acer: seed component 3 - token-cube catalog binder (references, never material)

- tools/behcs/token-cube-catalog-binder.mjs: deterministic time-free
contract binding crypto/hash token REFERENCES (token_id, kind,
digest_sha16, scope, catalog) to vantage-qualified cube BH addresses
- HARD RULES: tokens are references, never material - material-shaped
rejects (32+ hex, key-block markers, bearer shapes, base64 runs) are
REDACTED from rows, not echoed; digest exactly 16 lowercase hex kills
length spoofing; every row executable=0
- BH addresses MUST be vantage-qualified (BH-ACER-942, never BH-942) per
hilbert-collision canon; disputed band 930-1229 DEFERS to operator
regardless of vantage or scope (bilateral-ack pending)
- mint/write scopes and mode=live cap at DEFER_TO_OPERATOR; 12-rung ladder
- registries (6 kinds, 6 catalogs) declared DRAFT_ASSUMPTION; exact-match
case-sensitive - hilbert-omni-47D keeps its canonical capital D
- self-correction in receipt: acer's own test wrongly claimed all-lowercase
registries; fixed the test to exact-match semantics, not the registry
- sealed parity baseline 22 cases, time-free (no clock in any row);
pyramid 88/88 on acer; no live publish, no cube mutation, apex-T0 held

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -40,6 +40,7 @@ Every agent: (1) sees its **PID/device/timestamp-scoped dashboard**, (2) **trans
 - `tools/behcs/d22-verb-adapter.mjs` — thin D22 verb surface over the deterministic router/core.
 - `tools/behcs/dashboard-resolver.mjs` — component-1 resolver: `(pid, device, ts)` → tightest-scoped dashboard route, 8-rung demotion ladder.
 - `tools/behcs/watcher-supervisor-suggestion-emitter.mjs` — component-5 suggestion-row contract: watcher → supervisor draft rows, `executable=0` invariant, live actions cap at DEFER_TO_OPERATOR.
+- `tools/behcs/token-cube-catalog-binder.mjs` — component-3 binder: crypto/hash tokens as references bound to vantage-qualified cube BH addresses; material redacted, disputed band 930–1229 defers.
 - `tools/behcs/supervisor-collision-router.mjs` — Liris canonical implementation for Acer convergence.
 - `tests/supervisor-collision-router.unit.test.mjs` — executable router contract tests.
 

README.md.sha256

@@ -1 +1 @@
-39D0D3BB8F907463DC9713D64EFABCA6A85DF804D49B7ACA13306B38E1F936D6  README.md
+FDE9D25CE10E017E223172FD13E023E30BC2D8A19534A9017BB4243A476835F4  README.md

docs/ACER-TOKEN-CUBE-CATALOG-SEED-2026-06-11.hbp

@@ -0,0 +1,7 @@
+ACERTOKCUBESEEDHDR|host=acer|date=2026-06-11|component=architecture-component-3|topic=token-cube-catalog-binder-seed|lane=operator-relayed-liris-recommendation-acer-seeds-liris-attacks|json=0
+ACERTOKCUBESEEDSCOPE|repo_side_draft_only=1|untouched=live-MCP+fabric+cubes+keys|tokens=REFERENCES-ONLY(token_id+kind+digest_sha16+cube_bh+scope+catalog)|no-material-no-secrets-no-bearers-ever-inlined|json=0
+ACERTOKCUBESEEDDEFENSE|material-guard=long-hex+key-block-markers+bearer-shapes+base64-runs-REDACTED-not-echoed|digest=exactly-16-lowercase-hex-kills-length-spoofing|cube_bh=vantage-qualified-REQUIRED-per-hilbert-collision-canon|disputed-band-930-1229-DEFERS-always(bilateral-ack-pending)|scope-mint-write-DEFERS|mode-live-DEFERS|json=0
+ACERTOKCUBESEEDPROOF|determinism=double-run-byte-identical|parity_cases=22|time_free_contract=no-clock-in-any-row|binder_tests=12of12_PASS|selftest=9of9_PASS|json=0
+ACERTOKCUBESEEDSELFCORRECT|acer-own-test-initially-claimed-all-registries-lowercase|hilbert-omni-47D-carries-canonical-capital-D-from-real-artifact|fixed-test-to-exact-match-semantics-not-the-registry|json=0
+ACERTOKCUBESEEDOPEN|registry_membership=DRAFT_ASSUMPTION-declared(kinds+catalogs-from-fabric-canon)|live-binding+mint+write=gated-follow-up-operator-signoff|json=0
+ACERTOKCUBESEEDFTR|state=COMPONENT_3_SEED_READY_FOR_LIRIS_ADVERSARIAL_READBACK|mutates=receipt-files-only|mints=0|launches=0|usb_writes=0|engine_edits=0|json=0

docs/ACER-TOKEN-CUBE-CATALOG-SEED-2026-06-11.hbp.sha256

@@ -0,0 +1 @@
+3A61C7758B9347E2B89DB5D5896E65CCA16BE3BE04E86F9CCDF807E8EDD20BB2  ACER-TOKEN-CUBE-CATALOG-SEED-2026-06-11.hbp

