deadbyte-mcp 0.14.0 → 0.15.0

package/src/runtime-update.mjs

@@ -168,7 +168,7 @@ export function parseRollbackArgs(argv){
 function powershellPath(){
   return path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
 }
-function windowsPowerShellEnvironment(base=process.env){
+export function windowsPowerShellEnvironment(base=process.env){
   const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
   const userProfile=base.USERPROFILE||os.homedir();
   const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
@@ -485,6 +485,7 @@ export function parseControllerStatus(text){
     bridge_pid:number(/Bridge PID\s*:\s*(\d+)\s*\[verified\]/),
     cloud_pid:number(/Cloud PID\s*:\s*(\d+)\s*\[verified\]/),
     local_ready:/Local ready\s*:\s*True/.test(text),
+    process_armed:/Process plane\s*:\s*ARMED \[standing-grant\]/.test(text),
     coding_armed:/Coding plane\s*:\s*ARMED \[standing-grant\]/.test(text),
     autonomous_armed:/Autonomous\s*:\s*ARMED \[standing-grant\]/.test(text),
     desktop_armed:/Desktop plane\s*:\s*ARMED \[standing-grant\]/.test(text),
@@ -562,7 +563,7 @@ async function readLedger(ctx,name){
   }
   return {schema:value.schema,component:value.component,instance_nonce:String(value.instance_nonce),
     pid:Number(value.pid),creation_time_utc:String(value.creation_time_utc??''),image_path:String(value.image_path??''),
-    image_sha256:String(value.image_sha256)};
+    image_sha256:String(value.image_sha256),script_path:String(value.script_path??''),script_sha256:String(value.script_sha256??'')};
 }
 function sameGeneration(a,b){
   return a.pid===b.pid&&a.instance_nonce===b.instance_nonce&&a.creation_time_utc===b.creation_time_utc&&a.image_sha256===b.image_sha256;
@@ -573,19 +574,37 @@ function nodeProcesses(){
   const text=assertRun(result,'node process query').trim(); if(!text) return [];
   const parsed=JSON.parse(text); return Array.isArray(parsed)?parsed:[parsed];
 }
-function coreProcess(coreRoot,bridgePid){
+export function selectCoreProcess(processes,coreRoot,bridgePid,verifiedBridge=null){
   const needle=path.join(coreRoot,'src','mcp-server.mjs').replaceAll('/','\\').toLowerCase();
-  const matches=nodeProcesses().filter(item=>Number(item.ParentProcessId)===bridgePid&&String(item.CommandLine??'').toLowerCase().includes(needle));
-  if(matches.length!==1) throw new Error(`expected one downstream core for bridge ${bridgePid}, found ${matches.length}`);
-  const item=matches[0]; return {pid:Number(item.ProcessId),parent_pid:Number(item.ParentProcessId),creation_date:String(item.CreationDate??''),
-    executable_path:String(item.ExecutablePath??''),command_line:String(item.CommandLine??'')};
+  const children=processes.filter(item=>Number(item.ParentProcessId)===bridgePid);
+  const visible=children.filter(item=>String(item.CommandLine??'').length>0);
+  const matches=visible.filter(item=>String(item.CommandLine).replaceAll('/','\\').toLowerCase().includes(needle));
+  let item=null,identityBasis=null;
+  if(children.length===1&&visible.length===1&&matches.length===1){
+    item=matches[0]; identityBasis='command_line';
+  } else if(children.length===1&&visible.length===0){
+    if(verifiedBridge?.component!=='bridge'||verifiedBridge.pid!==bridgePid||!path.isAbsolute(String(verifiedBridge.script_path??''))||
+        !HEX64.test(String(verifiedBridge.script_sha256??''))) {
+      throw new Error(`opaque downstream core requires verified Bridge script binding for bridge ${bridgePid}`);
+    }
+    item=children[0]; identityBasis='verified_bridge_single_opaque_node_child';
+  } else {
+    throw new Error(`expected one unambiguous downstream core for bridge ${bridgePid}, found children=${children.length} visible_matches=${matches.length}`);
+  }
+  const pid=Number(item.ProcessId),creationDate=String(item.CreationDate??'');
+  if(!Number.isInteger(pid)||pid<1||creationDate.length<1) throw new Error(`downstream core identity incomplete for bridge ${bridgePid}`);
+  return {pid,parent_pid:Number(item.ParentProcessId),creation_date:creationDate,
+    executable_path:String(item.ExecutablePath??''),command_line:String(item.CommandLine??''),identity_basis:identityBasis};
+}
+function coreProcess(coreRoot,bridge){
+  return selectCoreProcess(nodeProcesses(),coreRoot,bridge.pid,bridge);
 }
 async function captureRuntime(ctx){
