deadbyte-mcp 0.12.0 → 0.14.0

package/src/provider-circuit.mjs

@@ -48,11 +48,11 @@ function openAt(state,ms,policy){
 }
 
 export function providerCircuitId(planner){
-  if(planner?.backend!=='openai_compatible'||typeof planner.endpoint!=='string'||typeof planner.model!=='string') {
+  if(!['openai_compatible','openai_responses'].includes(planner?.backend)||typeof planner.endpoint!=='string'||typeof planner.model!=='string') {
     throw new Error('provider circuit planner identity invalid');
   }
-  const digest=createHash('sha256').update(Buffer.from(`${planner.endpoint}\0${planner.model}`,'utf8')).digest('hex');
-  return `openai_compatible:${digest}`;
+  const digest=createHash('sha256').update(Buffer.from(`${planner.backend}\0${planner.endpoint}\0${planner.model}`,'utf8')).digest('hex');
+  return `${planner.backend}:${digest}`;
 }
 
 export function classifyProviderFailure(error){
@@ -61,7 +61,7 @@ export function classifyProviderFailure(error){
   if(name==='aborterror'||/\b(?:timed?\s*out|timeout|aborted)\b/.test(text)) return 'timeout';
   if(/(?:http\s*429|rate[ _-]?limit|too many requests)/.test(text)) return 'rate_limit';
   if(/(?:http\s*(?:401|403)|unauthori[sz]ed|forbidden|api key|authentication)/.test(text)) return 'auth';
-  if(/(?:not json|invalid json|missing choices|invalid response|response.*(?:schema|contract|content))/.test(text)) return 'invalid_response';
+  if(/(?:not json|invalid json|missing choices|missing output_text|refusal|not completed|incomplete response|invalid response|response.*(?:schema|contract|content))/.test(text)) return 'invalid_response';
   if(/(?:econnreset|econnrefused|enotfound|fetch failed|network|socket|transport|connection)/.test(text)) return 'transport';
   return 'other';
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.12.0';
+export const DEADBYTE_VERSION = '0.14.0';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/agent-eval-r42.test.mjs

@@ -0,0 +1,39 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { runIsolatedEvaluation, buildFreshCriticContext, triageJudgeResult } from '../src/agent-eval-r42.mjs';
+
+const H=value=>String(value).repeat(64).slice(0,64);
+
+test('R42 generator never receives judge-only oracle or hidden ground truth',async()=>{
+  const oracleToken='ORACLE_ONLY_7fca1b';
+  let generatorInput,judgeInput;
+  const result=await runIsolatedEvaluation({caseSpec:{schema:'deadbyte.agent-eval-case.v1',case_id:'no-leak',
+    task:'Return a safe plan.',allowed_context:{files:['a.mjs']},hidden_oracle:{secret:oracleToken,expected:'bounded'},
+    acceptance:['No oracle leakage']},
+    generator:async input=>{generatorInput=input;return {artifact:{plan:['inspect','verify']},trace:{private_reasoning:'not shared'}};},
+    judge:async input=>{judgeInput=input;return {verdict:'pass',findings:[],evidence_refs:[H('1')]};}
+  });
+  assert.equal(JSON.stringify(generatorInput).includes(oracleToken),false);
+  assert.equal(Object.hasOwn(generatorInput,'hidden_oracle'),false);
+  assert.equal(judgeInput.hidden_oracle.secret,oracleToken);
+  assert.equal(Object.hasOwn(judgeInput,'generator_trace'),false);
+  assert.equal(result.advisory,true);
+  assert.match(result.case_sha256,/^[0-9a-f]{64}$/);
+  assert.match(result.candidate_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('R42 fresh critic context contains artifacts and evidence but no implementer assumptions',()=>{
+  const context=buildFreshCriticContext({case_id:'fresh-review',artifact:{files:['x.mjs']},evidence:[{id:H('2'),level:'automated'}],
+    criteria:['No authority widening']});
+  assert.deepEqual(Object.keys(context).sort(),['artifact','case_id','criteria','evidence','schema']);
+  assert.equal(JSON.stringify(context).includes('reasoning'),false);
+  assert.throws(()=>buildFreshCriticContext({case_id:'bad',artifact:{},evidence:[],criteria:[],implementer_reasoning:'trust me'}),/unknown field/i);
+});
+
+test('R42 judge remains advisory and controller triage owns repair decision',()=>{
+  const judge={schema:'deadbyte.agent-eval-judge-result.v1',verdict:'fail',advisory:true,
+    findings:[{code:'AUTH_WIDEN',severity:'critical',evidence:'schema admits command'}],evidence_refs:[H('3')]};
+  const triage=triageJudgeResult(judge,{critical_action:'pause',noncritical_action:'repair'});
+  assert.deepEqual(triage,{action:'pause',reason_codes:['AUTH_WIDEN'],judge_advisory:true});
+  assert.throws(()=>triageJudgeResult({...judge,advisory:false},{critical_action:'pause',noncritical_action:'repair'}),/advisory/i);
+});