docs/TARGET-ARCHITECTURE-VISION-2026-06-10.hbp

@@ -15,6 +15,7 @@ PROGRESS|2|F5_D22_adapter=tools/behcs/d22-verb-adapter.mjs|verbs=tuple_to_englis
 COMPONENT|3|name=60D+-CATALOGS+CRYPTO-TOKENS-IN-MCP-PIPES-CONNECTED-TO-CUBES|vision=47D-expanded-to-60D+-catalogs+newest-binary/sha/hash/crypto-as-TOKENS-in-the-MCP-pipes-wired-to-the-cubes
 PROVEN|3|60D-already-HELD(coord64,atlas-v55/v56,tuple_dim=60,3-vantage-verified-2026-06-01)+HBP-hot-path(sha256/hex/tuple-rows)+MCP-tuple-text(tupleResult-sha-per-row)+cube-of-cubes-addressing
 GAP|3|crypto/hash-tokens-as-FIRST-CLASS-MCP-pipe-tokens-connected-to-the-cubes-not-fully-wired|FIX=MCP-tools-emit-sha/hash-token-rows-keyed-to-cube-BH-addresses(token=cube-address-binding)|catalog-driven-tool-surface(verbs.hbp-overlay-pattern:73-verbs-added-zero-code)=the-60D-catalog-expansion-mechanism
+PROGRESS|3|binder_seed=tools/behcs/token-cube-catalog-binder.mjs|tokens=references-never-material(redaction-on-material-shapes)|digest=16-lowercase-hex|cube_bh=vantage-qualified-per-hilbert-collision-canon|disputed-band-930-1229-DEFERS|mint-write-live=DEFER_TO_OPERATOR|parity_baseline=TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp|draft_only=1|no_cube_mutation=1|json=0
 
 COMPONENT|4|name=INFINITE-NESTED-AGENTS-IN-OS-HARNESSES|vision=infinite-nested-agents-IN-the-operating-system-harness-for-ANY-agent
 PROVEN|4|N-Nest-Prime(depth-N-watcher-gate-proven-depth-16-over-2732-real-files,planted-confab-caught-at-EVERY-level,131071-nodes)+8-byte-agent-seed(sha256(seed)->glyph/cube/hilbert/prime,35TB/8B~=4.38T-slots)+intelligent-terminal-host-CMD-harness(wta-registry-fills-at-runtime)

docs/TARGET-ARCHITECTURE-VISION-2026-06-10.hbp.sha256

@@ -1 +1 @@
-99EB46E4DC8B2DFE60D61B0DFAB638A12D7DC9FC791B3D70DCC6DC72D8D82A22  TARGET-ARCHITECTURE-VISION-2026-06-10.hbp
+B1D3A4D90896958A4A968F6A2AC92AD8FE6CAEBBA151AC934482FD33448CC3FA  TARGET-ARCHITECTURE-VISION-2026-06-10.hbp

docs/TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp

@@ -0,0 +1,24 @@
+TOKCUBEPARITYHDR|component=3|cases=22|clock=none-time-free-contract|rule=rows-byte-identical-on-every-machine|json=0
+TOKCUBEPARITY|case=01|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITY|case=02|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=attest|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITY|case=03|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=bind-draft|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITY|case=04|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=mint|source_catalog=atlas-v55|mode=draft|verdict=DEFER_TO_OPERATOR|gate=scope-escalation-requires-operator|executable=0|json=0
+TOKCUBEPARITY|case=05|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=write|source_catalog=atlas-v55|mode=draft|verdict=DEFER_TO_OPERATOR|gate=scope-escalation-requires-operator|executable=0|json=0
+TOKCUBEPARITY|case=06|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=live|verdict=DEFER_TO_OPERATOR|gate=live-binding-requires-operator|executable=0|json=0
+TOKCUBEPARITY|case=07|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-942|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DEFER_TO_OPERATOR|gate=disputed-hilbert-band-930-1229-bilateral-ack-pending|executable=0|json=0
+TOKCUBEPARITY|case=08|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-929|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITY|case=09|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-930|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DEFER_TO_OPERATOR|gate=disputed-hilbert-band-930-1229-bilateral-ack-pending|executable=0|json=0
+TOKCUBEPARITY|case=10|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-LIRIS-1229|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DEFER_TO_OPERATOR|gate=disputed-hilbert-band-930-1229-bilateral-ack-pending|executable=0|json=0
+TOKCUBEPARITY|case=11|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-LIRIS-1230|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITY|case=12|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=invalid|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=missing-or-unqualified-cube-address|executable=0|json=0
+TOKCUBEPARITY|case=13|token_id=TOK-GNN-EDGE-0001|token_kind=invalid|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=unknown-token-kind|executable=0|json=0
+TOKCUBEPARITY|case=14|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=redacted|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=malformed-digest+material-not-reference-suspected|executable=0|json=0
+TOKCUBEPARITY|case=15|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=invalid|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=malformed-digest|executable=0|json=0
+TOKCUBEPARITY|case=16|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=invalid|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=malformed-digest|executable=0|json=0
+TOKCUBEPARITY|case=17|token_id=invalid|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=dirty-token_id|executable=0|json=0
+TOKCUBEPARITY|case=18|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=invalid|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=unknown-source-catalog|executable=0|json=0
+TOKCUBEPARITY|case=19|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=invalid|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=unknown-scope|executable=0|json=0
+TOKCUBEPARITY|case=20|token_id=TOK-GNN-EDGE-0001|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=invalid|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=missing-or-unqualified-cube-address|executable=0|json=0
+TOKCUBEPARITY|case=21|token_id=redacted|token_kind=sha16-row-hash|digest_sha16=794b8c68ec512f9e|cube_bh=BH-ACER-754|scope=read|source_catalog=atlas-v55|mode=draft|verdict=DRAFT_BINDING_BLOCKED|gate=malformed-token-id+material-not-reference-suspected|executable=0|json=0
+TOKCUBEPARITY|case=22|token_id=TOK-GNN-EDGE-0001|token_kind=cosign-seal|digest_sha16=794b8c68ec512f9e|cube_bh=BH-SHARED-1|scope=read|source_catalog=d22-translation|mode=draft|verdict=DRAFT_BINDING_READY|gate=none|executable=0|json=0
+TOKCUBEPARITYFTR|cases=22|exit=byte-match-when-regenerated-file-equals-sealed-baseline|json=0