   const statusText=controllerCaptured(ctx,'status',15000); const status=parseControllerStatus(statusText);
   if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
   if(status.host_armed) throw new Error('slot update requires host plane DISARMED');
   if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
-  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,status.bridge_pid);
+  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
   return {status,status_text:statusText.trim(),bridge,cloud,core};
 }
 async function capturePredecessor(ctx,recoverOfflinePredecessor){
@@ -631,7 +650,7 @@ async function startAndVerify(ctx,oldRuntime){
     catch {} await sleep(500);
   }
   if(!status?.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`new runtime failed ONLINE gate: ${statusText}`);
-  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,status.bridge_pid);
+  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
   if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
   if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
   if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) throw new Error('fresh downstream core generation gate failed');
@@ -756,26 +775,42 @@ async function revokeAuthority(ctx,prior){
   if(prior.desktop_armed){ controllerCaptured(ctx,'disarmdesktop',15000); revoked=true; }
   if(prior.autonomous_armed){ controllerCaptured(ctx,'disarmautonomous',15000); revoked=true; }
   if(prior.coding_armed){ controllerCaptured(ctx,'disarmcoding',15000); revoked=true; }
+  if(prior.process_armed){ controllerCaptured(ctx,'disarmprocess',15000); revoked=true; }
   const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority revoke gate failed');
+  if(status.process_armed||status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority revoke gate failed');
   if(status.host_armed) throw new Error('host plane became armed during revoke');
   return {revoked,status};
 }
-async function restoreStandingAuthority(ctx,prior,enabled){
-  if(!enabled){
-    const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-    if(status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority unexpectedly survived slot switch');
-    if(status.host_armed) throw new Error('host plane became armed during slot switch');
-    return status;
+export function standingAuthorityRestorePlan(prior,enabled){
+  const before={
+    process_armed:prior?.process_armed===true,
+    coding_armed:prior?.coding_armed===true,
+    autonomous_armed:prior?.autonomous_armed===true,
+    desktop_armed:prior?.desktop_armed===true,
+    host_armed:prior?.host_armed===true
+  };
+  if(before.autonomous_armed&&!before.coding_armed) throw new Error('invalid prior authority: autonomous armed without coding');
+  const expected={process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false};
+  const commands=[];
+  if(enabled){
+    expected.process_armed=before.process_armed;
+    expected.coding_armed=before.coding_armed;
+    expected.autonomous_armed=before.autonomous_armed;
+    if(before.coding_armed) commands.push('armcoding');
+    if(before.autonomous_armed) commands.push('armautonomous');
+    if(before.process_armed) commands.push('armprocess');
   }
-  if(prior.autonomous_armed&&!prior.coding_armed) throw new Error('invalid prior authority: autonomous armed without coding');
-  if(prior.coding_armed) controllerCaptured(ctx,'armcoding',15000);
-  if(prior.autonomous_armed) controllerCaptured(ctx,'armautonomous',15000);
+  return {commands,expected};
+}
+async function restoreStandingAuthority(ctx,prior,enabled){
+  const plan=standingAuthorityRestorePlan(prior,enabled);
+  for(const command of plan.commands) controllerCaptured(ctx,command,15000);
   const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(status.coding_armed!==prior.coding_armed) throw new Error('coding standing-grant restore gate failed');
-  if(status.autonomous_armed!==prior.autonomous_armed) throw new Error('autonomous standing-grant restore gate failed');
-  if(status.desktop_armed) throw new Error('desktop plane must remain disarmed after slot switch');
-  if(status.host_armed) throw new Error('host plane became armed during slot switch');
+  for(const key of ['process_armed','coding_armed','autonomous_armed']){
+    if(status[key]!==plan.expected[key]) throw new Error(`${key.replace('_armed','')} standing-grant restore gate failed`);