package/test/agent-eval-runner-r42.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runAgentEvalSuiteR42, readAndVerifyR42EvalEvidence } from '../src/agent-eval-runner-r42.mjs';
+
+const H=value=>String(value).repeat(64).slice(0,64);
+const suite={schema:'deadbyte.agent-eval-suite.v1',suite_id:'suite',
+  cases:[{schema:'deadbyte.agent-eval-case.v1',case_id:'case-1',task:'Safe action',
+    allowed_context:{visible:'YES'},hidden_oracle:{secret:'ORACLE_ONLY',expected:'bounded'},acceptance:['bounded']}]
+};
+
+test('R42 model eval keeps hidden oracle out of generator and binds passed evidence to manifest',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r42-eval-'));
+  const calls=[];
+  try{
+    const run=await runAgentEvalSuiteR42({suite,subjectManifestSha256:H('a'),evidenceRoot:root,
+      clock:()=>new Date('2026-09-20T02:00:00.000Z'),
+      requestModel:async call=>{
+        calls.push(call);
+        if(call.role==='generator')return {backend:'fake',model:'fake',response_id:'g1',raw_text:JSON.stringify({artifact:{plan:['inspect','verify']}})};
+        return {backend:'fake',model:'fake',response_id:'j1',raw_text:JSON.stringify({schema:'deadbyte.agent-eval-judge-result.v1',
+          verdict:'pass',advisory:true,findings:[],evidence_refs:[H('1')]})};
+      }});
+    assert.equal(calls.length,2);
+    assert.equal(calls[0].prompt.includes('ORACLE_ONLY'),false);
+    assert.equal(calls[1].prompt.includes('ORACLE_ONLY'),true);
+    assert.equal(run.payload.status,'passed');
+    assert.equal(run.payload.subject_manifest_sha256,H('a'));
+    assert.equal(run.publication.status,'created');
+    const verified=await readAndVerifyR42EvalEvidence(run.publication.path,{subjectManifestSha256:H('a'),suiteSha256:run.payload.suite_sha256});
+    assert.equal(verified.status,'passed');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R42 model eval rejects failed judge and publishes no PASS evidence',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r42-eval-fail-'));
+  try{
+    await assert.rejects(runAgentEvalSuiteR42({suite,subjectManifestSha256:H('b'),evidenceRoot:root,
+      requestModel:async call=>call.role==='generator'
+        ?{raw_text:JSON.stringify({artifact:{plan:['unsafe']}})}
+        :{raw_text:JSON.stringify({schema:'deadbyte.agent-eval-judge-result.v1',verdict:'fail',advisory:true,
+          findings:[{code:'AUTH',severity:'critical',evidence:'authority widening'}],evidence_refs:[H('2')]})}}),/suite failed/i);
+    await assert.rejects(readFile(path.join(root,'agent_eval',`r42-${H('b').slice(0,16)}-`),'utf8'));
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R42 eval evidence tampering fails independent verification',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r42-eval-tamper-'));
+  try{
+    const run=await runAgentEvalSuiteR42({suite,subjectManifestSha256:H('c'),evidenceRoot:root,
+      requestModel:async call=>call.role==='generator'
+        ?{raw_text:JSON.stringify({artifact:{plan:['safe']}})}
+        :{raw_text:JSON.stringify({schema:'deadbyte.agent-eval-judge-result.v1',verdict:'pass',advisory:true,findings:[],evidence_refs:[H('3')]})}});
+    const raw=JSON.parse(await readFile(run.publication.path,'utf8'));
+    raw.payload.cases[0].result.verdict='fail';
+    await writeFile(run.publication.path,JSON.stringify(raw));
+    await assert.rejects(readAndVerifyR42EvalEvidence(run.publication.path,{subjectManifestSha256:H('c')}),/hash mismatch/i);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/agent-governance-r42.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  bindApprovalSubject, validateBoundApproval, createTaskDag, invalidateTaskDag,
+  createEvidenceClaim, evidenceSatisfies, deriveEffectiveRigor, taskDagFromPlan,
+  createDecisionRecord, evaluateDecisionFreshness
+} from '../src/agent-governance-r42.mjs';
+
+const H=value=>String(value).repeat(64).slice(0,64);
+
+test('R42 approval binds exact artifact, event head, scope and expiry',()=>{
+  const subject=bindApprovalSubject({goal_id:H('1'),reviewed_event_seq:9,reviewed_event_sha256:H('2'),
+    journal_head_sha256:H('3'),scope:'resume_goal',subject:{diff_id:H('4'),operation_count:2}});
+  const approval={schema:'deadbyte.bound-approval.v1',approval_subject_sha256:subject.approval_subject_sha256,
