.meta.url)), 'utf8');
+  assert.ok(executorSource.indexOf('createRequestIdentity') < executorSource.indexOf('runWorker({ cwd'));
+  assert.ok(containedSource.lastIndexOf('createRequestIdentity') < containedSource.lastIndexOf('runContainedLauncher({ inputBytes'));
+  assert.ok(verifierSource.indexOf("if (!signatureOk) return fail('receipt signature mismatch')") < verifierSource.indexOf('const envelope = await verifyV2Envelope(receipt)'));
+});
+
+
+test('strict UTF-8 decoder rejects malformed byte sequences', () => {
+  assert.equal(decodeUtf8Strict(Buffer.from('machine truth\n', 'utf8')), 'machine truth\n');
+  assert.throws(() => decodeUtf8Strict(Buffer.from([0xc3, 0x28])), /not valid UTF-8/);
+});
+
+test('proof execution enforces compile-time input and timeout budgets', async () => {
+  const f = await fixture();
+  await writeFile(path.join(f.dir, 'oversized.bin'), Buffer.alloc(PROOF_EXECUTION_POLICY.maxInputBytes + 1, 0x41));
+  await assert.rejects(() => execute(f, { input: 'oversized.bin', output: 'oversized.out' }), /proof execution limit/);
+  await assert.rejects(() => execute(f, { output: 'timeout.out', timeoutMs: PROOF_EXECUTION_POLICY.timeoutMs + 1 }), /timeoutMs/);
+});
+
+test('request identity validator rejects digest, worker and invocation substitution', () => {
+  const inputSha256 = '11'.repeat(32);
+  const workerSha256 = '22'.repeat(32);
+  const containedInvocation = { schema: 'deadbyte.invocation.v1', challenge: '33'.repeat(32), requestSha256: '44'.repeat(32) };
+  const request = createRequestIdentity({ operation: 'contained_transform', inputSha256, workerId: 'contained-transform-v1', workerSha256, containedInvocation });
+  assert.equal(validateRequestIdentity(request, { operation: 'contained_transform', inputSha256, workerId: 'contained-transform-v1', workerSha256, containedInvocation }), true);
+  assert.throws(() => validateRequestIdentity({ ...request, sha256: 'ff'.repeat(32) }, { operation: 'contained_transform', inputSha256, workerId: 'contained-transform-v1', workerSha256, containedInvocation }), /request digest mismatch/);
+  assert.throws(() => validateRequestIdentity(request, { operation: 'contained_transform', inputSha256, workerId: 'contained-reverse-v1', workerSha256, containedInvocation }), /request identity binding mismatch/);
+  assert.throws(() => validateRequestIdentity(request, { operation: 'contained_transform', inputSha256, workerId: 'contained-transform-v1', workerSha256, containedInvocation: { ...containedInvocation, challenge: '55'.repeat(32) } }), /contained invocation binding mismatch/);
+});
+
+
+test('V0.8.0 resolves workspace and optional host policy from package root when bridge does not forward environment', async () => {
+  const source = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /fileURLToPath\(import\.meta\.url\)/);
+  assert.match(source, /path\.join\(packageRoot, 'workspaces'\)/);
+  assert.match(source, /path\.join\(packageRoot, 'controller', 'deadbyte-host-policy\.json'\)/);
+  assert.match(source, /await access\(localPrivilegedPolicyPath\)/);
+  assert.match(source, /error\?\.code !== 'ENOENT'/);
+});

package/test/deferred-slot-operation-behavior.test.mjs

@@ -0,0 +1,29 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { setTimeout as sleep } from 'node:timers/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+test('R33 deferred worker survives scheduler exit and stays bound to explicit state root',
+  { skip: process.platform !== 'win32', timeout:15000 }, async()=>{
+    const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-deferred-'));
+    try {
+      const child=spawn(process.execPath,['scripts/deferred-slot-operation.mjs','activate','0'.repeat(64)],{
+        cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:state},stdio:['ignore','pipe','pipe'],windowsHide:true
+      });
+      let stdout=''; child.stdout.on('data',chunk=>stdout+=chunk);
+      const exit=await new Promise(resolve=>child.on('exit',code=>resolve(code)));
+      assert.equal(exit,0);
+      const scheduled=JSON.parse(stdout.trim());
+      assert.equal(scheduled.status,'scheduled');
+      assert.ok(path.resolve(scheduled.state_path).startsWith(path.resolve(state)+path.sep));
+      let record;
+      for(let i=0;i<20;i++){ await sleep(300); record=JSON.parse(await readFile(scheduled.state_path,'utf8')); if(record.state!=='scheduled') break; }
+      assert.equal(record?.state,'failed');
+      assert.match(record.error,/trust|ENOENT|ed25519/i);
+    } finally { await rm(state,{recursive:true,force:true}); }
+  });