+  }
+  if(status.desktop_armed!==plan.expected.desktop_armed) throw new Error('desktop plane must remain disarmed after slot switch');
+  if(status.host_armed!==plan.expected.host_armed) throw new Error('host plane became armed during slot switch');
   return status;
 }
 async function stopAndVerify(ctx,runtime){
@@ -818,7 +853,8 @@ function generationTuple(runtime){
   if(!runtime) return null;
   return {bridge:{pid:runtime.bridge.pid,instance_nonce:runtime.bridge.instance_nonce,creation_time_utc:runtime.bridge.creation_time_utc,image_sha256:runtime.bridge.image_sha256},
     cloud:{pid:runtime.cloud.pid,instance_nonce:runtime.cloud.instance_nonce,creation_time_utc:runtime.cloud.creation_time_utc,image_sha256:runtime.cloud.image_sha256},
-    core:{pid:runtime.core.pid,parent_pid:runtime.core.parent_pid,creation_date:runtime.core.creation_date,command_line:runtime.core.command_line}};
+    core:{pid:runtime.core.pid,parent_pid:runtime.core.parent_pid,creation_date:runtime.core.creation_date,
+      command_line:runtime.core.command_line,identity_basis:runtime.core.identity_basis}};
 }
 function publicPointer(pointer){
   if(!pointer) return null;
@@ -933,7 +969,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     const stabilization=await stabilizeRuntime(newCtx,newRuntime);
     await writeState(statePath,journal,'fresh_runtime_verified',{new_runtime:generationTuple(newRuntime),stabilization});
     const finalAuthority=await restoreStandingAuthority(newCtx,priorStatus,restoreStandingGrants);
-    await writeState(statePath,journal,'authority_verified',{final_authority:{coding_armed:finalAuthority.coding_armed,
+    await writeState(statePath,journal,'authority_verified',{final_authority:{process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,
       autonomous_armed:finalAuthority.autonomous_armed,desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed}});
     const body={schema:UPDATE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,
       completed_at_utc:new Date().toISOString(),activation_boundary:'active-release-pointer',mechanism:'immutable-release-slot-plus-atomic-pointer-rename',
@@ -944,10 +980,10 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       development_root:development,
       host_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.hostRepinned},
       coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},old_runtime:generationTuple(oldRuntime),new_runtime:generationTuple(newRuntime),stabilization,
-      authority:{prior:{coding_armed:priorStatus.coding_armed,
+      authority:{prior:{process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,
       autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed},revoked_before_switch:revoked,restore_requested:restoreStandingGrants,
       desktop_restore_policy:'explicit-rearm-required',
-      final:{coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed}},rollback_performed:false};
+      final:{process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed}},rollback_performed:false};
     const receipt=await writeEnvelope(receiptPath,body,key);
     await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
     return {ok:true,update_id:updateId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,
@@ -1027,10 +1063,7 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   if(!pointerInfo.pointer||canonicalJson(publicPointer(pointerInfo.pointer))!==canonicalJson(publicPointer(activePointer))) throw new Error('rollback current pointer does not match signed activation pointer');
   await verifyActiveInstallation(state,priorPointer);
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
-  if(/Process plane\s*:\s*ARMED/.test(currentRuntime.status_text)) controllerCaptured(currentCtx,'disarmprocess',15000);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
-  const authorityText=controllerCaptured(currentCtx,'status',15000);
-  if(/Process plane\s*:\s*ARMED/.test(authorityText)) throw new Error('process standing authority revoke gate failed');
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
   const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
   await mkdir(evidenceDir,{recursive:true});
@@ -1048,7 +1081,7 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
     priorRuntime=await startAndVerify(priorCtx,currentRuntime);
