deadbyte-mcp 0.11.3 → 0.13.0

package/src/remote-mcp-desktop-r40-smoke-client.mjs

@@ -0,0 +1,70 @@
+import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client,StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { loadDesktopPolicy } from './desktop-policy-r40.mjs';
+import { verifyDesktopReceiptObject } from './desktop-runtime-r40.mjs';
+import { loadPublicVerifyKey } from './trust.mjs';
+
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+function gateway(result,label){
+  if(result.isError)throw new Error(label+' returned error: '+JSON.stringify(result.structuredContent??result.content));
+  const value=result.structuredContent;
+  if(!value||value.status!=='ok'||!value.result)throw new Error(label+' malformed');
+  return value.result;
+}
+function predispatchForegroundChanged(result){
+  if(result?.isError!==true)return false;
+  const value=result.structuredContent;
+  return value?.status==='denied'&&value?.op==='action'&&value?.error==='desktop foreground window changed before action';
+}
+async function verify(policy,key,id,sha,kind){
+  const receipt=JSON.parse(await readFile(path.join(policy.evidence_dir,id+'.json'),'utf8'));
+  const proof=verifyDesktopReceiptObject(receipt,{policySha256:policy.policy_sha256,publicKey:key.publicKey,keyId:key.keyId});
+  if(!proof.ok||proof.receipt_sha256!==sha||proof.kind!==kind)throw new Error('desktop smoke receipt mismatch '+kind);
+}
+export async function runR40DesktopGuardedSmoke(endpointText){
+  const endpoint=new URL(endpointText);if(endpoint.protocol!=='https:')throw new Error('R40 Desktop smoke requires HTTPS');
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  const policy=await loadDesktopPolicy(path.join(pointer.generation_root,'desktop-policy.json'));
+  const key=await loadPublicVerifyKey(path.join(stateRoot,'trust','ed25519-public.pem'));
+  const client=new Client({name:'deadbyte-r40-desktop-guarded-smoke',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StreamableHTTPClientTransport(endpoint);
+  try{
+    await client.connect(transport);
+    const status=gateway(await client.callTool({name:'desktop_control',arguments:{op:'status'}}),'desktop status');
+    if(status.armed!==true||!status.action_kinds?.includes('key_chord'))throw new Error('Desktop smoke requires separately armed key_chord authority');
+    const maxPredispatchAttempts=3;
+    let action=null;
+    let observationReceiptsVerified=0;
+    let predispatchRetryCount=0;
+    for(let attempt=1;attempt<=maxPredispatchAttempts;attempt+=1){
+      const observed=gateway(await client.callTool({name:'desktop_control',arguments:{op:'observe',preview:false}}),'desktop observe');
+      await verify(policy,key,observed.receipt_id,observed.receipt_sha256,'desktop_observation');
+      observationReceiptsVerified+=1;
+      const actionResult=await client.callTool({name:'desktop_control',arguments:{
+        op:'action',intent_id:randomBytes(32).toString('hex'),kind:'key_chord',expected_frame_id:observed.frame.frame_id,
+        target_id:null,point:null,scroll_delta:null,key_chord:['SHIFT'],text:null
+      }});
+      if(predispatchForegroundChanged(actionResult)){
+        if(attempt===maxPredispatchAttempts)throw new Error('Desktop guarded smoke foreground remained unstable before dispatch');
+        predispatchRetryCount+=1;
+        continue;
+      }
+      action=gateway(actionResult,'desktop key_chord');
+      break;
+    }
+    if(!action||action.injected!==true||action.side_effect_state!=='confirmed_injected'||action.action_summary?.kind!=='key_chord')throw new Error('Desktop guarded smoke input not confirmed');
+    await verify(policy,key,action.started_receipt_id,action.started_receipt_sha256,'desktop_action_started');
+    await verify(policy,key,action.post_receipt_id,action.post_receipt_sha256,'desktop_post_observation');
+    await verify(policy,key,action.receipt_id,action.receipt_sha256,'desktop_action_completed');
+    return {status:'passed',kind:'key_chord',keys:['SHIFT'],native_injected:true,replay_performed:false,
+      predispatch_retry_count:predispatchRetryCount,observation_receipts_verified:observationReceiptsVerified,
+      observation_receipt_verified:true,action_receipts_verified:3,action_chain_sha256:action.action_chain?.chain_sha256??null,
+      effect_id:action.effect_id,receipt_id:action.receipt_id,receipt_sha256:action.receipt_sha256};
+  }finally{await client.close().catch(()=>{});}
+}
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){const endpoint=process.argv[2];if(!endpoint)throw new Error('usage: node src/remote-mcp-desktop-r40-smoke-client.mjs https://host/mcp/path');
+runR40DesktopGuardedSmoke(endpoint).then(v=>console.log(JSON.stringify(v,null,2))).catch(e=>{console.error(e instanceof Error?e.stack:String(e));process.exitCode=1;});}

package/src/remote-mcp-r40-parity-client.mjs

@@ -0,0 +1,200 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { R34_EXPECTED_TOOLS } from './remote-mcp-r34-parity-client.mjs';
+import { loadCodingPolicy } from './coding-plane.mjs';
+import { verifyMachineFsReceiptFile } from './machine-fs.mjs';
+import { verifyObservationReceiptFile } from './observation-runtime.mjs';
+import { loadDesktopPolicy } from './desktop-policy-r40.mjs';
+import { verifyDesktopReceiptObject } from './desktop-runtime-r40.mjs';
+import { loadPublicVerifyKey } from './trust.mjs';
+
+export const R40_EXPECTED_TOOLS=Object.freeze([...new Set([
+  ...R34_EXPECTED_TOOLS,
+  'coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_rename_preview',
+  'desktop_status','desktop_observe','desktop_target','desktop_action'
+])].sort());
+if(R40_EXPECTED_TOOLS.length !== 80) throw new Error(`R40 full catalog identity mismatch: ${R40_EXPECTED_TOOLS.length}`);