+    reviewed_event_seq:9,reviewed_event_sha256:H('2'),journal_head_sha256:H('3'),scope:'resume_goal',
+    issued_at_utc:'2026-09-20T01:00:00.000Z',expires_at_utc:'2026-09-20T01:05:00.000Z',provenance:'operator_mcp'};
+  assert.equal(validateBoundApproval({approval,subject,now:new Date('2026-09-20T01:01:00Z')}),true);
+  assert.throws(()=>validateBoundApproval({approval:{...approval,journal_head_sha256:H('9')},subject,
+    now:new Date('2026-09-20T01:01:00Z')}),/journal|subject/i);
+  assert.throws(()=>validateBoundApproval({approval,subject:{...subject,subject:{diff_id:H('5'),operation_count:2}},
+    now:new Date('2026-09-20T01:01:00Z')}),/subject/i);
+  assert.throws(()=>validateBoundApproval({approval,subject,now:new Date('2026-09-20T01:06:00Z')}),/expired/i);
+});
+
+test('R42 canonical DAG propagates STALE only through affected descendants',()=>{
+  const dag=createTaskDag({run_id:'run-1',goal_id:H('a'),tasks:[
+    {task_id:'inspect',depends_on:[],input_artifacts:['source'],output_artifacts:['analysis']},
+    {task_id:'patch',depends_on:['inspect'],input_artifacts:['analysis'],output_artifacts:['diff']},
+    {task_id:'test',depends_on:['patch'],input_artifacts:['diff'],output_artifacts:['test-result']},
+    {task_id:'docs',depends_on:[],input_artifacts:['readme'],output_artifacts:['docs-result']}
+  ]});
+  const next=invalidateTaskDag(dag,{changed_artifact_ids:['analysis']});
+  assert.deepEqual(next.tasks.filter(task=>task.state==='STALE').map(task=>task.task_id),['patch','test']);
+  assert.equal(next.tasks.find(task=>task.task_id==='inspect').state,'PENDING');
+  assert.equal(next.tasks.find(task=>task.task_id==='docs').state,'PENDING');
+  assert.throws(()=>createTaskDag({run_id:'x',goal_id:H('a'),tasks:[
+    {task_id:'a',depends_on:['b'],input_artifacts:[],output_artifacts:[]},
+    {task_id:'b',depends_on:['a'],input_artifacts:[],output_artifacts:[]}
+  ]}),/cycle/i);
+});
+
+test('R42 one canonical DAG is deterministically derived from the authoritative plan',()=>{
+  const plan={steps:[{step_id:'inspect',status:'completed'},{step_id:'patch',status:'active'},{step_id:'verify',status:'pending'}]};
+  const one=taskDagFromPlan({run_id:H('7'),goal_id:H('7'),plan});
+  const two=taskDagFromPlan({run_id:H('7'),goal_id:H('7'),plan});
+  assert.equal(one.dag_sha256,two.dag_sha256);
+  assert.deepEqual(one.tasks.map(task=>[task.task_id,task.depends_on,task.state]),[
+    ['inspect',[],'COMPLETE'],['patch',['inspect'],'RUNNING'],['verify',['patch'],'PENDING']
+  ]);
+});
+
+test('R42 evidence ladder never lets weak evidence masquerade as runtime proof',()=>{
+  const source=createEvidenceClaim({claim_id:'claim-1',statement:'provider shape matches source',level:'source',refs:[H('b')]});
+  assert.equal(evidenceSatisfies(source,'source'),true);
+  assert.equal(evidenceSatisfies(source,'automated'),false);
+  assert.equal(evidenceSatisfies(source,'runtime'),false);
+  assert.throws(()=>createEvidenceClaim({claim_id:'claim-2',statement:'bad',level:'runtime',refs:[]}),/reference/i);
+});
+
+test('R42 rigor is derived once and cannot downgrade below risk minimum',()=>{
+  assert.deepEqual(deriveEffectiveRigor({project_default:'lightweight',risk_level:'high',explicit_override:'structured'}),{
+    project_default:'lightweight',risk_minimum:'agentic',explicit_override:'structured',effective_rigor:'agentic'
+  });
+  assert.equal(deriveEffectiveRigor({project_default:'structured',risk_level:'low',explicit_override:'agentic'}).effective_rigor,'agentic');
+});
+
+test('R42 decisions become stale deterministically without deleting history',()=>{
+  const record=createDecisionRecord({decision_id:'provider-choice',decision:'Use Responses adapter',reason:'strict bounded JSON',
+    evidence_refs:[H('c')],invalidates_if:[
+      {kind:'artifact_sha_changed',artifact_id:'provider-contract',expected_sha256:H('d')},
+      {kind:'policy_sha_changed',expected_sha256:H('e')}
+    ]});
+  assert.equal(evaluateDecisionFreshness(record,{artifact_sha256:{'provider-contract':H('d')},policy_sha256:H('e')}).state,'CURRENT');
+  const stale=evaluateDecisionFreshness(record,{artifact_sha256:{'provider-contract':H('f')},policy_sha256:H('e')});
+  assert.equal(stale.state,'STALE');
+  assert.deepEqual(stale.invalidated_by,[{kind:'artifact_sha_changed',artifact_id:'provider-contract',expected_sha256:H('d'),observed_sha256:H('f')}]);
+});

