DBNET 1.2.6
============

1.2.6 binds every new Audit/Probe, NativeProbe, and Ndt7Probe session to verified package bytes before workload traffic. PACKAGE-PROVENANCE.json records the manifest SHA-256, loaded source hashes, runtime identity, and fail-closed supplemental Git identity.

The raw RFC 6455 upload transport introduced in 1.2.5 remains unchanged. Download uses ClientWebSocket; upload uses TcpClient plus SslStream.
NETWORK BOTTLENECK CLASSIFIER
CLOUDFLARE REQUEST-LEVEL HARNESS
M-LAB NDT7 SINGLE-FLOW ADAPTER
TRANSACTIONAL WINDOWS NETWORK MUTATION ENGINE

DBNET IS THE PRODUCT NAME.
OVERHEAVEN IS THE INTERNAL JOURNALED MUTATION FUNCTION.
REPORTS ARE CLAIMS, NOT EVIDENCE.

WHAT CHANGED
------------
1.2.6 adds byte-exact package provenance. EXACT_CLEAN_COMMIT requires package-root equality, safe index flags, sanitized inherited GIT_* variables, and byte-for-byte HEAD proof. Dirty, hidden-index, nested-root, unavailable-Git, and non-Git states never claim exact commit bytes. No endpoint, threshold, measurement-policy, or Windows/network mutation changed.

NDT7 mode:
  - fails closed without explicit M-Lab data-policy consent;
  - discovers nearby healthy targets through Locate API v2;
  - uses the signed WSS download/upload URLs returned by Locate;
  - requires WebSocket subprotocol net.measurementlab.ndt.v7;
  - measures application goodput over one TCP connection per direction;
  - records server measurement messages and system counters separately;
  - redacts Locate access tokens from every persistent artifact;
  - optionally compares against a SHA-256-verified Cloudflare native session;
  - never changes Registry, TCP settings, NIC properties, adapter state, or Winsock.

QUALIFY
-------
  Set-Location 'C:\Users\DEADBYTE\Downloads\DBNET-1.2.6'
  .\DBNET.ps1 -Mode Verify
  .\DBNET.ps1 -Mode SelfTest
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass `
      -File .\tests\TEST-PROVENANCE.ps1

Expected results:
  Verify Status     : PASS
  SelfTest Status   : PASS
  NativeHarness     : PASS (19/19)
  Ndt7Harness       : PASS (40/40)
  Provenance suite  : PASS (18/18)

PRIVACY GATE
------------
M-Lab measurement data is retained and made public for research. Test data can
include the public-facing IP address and connection metadata. DBNET refuses to
run NDT7 unless the operator explicitly supplies:

  -AcceptMlabDataPolicy

That switch records consent in CONSENT.json. It does not hide data from M-Lab.

RUN WITHOUT BASELINE
--------------------
Open Windows PowerShell as Administrator:

  pktmon status

  .\DBNET.ps1 `
      -Mode Ndt7Probe `
      -AcceptMlabDataPolicy

RUN WITH VERIFIED CLOUDFLARE BASELINE
-------------------------------------
Use the qualified Standard session from DBNET 1.1.4 or later:

  $CloudflareSession =
      'C:\path\to\DBNET-NATIVE-YYYYMMDD-HHMMSS-NONCE'

  .\DBNET.ps1 `
      -Mode Ndt7Probe `
      -AcceptMlabDataPolicy `
      -CloudflareSessionPath $CloudflareSession

DBNET verifies the baseline SHA256SUMS.txt and fixed Cloudflare endpoint before
comparison. Unverified or altered sessions are rejected.

NDT7 EVIDENCE
-------------
Each successful session contains:

  PACKAGE-PROVENANCE.json
  CONSENT.json
  NDT7-CONFIG.json
  NDT7-LOCATE.json                  access tokens redacted
  NDT7-ATTEMPTS.json                target fallback record
  NDT7-DOWNLOAD.json
  NDT7-UPLOAD.json
  NDT7-DOWNLOAD-MESSAGES.jsonl
  NDT7-UPLOAD-MESSAGES.jsonl
  NDT7-SERVER-EVIDENCE.json
  NDT7-SUMMARY.json
  NDT7-REPORT.TXT
  LIVE-SAMPLES.csv
  LIVE-SUMMARY.json
  TOKEN-LEAK-CHECK.json
  SHA256SUMS.txt

INTERPRETATION
--------------
NDT7 is a single-connection application-goodput test. Cloudflare NativeProbe
contains both single-flow and multi-flow stages. Comparing NDT7 with the
verified Cloudflare single-flow values helps distinguish:

  similar result on both endpoints
    broader single-flow path behavior;

  NDT7 materially faster than Cloudflare single-flow
    Cloudflare endpoint/path-specific limitation candidate;

  NDT7 materially slower than Cloudflare single-flow
    M-Lab endpoint/path variance or transient path condition;

  local CPU/DPC/NIC saturation signature
    local candidate requiring exact inspection, never preset tuning.

SAFETY
------
Ndt7Probe is diagnostic-only.

  REGISTRY WRITE       NONE
  NETSH SET            NONE
  NIC PROPERTY WRITE   NONE
  ADAPTER RESTART      NONE
  WINSOCK RESET        NONE
  OVERHEAVEN           LOCKED

we are in ring-0 or overheaven!