+export const R40_COMPACT_GATEWAYS=Object.freeze(['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session','desktop_control'].sort());
+export const R40_COMPACT_TOOL_LIMIT=42;
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const verifyKeyPath=path.join(stateRoot,'trust','ed25519-public.pem');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+function structured(result,label){
+  if(result.isError) throw new Error(`${label} returned error: ${JSON.stringify(result.structuredContent??result.content)}`);
+  if(!result.structuredContent||typeof result.structuredContent!=='object') throw new Error(`${label} missing structured output`);
+  return result.structuredContent;
+}
+function gateway(result,label){
+  const value=structured(result,label);
+  if(value.status!=='ok'||!value.result||typeof value.result!=='object') throw new Error(`${label} gateway status=${String(value.status)} error=${String(value.error??'')}`);
+  return value.result;
+}
+async function fileSha(relative){return sha256(await readFile(path.join(repoRoot,...relative.split('/'))));}
+async function verifyMachineReceipt(policy,receiptId,operation){
+  const checked=await verifyMachineFsReceiptFile({policy,verifyKeyPath,receiptId});
+  if(!checked.ok||checked.signature_valid!==true||checked.operation!==operation) throw new Error(`machine-fs receipt verification failed for ${operation}`);
+  return checked;
+}
+async function verifyObservationReceipt(policy,receiptId){
+  const checked=await verifyObservationReceiptFile({policy,verifyKeyPath,receiptId});
+  if(!checked.ok||checked.signature_valid!==true) throw new Error('observation receipt verification failed');
+  return checked;
+}
+async function verifyDesktopReceipt(policy,verifyKey,receiptId,receiptSha256,kind){
+  const file=path.join(policy.evidence_dir,`${receiptId}.json`);
+  const receipt=JSON.parse(await readFile(file,'utf8'));
+  const checked=verifyDesktopReceiptObject(receipt,{policySha256:policy.policy_sha256,publicKey:verifyKey.publicKey,keyId:verifyKey.keyId});
+  if(!checked.ok||checked.receipt_sha256!==receiptSha256||checked.kind!==kind) throw new Error(`desktop receipt verification failed for ${kind}`);
+  return checked;
+}
+async function waitSearch(client,searchId){
+  for(let attempt=0;attempt<200;attempt+=1){
+    const status=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_status',search_id:searchId}}),'search_status');
+    if(['completed','cancelled','failed'].includes(status.state)) return status;
+    await sleep(25);
+  }
+  throw new Error('R40 compact search timeout');
+}
+async function waitProcessOutput(client,sessionId){
+  for(let attempt=0;attempt<100;attempt+=1){
+    const page=gateway(await client.callTool({name:'process_session',arguments:{op:'read',session_id:sessionId,offset:0,max_bytes:65536}}),'process read');
+    if(Buffer.from(page.data_base64??'','base64').toString('utf8').includes('DEADBYTE_ACTION_PING')) return page;
+    await sleep(50);
+  }
+  throw new Error('R40 compact process output timeout');
+}
+
+export async function runR40CompactParity(endpointText){
+  const endpoint=new URL(endpointText);
+  if(endpoint.protocol!=='https:') throw new Error('R40 compact parity requires HTTPS');
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  const policy=await loadCodingPolicy(path.join(pointer.generation_root,'coding-policy.json'));
+  const desktopPolicy=await loadDesktopPolicy(path.join(pointer.generation_root,'desktop-policy.json'));
+  const desktopVerifyKey=await loadPublicVerifyKey(verifyKeyPath);
+  const client=new Client({name:'deadbyte-r40-compact-parity',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StreamableHTTPClientTransport(endpoint);
+  const tag=randomBytes(8).toString('hex');
+  const scratchRoot='parity_scratch';
+  const target=`.deadbyte-r40-parity-${tag}.txt`;
+  let processSession=null,targetPresent=false;
+  const machineReceipts=[],observationReceipts=[];
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    if(names.length>R40_COMPACT_TOOL_LIMIT) throw new Error(`R40 compact catalog exceeds ${R40_COMPACT_TOOL_LIMIT}: ${names.length}`);
+    if(names.length!==R40_COMPACT_TOOL_LIMIT) throw new Error(`R40 compact catalog must be exactly ${R40_COMPACT_TOOL_LIMIT}, got ${names.length}`);
+    for(const name of R40_COMPACT_GATEWAYS) if(!names.includes(name)) throw new Error(`R40 compact gateway missing ${name}`);
+    for(const tool of listed.tools){
+      if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties) throw new Error(`tool ${tool.name} missing strict output schema`);
+    }
+    const manifest=gateway(await client.callTool({name:'capability_manifest',arguments:{}}),'capability_manifest');
+    if(manifest.schema!=='deadbyte.capability-manifest.v2'||manifest.profile!=='compact'||!Array.isArray(manifest.capabilities)||!/^[0-9a-f]{64}$/.test(String(manifest.ledger_sha256??''))) throw new Error('R40 compact capability manifest malformed');
+    if(manifest.tool_count!==names.length||JSON.stringify(manifest.tool_catalog)!==JSON.stringify(names)||
+      manifest.catalog_sha256!==sha256(Buffer.from(JSON.stringify(names),'utf8'))) throw new Error('R40 compact manifest catalog binding mismatch');
+    const required=manifest.capabilities.filter(item=>item?.production===true&&item?.host_only!==true);
+    for(const item of required){
+      if(typeof item.compact_tool!=='string'||!names.includes(item.compact_tool)) throw new Error(`compact capability route missing: ${String(item.id)}`);
+    }
+    const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
+    const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous_session_status');