docs/TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp.sha256

@@ -0,0 +1 @@
+4C9814008D178AF175B77E406F459A92605CE218EB97DC3C0650A0931D699D74  TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp

tests/supervisor-collision-router.system.test.mjs

@@ -28,6 +28,8 @@ const sealedFiles = [
   'docs/ACER-READBACK-DASHBOARD-RESOLVER-2026-06-11.hbp',
   'docs/WATCHER-SUPERVISOR-SUGGESTION-PARITY-BASELINE-2026-06-11.hbp',
   'docs/ACER-WATCHER-SUPERVISOR-SEED-2026-06-11.hbp',
+  'docs/TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp',
+  'docs/ACER-TOKEN-CUBE-CATALOG-SEED-2026-06-11.hbp',
   'docs/LIRIS-WATCHER-SUPERVISOR-READBACK-2026-06-11.hbp',
   'docs/ACER-READBACK-WATCHER-SUPERVISOR-2026-06-11.hbp',
   'docs/LIRIS-STEP166-PARITY-CONFIRMED-2026-06-11.hbp',
@@ -48,11 +50,15 @@ const sealedFiles = [
   'tools/behcs/watcher-supervisor-suggestion-emitter.mjs',
   'tools/behcs/watcher-supervisor-suggestion-emitter.hbp',
   'tools/behcs/watcher-supervisor-suggestion-emitter.hbi',
+  'tools/behcs/token-cube-catalog-binder.mjs',
+  'tools/behcs/token-cube-catalog-binder.hbp',
+  'tools/behcs/token-cube-catalog-binder.hbi',
   'tools/omni-processor/omnitranslator-v0.js',
   'tests/d22-verb-adapter.unit.test.mjs',
   'tests/d22-parity-probe.unit.test.mjs',
   'tests/dashboard-resolver.unit.test.mjs',
   'tests/watcher-supervisor-suggestion-emitter.unit.test.mjs',
+  'tests/token-cube-catalog-binder.unit.test.mjs',
   'tests/supervisor-collision-router.unit.test.mjs',
   'tests/supervisor-collision-router.integration.test.mjs',
   'tests/supervisor-collision-router.suite.test.mjs',
@@ -100,6 +106,12 @@ test('suggestion emitter descriptor records the current source and unit-test has
   assert.match(hbp, new RegExp(`test_sha256=${sha256('tests/watcher-supervisor-suggestion-emitter.unit.test.mjs')}`));
 });
 
+test('token-cube binder descriptor records the current source and unit-test hashes', () => {
+  const hbp = readFileSync(join(repo, 'tools/behcs/token-cube-catalog-binder.hbp'), 'utf8');
+  assert.match(hbp, new RegExp(`binder_sha256=${sha256('tools/behcs/token-cube-catalog-binder.mjs')}`));
+  assert.match(hbp, new RegExp(`test_sha256=${sha256('tests/token-cube-catalog-binder.unit.test.mjs')}`));
+});
+
 test('sidecar filenames point at their target basenames', () => {
   for (const rel of sealedFiles) {
     const text = readFileSync(join(repo, `${rel}.sha256`), 'utf8').trim();

tests/supervisor-collision-router.system.test.mjs.sha256

@@ -1 +1 @@
-07B3FCF17EAE1BA4EB3773E9B48D9AEFED38BFFAB5173803BFB73F016FEB52AB  supervisor-collision-router.system.test.mjs
+D555A102A27A58501D5193BFA4F7C2455AE12ACD6EAF9BD3A6485F401FF0AACA  supervisor-collision-router.system.test.mjs