package/test/autonomous-r34-e2e.test.mjs

@@ -75,7 +75,8 @@ test('R34 missing authority waits durably and approval resumes the same phase af
     assert.equal(journal.events.filter(event=>event.type==='action_started').length,0);
 
     await f.arm();
-    const approved = await f.runtime.approve({goalId:goal.goal_id,decision:'approve'});
+    const approved = await f.runtime.approve({goalId:goal.goal_id,decision:'approve',
+      approvalSubjectSha256:result.loop.approval_subject.approval_subject_sha256});
     assert.equal(approved.status,'approved');
     assert.equal(approved.loop.phase,'ACTING');
     const resumed = await f.runtime.run({goalId:goal.goal_id,maxCycles:2});

package/test/cli-entrypoint.test.mjs

@@ -21,7 +21,7 @@ test('npx CLI reports the canonical package version through --version, -v and ve
   for(const arg of ['--version','-v','version']){
     const result=spawnSync(process.execPath,[cliPath,arg],{cwd:root,encoding:'utf8',windowsHide:true});
     assert.equal(result.status,0,result.stderr);
-    assert.equal(result.stdout.trim(),'0.12.0');
+    assert.equal(result.stdout.trim(),'0.14.0');
   }
 });
 

package/test/controller-desktop-r40.test.mjs

@@ -70,7 +70,8 @@ test('R40 policy initializer pins current native observer and input and starts D
   assert.match(source,/deadbyte-desktop-observer-r40\.exe/);
   assert.match(source,/deadbyte-desktop-input-r40\.exe/);
   assert.match(source,/deadbyte-desktop-uia-r40\.exe/);
-  assert.match(source,/Get-FileHash/);
+  assert.match(source,/System\.Security\.Cryptography\.SHA256/);
+  assert.match(source,/Get-Sha256Hex -Path \$Observer/);
   assert.match(source,/Remove-Item -LiteralPath \$Grant/);
   assert.match(source,/grant_state='DISARMED'/);
   assert.match(source,/deadbyte\.desktop-policy\.v1/);