+    if(coding.armed!==true||autonomous.coding_armed!==true||autonomous.autonomous_armed!==true) throw new Error('R40 compact parity requires coding and autonomous standing grants');
+    const desktopStatus=gateway(await client.callTool({name:'desktop_control',arguments:{op:'status'}}),'desktop status');
+    if(desktopStatus.configured!==true||desktopStatus.armed!==false) throw new Error('R40 compact parity requires Desktop configured and DISARMED');
+    const desktopObserved=gateway(await client.callTool({name:'desktop_control',arguments:{op:'observe',preview:false}}),'desktop observe');
+    await verifyDesktopReceipt(desktopPolicy,desktopVerifyKey,desktopObserved.receipt_id,desktopObserved.receipt_sha256,'desktop_observation');
+    const desktopTarget=gateway(await client.callTool({name:'desktop_control',arguments:{op:'target',frame_id:desktopObserved.frame.frame_id,uia_query:{kind:'root',value:'',max_results:1,ordinal:0}}}),'desktop target');
+    await verifyDesktopReceipt(desktopPolicy,desktopVerifyKey,desktopTarget.grounding.receipt_id,desktopTarget.grounding.receipt_sha256,'desktop_grounding');
+    if(desktopTarget.target?.source!=='uia') throw new Error('R40 compact UIA root grounding missing');
+    const tree=structured(await client.callTool({name:'coding_tree',arguments:{root_id:'core',path:'workspaces/demo',max_depth:2,max_entries:128}}),'coding_tree');
+    if(tree.status!=='ok'||!Array.isArray(tree.entries)) throw new Error('coding_tree malformed');
+    const stat=gateway(await client.callTool({name:'coding_inspect',arguments:{op:'stat',root_id:'core',path:'package.json',hash:true}}),'coding stat');
+    if(stat.type!=='file'||!/^[0-9a-f]{64}$/.test(String(stat.sha256??''))||!/^[0-9a-f]{64}$/.test(String(stat.observation_sha256??''))) throw new Error('coding stat identity missing');
+    const search=gateway(await client.callTool({name:'coding_inspect',arguments:{op:'search',root_id:'core',path:'src',pattern:'R36_CAPABILITY_LEDGER',target:'content',mode:'literal',case_sensitive:true,max_results:20,max_file_bytes:262144,max_scan_bytes:4194304,page_size:20,cursor:null}}),'coding search');
+    if(!Array.isArray(search.matches)||search.matches.length<1) throw new Error('coding search returned no canonical ledger match');
+
+    const buildScript='scripts/autonomous-build.ps1';
+    const testScript='scripts/release-parity-tests-r40.ps1';
+    const build=structured(await client.callTool({name:'coding_command_run',arguments:{root_id:'core',command_id:'powershell_script',script_path:buildScript,script_sha256:await fileSha(buildScript),args:[],cwd:'.',timeout_ms:120000}},{timeout:180000,maxTotalTimeout:180000}),'coding build');
+    if(build.status!=='passed'||build.exit_code!==0) throw new Error('R40 coding build failed');
+    const buildVerify=structured(await client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:build.receipt_id}}),'coding build receipt');
+    if(buildVerify.ok!==true||buildVerify.signature_valid!==true) throw new Error('R40 coding build receipt invalid');
+    const tests=structured(await client.callTool({name:'coding_command_run',arguments:{root_id:'core',command_id:'powershell_script',script_path:testScript,script_sha256:await fileSha(testScript),args:[],cwd:'.',timeout_ms:300000}},{timeout:360000,maxTotalTimeout:360000}),'coding tests');
+    if(tests.status!=='passed'||tests.exit_code!==0) throw new Error('R40 coding tests failed');
+    const testVerify=structured(await client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:tests.receipt_id}}),'coding test receipt');
+    if(testVerify.ok!==true||testVerify.signature_valid!==true) throw new Error('R40 coding test receipt invalid');
+
+    const initial=`needle-${tag}\n`;
+    const write=gateway(await client.callTool({name:'machine_fs',arguments:{op:'write',root_id:scratchRoot,path:target,content:initial,encoding:'utf8',expected_sha256:'absent'}}),'machine_fs write');
+    targetPresent=true;machineReceipts.push(write.receipt_id);await verifyMachineReceipt(policy,write.receipt_id,'machine_fs_write');
+    const bounded=gateway(await client.callTool({name:'machine_fs',arguments:{op:'read',root_id:scratchRoot,path:target,offset:0,max_bytes:128,hash_file:true}}),'machine_fs read');
+    if(Buffer.from(bounded.data_base64,'base64').toString('utf8')!==initial||bounded.file_sha256!==write.sha256) throw new Error('R40 bounded machine read mismatch');
+    const edit=gateway(await client.callTool({name:'machine_fs',arguments:{op:'edit_exact',root_id:scratchRoot,path:target,expected_sha256:write.sha256,old_string:'needle',new_string:'beta',expected_replacements:1}}),'machine_fs edit');
+    machineReceipts.push(edit.receipt_id);await verifyMachineReceipt(policy,edit.receipt_id,'machine_fs_edit_exact');
+    const stale=await client.callTool({name:'machine_fs',arguments:{op:'edit_exact',root_id:scratchRoot,path:target,expected_sha256:write.sha256,old_string:'beta',new_string:'bad',expected_replacements:1}});
+    const staleValue=stale.structuredContent;
+    if(!staleValue||typeof staleValue!=='object') throw new Error('R40 stale machine-fs denial missing structured output');
+    if(stale.isError!==true||staleValue.status!=='denied'||!/precondition mismatch/i.test(String(staleValue.error??''))) {
+      throw new Error(`R40 stale machine-fs precondition was not denied: ${JSON.stringify(staleValue)}`);
+    }
+
+    const searchStart=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_start',root_id:scratchRoot,path:'.',pattern:tag,case_sensitive:true,max_results:20,max_files:200,max_bytes:262144,max_file_bytes:16384}}),'observe search start');
+    const searchStatus=await waitSearch(client,searchStart.search_id);
