test(T04-H78): Windows reserved-name and ADS backup restore path negative controls (diagnostic)

.github/workflows/ci.yml

@@ -21,6 +21,9 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -99,8 +102,13 @@ jobs:
         run: npm run execution-capsule:test
 
       - name: Validate v0.12 reduced-release scope
+        if: ${{ hashFiles('runtime/orchestration/state-engine-v2.mjs') == '' }}
         run: npm run release-scope:v012
 
+      - name: Validate v0.13 State Engine V2 increment
+        if: ${{ hashFiles('runtime/orchestration/state-engine-v2.mjs') != '' }}
+        run: npm run v013-state-engine-v2:test
+
       - name: Validate v0.12 non-T04 feature increments
         run: |
           npm run lifecycle-instances:test
@@ -120,7 +128,53 @@ jobs:
         run: npm pack --dry-run
 
       - name: Verify installed v0.12 consumer package
+        if: ${{ hashFiles('runtime/orchestration/state-engine-v2.mjs') == '' }}
         run: npm run consumer-smoke:v012
 
       - name: Validate exact release command
+        if: ${{ hashFiles('runtime/orchestration/state-engine-v2.mjs') == '' }}
         run: npm run release:validate
+
+      - name: Validate v0.13 full compatibility regression
+        if: ${{ hashFiles('runtime/orchestration/state-engine-v2.mjs') != '' }}
+        run: npm run v013:regression
+
+      - name: Verify v0.13 risk-3 acceptance job contract (negative control)
+        run: node --test scripts/v013-t04-acceptance-ci-contract.test.mjs
+
+  t04_acceptance:
+    name: T04 independently reviewed risk-3 acceptance
+    if: ${{ github.event_name == 'pull_request' && github.head_ref == 'feature/v0.13-state-engine-v2' }}
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      actions: read
+    steps:
+      - name: Check out exact reviewed integration source
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Establish exact-source v0.13 Development Contract
+        run: node scripts/v013-state-engine-v2-contract.mjs
+      - name: Verify immutable external T04 acceptance evidence
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node scripts/v013-t04-acceptance-gate.mjs
+      - name: Preserve canonical T04 verdict evidence
+        if: ${{ success() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: dkf-v013-t04-acceptance-evidence-${{ github.event.pull_request.head.sha }}
+          path: .development-kit/acceptance/DKF130-T04.json
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90

docs/03-reference/scripts/state-engine-v2-benchmark.md

@@ -0,0 +1,30 @@
+# state-engine-v2-benchmark.mjs
+
+## Purpose
+
+A reproducible, disposable **v0.13 State Engine V2 endurance fixture** that checks canonical event append and history reconstruction without modifying an existing project.
+
+The script creates a temporary project, appends generic entity revisions, verifies the monotonic canonical hash chain and final entity state, then removes the fixture.
+
+## Usage
+
+```bash
+npm run state-engine-v2:benchmark
+node scripts/state-engine-v2-benchmark.mjs --events 1000
+```
+
+The bounded CI/review fixture uses 300 events. The CLI accepts 1–5,000 events for targeted measurements.
+
+## Reported observations
+
+The script emits `T04_ENDURANCE_EVIDENCE` JSON including operation count, platform/Node version, append duration, integrity-read duration, final canonical-ledger bytes and modeled write savings against the former full-ledger-rewrite design.
+
+The historical rewrite comparison is a deterministic calculation from observed ledger lengths, not a measured execution of the retired implementation and not a release-wide performance claim.
+
+## Authority and safety
+
+- `events.jsonl` remains canonical.
+- Snapshot/index are rebuildable.
+- Interrupted appends are recovery-gated.
+- The fixture uses a disposable temporary project.
+- Passing the benchmark does not satisfy independent risk-3 acceptance.

docs/03-reference/scripts/t04-review-thread-blockers.md

@@ -0,0 +1,28 @@
+# t04-review-thread-blockers.mjs
+
+## Purpose
+
+Provides deterministic helpers for the **v0.13 T04 risk-3 review gate**.
+
+T04 acceptance must refuse approval while an authenticated review thread remains unresolved, while source anchoring is ambiguous, or while authenticated review evidence is malformed.
+
+## Usage
+
+The module is imported by T04 acceptance/review tooling and is not itself an acceptance authority.
+
+```js
+import { unresolvedReviewThreads } from './t04-review-thread-blockers.mjs';
+const blockers = unresolvedReviewThreads(githubReviewThreads);
+```
+
+The helper also validates canonical review-request source SHA anchoring and authenticated review-thread page structure.
+
+## Verification
+
+```bash
+node --test scripts/t04-review-thread-blockers.test.mjs
+```
+
+The regressions cover unresolved findings, conflicting or duplicated source SHAs, malformed review evidence and pagination failures.
+
+This helper cannot generate reviewer PASS results, resolve comments, or bypass source-bound independent review.