tests/token-cube-catalog-binder.unit.test.mjs

@@ -0,0 +1,148 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import {
+  CATALOGS,
+  DISPUTED_BANDS,
+  SCOPES,
+  TOKEN_KINDS,
+  bindToken,
+  emitParityRows,
+  selfTest,
+  statusRows,
+} from '../tools/behcs/token-cube-catalog-binder.mjs';
+
+const GOOD = Object.freeze({
+  token_id: 'TOK-GNN-EDGE-0001',
+  token_kind: 'sha16-row-hash',
+  digest_sha16: '794b8c68ec512f9e',
+  cube_bh: 'BH-ACER-754',
+  scope: 'read',
+  source_catalog: 'atlas-v55',
+});
+
+const FULL_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+
+test('clean reference binding is DRAFT_BINDING_READY and never executable', () => {
+  const out = bindToken({ ...GOOD });
+  assert.equal(out.verdict, 'DRAFT_BINDING_READY');
+  assert.equal(out.executable, 0);
+  assert.ok(out.row.includes('|executable=0|'));
+  assert.equal(out.gate, 'none');
+});
+
+test('secret leakage: material-shaped values are redacted, never echoed', () => {
+  const longKey = bindToken({ ...GOOD, token_id: 'BEGIN-PRIVATE-KEY-MATERIAL-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' });
+  assert.equal(longKey.verdict, 'DRAFT_BINDING_BLOCKED');
+  assert.equal(longKey.token_id, 'redacted');
+  assert.ok(longKey.gate.includes('material-not-reference-suspected'));
+  assert.ok(!longKey.row.includes('PRIVATE'), 'key-block marker must not reach the row');
+
+  const fullHash = bindToken({ ...GOOD, digest_sha16: FULL_SHA256 });
+  assert.equal(fullHash.digest_sha16, 'redacted');
+  assert.ok(!fullHash.row.includes(FULL_SHA256), 'full sha256 material must not reach the row');
+});
+
+test('hash-length spoofing and digest normalization: exactly 16 lowercase hex or blocked', () => {
+  for (const digest of ['794b8c68ec512f9', '794b8c68ec512f9e0', '794B8C68EC512F9E', 'zz4b8c68ec512f9e', '', null]) {
+    const out = bindToken({ ...GOOD, digest_sha16: digest });
+    assert.equal(out.verdict, 'DRAFT_BINDING_BLOCKED', `digest=${digest}`);
+    assert.ok(out.gate.startsWith('malformed-digest') || out.gate.startsWith('dirty-'), out.gate);
+  }
+  assert.equal(bindToken({ ...GOOD, digest_sha16: FULL_SHA256 }).gate, 'malformed-digest+material-not-reference-suspected');
+});
+
+test('HBP injection: pipe/CR/LF in any field blocks before echo', () => {
+  for (const patch of [
+    { token_id: 'TOK-EVIL|json=1' },
+    { cube_bh: 'BH-ACER-754|mutates=1' },
+    { source_catalog: 'atlas-v55\nrow' },
+    { scope: 'read\r' },
+  ]) {
+    const out = bindToken({ ...GOOD, ...patch });
+    assert.equal(out.verdict, 'DRAFT_BINDING_BLOCKED');
+    assert.ok(out.gate.startsWith('dirty-'));
+    assert.ok(!out.row.includes('json=1') || !out.row.includes('mutates=1'));
+    assert.equal((out.row.match(/json=0/g) ?? []).length, 1, 'row carries exactly one json=0 terminator');
+  }
+});
+
+test('scope escalation: mint and write cap at DEFER_TO_OPERATOR, never READY', () => {
+  for (const [scope, meta] of Object.entries(SCOPES)) {
+    const out = bindToken({ ...GOOD, scope });
+    if (meta.escalates) {
+      assert.equal(out.verdict, 'DEFER_TO_OPERATOR', scope);
+      assert.equal(out.gate, 'scope-escalation-requires-operator');
+    } else {
+      assert.equal(out.verdict, 'DRAFT_BINDING_READY', scope);
+    }
+    assert.equal(out.executable, 0);
+  }
+  assert.equal(bindToken({ ...GOOD, scope: 'root' }).gate, 'unknown-scope');
+});
+
+test('live-binding semantics: mode=live defers, unknown mode blocks, default is draft', () => {
+  assert.equal(bindToken({ ...GOOD, mode: 'live' }).verdict, 'DEFER_TO_OPERATOR');
+  assert.equal(bindToken({ ...GOOD, mode: 'live' }).gate, 'live-binding-requires-operator');
+  assert.equal(bindToken({ ...GOOD, mode: 'yolo' }).gate, 'unknown-mode');
+  assert.equal(bindToken({ ...GOOD }).mode, 'draft');
+});
+
+test('cube address ambiguity: vantage qualification required per hilbert-collision canon', () => {
+  for (const cube_bh of ['BH-942', 'BH-acer-754', 'BH-OTHER-754', '754', 'BH-ACER-', 'BH-ACER-1234567', null]) {
+    const out = bindToken({ ...GOOD, cube_bh });
+    assert.equal(out.verdict, 'DRAFT_BINDING_BLOCKED', `cube_bh=${cube_bh}`);
+    assert.equal(out.gate, 'missing-or-unqualified-cube-address');
+  }
+});
+
+test('disputed hilbert band 930-1229 defers regardless of vantage, exact boundaries', () => {
+  assert.deepEqual(DISPUTED_BANDS.map((b) => [b.lo, b.hi]), [[930, 1229]]);
+  assert.equal(bindToken({ ...GOOD, cube_bh: 'BH-ACER-929' }).verdict, 'DRAFT_BINDING_READY');
+  assert.equal(bindToken({ ...GOOD, cube_bh: 'BH-ACER-930' }).verdict, 'DEFER_TO_OPERATOR');
+  assert.equal(bindToken({ ...GOOD, cube_bh: 'BH-LIRIS-1229' }).verdict, 'DEFER_TO_OPERATOR');
+  assert.equal(bindToken({ ...GOOD, cube_bh: 'BH-LIRIS-1230' }).verdict, 'DRAFT_BINDING_READY');
+  assert.equal(bindToken({ ...GOOD, cube_bh: 'BH-SHARED-1000' }).verdict, 'DEFER_TO_OPERATOR', 'SHARED vantage does not bypass the disputed band');
+});
+
+test('registry case sensitivity: exact-match only, case-flips rejected', () => {
+  assert.equal(bindToken({ ...GOOD, token_kind: 'SHA16-ROW-HASH' }).gate, 'unknown-token-kind');
+  assert.equal(bindToken({ ...GOOD, source_catalog: 'ATLAS-V55' }).gate, 'unknown-source-catalog');
+  assert.equal(bindToken({ ...GOOD, token_kind: 'jwt-bearer' }).gate, 'unknown-token-kind');
+  // hilbert-omni-47D carries its canonical capital D (matches the real
+  // fabric artifact name) -- exact bytes pass, case-flips fail.
+  assert.ok(CATALOGS.includes('hilbert-omni-47D'));
+  assert.equal(bindToken({ ...GOOD, source_catalog: 'hilbert-omni-47D' }).verdict, 'DRAFT_BINDING_READY');
+  assert.equal(bindToken({ ...GOOD, source_catalog: 'hilbert-omni-47d' }).gate, 'unknown-source-catalog');
+  assert.ok(TOKEN_KINDS.every((k) => k === k.toLowerCase()), 'kinds are all-lowercase by design');
+});
+
+test('blocked and deferred rows leak no extra context: closed verdict set, no host paths, no material', () => {
+  const allRows = [...statusRows(), ...emitParityRows()];
+  for (const row of allRows) {
+    assert.ok(!row.includes('executable=1'), row);
+    assert.ok(!/[\\]|C:|Users|rayss|home\/|PRIVATE/.test(row), `leak: ${row}`);
+    assert.ok(!row.includes(FULL_SHA256), 'material must not appear in any sealed row');
+    assert.ok(row.endsWith('json=0') && !row.includes('{"'));
+  }
+  for (const c of [{ ...GOOD }, { ...GOOD, mode: 'live' }, { ...GOOD, token_kind: 'nope' }]) {
+    const v = bindToken(c).verdict;
+    assert.ok(['DRAFT_BINDING_READY', 'DEFER_TO_OPERATOR', 'DRAFT_BINDING_BLOCKED'].includes(v));
+  }
+});
+
+// Component-3 parity, STEP|166 pattern: a green pyramid run on liris IS the
+// bilateral byte-match. Contract is time-free, so no clock enters the rows.
+test('component-3 parity: regenerated rows byte-match the sealed baseline', () => {
+  const regenerated = emitParityRows().join('\n') + '\n';
+  const baseline = readFileSync(
+    new URL('../docs/TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp', import.meta.url),
+    'utf8',
+  );
+  assert.equal(regenerated, baseline, 'this machine produced different bytes than the sealed baseline');
+});
+
+test('binder self-test passes', () => {
+  assert.equal(selfTest().ok, true);
+});