+    if(searchStatus.state!=='completed'||!searchStatus.receipt_id) throw new Error('R40 compact observation search failed');
+    observationReceipts.push(searchStatus.receipt_id);await verifyObservationReceipt(policy,searchStatus.receipt_id);
+    const page=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_page',search_id:searchStart.search_id,limit:20,cursor:null}}),'observe search page');
+    if(!page.results.some(item=>item.path===target)) throw new Error('R40 compact search did not return parity file');
+    const system=gateway(await client.callTool({name:'machine_observe',arguments:{op:'system_status'}}),'system status');
+    observationReceipts.push(system.receipt_id);await verifyObservationReceipt(policy,system.receipt_id);
+    const machineStatus=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_status'}}),'machine status');
+    if(machineStatus.release_id!==pointer.release_id||machineStatus.release_manifest_sha256!==pointer.manifest_sha256) throw new Error('R40 compact machine status release mismatch');
+
+    const started=gateway(await client.callTool({name:'process_session',arguments:{op:'start',profile_id:'ping_hold',root_id:'core',cwd:'.',args:[]}}),'process start');
+    processSession=started.session_id??started.session?.session_id;
+    if(!/^[0-9a-f]{64}$/.test(String(processSession??''))) throw new Error('R40 compact process session id missing');
+    const action=gateway(await client.callTool({name:'process_session',arguments:{op:'action',session_id:processSession,action_id:'ping'}}),'process action');
+    const processRead=await waitProcessOutput(client,processSession);
+    const terminated=gateway(await client.callTool({name:'process_session',arguments:{op:'terminate',session_id:processSession}}),'process terminate');
+    const terminalState=terminated.state??terminated.session?.state;
+    if(action.action_id!=='ping'||terminalState!=='terminated') throw new Error('R40 compact process lifecycle failed');
+
+    const fsStat=gateway(await client.callTool({name:'machine_fs',arguments:{op:'stat',root_id:scratchRoot,path:target,hash:true}}),'machine_fs stat');
+    const deleted=gateway(await client.callTool({name:'machine_fs',arguments:{op:'delete',root_id:scratchRoot,path:target,expected_source_identity:fsStat.identity_sha256}}),'machine_fs delete');
+    machineReceipts.push(deleted.receipt_id);await verifyMachineReceipt(policy,deleted.receipt_id,'machine_fs_delete');targetPresent=false;
+
+    return {status:'passed',protocol_revision:client.getNegotiatedProtocolVersion(),profile:'compact',tool_count:names.length,tools:names,
+      catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),strict_output_schemas:true,ledger_sha256:manifest.ledger_sha256,
+      capability_count:manifest.capabilities.length,production_non_host_capabilities:required.length,capability_closure:true,
+      gateway_count:R40_COMPACT_GATEWAYS.length,tree_entries:tree.entries.length,coding_stat_verified:true,coding_search_result_count:search.matches.length,
+      desktop_armed:false,desktop_observation_receipt_verified:true,desktop_grounding_receipt_verified:true,
+      desktop_frame_id:desktopObserved.frame.frame_id,desktop_target_id:desktopTarget.target.target_id,
+      machine_fs_receipts_verified:machineReceipts.length,observation_receipts_verified:observationReceipts.length,
+      observation_search_result_count:page.results.length,process_session_id:processSession,process_output_bytes:processRead.stream_head,
+      process_journal_head_sha256:terminated.journal_head_sha256??terminated.session?.journal_head_sha256,
+      build_receipt_id:build.receipt_id,test_receipt_id:tests.receipt_id,coding_receipts_verified:2,
+      execution_provider:'deadbyte_mcp',rdc_operation_count:0};
+  } finally {
+    if(processSession) await client.callTool({name:'process_session',arguments:{op:'terminate',session_id:processSession}}).catch(()=>{});
+    if(targetPresent){
+      try{const fsStat=gateway(await client.callTool({name:'machine_fs',arguments:{op:'stat',root_id:scratchRoot,path:target,hash:false}}),'cleanup stat');
+        if(fsStat.identity_sha256) await client.callTool({name:'machine_fs',arguments:{op:'delete',root_id:scratchRoot,path:target,expected_source_identity:fsStat.identity_sha256}}).catch(()=>{});
+      }catch{}
+    }
+    await client.close().catch(()=>{});
+  }
+}
+
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){
+  const endpoint=process.argv[2];
+  if(!endpoint) throw new Error('usage: node src/remote-mcp-r40-parity-client.mjs https://host/mcp/path');
+  runR40CompactParity(endpoint).then(result=>console.log(JSON.stringify(result,null,2))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}

package/src/remote-mcp-smoke-client.mjs

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
 
 const endpointText = process.argv[2];
@@ -51,6 +51,9 @@ const r36CompactTools = [
   'process_session'
 ].sort();
 if (r36CompactTools.length !== 41) throw new Error(`R36 compact catalog constant drift: ${r36CompactTools.length}`);
+const r40CompactTools = [...r36CompactTools, 'desktop_control'].sort();
+if (r40CompactTools.length !== 42) throw new Error(`R40 compact catalog constant drift: ${r40CompactTools.length}`);
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
 const allowedCatalogs = [];
 for (const machine of [false, true]) for (const host of [false, true]) for (const agent of [false, true]) {
   for (const processPlane of [false, true]) for (const machineFs of [false, true]) for (const observation of [false, true]) for (const codingMode of ['none', 'coding', 'autonomous']) {
@@ -93,7 +96,9 @@ try {