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.12.0');
+  assert.equal(result.receipt.runtime.package_version, '0.14.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/evidence-publisher-r42.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  publishEvidenceAtomic, createExecutionReceipt, createVerificationResult
+} from '../src/evidence-publisher-r42.mjs';
+
+const H=value=>String(value).repeat(64).slice(0,64);
+
+test('R42 evidence publication is atomic, no-clobber and idempotent for identical bytes',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r42-evidence-'));
+  try{
+    const one=await publishEvidenceAtomic({root,kind:'eval',evidenceId:'case-1',payload:{status:'passed',score:1}});
+    assert.equal(one.status,'created');
+    const two=await publishEvidenceAtomic({root,kind:'eval',evidenceId:'case-1',payload:{status:'passed',score:1}});
+    assert.equal(two.status,'existing');
+    assert.equal(two.evidence_sha256,one.evidence_sha256);
+    const bytes=await readFile(one.path);
+    assert.equal(H('0')===one.evidence_sha256,false);
+    assert.match(bytes.toString('utf8'),/"payload_sha256":"[0-9a-f]{64}"/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R42 conflicting concurrent evidence identity fails closed without overwrite',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r42-evidence-race-'));
+  try{
+    const settled=await Promise.allSettled([
+      publishEvidenceAtomic({root,kind:'closure',evidenceId:'release-final',payload:{candidate:'a'}}),
+      publishEvidenceAtomic({root,kind:'closure',evidenceId:'release-final',payload:{candidate:'b'}})
+    ]);
+    assert.equal(settled.filter(item=>item.status==='fulfilled').length,1);
+    assert.equal(settled.filter(item=>item.status==='rejected').length,1);
+    assert.match(String(settled.find(item=>item.status==='rejected').reason),/EVIDENCE_ID_CONFLICT/);
+    const winner=settled.find(item=>item.status==='fulfilled').value;
+    const parsed=JSON.parse(await readFile(winner.path,'utf8'));
+    assert.ok(['a','b'].includes(parsed.payload.candidate));
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R42 execution receipt and outcome verification are distinct typed artifacts',()=>{
+  const receipt=createExecutionReceipt({execution_id:'exec-1',subject_sha256:H('1'),request_sha256:H('2'),
+    observed_exit_code:0,started_at_utc:'2026-09-20T01:00:00.000Z',completed_at_utc:'2026-09-20T01:00:01.000Z'});
+  assert.equal(receipt.schema,'deadbyte.execution-receipt.v1');
+  assert.equal(Object.hasOwn(receipt,'outcome_passed'),false);
+  const verified=createVerificationResult({verification_id:'verify-1',subject_sha256:H('1'),
+    execution_receipt_sha256:receipt.receipt_sha256,outcome_passed:true,oracle:'runtime_behavior',evidence_refs:[H('3')]});
+  assert.equal(verified.schema,'deadbyte.verification-result.v1');
+  assert.equal(verified.outcome_passed,true);
+  assert.throws(()=>createExecutionReceipt({execution_id:'exec-2',subject_sha256:H('1'),request_sha256:H('2'),
+    observed_exit_code:0,started_at_utc:'2026-09-20T01:00:00.000Z',completed_at_utc:'2026-09-20T01:00:01.000Z',outcome_passed:true}),/unknown field/i);
+});

package/test/helpers/autonomous-r34-fixture.mjs

@@ -12,7 +12,7 @@ import { createAutonomousRuntime } from '../../src/autonomous-runtime.mjs';
 const sha = bytes => createHash('sha256').update(bytes).digest('hex');
 const nonce = () => randomBytes(32).toString('hex');
 
-export async function createR34Fixture({authority='armed',withFailingProfile=false,withStatefulProfile=false,codingRuntimeFactory=null,nativeDiffRuntimeFactory=null,desktopMemoryProvider=null,desktopRuntime=null}={}) {
+export async function createR34Fixture({authority='armed',withFailingProfile=false,withStatefulProfile=false,codingRuntimeFactory=null,nativeDiffRuntimeFactory=null,desktopMemoryProvider=null,memoryProvider=null,desktopRuntime=null}={}) {
   const root = await mkdtemp(path.join(os.tmpdir(),'deadbyte-r34-e2e-'));
   const project = path.join(root,'project');
   const trust = path.join(root,'trust');
@@ -73,8 +73,8 @@ export async function createR34Fixture({authority='armed',withFailingProfile=fal
   const machineFsRuntime = createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const nativeDiffRuntime = nativeDiffRuntimeFactory ? nativeDiffRuntimeFactory(baseNativeDiffRuntime) : baseNativeDiffRuntime;
-  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime,desktopMemoryProviderOverride=desktopMemoryProvider,desktopRuntimeOverride=desktopRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
-    desktopRuntime:desktopRuntimeOverride,desktopMemoryProvider:desktopMemoryProviderOverride,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime,desktopMemoryProviderOverride=desktopMemoryProvider,memoryProviderOverride=memoryProvider,desktopRuntimeOverride=desktopRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
+    desktopRuntime:desktopRuntimeOverride,desktopMemoryProvider:desktopMemoryProviderOverride,memoryProvider:memoryProviderOverride,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   return {
     root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,machineFsRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
     initial_sha256:sha(await readFile(target)),arm,disarm,