     const stabilization=await stabilizeRuntime(priorCtx,priorRuntime);
     const finalStatus=parseControllerStatus(controllerCaptured(priorCtx,'status',15000));
-    if(finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
+    if(finalStatus.process_armed||finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.desktop_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
     const body={schema:ROLLBACK_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
       completed_at_utc:new Date().toISOString(),from_pointer:publicPointer(activePointer),active_pointer:publicPointer(priorPointer),
       old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,authority_revoked:revoked.revoked,rollback_performed:true};

package/src/skill-mcp-tools-r44.mjs

@@ -0,0 +1,37 @@
+import * as z from 'zod/v4';
+
+const name=z.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/);
+const rel=z.string().min(1).max(512);
+export const skillCatalogInputSchema=z.discriminatedUnion('op',[
+  z.strictObject({op:z.literal('list')}),
+  z.strictObject({op:z.literal('load'),name}),
+  z.strictObject({op:z.literal('resource'),name,path:rel})
+]);
+export const skillCatalogOutputSchema=z.strictObject({
+  status:z.enum(['ok','denied']),
+  op:z.enum(['list','load','resource']),
+  result:z.record(z.string(),z.json()).optional(),
+  error:z.string().optional()
+}).superRefine((value,ctx)=>{
+  if(value.status==='ok'&&value.result===undefined) ctx.addIssue({code:'custom',path:['result'],message:'result required for status=ok'});
+  if(value.status==='denied'&&value.error===undefined) ctx.addIssue({code:'custom',path:['error'],message:'error required for status=denied'});
+  if(value.status==='ok'&&value.error!==undefined) ctx.addIssue({code:'custom',path:['error'],message:'error invalid for status=ok'});
+});
+function result(value,isError=false){
+  const parsed=skillCatalogOutputSchema.safeParse(value);
+  if(!parsed.success) throw new Error(`R44 skill output contract violation: ${z.prettifyError(parsed.error)}`);
+  return {isError,structuredContent:parsed.data,content:[{type:'text',text:JSON.stringify(parsed.data)}]};
+}
+export function registerSkillToolsR44(server,{runtime}={}){
+  if(!server||!runtime) throw new Error('R44 skill tool registration requires runtime');
+  server.registerTool('skill_catalog',{
+    description:'Read-only content-addressed R44 skill catalog. list is metadata-only; load/resource verify signed bytes. This tool never arms or renews authority.',
+    inputSchema:skillCatalogInputSchema,outputSchema:skillCatalogOutputSchema
+  },async args=>{
+    try{
+      if(args.op==='list') return result({status:'ok',op:'list',result:await runtime.list()});
+      if(args.op==='load') return result({status:'ok',op:'load',result:await runtime.load({name:args.name})});
+      return result({status:'ok',op:'resource',result:await runtime.readResource({name:args.name,resourcePath:args.path})});
+    }catch(error){return result({status:'denied',op:args.op,error:String(error)},true);}
+  });
+}

package/src/skill-plane-r44.mjs

@@ -0,0 +1,203 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { lstat, readFile, readdir, realpath } from 'node:fs/promises';
+import path from 'node:path';
+
+const DOMAIN=Buffer.from('DEADBYTE-SKILL-MANIFEST-V1\0','utf8');
+const SKILL_NAME=/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+const VERSION=/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/;
+const CAPABILITY=/^[A-Za-z0-9._-]{1,96}$/;
+const AUTHORITY_PLANES=new Set(['process','coding','autonomous','desktop','host']);
+const RESOURCE_KINDS=new Set(['reference','script','agent','asset']);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort((a,b)=>a.localeCompare(b,'en')).map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const strictUtf8=bytes=>new TextDecoder('utf-8',{fatal:true}).decode(bytes);
+function insist(ok,message){if(!ok) throw new Error(message);}
+function exactKeys(object,expected,label){
+  insist(object&&typeof object==='object'&&!Array.isArray(object),`${label} must be an object`);
+  const actual=Object.keys(object).sort();
+  const wanted=[...expected].sort();
+  insist(JSON.stringify(actual)===JSON.stringify(wanted),`${label} fields mismatch`);
+}
+function uniqueSorted(values,label,validator){
+  insist(Array.isArray(values),`${label} must be an array`);
+  const copy=values.map(value=>String(value));