   if (client.getProtocolEra() !== 'modern') throw new Error(`expected modern MCP era, got ${String(client.getProtocolEra())}`);
   const listed = await client.listTools();
   const names = listed.tools.map(t => t.name).sort();
-  const compactProfile = JSON.stringify(names) === JSON.stringify(r36CompactTools);
+  const exactR36Compact = JSON.stringify(names) === JSON.stringify(r36CompactTools);
+  const exactR40Compact = JSON.stringify(names) === JSON.stringify(r40CompactTools);
+  const compactProfile = exactR36Compact || exactR40Compact;
   const catalogOk = compactProfile || allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected));
   if (!catalogOk) throw new Error(`tool catalog mismatch: ${JSON.stringify(names)}`);
   for (const tool of listed.tools) {
@@ -117,14 +122,23 @@ try {
   let agent = null;
   if (compactProfile) {
     const manifest = gateway(await client.callTool({ name: 'capability_manifest', arguments: {} }), 'capability_manifest');
-    if (manifest.schema !== 'deadbyte.capability-manifest.v1' || manifest.profile !== 'compact' ||
+    const manifestV1 = manifest.schema === 'deadbyte.capability-manifest.v1' && exactR36Compact;
+    const manifestV2 = manifest.schema === 'deadbyte.capability-manifest.v2' && exactR40Compact;
+    if ((!manifestV1 && !manifestV2) || manifest.profile !== 'compact' ||
         !Array.isArray(manifest.capabilities) || !/^[0-9a-f]{64}$/.test(String(manifest.ledger_sha256 ?? ''))) {
-      throw new Error('R36 compact capability manifest malformed');
+      throw new Error('compact capability manifest malformed');
+    }
+    if (manifestV2) {
+      const expectedCatalogSha = sha256(Buffer.from(JSON.stringify(names), 'utf8'));
+      if (manifest.tool_count !== names.length || JSON.stringify(manifest.tool_catalog) !== JSON.stringify(names) ||
+          manifest.catalog_sha256 !== expectedCatalogSha) {
+        throw new Error('R40 compact capability manifest catalog attestation mismatch');
+      }
     }
     const required = manifest.capabilities.filter(item => item?.production === true && item?.host_only !== true);
     for (const item of required) {
       if (typeof item.compact_tool !== 'string' || !names.includes(item.compact_tool)) {
-        throw new Error(`R36 compact capability route missing: ${String(item.id)}`);
+        throw new Error(`compact capability route missing: ${String(item.id)}`);
       }
     }
     const machine = gateway(await client.callTool({ name: 'machine_observe', arguments: { op: 'machine_status' } }), 'machine_status');
@@ -132,7 +146,7 @@ try {
     const ping = gateway(await client.callTool({ name: 'machine_observe', arguments: { op: 'machine_ping', nonce } }), 'machine_ping');
     if (ping.nonce !== nonce || ping.machine_id !== machine.machine_id ||
         ping.release_id !== machine.release_id || ping.release_manifest_sha256 !== machine.release_manifest_sha256) {
-      throw new Error('R36 compact machine ping binding mismatch');
+      throw new Error('compact machine ping binding mismatch');
     }
     compact = {
       profile: 'compact',

package/src/remote-result-journal.mjs

@@ -6,6 +6,7 @@ export const REMOTE_RESULT_JOURNAL_SCHEMA='deadbyte.remote-result-journal.v1';
 const SESSION=/^[0-9a-f]{24}$/;
 const HASH=/^[0-9a-f]{64}$/;
 const STATUS=new Set(['ok','error']);
+const SIDE_EFFECT_STATES=new Set(['unknown']);
 const EVENT_TYPES=new Set(['tool.call','tool.result']);
 
 function text(value,label,max){
@@ -40,10 +41,17 @@ function validateEvent(raw,index=null){
       observed_at_utc:observed,payload_sha256:raw.payload_sha256,arguments:sanitizeAuditArgs(rawArgs)});
   }
   if(!STATUS.has(raw.status)) throw new Error('remote result status invalid');
+  const durationMs=raw.duration_ms===undefined?null:raw.duration_ms;
+  if(durationMs!==null&&(!Number.isFinite(durationMs)||durationMs<0||durationMs>86_400_000)) throw new Error('remote result duration_ms invalid');
+  const reason=raw.reason===undefined||raw.reason===null?null:text(raw.reason,'remote result reason',512);
+  const sideEffectState=raw.side_effect_state===undefined||raw.side_effect_state===null?null:raw.side_effect_state;
+  if(sideEffectState!==null&&!SIDE_EFFECT_STATES.has(sideEffectState)) throw new Error('remote result side_effect_state invalid');
   return Object.freeze({session_id:sessionId,seq,event_type:eventType,request_id:requestId,tool,status:raw.status,
-    observed_at_utc:observed,payload_sha256:raw.payload_sha256});
+    observed_at_utc:observed,payload_sha256:raw.payload_sha256,
+    ...(durationMs===null?{}:{duration_ms:durationMs}),...(reason===null?{}:{reason}),
+    ...(sideEffectState===null?{}:{side_effect_state:sideEffectState})});
 }
-function identity(item){return `${item.event_type}\0${item.request_id}\0${item.status??''}\0${item.payload_sha256}`;}
+function identity(item){return `${item.event_type}\0${item.request_id}\0${item.status??''}\0${item.side_effect_state??''}\0${item.payload_sha256}`;}
 export function parseRemoteResultCursor(cursor){
   if(typeof cursor!=='string') throw new Error('remote result cursor invalid');
   const match=/^r1:([0-9a-f]{24}):(0|[1-9][0-9]{0,15})$/.exec(cursor);

package/src/runtime-update.mjs

@@ -45,14 +45,17 @@ function normalizePersistentPublicOrigin(value){
   return publicOrigin.origin;
 }
 export function parseUpdateArgs(argv){
-  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
-  const cloud={},bridge={},processPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
+  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableDesktop:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,desktopPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
+  const cloud={},bridge={},processPolicy={},desktopPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