docs/03-reference/scripts/v013-state-engine-v2-contract.md

@@ -0,0 +1,83 @@
+# v013-state-engine-v2-contract.mjs
+
+## Purpose
+
+`scripts/v013-state-engine-v2-contract.mjs` creates or reuses the Development Contract for **DKF130-T04 — State Engine V2**, the first v0.13 priority carried forward from deferred DKF120-T04.
+
+The runtime contract is persisted under:
+
+```text
+.development-kit/contracts/INC-DKF130-T04/
+```
+
+The directory remains git-ignored. The committed generator makes contract construction reproducible from the exact v0.13 authority files.
+
+## Bound authority
+
+The contract fingerprints:
+
+- `dkf-v0.13-state-engine-v2-specification.md`;
+- `dkf-v0.13-t04-release-authority.md`;
+- the released v0.12.1/v0.12.0 changelog baseline;
+- the historical v0.12 State Engine technical design and PLAN as supporting context.
+
+## Restored acceptance criteria
+
+- `DKF-120-AC-012`
+- `DKF-120-AC-013`
+- `DKF-120-AC-014`
+- `DKF-120-AC-015`
+- `DKF-120-AC-034`
+
+These retain their original IDs because v0.12 explicitly deferred rather than replaced them.
+
+## High-assurance gates
+
+The contract is risk level 3 and binds the high-assurance Gate Profile.
+
+Expected effective gates:
+
+```text
+verification:
+  architecture-verification
+  security-audit
+  specification
+  tests
+
+reviewers:
+  architecture-reviewer
+  code-reviewer
+  security-reviewer
+
+control domains:
+  security
+```
+
+T04 cannot be accepted from tests alone.
+
+## Target binding
+
+```text
+primary:      dkf-framework
+affected:     dkf-framework
+verification: dkf-framework
+```
+
+## Usage
+
+```bash
+node scripts/v013-state-engine-v2-contract.mjs
+```
+
+The generator validates source freshness, target freshness and effective gates immediately.
+
+## Boundary
+
+The contract does not authorize:
+
+- application/domain-specific state policy;
+- distributed locking;
+- Issue #72 hostile same-account writer hardening;
+- removal of v0.12.1 features;
+- release publication;
+- deletion of retained legacy recovery assets.

docs/03-reference/scripts/v013-t04-acceptance-gate.md

@@ -0,0 +1,29 @@
+# v013-t04-acceptance-gate.mjs
+
+## Purpose
+
+`scripts/v013-t04-acceptance-gate.mjs` is the fail-closed, risk-3 DKF130-T04 acceptance evaluator for the **v0.13.0 integration candidate PR #92**. It is not a general release approval and must never run as a shortcut around independent reviews or Windows restore durability evidence.
+
+## Execution context
+
+The script requires an authenticated GitHub Actions pull-request event for `eybersjp/development-kit`, PR #92, from branch `feature/v0.13-state-engine-v2`. The dedicated `t04_acceptance` job must depend on both Ubuntu and Windows validation jobs. The job cannot authenticate evidence from a local invocation or an unrelated diagnostic PR.
+
+## Required independent evidence
+
+The committed `docs/04-architecture/dkf-v013-t04-independent-review-receipts.json` register must bind one immutable reviewed source commit and three distinct, authenticated GitHub `APPROVED` reviews for code, architecture, and security, with exact SHA and role scope. All review threads must be resolved. Review metadata is fetched from GitHub, not trusted from a self-authored receipt.
+
+Issue #73 must be resolved without waiver. Controlled NTFS physical power-loss evidence must be source-bound, independently reviewed and supported by a verified GitHub Actions artifact and digest. Two distinct full Ubuntu/Windows workflow executions must have passed on the identical reviewed commit. The source tree, Git index and executable modes must match the reviewed commit except for the receipt-only follow-up.
+
+## Deterministic decision
+
+After authenticated evidence verification, the script constructs the v0.13 Development Contract verification record, independent review records, security control coverage, and architecture drift assessment. The canonical acceptance engine must return `ACCEPTED` before any acceptance record is written.
+
+The acceptance record is written under `.development-kit/acceptance/DKF130-T04.json` in the runner workspace. **A runner-local file is not, by itself, a durable repository-persisted acceptance verdict.** Release integration requires independently verified retention and retrieval of the authentic record through an approved governance artifact or repository persistence mechanism; this diagnostic implementation does not authorize a merge or release merely because its job passes.
+
+## Usage and limits
+
+```bash
+node scripts/v013-t04-acceptance-gate.mjs
+```
+
+The command is intended to run only inside its restricted GitHub Actions job. It does not publish releases, close blocking issues, resolve review threads, modify production state or waive full Windows legacy-backup restoration. Source-bound reviews and physical sudden-power-loss evidence cannot be simulated by ordinary CI.

docs/03-reference/scripts/v013-t04-review-provenance.md

@@ -0,0 +1,15 @@
+# v013-t04-review-provenance.mjs
+
+## Purpose
+
+`scripts/v013-t04-review-provenance.mjs` supplies the narrowly scoped authenticated-review effective-state guard used by the DKF130-T04 v0.13 risk-3 acceptance evaluator.
+
+## Review provenance contract
+
+A valid role receipt identifies a distinct authenticated GitHub `APPROVED` review bound to the immutable reviewed source commit. The single-review endpoint alone is insufficient: an earlier approved review may have been superseded by a later `CHANGES_REQUESTED`, `DISMISSED`, or approval on a different commit.
+
+`assertCurrentRoleApproval(approval, submittedReviews, reviewedCommit)` examines the authenticated, paginated pull-request review timeline using the immutable positive numeric GitHub `user.id` (not mutable/case-insensitive `user.login`). It ignores non-decisive `COMMENTED` submissions, requires valid submitted-at ordering witnesses, and fails closed unless the latest decisive review by the same account, including after username changes, is the exact approved receipt for the exact reviewed commit. The production gate also binds distinct role reviewers, source-author exclusion and the independent physical NTFS reviewer to authenticated numeric account IDs. The caller must retrieve the review timeline through authenticated GitHub API calls and retain the independent role, distinct identity, zero unresolved threads, and physical NTFS evidence gates.
+
+## Validation
+
+`node --test scripts/v013-t04-acceptance-ci-contract.test.mjs` includes T04-A19/A23/A24 adversarial cases for revoked approvals, stale reapprovals, dismissed reviews, and harmless later comments. Both Ubuntu and Windows full CI jobs must pass on the same candidate commit. This helper never issues approvals, marks review threads resolved, merges PRs, or emits `ACCEPTED` by itself.