tests/token-cube-catalog-binder.unit.test.mjs.sha256

@@ -0,0 +1 @@
+5CA3D173EEE52A1689BC56A7FC5BA889781A894F807585121C7DA7B333B7ED68  token-cube-catalog-binder.unit.test.mjs

tools/behcs/token-cube-catalog-binder.hbi

@@ -0,0 +1,12 @@
+TOKCUBEINDEX|host=acer|target=token-cube-catalog-binder.hbp|tool=token-cube-catalog-binder.mjs|rows=11|json=0
+INDEXROW|row=1|kind=header|component=architecture-component-3|json=0
+INDEXROW|row=2|kind=law|tokens=references-never-material|invariant=executable-0|json=0
+INDEXROW|row=3|kind=scope|repo_side_draft_only=1|no_live_binding=1|json=0
+INDEXROW|row=4|kind=ladder|rungs=12|json=0
+INDEXROW|row=5|kind=table|kinds=6|catalogs=6|membership=DRAFT_ASSUMPTION|json=0
+INDEXROW|row=6|kind=format|digest=16-lowercase-hex|cube_bh=vantage-qualified|registries=exact-match|json=0
+INDEXROW|row=7|kind=disputed|band=930-1229|verdict=DEFER_TO_OPERATOR|json=0
+INDEXROW|row=8|kind=safety|mutates=0|pure_function=1|no_secret_material=1|json=0
+INDEXROW|row=9|kind=verify|required=node-check+node-test+self-test+parity-byte-compare|json=0
+INDEXROW|row=10|kind=sha|fields=binder_sha256+test_sha256|json=0
+INDEXROW|row=11|kind=footer|state=COMPONENT_3_SEED_READY_FOR_LIRIS_ADVERSARIAL_READBACK|json=0

tools/behcs/token-cube-catalog-binder.hbi.sha256

@@ -0,0 +1 @@
+03FE77AE283BDC8AC5838852F540AC9FD9513ABA844A6DB7D36DCF27F70EFBA2  token-cube-catalog-binder.hbi

tools/behcs/token-cube-catalog-binder.hbp

@@ -0,0 +1,11 @@
+TOKCUBEHDR|host=acer|component=architecture-component-3|tool=tools/behcs/token-cube-catalog-binder.mjs|purpose=crypto-hash-tokens-as-first-class-references-bound-to-cube-bh-addresses|json=0
+TOKCUBELAW|rule=tokens-are-REFERENCES-never-material|invariant=every-row-executable-0|redaction=material-shaped-rejects-show-redacted-never-echoed|composes=TARGET-ARCHITECTURE-VISION-2026-06-10(COMPONENT-3)+hilbert-collision-canon(vantage-qualified-BH-ADDR)|json=0
+TOKCUBESCOPE_DOC|repo_side_draft_only=1|never=live-MCP-publish+fabric-call+mint+cube-mutation+key-generation+secret-material|live_binding=SEPARATE-GATED-FOLLOW-UP-operator-signoff|json=0
+TOKCUBELADDER|rungs=12|order=dirty-BLOCKED+malformed-token-id-BLOCKED(material-redacted)+unknown-kind-BLOCKED+malformed-digest-BLOCKED(material-redacted)+unqualified-cube-address-BLOCKED+unknown-catalog-BLOCKED+unknown-scope-BLOCKED+unknown-mode-BLOCKED+live-mode-DEFER+mint-write-scope-DEFER+disputed-band-DEFER+clean-DRAFT_BINDING_READY|json=0
+TOKCUBETABLE|kinds=sha256-ref+sha16-row-hash+hex-envelope+ed25519-pubkey-fingerprint+cosign-seal+bh-tuple-digest|catalogs=hilbert-omni-47D+atlas-v55+atlas-v56+verbs-overlay-73+quant-bus-v48+d22-translation|membership=DRAFT_ASSUMPTION-declared-bilateral-contest-welcome|json=0
+TOKCUBEFORMAT|token_id=TOK-prefix-bounded-4-to-40|digest=exactly-16-lowercase-hex(sha16-row-hash-convention)|cube_bh=BH-VANTAGE-INDEX(vantage=ACER+LIRIS+SHARED-REQUIRED-per-hilbert-collision-canon)|registries=exact-match-case-sensitive(hilbert-omni-47D-keeps-canonical-capital-D)|json=0
+TOKCUBEDISPUTED_DOC|band=930-1229|why=acer-liris-hilbert-overlap-bilateral-ack-pending|rule=any-binding-in-band-DEFERS-regardless-of-vantage-or-scope|json=0
+TOKCUBESAFETY|mutates=0|pure_function=1|time_free_contract=1|no_live_publish=1|no_fabric_call=1|no_mint=1|no_cube_mutation=1|no_key_generation=1|no_secret_material=1|usb_writes=0|engine_edits=0|external_calls=0|json=0
+TOKCUBEVERIFY|required=node-check+node-test+self-test+parity-byte-compare|parity_baseline=docs/TOKEN-CUBE-CATALOG-PARITY-BASELINE-2026-06-11.hbp|clock=none-time-free|json=0
+TOKCUBESHA|binder_sha256=CB410FB9F8FCD91DBF048A408AE9A7CBA92141323760BFC00D9BB9F61A526FAF|test_sha256=5CA3D173EEE52A1689BC56A7FC5BA889781A894F807585121C7DA7B333B7ED68|json=0
+TOKCUBEFTR|state=COMPONENT_3_SEED_READY_FOR_LIRIS_ADVERSARIAL_READBACK|json=0