   const bridgeFlags=new Map([
     ['--bridge-root','root'],['--bridge-script-sha256','scriptSha256']
   ]);
   const processPolicyFlags=new Map([
     ['--process-policy','path'],['--process-policy-sha256','sha256']
   ]);
+  const desktopPolicyFlags=new Map([
+    ['--desktop-policy','path'],['--desktop-policy-sha256','sha256']
+  ]);
   const semanticLspFlags=new Map([
     ['--semantic-lsp-config','path'],['--semantic-lsp-config-sha256','sha256']
   ]);
@@ -61,16 +64,17 @@ export function parseUpdateArgs(argv){
     ['--cloud-token-file','tokenFilePath'],['--cloud-token-sha256','tokenFileSha256'],
     ['--cloud-child-working-directory','childWorkingDirectory'],['--cloud-public-origin','publicOrigin']
   ]);
-  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
+  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...desktopPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
   for(let index=0;index<argv.length;index++){
     const arg=argv[index];
-    if(arg==='--restore-standing-grants'||arg==='--recover-offline-predecessor'||arg==='--enable-machine-fs'||arg==='--enable-observation'||arg==='--enable-autonomous-supervisor'){
+    if(arg==='--restore-standing-grants'||arg==='--recover-offline-predecessor'||arg==='--enable-machine-fs'||arg==='--enable-observation'||arg==='--enable-desktop'||arg==='--enable-autonomous-supervisor'){
       if(seen.has(arg)) throw new Error(`duplicate self-update argument '${arg}'`);
       seen.add(arg);
       if(arg==='--restore-standing-grants') out.restoreStandingGrants=true;
       else if(arg==='--recover-offline-predecessor') out.recoverOfflinePredecessor=true;
       else if(arg==='--enable-machine-fs') out.enableMachineFs=true;
       else if(arg==='--enable-observation') out.enableObservation=true;
+      else if(arg==='--enable-desktop') out.enableDesktop=true;
       else out.enableAutonomousSupervisor=true;
       continue;
     }
@@ -95,6 +99,7 @@ export function parseUpdateArgs(argv){
     else if(arg==='--source-root') out.sourceRoot=path.resolve(value);
     else if(bridgeFlags.has(arg)) bridge[bridgeFlags.get(arg)]=value;
     else if(processPolicyFlags.has(arg)) processPolicy[processPolicyFlags.get(arg)]=value;
+    else if(desktopPolicyFlags.has(arg)) desktopPolicy[desktopPolicyFlags.get(arg)]=value;
     else if(semanticLspFlags.has(arg)) semanticLsp[semanticLspFlags.get(arg)]=value;
     else cloud[cloudFlags.get(arg)]=value;
   }
@@ -116,6 +121,13 @@ export function parseUpdateArgs(argv){
     if(!HEX64.test(sha256)) throw new Error('process policy SHA-256 must be lowercase hex');
     out.processPolicyBootstrap={path:path.resolve(processPolicy.path),sha256};
   }
+  const desktopPolicyFields=[...desktopPolicyFlags.values()],desktopPolicyPresent=desktopPolicyFields.filter(key=>desktopPolicy[key]!==undefined);
+  if(desktopPolicyPresent.length!==0&&desktopPolicyPresent.length!==desktopPolicyFields.length) throw new Error('desktop policy bootstrap requires path plus SHA-256 as one pair');
+  if(desktopPolicyPresent.length===desktopPolicyFields.length){
+    const sha256=String(desktopPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('desktop policy SHA-256 must be lowercase hex');
+    out.desktopPolicyBootstrap={path:path.resolve(desktopPolicy.path),sha256};
+  }
   const semanticLspFields=[...semanticLspFlags.values()],semanticLspPresent=semanticLspFields.filter(key=>semanticLsp[key]!==undefined);
   if(semanticLspPresent.length!==0&&semanticLspPresent.length!==semanticLspFields.length) throw new Error('semantic LSP config bootstrap requires path plus SHA-256 as one pair');
   if(semanticLspPresent.length===semanticLspFields.length){
@@ -321,6 +333,21 @@ export async function prepareProcessPolicyBootstrap(bootstrap){
   return {...pinned,policy};
 }
 
+export async function prepareDesktopPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'desktop policy');
+  const policy=await readJson(pinned.path);
+  if(policy?.schema!=='deadbyte.desktop-policy.v1'||policy?.enabled!==true) throw new Error('desktop policy schema/enabled mismatch');
+  for(const name of ['observer','input','grounder']){
+    const provider=policy[name];
+    if(!provider||typeof provider.executable!=='string'||!path.isAbsolute(provider.executable)||!HEX64.test(String(provider.sha256??''))) {
+      throw new Error(`desktop policy ${name} pin invalid`);
+    }
+  }
+  if(!Array.isArray(policy.allowed_actions)||policy.allowed_actions.length<1) throw new Error('desktop policy allowed_actions invalid');
+  return {...pinned,policy};
+}
+
 export async function prepareSemanticLspConfigBootstrap(bootstrap){
   if(!bootstrap) return null;
   const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'semantic LSP config');
@@ -460,6 +487,7 @@ export function parseControllerStatus(text){
     local_ready:/Local ready\s*:\s*True/.test(text),
     coding_armed:/Coding plane\s*:\s*ARMED \[standing-grant\]/.test(text),
     autonomous_armed:/Autonomous\s*:\s*ARMED \[standing-grant\]/.test(text),
+    desktop_armed:/Desktop plane\s*:\s*ARMED \[standing-grant\]/.test(text),
     host_armed:/Host plane\s*:\s*ARMED \[standing-grant\]/.test(text)
   };
 }
@@ -664,13 +692,14 @@ async function loadControlInputs({stateRoot,sourceRoot,pointerInfo}){
     ctx=legacyContext(sourceRoot); configPath=path.join(ctx.source_root,'controller','deadbyte-controller.config.psd1');
   }
   let config=await loadPowerShellDataFile(configPath); config=await normalizeComponentIdentities(config);
-  const codingPath=String(config.CodingPolicyFile??''); const autonomousPath=String(config.AutonomousPolicyFile??''); const hostPath=String(config.HostPolicyFile??''); const processPath=String(config.ProcessPolicyFile??'');