package/test/human-clarification-r42.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createR34Fixture, planCreateDecision, sendPlannerDecision } from './helpers/autonomous-r34-fixture.mjs';
+
+async function startPlannedGoal(f) {
+  const goal=await f.runtime.submit({submissionId:'r42-clarify',rootId:'project',title:'Clarification',
+    goal:'Choose the correct bounded implementation.',acceptance:'Use the operator choice.',maxIterations:8});
+  let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+  result=await sendPlannerDecision(f.runtime,goal.goal_id,result,planCreateDecision(),{maxCycles:2});
+  return {goal,result};
+}
+
+test('R42 planner can request typed human clarification and resume with signed answer context',async()=>{
+  const f=await createR34Fixture();
+  try {
+    const {goal,result:first}=await startPlannedGoal(f);
+    const clarify={schema:'deadbyte.autonomous-decision.v2',kind:'clarify',
+      question:'Which compatibility target should be authoritative?',
+      choices:['Preserve R41 behavior','Adopt R42 behavior']};
+    const paused=await sendPlannerDecision(f.runtime,goal.goal_id,first,clarify,{maxCycles:2});
+    assert.equal(paused.status,'paused');
+    assert.equal(paused.reason,'human_input_required');
+    assert.deepEqual(paused.loop.clarification,{question:clarify.question,choices:clarify.choices});
+    const subject=paused.loop.approval_subject.approval_subject_sha256;
+    await assert.rejects(f.runtime.approve({goalId:goal.goal_id,decision:'approve',answer:'Preserve R41 behavior',
+      approvalSubjectSha256:'f'.repeat(64)}),/approval subject mismatch/i);
+    await assert.rejects(f.runtime.approve({goalId:goal.goal_id,decision:'approve',approvalSubjectSha256:subject}),/answer.*required/i);
+    const approved=await f.runtime.approve({goalId:goal.goal_id,decision:'approve',answer:'Preserve R41 behavior',
+      approvalSubjectSha256:subject});
+    assert.equal(approved.status,'approved');
+    const next=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    assert.equal(next.status,'input_required');
+    assert.match(next.planner_request.prompt,/Preserve R41 behavior/);
+    const events=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const provided=events.events.find(event=>event.type==='human_input_provided');
+    assert.equal(provided.payload.answer,'Preserve R41 behavior');
+    assert.match(provided.payload.answer_sha256,/^[0-9a-f]{64}$/);
+    const approval=events.events.find(event=>event.type==='approval_granted');
+    assert.equal(approval.payload.approval_subject_sha256,subject);
+    assert.equal(approval.payload.scope,'human_clarification');
+  } finally { await f.cleanup(); }
+});
+
+test('R42 clarification contract rejects injected fields and oversized choices',async()=>{
+  const f=await createR34Fixture();
+  try {
+    const {goal,result:first}=await startPlannedGoal(f);
+    const injected={schema:'deadbyte.autonomous-decision.v2',kind:'clarify',question:'Choose?',choices:[],command:'cmd.exe'};
+    const repaired=await sendPlannerDecision(f.runtime,goal.goal_id,first,injected,{maxCycles:2});
+    assert.equal(repaired.status,'input_required');
+    assert.match(repaired.planner_request.prompt,/PREVIOUS_RESPONSE_REJECTED/);
+  } finally { await f.cleanup(); }
+});

package/test/memory-autonomous-integration-r41.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+import { loadPrivateSigningKey,loadPublicVerifyKey } from '../src/trust.mjs';
+import { createR41MemoryProvider } from '../src/memory-r41.mjs';
+
+const sha=value=>createHash('sha256').update(String(value)).digest('hex');
+
+test('R41 planner request binds verified bounded memory before a mutating decision',async()=>{
+  const f=await createR34Fixture();
+  try{
+    const signing=await loadPrivateSigningKey(f.keys.privateKeyPath);
+    const verify=await loadPublicVerifyKey(f.keys.publicKeyPath);
+    const provider=createR41MemoryProvider({memoryRoot:path.join(f.root,'memory'),sourceReleaseManifest:sha('r41-release'),
+      writerVersion:'0.13.0',privateKey:signing.privateKey,publicKey:verify.publicKey,keyId:signing.keyId,byteBudget:65536});
+    const runtime=f.createRuntime({memoryProviderOverride:provider});
+    const goal=await runtime.submit({submissionId:'r41-memory-binding',rootId:'project',title:'repair',goal:'repair x.txt',acceptance:'x is y'});
+    const run=await runtime.run({goalId:goal.goal_id,maxCycles:1});
+    assert.equal(run.status,'input_required');
+    assert.match(run.planner_request.prompt,/"long_term_memory"/);
+    assert.match(run.planner_request.prompt,/"working_memory_sha256":"[0-9a-f]{64}"/);
+    const journal=await runtime.events({goalId:goal.goal_id,fromSeq:1,limit:100});
+    const requested=journal.events.find(event=>event.type==='planner_requested');
+    assert.match(requested.payload.working_memory_sha256,/^[0-9a-f]{64}$/);
+    assert.match(requested.payload.memory_snapshot_sha256,/^[0-9a-f]{64}$/);
+    assert.match(requested.payload.memory_index_sha256,/^[0-9a-f]{64}$/);
+    assert.equal(requested.payload.memory_source_release_manifest,sha('r41-release'));
+  }finally{await f.cleanup();}
+});