tools/behcs/token-cube-catalog-binder.hbp.sha256

@@ -0,0 +1 @@
+036F0C62CAEE71A1DF75FBEAFAFF5940597604F8F71A4D567F406D2586E20BFD  token-cube-catalog-binder.hbp

tools/behcs/token-cube-catalog-binder.mjs

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// COMPONENT|3 seed: crypto/hash tokens as FIRST-CLASS references bound to
+// cube BH addresses -- deterministic catalog + binder, repo-side DRAFT ONLY.
+// No live MCP publish, no fabric call, no mint, no cube mutation, no key
+// generation. Tokens are REFERENCES: a row carries a token_id, a kind, a
+// 16-hex digest, and a cube address -- never token material, secrets,
+// private keys, or bearer strings. Every field is format- or registry-
+// validated before it can reach a row, and anything that LOOKS like raw
+// material is redacted, not echoed. Every row carries executable=0.
+// The contract is time-free: no clock enters any row, so parity is
+// deterministic without a fixed-now.
+
+export const BINDER_ID = 'token-cube-catalog-binder.v1';
+
+// Registry membership is a DRAFT_ASSUMPTION (declared per lane rules) --
+// kinds/catalogs drawn from fabric canon, bilateral contest welcome.
+export const TOKEN_KINDS = Object.freeze([
+  'sha256-ref',
+  'sha16-row-hash',
+  'hex-envelope',
+  'ed25519-pubkey-fingerprint',
+  'cosign-seal',
+  'bh-tuple-digest',
+]);
+
+export const CATALOGS = Object.freeze([
+  'hilbert-omni-47D',
+  'atlas-v55',
+  'atlas-v56',
+  'verbs-overlay-73',
+  'quant-bus-v48',
+  'd22-translation',
+]);
+
+// mint and write scopes are cosign territory: they cap at DEFER_TO_OPERATOR
+// no matter how clean the rest of the input is.
+export const SCOPES = Object.freeze({
+  read: { escalates: 0 },
+  attest: { escalates: 0 },
+  'bind-draft': { escalates: 0 },
+  mint: { escalates: 1 },
+  write: { escalates: 1 },
+});
+
+// Hilbert-collision canon: BH addresses MUST be vantage-qualified, and the
+// acer/liris overlap band 930-1229 is DISPUTED pending bilateral ack --
+// any binding into it defers to the operator regardless of scope/vantage.
+export const BH_VANTAGES = Object.freeze(['ACER', 'LIRIS', 'SHARED']);
+export const DISPUTED_BANDS = Object.freeze([Object.freeze({ lo: 930, hi: 1229, why: 'acer-liris-overlap-bilateral-ack-pending' })]);
+
+const TOKEN_ID_RE = /^TOK-[A-Z0-9][A-Z0-9-]{2,38}$/;
+const DIGEST_RE = /^[0-9a-f]{16}$/;
+const CUBE_BH_RE = /^BH-(ACER|LIRIS|SHARED)-(\d{1,6})$/;
+const DIRTY_RE = /[|\r\n]/;
+// Material detectors: long contiguous hex, key-block markers, bearer shapes,
+// long base64 runs. Anything matching is redacted from rows entirely.
+const MATERIAL_RES = Object.freeze([
+  /[0-9a-fA-F]{32,}/,
+  /BEGIN[ -]?[A-Z -]*PRIVATE[ -]?KEY/i,
+  /bearer[ :=-]/i,
+  /[A-Za-z0-9+/]{40,}={0,2}/,
+]);
+
+function looksLikeMaterial(value) {
+  return typeof value === 'string' && MATERIAL_RES.some((re) => re.test(value));
+}
+
+function cleanString(value) {
+  return typeof value === 'string' && !DIRTY_RE.test(value) ? value : null;
+}
+
+// Row echo policy: format/registry-valid value, or 'invalid', or 'redacted'
+// when the rejected value looks like raw material. Raw input never passes.
+function echoField(value, validator) {
+  const clean = cleanString(value);
+  if (clean == null) return 'invalid';
+  if (looksLikeMaterial(clean)) return 'redacted';
+  return validator(clean) ? clean : 'invalid';
+}
+
+function buildResult(inp, verdict, gates) {
+  const fields = {
+    token_id: echoField(inp.token_id, (v) => TOKEN_ID_RE.test(v)),
+    token_kind: echoField(inp.token_kind, (v) => TOKEN_KINDS.includes(v)),
+    digest_sha16: echoField(inp.digest_sha16, (v) => DIGEST_RE.test(v)),
+    cube_bh: echoField(inp.cube_bh, (v) => CUBE_BH_RE.test(v)),
+    scope: echoField(inp.scope, (v) => Object.hasOwn(SCOPES, v)),
+    source_catalog: echoField(inp.source_catalog, (v) => CATALOGS.includes(v)),
+    mode: echoField(inp.mode ?? 'draft', (v) => v === 'draft' || v === 'live'),
+    verdict,
+    gate: gates.length ? gates.join('+') : 'none',
+  };
+  const row = [
+    'TOKCUBEBIND',
+    `token_id=${fields.token_id}`,
+    `token_kind=${fields.token_kind}`,
+    `digest_sha16=${fields.digest_sha16}`,
+    `cube_bh=${fields.cube_bh}`,
+    `scope=${fields.scope}`,
+    `source_catalog=${fields.source_catalog}`,
+    `mode=${fields.mode}`,
+    `verdict=${fields.verdict}`,