+  const codingPath=String(config.CodingPolicyFile??''); const autonomousPath=String(config.AutonomousPolicyFile??''); const hostPath=String(config.HostPolicyFile??''); const processPath=String(config.ProcessPolicyFile??''); const desktopPath=String(config.DesktopPolicyFile??'');
   if(!path.isAbsolute(codingPath)||!path.isAbsolute(autonomousPath)) throw new Error('coding/autonomous policy paths must be absolute');
   if(processPath&&!path.isAbsolute(processPath)) throw new Error('process policy path must be absolute');
-  const codingPolicy=await readJson(codingPath); const autonomousPolicy=await readJson(autonomousPath); const hostPolicy=hostPath?await readJson(hostPath):null; const processPolicy=processPath?await readJson(processPath):null;
+  if(desktopPath&&!path.isAbsolute(desktopPath)) throw new Error('desktop policy path must be absolute');
+  const codingPolicy=await readJson(codingPath); const autonomousPolicy=await readJson(autonomousPath); const hostPolicy=hostPath?await readJson(hostPath):null; const processPolicy=processPath?await readJson(processPath):null; const desktopPolicy=desktopPath?await readJson(desktopPath):null;
   const legacyCore=typeof config.CoreRoot==='string'&&config.CoreRoot?path.resolve(config.CoreRoot):ctx.core_root;
   const workspaceRoot=typeof config.WorkspaceRoot==='string'&&config.WorkspaceRoot?path.resolve(config.WorkspaceRoot):path.join(legacyCore,'workspaces');
-  return {ctx,configPath,config,codingPolicy,autonomousPolicy,hostPolicy,processPolicy,workspaceRoot};
+  return {ctx,configPath,config,codingPolicy,autonomousPolicy,hostPolicy,processPolicy,desktopPolicy,workspaceRoot};
 }
 export function assertDevelopmentRootSafe(developmentRoot,stateRoot){
   const dev=path.resolve(developmentRoot),state=path.resolve(stateRoot);
@@ -724,17 +753,18 @@ async function rollbackLaunchers(plan){
 }
 async function revokeAuthority(ctx,prior){
   let revoked=false;
+  if(prior.desktop_armed){ controllerCaptured(ctx,'disarmdesktop',15000); revoked=true; }
   if(prior.autonomous_armed){ controllerCaptured(ctx,'disarmautonomous',15000); revoked=true; }
   if(prior.coding_armed){ controllerCaptured(ctx,'disarmcoding',15000); revoked=true; }
   const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(status.coding_armed||status.autonomous_armed) throw new Error('standing authority revoke gate failed');
+  if(status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority revoke gate failed');
   if(status.host_armed) throw new Error('host plane became armed during revoke');
   return {revoked,status};
 }
 async function restoreStandingAuthority(ctx,prior,enabled){
   if(!enabled){
     const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-    if(status.coding_armed||status.autonomous_armed) throw new Error('standing authority unexpectedly survived slot switch');
+    if(status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority unexpectedly survived slot switch');
     if(status.host_armed) throw new Error('host plane became armed during slot switch');
     return status;
   }
@@ -744,6 +774,7 @@ async function restoreStandingAuthority(ctx,prior,enabled){
   const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
   if(status.coding_armed!==prior.coding_armed) throw new Error('coding standing-grant restore gate failed');
   if(status.autonomous_armed!==prior.autonomous_armed) throw new Error('autonomous standing-grant restore gate failed');
+  if(status.desktop_armed) throw new Error('desktop plane must remain disarmed after slot switch');
   if(status.host_armed) throw new Error('host plane became armed during slot switch');
   return status;
 }
@@ -795,7 +826,7 @@ function publicPointer(pointer){
     release_root:pointer.release_root,generation_root:pointer.generation_root,generation_manifest_sha256:pointer.generation_manifest_sha256,
     launcher_sha256:pointer.launcher_sha256,config_path:pointer.config_path};
 }
-export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
+export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableDesktop=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
   if(process.platform!=='win32') throw new Error('R27 slot update is Windows-only');
   const state=path.resolve(stateRoot),stageRoot=path.resolve(stage),development=assertDevelopmentRootSafe(developmentRoot,state);
   const key=await loadUpdateKey(state); const updateId=`r27-${expectedManifest.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
@@ -820,6 +851,8 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       control.processPolicy=processBootstrap.policy;
       control.config.ProcessRuntimeEnabled=true;
     }
+    const desktopBootstrap=await prepareDesktopPolicyBootstrap(desktopPolicyBootstrap);
+    if(desktopBootstrap) control.desktopPolicy=desktopBootstrap.policy;
     const semanticBootstrap=await prepareSemanticLspConfigBootstrap(semanticLspBootstrap);
     if(semanticBootstrap){
       control.config.SemanticLspConfigFile=semanticBootstrap.path;
@@ -834,6 +867,10 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       if(control.config.CodingRuntimeEnabled!==true) throw new Error('ObservationRuntimeEnabled requires CodingRuntimeEnabled');
       control.config.ObservationRuntimeEnabled=true;
     }
+    if(enableDesktop){
+      if(!control.desktopPolicy) throw new Error('DesktopRuntimeEnabled requires pinned desktop policy bootstrap or existing policy');
+      control.config.DesktopRuntimeEnabled=true;
+    }
     control.config=await prepareBridgeSpec(control.config,bridgeBootstrap);
     control.config=await prepareNamedTunnelCloudSpec(control.config,{releaseRoot:slot.release_root,bootstrap:cloudTransport});