+  insist(copy.every(validator),`${label} contains invalid value`);
+  insist(new Set(copy).size===copy.length,`${label} contains duplicate value`);
+  const sorted=[...copy].sort((a,b)=>a.localeCompare(b,'en'));
+  insist(JSON.stringify(copy)===JSON.stringify(sorted),`${label} must be sorted`);
+  return copy;
+}
+function resourcePath(value){
+  insist(typeof value==='string'&&value.length>0&&value.length<=512,'resource path invalid');
+  insist(!value.includes('\\'),'resource path must use forward slashes');
+  insist(!path.posix.isAbsolute(value),'resource path must be relative');
+  const parts=value.split('/');
+  insist(parts.every(part=>part&&part!=='.'&&part!=='..'),'resource path traversal denied');
+  insist(value!=='SKILL.md'&&value!=='skill.json','resource path is reserved');
+  return value;
+}
+function parseFrontmatter(text){
+  const lines=text.split(/\r?\n/);
+  insist(lines[0]==='---','SKILL.md frontmatter missing');
+  const end=lines.indexOf('---',1);
+  insist(end>1&&end<=32,'SKILL.md frontmatter boundary invalid');
+  const meta={};
+  for(const line of lines.slice(1,end)){
+    const m=/^([a-z_]+):\s*(.*)$/.exec(line);
+    insist(m,'SKILL.md frontmatter line malformed');
+    insist(!Object.hasOwn(meta,m[1]),`SKILL.md duplicate frontmatter key ${m[1]}`);
+    meta[m[1]]=m[2];
+  }
+  exactKeys(meta,['name','description','version','audience'],'SKILL.md frontmatter');
+  return meta;
+}
+async function walkFiles(root,rel=''){
+  const dir=path.join(root,...(rel?rel.split('/'):[]));
+  const names=(await readdir(dir)).sort((a,b)=>a.localeCompare(b,'en'));
+  const out=[];
+  for(const name of names){
+    const childRel=rel?`${rel}/${name}`:name;
+    const full=path.join(root,...childRel.split('/'));
+    const st=await lstat(full);
+    insist(!st.isSymbolicLink(),`skill symlink forbidden: ${childRel}`);
+    if(st.isDirectory()) out.push(...await walkFiles(root,childRel));
+    else { insist(st.isFile(),`skill non-file forbidden: ${childRel}`);out.push(childRel); }
+  }
+  return out;
+}
+async function readBounded(file,max,label){
+  const bytes=await readFile(file);
+  insist(bytes.length<=max,`${label} exceeds byte limit`);
+  return bytes;
+}
+
+export async function createSkillPlane({root,verifyKeyPath}={}){
+  insist(typeof root==='string'&&path.isAbsolute(root),'skill root must be absolute');
+  insist(typeof verifyKeyPath==='string'&&path.isAbsolute(verifyKeyPath),'skill verify key path must be absolute');
+  const rootStat=await lstat(root);
+  insist(rootStat.isDirectory()&&!rootStat.isSymbolicLink(),'skill root must be a real directory');
+  const rootReal=await realpath(root);
+  const publicKey=createPublicKey(await readFile(verifyKeyPath));
+  insist(publicKey.asymmetricKeyType==='ed25519','skill verify key must be Ed25519');
+  const keyId=sha(Buffer.from(publicKey.export({type:'spki',format:'der'})));
+
+  async function verified(name){
+    insist(typeof name==='string'&&SKILL_NAME.test(name),'skill name invalid');
+    const dir=path.join(rootReal,name);
+    const st=await lstat(dir);
+    insist(st.isDirectory()&&!st.isSymbolicLink(),'skill directory must be real');
+    const dirReal=await realpath(dir);
+    insist(path.dirname(dirReal).toLowerCase()===rootReal.toLowerCase(),'skill directory escape denied');
+
+    for(const reserved of ['skill.json','SKILL.md']){
+      const rst=await lstat(path.join(dirReal,reserved));
+      insist(rst.isFile()&&!rst.isSymbolicLink(),`${reserved} must be a real file`);
+    }
+    const envelopeBytes=await readBounded(path.join(dirReal,'skill.json'),256*1024,'skill.json');
+    let envelope;
+    try{envelope=JSON.parse(strictUtf8(envelopeBytes));}catch(error){throw new Error(`skill.json invalid JSON/UTF-8: ${error.message}`);}
+    exactKeys(envelope,['body','body_sha256','attestation','manifest_sha256'],'skill envelope');
+    insist(/^[0-9a-f]{64}$/.test(envelope.body_sha256??''),'skill body hash malformed');
+    insist(/^[0-9a-f]{64}$/.test(envelope.manifest_sha256??''),'skill manifest hash malformed');
+    exactKeys(envelope.attestation,['algorithm','domain','key_id','signature_base64'],'skill attestation');
+    insist(envelope.attestation.algorithm==='ed25519'&&envelope.attestation.domain==='DEADBYTE-SKILL-MANIFEST-V1','skill attestation contract mismatch');