package/test/memory-history-r41.test.mjs

@@ -0,0 +1,126 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash,generateKeyPairSync,sign as cryptoSign } from 'node:crypto';
+import { mkdir,mkdtemp,rm,writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { createR41MemoryProvider } from '../src/memory-r41.mjs';
+import { verifyR41Memory } from '../scripts/verify-memory-r41.mjs';
+
+const EVENT_DOMAIN=Buffer.from('DEADBYTE-AUTONOMOUS-EVENT-V1\0');
+const GOAL_DOMAIN=Buffer.from('DEADBYTE-AUTONOMOUS-GOAL-V1\0');
+const ZERO='0'.repeat(64);
+const sha=value=>createHash('sha256').update(Buffer.from(typeof value==='string'?value:canonicalJson(value),'utf8')).digest('hex');
+const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+const keyId=createHash('sha256').update(Buffer.from(publicKey.export({type:'spki',format:'der'}))).digest('hex');
+const manifest=sha('r41-history-release');
+
+function eventJournal(goalId,items){
+  const events=[];
+  for(const [index,[type,payload]] of items.entries()){
+    const body={schema:'deadbyte.autonomous-event.v1',seq:index+1,goal_id:goalId,
+      created_at_utc:`2026-09-20T08:00:${String(index).padStart(2,'0')}.000Z`,prev_sha256:events.at(-1)?.event_sha256??ZERO,type,payload};
+    const event_sha256=sha(body);const signed={...body,event_sha256};
+    events.push({...signed,attestation:{algorithm:'ed25519',key_id:keyId,
+      signature_base64:cryptoSign(null,Buffer.concat([EVENT_DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),privateKey).toString('base64')}});
+  }
+  return events;
+}
+function signedGoal(goalId,title){
+  const identity={schema:'deadbyte.autonomous-goal.v1',policy_sha256:sha('policy'),root_id:'core',submission_id:title,
+    title,goal:`repair ${title}`,acceptance:'tests pass',max_iterations:8};
+  const body={...identity,goal_sha256:sha(identity),goal_id:goalId};
+  return {...body,attestation:{algorithm:'ed25519',key_id:keyId,
+    signature_base64:cryptoSign(null,Buffer.concat([GOAL_DOMAIN,Buffer.from(canonicalJson(body),'utf8')]),privateKey).toString('base64')}};
+}
+async function writeHistory(root,goal,events){
+  const dir=path.join(root,goal.goal_id);await mkdir(path.join(dir,'events'),{recursive:true});
+  await writeFile(path.join(dir,'goal.json'),`${canonicalJson(goal)}\n`);
+  for(const event of events)await writeFile(path.join(dir,'events',`${String(event.seq).padStart(6,'0')}.json`),`${canonicalJson(event)}\n`);
+}
+
+test('R41 provider retrieves verified prior-goal memory and excludes cross-release journals',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r41-history-'));
+  try{
+    const journalRoot=path.join(root,'goals');const memoryRoot=path.join(root,'memory');
+    const priorId=sha('prior-goal');const priorGoal=signedGoal(priorId,'ParserSymbol timeout');
+    const priorEvents=eventJournal(priorId,[
+      ['goal_created',{source_release_manifest:manifest}],
+      ['profile_completed',{profile_id:'test',passed:false,diagnostic_codes:['ERR_PARSER_TIMEOUT'],symbols:['ParserSymbol']}]
+    ]);
+    await writeHistory(journalRoot,priorGoal,priorEvents);
+    const foreignId=sha('foreign-goal');const foreignGoal=signedGoal(foreignId,'ParserSymbol foreign');
+    await writeHistory(journalRoot,foreignGoal,eventJournal(foreignId,[['goal_created',{source_release_manifest:sha('other-release')}]]));
+    const currentId=sha('current-goal');const signedCurrent=signedGoal(currentId,'ParserSymbol regression');
+    await writeHistory(journalRoot,signedCurrent,eventJournal(currentId,[['goal_created',{source_release_manifest:manifest}]]));
+    const currentGoal={...signedCurrent};delete currentGoal.attestation;
+    const currentEvents=eventJournal(currentId,[['goal_created',{source_release_manifest:manifest}]]);
+    const provider=createR41MemoryProvider({memoryRoot,journalRoot,sourceReleaseManifest:manifest,privateKey,publicKey,keyId,byteBudget:32768});
+    const result=await provider.refresh({goal:currentGoal,events:currentEvents,currentSymbols:['ParserSymbol']});
+    assert.equal(result.historical_goal_count,1);
+    assert.ok(result.planner_context.historical_memory.length>=1);
+    assert.equal(result.planner_context.historical_memory.some(item=>item.goal?.goal_id===foreignId||item.goal_id===foreignId),false);
+    assert.equal(result.planner_context.historical_archive_sha256,result.historical_archive_sha256);