     control.config=await prepareAutonomousSupervisorSpec(control.config,{releaseRoot:slot.release_root,enable:enableAutonomousSupervisor});
@@ -860,7 +897,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     launchers=await launcherPlan(state);
     const generation=await createGenerationBundle({stateRoot:state,releaseRoot:slot.release_root,developmentRoot:development,
       workspaceRoot:workspace.target,releaseId:slot.release_id,currentConfig:control.config,codingPolicy:control.codingPolicy,
-      autonomousPolicy:control.autonomousPolicy,hostPolicy:control.hostPolicy,processPolicy:control.processPolicy});
+      autonomousPolicy:control.autonomousPolicy,hostPolicy:control.hostPolicy,processPolicy:control.processPolicy,desktopPolicy:control.desktopPolicy});
     newPointer={schema:'deadbyte.active-release.v1',release_id:slot.release_id,version:expectedVersion,manifest_sha256:expectedManifest,
       release_root:slot.release_root,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,
       launcher_sha256:launchers.launcher_sha256,config_path:generation.config_path};
@@ -875,7 +912,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},new_pointer:publicPointer(newPointer)});
     predecessor=await capturePredecessor(control.ctx,recoverOfflinePredecessor); oldRuntime=predecessor.runtime; priorStatus=predecessor.status;
     await writeState(statePath,journal,'old_runtime_verified',{predecessor_mode:predecessor.mode,old_runtime:generationTuple(oldRuntime),
-      prior_authority:{coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,host_armed:priorStatus.host_armed}});
+      prior_authority:{coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed}});
     const revoke=await revokeAuthority(control.ctx,priorStatus); revoked=revoke.revoked;
     await writeState(statePath,journal,'authority_revoked',{revoked_before_switch:revoked});
     if(oldRuntime){
@@ -897,7 +934,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     await writeState(statePath,journal,'fresh_runtime_verified',{new_runtime:generationTuple(newRuntime),stabilization});
     const finalAuthority=await restoreStandingAuthority(newCtx,priorStatus,restoreStandingGrants);
     await writeState(statePath,journal,'authority_verified',{final_authority:{coding_armed:finalAuthority.coding_armed,
-      autonomous_armed:finalAuthority.autonomous_armed,host_armed:finalAuthority.host_armed}});
+      autonomous_armed:finalAuthority.autonomous_armed,desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed}});
     const body={schema:UPDATE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,
       completed_at_utc:new Date().toISOString(),activation_boundary:'active-release-pointer',mechanism:'immutable-release-slot-plus-atomic-pointer-rename',
       predecessor_mode:predecessor.mode,prior_pointer:publicPointer(pointerInfo.pointer),active_pointer:publicPointer(newPointer),release_slot:{release_id:slot.release_id,release_root:slot.release_root,
@@ -908,8 +945,9 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       host_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.hostRepinned},
       coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},old_runtime:generationTuple(oldRuntime),new_runtime:generationTuple(newRuntime),stabilization,
       authority:{prior:{coding_armed:priorStatus.coding_armed,
-      autonomous_armed:priorStatus.autonomous_armed,host_armed:priorStatus.host_armed},revoked_before_switch:revoked,restore_requested:restoreStandingGrants,
-      final:{coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,host_armed:finalAuthority.host_armed}},rollback_performed:false};
+      autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed},revoked_before_switch:revoked,restore_requested:restoreStandingGrants,
+      desktop_restore_policy:'explicit-rearm-required',
+      final:{coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed}},rollback_performed:false};
     const receipt=await writeEnvelope(receiptPath,body,key);
     await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
     return {ok:true,update_id:updateId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,
@@ -1042,8 +1080,8 @@ export async function runSlotUpdateCli(argv=process.argv.slice(2),{stateRoot=DEF
   const args=parseUpdateArgs(argv);
   const result=await performSlotUpdate({stage:args.stage,developmentRoot:args.developmentRoot,expectedVersion:args.expectedVersion,
     expectedManifest:args.expectedManifest,sourceRoot:args.sourceRoot,stateRoot,restoreStandingGrants:args.restoreStandingGrants,recoverOfflinePredecessor:args.recoverOfflinePredecessor,
-    cloudTransport:args.cloudTransport,bridgeBootstrap:args.bridgeBootstrap,processPolicyBootstrap:args.processPolicyBootstrap,semanticLspBootstrap:args.semanticLspBootstrap,enableMachineFs:args.enableMachineFs,
-    enableObservation:args.enableObservation,enableAutonomousSupervisor:args.enableAutonomousSupervisor,hostCommandPins:args.hostCommandPins});
+    cloudTransport:args.cloudTransport,bridgeBootstrap:args.bridgeBootstrap,processPolicyBootstrap:args.processPolicyBootstrap,desktopPolicyBootstrap:args.desktopPolicyBootstrap,semanticLspBootstrap:args.semanticLspBootstrap,enableMachineFs:args.enableMachineFs,
+    enableObservation:args.enableObservation,enableDesktop:args.enableDesktop,enableAutonomousSupervisor:args.enableAutonomousSupervisor,hostCommandPins:args.hostCommandPins});
   console.log(`R27_SLOT_UPDATE_PASS version=${args.expectedVersion}`);
   console.log(`UPDATE_ID ${result.update_id}`); console.log(`RECEIPT_SHA256 ${result.receipt_sha256}`);
   console.log(`STATE_PATH ${result.state_path}`); console.log(`ACTIVE_RELEASE ${result.pointer.release_id}`);