feat: ship ByteFence raw-byte write firewall for AI agents

[guillaumevele]

Why

AI coding agents can turn a small declared edit into a much larger file rewrite through newline normalization, encoding changes, truncation, or stale-state races. ByteFence makes the write boundary deterministic: the committed bytes must be the one candidate derived from the preserved raw preimage and a narrow exactReplace intent.

What ships

• raw-byte intent, policy, and in-toto Statement contracts with strict duplicate-key parsing and fixed safety invariants
• fail-closed evaluator plus a transactional local broker with cooperative locking, stale-state checks, exclusive temporary files, atomic rename, reread verification, and immutable receipts
• CLI and MCP check, verify, and apply paths
• a version-pinned Mistral Vibe 2.19.1 project-tool adapter with compatibility attestation and hostile-configuration checks
• seven-case adversarial corpus covering truncation, ambiguous anchors, BOM loss, Unicode normalization, full rewrites, and mixed-EOL drift reproduced through Vibe
• hardened GitHub Action packaging and release verification for the npm package

Reproducible proof

• npm run verify: 169/169 Node tests pass
• pinned Vibe adapter suite: 46/46 tests pass
• corpus: 7 cases, 28 generated files, 39,794 bytes, byte-for-byte current
• property tests: 100,000 out-of-range mutations produce zero false allows; 1,000 valid edits produce zero false blocks
• package: 109 files; npm pack and npm publish --dry-run share SHA-1 e481661a86057d073e50ef5e48ff5deb9999359e
• public scans: 156 tracked repository files and 8 generated files, zero findings
• clean checkout with forced core.autocrlf=true: corpus and generated-artifact verification pass with no worktree drift
• production dependency audit: zero known vulnerabilities

Security boundary

ByteFence is a mediated-write boundary, not a universal operating-system sandbox. The default effective guarantee remains CORE_PROVEN; MEDIATED_PROVEN requires explicit trust in both the producer and the mediation environment. The Vibe adapter also documents PATH, python3, and agent-proof as local trust roots.