+    `gate=${fields.gate}`,
+    'executable=0',
+    'json=0',
+  ].join('|');
+  return { ...fields, ok: verdict !== 'DRAFT_BINDING_BLOCKED', executable: 0, row };
+}
+
+export function bindToken(input) {
+  const inp = input ?? {};
+  const blocked = (...gates) => buildResult(inp, 'DRAFT_BINDING_BLOCKED', gates);
+
+  // Rung 1: dirty input never reaches a row.
+  for (const field of ['token_id', 'token_kind', 'digest_sha16', 'cube_bh', 'scope', 'source_catalog', 'mode']) {
+    const value = inp[field];
+    if (value != null && (typeof value !== 'string' || DIRTY_RE.test(value))) {
+      return blocked(`dirty-${field}`);
+    }
+  }
+
+  // Rung 2: token_id is a bounded reference id -- material cannot hide in it.
+  const tokenId = inp.token_id ?? '';
+  if (!TOKEN_ID_RE.test(tokenId)) {
+    return looksLikeMaterial(tokenId)
+      ? blocked('malformed-token-id', 'material-not-reference-suspected')
+      : blocked('malformed-token-id');
+  }
+
+  // Rung 3: kind must be registered.
+  if (!TOKEN_KINDS.includes(inp.token_kind ?? '')) return blocked('unknown-token-kind');
+
+  // Rung 4: digest is EXACTLY 16 lowercase hex (sha16 row-hash convention).
+  // Longer hex is a length-spoof AND looks like material -> redact + flag.
+  const digest = inp.digest_sha16 ?? '';
+  if (!DIGEST_RE.test(digest)) {
+    return looksLikeMaterial(digest)
+      ? blocked('malformed-digest', 'material-not-reference-suspected')
+      : blocked('malformed-digest');
+  }
+
+  // Rung 5: cube address must be vantage-qualified per hilbert-collision canon.
+  const bhMatch = CUBE_BH_RE.exec(inp.cube_bh ?? '');
+  if (!bhMatch) return blocked('missing-or-unqualified-cube-address');
+
+  // Rungs 6-7: catalog and scope must be registered.
+  if (!CATALOGS.includes(inp.source_catalog ?? '')) return blocked('unknown-source-catalog');
+  if (!Object.hasOwn(SCOPES, inp.scope ?? '')) return blocked('unknown-scope');
+
+  // Rung 8: mode must be draft or live.
+  const mode = inp.mode ?? 'draft';
+  if (mode !== 'draft' && mode !== 'live') return blocked('unknown-mode');
+
+  // Rung 9: live binding is operator territory.
+  if (mode === 'live') return buildResult(inp, 'DEFER_TO_OPERATOR', ['live-binding-requires-operator']);
+
+  // Rung 10: scope escalation (mint/write) is cosign territory.
+  if (SCOPES[inp.scope].escalates) {
+    return buildResult(inp, 'DEFER_TO_OPERATOR', ['scope-escalation-requires-operator']);
+  }
+
+  // Rung 11: disputed hilbert band defers regardless of vantage or scope.
+  const index = Number(bhMatch[2]);
+  const disputed = DISPUTED_BANDS.find((band) => index >= band.lo && index <= band.hi);
+  if (disputed) {
+    return buildResult(inp, 'DEFER_TO_OPERATOR', [`disputed-hilbert-band-${disputed.lo}-${disputed.hi}-bilateral-ack-pending`]);
+  }
+
+  // Rung 12: clean draft binding, still executable=0 by contract.
+  return buildResult(inp, 'DRAFT_BINDING_READY', []);
+}
+
+export function statusRows() {
+  const rows = [
+    `TOKCUBEHDR|ok=1|id=${BINDER_ID}|component=3|kinds=${TOKEN_KINDS.length}|catalogs=${CATALOGS.length}|scopes=${Object.keys(SCOPES).length}|vantages=${BH_VANTAGES.length}|invariant=every-row-executable-0|state=DRAFT_CONTRACT_NO_LIVE_BINDING|json=0`,
+    'TOKCUBELAW|rule=tokens-are-REFERENCES-never-material|redaction=material-shaped-rejects-show-redacted-not-echoed|address_rule=BH-vantage-qualified-per-hilbert-collision-canon|json=0',
+  ];
+  for (const kind of TOKEN_KINDS) rows.push(`TOKCUBEKIND|id=${kind}|json=0`);
+  for (const catalog of CATALOGS) rows.push(`TOKCUBECATALOG|id=${catalog}|membership=DRAFT_ASSUMPTION|json=0`);
+  for (const [id, meta] of Object.entries(SCOPES)) {
+    rows.push(`TOKCUBESCOPE|id=${id}|escalates=${meta.escalates}|max_verdict=${meta.escalates ? 'DEFER_TO_OPERATOR' : 'DRAFT_BINDING_READY'}|json=0`);
+  }
+  for (const band of DISPUTED_BANDS) {
+    rows.push(`TOKCUBEDISPUTED|lo=${band.lo}|hi=${band.hi}|why=${band.why}|verdict=DEFER_TO_OPERATOR|json=0`);
+  }
+  rows.push('TOKCUBESAFETY|mutates=0|pure_function=1|no_live_publish=1|no_fabric_call=1|no_mint=1|no_cube_mutation=1|no_key_generation=1|no_secret_material=1|json=0');
+  rows.push('TOKCUBEEND|state=COMPONENT_3_SEED_DRAFT_CONTRACT|json=0');
+  return rows;
+}
+
+// Parity baseline: fixed cases, time-free contract -- rows byte-identical
+// on every machine with no clock input at all.