+    const grownPriorEvents=eventJournal(priorId,[
+      ['goal_created',{source_release_manifest:manifest}],
+      ['profile_completed',{profile_id:'test',passed:false,diagnostic_codes:['ERR_PARSER_TIMEOUT'],symbols:['ParserSymbol']}],
+      ['planner_decision',{decision:{summary:'retry parser',action:'run_profile'}}],
+      ['profile_completed',{profile_id:'test',passed:true,symbols:['ParserSymbol']}],
+      ['release_completed',{receipt_sha256:sha('prior-release-grown')}]
+    ]);
+    await rm(path.join(journalRoot,priorId),{recursive:true,force:true});
+    await writeHistory(journalRoot,priorGoal,grownPriorEvents);
+    const refreshed=await provider.refresh({goal:currentGoal,events:currentEvents,currentSymbols:['ParserSymbol']});
+    assert.notEqual(refreshed.historical_archive_sha256,result.historical_archive_sha256);
+    const publicKeyPath=path.join(root,'public.pem');await writeFile(publicKeyPath,publicKey.export({type:'spki',format:'pem'}));
+    const verified=await verifyR41Memory({memoryRoot,journalRoot,sourceReleaseManifest:manifest,publicKeyPath});
+    assert.equal(verified.status,'passed');assert.equal(verified.goal_count,1);assert.equal(verified.archive_count,2);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R41 provider fails closed on a poisoned same-release historical chain',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r41-history-poison-'));
+  try{
+    const journalRoot=path.join(root,'goals');const goalId=sha('poisoned-goal');const historical=signedGoal(goalId,'poisoned');
+    const events=eventJournal(goalId,[['goal_created',{source_release_manifest:manifest}],['release_completed',{}]]);
+    events[1].prev_sha256=sha('forged');
+    await writeHistory(journalRoot,historical,events);
+    const currentId=sha('current-poison-check');const current={...signedGoal(currentId,'current')};delete current.attestation;
+    const provider=createR41MemoryProvider({memoryRoot:path.join(root,'memory'),journalRoot,sourceReleaseManifest:manifest,privateKey,publicKey,keyId});
+    await assert.rejects(provider.refresh({goal:current,events:eventJournal(currentId,[['goal_created',{source_release_manifest:manifest}]])}),/predecessor mismatch|hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+
+test('R41 verifier accepts content-addressed indexes from earlier verified snapshot prefixes',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r41-history-prefix-index-'));
+  try{
+    const journalRoot=path.join(root,'goals');const memoryRoot=path.join(root,'memory');
+    const goalId=sha('growing-goal');const signed=signedGoal(goalId,'growing journal');const goal={...signed};delete goal.attestation;
+    const firstEvents=eventJournal(goalId,[
+      ['goal_created',{source_release_manifest:manifest}],
+      ['profile_completed',{profile_id:'test',passed:false,diagnostic_codes:['ERR_FIRST']}]
+    ]);
+    await writeHistory(journalRoot,signed,firstEvents);
+    const provider=createR41MemoryProvider({memoryRoot,journalRoot,sourceReleaseManifest:manifest,privateKey,publicKey,keyId,byteBudget:32768});
+    const first=await provider.refresh({goal,events:firstEvents});
+    const grownEvents=eventJournal(goalId,[
+      ['goal_created',{source_release_manifest:manifest}],
+      ['profile_completed',{profile_id:'test',passed:false,diagnostic_codes:['ERR_FIRST']}],
+      ['planner_decision',{decision:{summary:'retry safely',action:'run_profile'}}],
+      ['profile_completed',{profile_id:'test',passed:true}],
+      ['release_completed',{receipt_sha256:sha('grown-release')}]
+    ]);
+    await rm(path.join(journalRoot,goalId),{recursive:true,force:true});
+    await writeHistory(journalRoot,signed,grownEvents);
+    const grown=await provider.refresh({goal,events:grownEvents});
+    assert.notEqual(first.memory_sha256,grown.memory_sha256);
+    assert.notEqual(first.index_sha256,grown.index_sha256);
+    const publicKeyPath=path.join(root,'public.pem');await writeFile(publicKeyPath,publicKey.export({type:'spki',format:'pem'}));
+    const verified=await verifyR41Memory({memoryRoot,journalRoot,sourceReleaseManifest:manifest,publicKeyPath});
+    assert.equal(verified.status,'passed');
+    assert.equal(verified.snapshot_count,2);
+    assert.equal(verified.index_count,2);
+  }finally{await rm(root,{recursive:true,force:true});}
+});