+const BASE = Object.freeze({
+  token_id: 'TOK-GNN-EDGE-0001',
+  token_kind: 'sha16-row-hash',
+  digest_sha16: '794b8c68ec512f9e',
+  cube_bh: 'BH-ACER-754',
+  scope: 'read',
+  source_catalog: 'atlas-v55',
+});
+const PARITY_CASES = Object.freeze([
+  { id: '01', input: { ...BASE } },
+  { id: '02', input: { ...BASE, scope: 'attest' } },
+  { id: '03', input: { ...BASE, scope: 'bind-draft' } },
+  { id: '04', input: { ...BASE, scope: 'mint' } },
+  { id: '05', input: { ...BASE, scope: 'write' } },
+  { id: '06', input: { ...BASE, mode: 'live' } },
+  { id: '07', input: { ...BASE, cube_bh: 'BH-ACER-942' } },
+  { id: '08', input: { ...BASE, cube_bh: 'BH-ACER-929' } },
+  { id: '09', input: { ...BASE, cube_bh: 'BH-ACER-930' } },
+  { id: '10', input: { ...BASE, cube_bh: 'BH-LIRIS-1229' } },
+  { id: '11', input: { ...BASE, cube_bh: 'BH-LIRIS-1230' } },
+  { id: '12', input: { ...BASE, cube_bh: 'BH-942' } },
+  { id: '13', input: { ...BASE, token_kind: 'jwt-bearer' } },
+  { id: '14', input: { ...BASE, digest_sha16: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' } },
+  { id: '15', input: { ...BASE, digest_sha16: '794B8C68EC512F9E' } },
+  { id: '16', input: { ...BASE, digest_sha16: '794b8c68ec512f9' } },
+  { id: '17', input: { ...BASE, token_id: 'TOK-EVIL|json=1' } },
+  { id: '18', input: { ...BASE, source_catalog: 'catalog-of-doom' } },
+  { id: '19', input: { ...BASE, scope: 'root' } },
+  { id: '20', input: { ...BASE, cube_bh: null } },
+  { id: '21', input: { ...BASE, token_id: 'BEGIN-PRIVATE-KEY-MATERIAL-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' } },
+  { id: '22', input: { ...BASE, cube_bh: 'BH-SHARED-1', token_kind: 'cosign-seal', source_catalog: 'd22-translation' } },
+]);
+
+export function emitParityRows() {
+  const rows = [
+    `TOKCUBEPARITYHDR|component=3|cases=${PARITY_CASES.length}|clock=none-time-free-contract|rule=rows-byte-identical-on-every-machine|json=0`,
+  ];
+  for (const probe of PARITY_CASES) {
+    const out = bindToken(probe.input);
+    rows.push(`TOKCUBEPARITY|case=${probe.id}|${out.row.slice('TOKCUBEBIND|'.length)}`);
+  }
+  rows.push(
+    `TOKCUBEPARITYFTR|cases=${PARITY_CASES.length}|exit=byte-match-when-regenerated-file-equals-sealed-baseline|json=0`,
+  );
+  return rows;
+}
+
+export function selfTest() {
+  const checks = [];
+  const add = (name, ok) => checks.push({ name, ok });
+
+  add('clean-draft-ready', bindToken({ ...BASE }).verdict === 'DRAFT_BINDING_READY');
+  add('mint-scope-defers', bindToken({ ...BASE, scope: 'mint' }).verdict === 'DEFER_TO_OPERATOR');
+  add('live-mode-defers', bindToken({ ...BASE, mode: 'live' }).verdict === 'DEFER_TO_OPERATOR');
+  add('disputed-band-defers', bindToken({ ...BASE, cube_bh: 'BH-ACER-942' }).gate.startsWith('disputed-hilbert-band'));
+  add('unqualified-bh-blocked', bindToken({ ...BASE, cube_bh: 'BH-942' }).verdict === 'DRAFT_BINDING_BLOCKED');
+  add('full-sha256-redacted', bindToken({ ...BASE, digest_sha16: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' }).digest_sha16 === 'redacted');
+  add('material-token-id-redacted', bindToken({ ...BASE, token_id: 'BEGIN-PRIVATE-KEY-MATERIAL-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' }).token_id === 'redacted');
+  add('every-row-executable-0', emitParityRows().slice(1, -1).every((row) => row.includes('|executable=0|')));
+  add('rows-hbp-only', [...statusRows(), ...emitParityRows()].every((row) => row.endsWith('json=0') && !row.includes('{"')));
+
+  return { ok: checks.every((check) => check.ok), checks };
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+
+if (isMain) {
+  const cmd = process.argv[2] || '--status';
+  if (cmd === '--status') {
+    console.log(statusRows().join('\n'));
+  } else if (cmd === '--self-test') {
+    const result = selfTest();
+    for (const check of result.checks) console.log(`${check.ok ? 'PASS' : 'FAIL'} ${check.name}`);
+    process.exit(result.ok ? 0 : 1);
+  } else if (cmd === '--parity') {
+    process.stdout.write(emitParityRows().join('\n') + '\n');
+  } else {
+    console.error('usage: token-cube-catalog-binder.mjs --status | --self-test | --parity');
+    process.exit(1);
+  }
+}

tools/behcs/token-cube-catalog-binder.mjs.sha256

@@ -0,0 +1 @@
+CB410FB9F8FCD91DBF048A408AE9A7CBA92141323760BFC00D9BB9F61A526FAF  token-cube-catalog-binder.mjs