+    insist(envelope.attestation.key_id===keyId,'skill signer mismatch');
+
+    const body=envelope.body;
+    exactKeys(body,['schema','name','version','description','audience','skill_md_sha256','resources','required_capabilities','authority_planes','provenance'],'skill manifest body');
+    insist(body.schema==='deadbyte.skill-manifest.v1','skill manifest schema mismatch');
+    insist(body.name===name&&SKILL_NAME.test(body.name),'skill manifest name mismatch');
+    insist(typeof body.version==='string'&&VERSION.test(body.version),'skill version invalid');
+    insist(typeof body.description==='string'&&body.description.length>=1&&body.description.length<=512,'skill description invalid');
+    insist(body.audience==='agent','skill audience invalid');
+    insist(/^[0-9a-f]{64}$/.test(body.skill_md_sha256??''),'SKILL.md hash malformed');
+    const requiredCapabilities=uniqueSorted(body.required_capabilities,'required capabilities',value=>CAPABILITY.test(value));
+    const authorityPlanes=uniqueSorted(body.authority_planes,'authority planes',value=>typeof value==='string'&&value.length>=1&&value.length<=32);
+    for(const plane of authorityPlanes) insist(AUTHORITY_PLANES.has(plane),`unknown authority plane: ${plane}`);
+    exactKeys(body.provenance,['source','origin_url','source_revision'],'skill provenance');
+    insist(typeof body.provenance.source==='string'&&body.provenance.source.length>=1&&body.provenance.source.length<=128,'skill provenance source invalid');
+    insist(body.provenance.origin_url===null||typeof body.provenance.origin_url==='string','skill provenance origin_url invalid');
+    insist(body.provenance.source_revision===null||typeof body.provenance.source_revision==='string','skill provenance source_revision invalid');
+
+    insist(Array.isArray(body.resources)&&body.resources.length<=128,'skill resources invalid');
+    const resources=body.resources.map(item=>{
+      exactKeys(item,['path','sha256','kind'],'skill resource');
+      const rel=resourcePath(item.path);
+      insist(/^[0-9a-f]{64}$/.test(item.sha256??''),'skill resource hash malformed');
+      insist(RESOURCE_KINDS.has(item.kind),'skill resource kind invalid');
+      return {path:rel,sha256:item.sha256,kind:item.kind};
+    });
+    const resourceNames=resources.map(item=>item.path);
+    insist(new Set(resourceNames).size===resourceNames.length,'skill resource paths duplicate');
+    insist(JSON.stringify(resourceNames)===JSON.stringify([...resourceNames].sort((a,b)=>a.localeCompare(b,'en'))),'skill resources must be sorted');
+
+    const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+    insist(sha(bodyBytes)===envelope.body_sha256,'skill body hash mismatch');
+    const {manifest_sha256,...unsignedEnvelope}=envelope;
+    insist(sha(Buffer.from(canonicalJson(unsignedEnvelope),'utf8'))===manifest_sha256,'skill manifest envelope hash mismatch');
+    insist(cryptoVerify(null,Buffer.concat([DOMAIN,bodyBytes]),publicKey,Buffer.from(envelope.attestation.signature_base64,'base64')),'skill signature invalid');
+
+    const skillBytes=await readBounded(path.join(dirReal,'SKILL.md'),128*1024,'SKILL.md');
+    insist(sha(skillBytes)===body.skill_md_sha256,'SKILL.md hash mismatch');
+    const skillText=strictUtf8(skillBytes);
+    const frontmatter=parseFrontmatter(skillText);
+    insist(frontmatter.name===body.name,'SKILL.md name mismatch');
+    insist(frontmatter.version===body.version,'SKILL.md version mismatch');
+    insist(frontmatter.description===body.description,'SKILL.md description mismatch');
+    insist(frontmatter.audience===body.audience,'SKILL.md audience mismatch');
+
+    for(const item of resources){
+      const full=path.join(dirReal,...item.path.split('/'));
+      const rst=await lstat(full);
+      insist(rst.isFile()&&!rst.isSymbolicLink(),`skill resource must be a real file: ${item.path}`);
+      const bytes=await readBounded(full,512*1024,`skill resource ${item.path}`);
+      insist(sha(bytes)===item.sha256,`resource hash mismatch: ${item.path}`);
+    }
+    const actual=await walkFiles(dirReal);
+    const allowed=['SKILL.md','skill.json',...resourceNames].sort((a,b)=>a.localeCompare(b,'en'));
+    const extra=actual.filter(file=>!allowed.includes(file));
+    insist(extra.length===0,`undeclared skill file: ${extra[0]}`);
+    const missing=allowed.filter(file=>!actual.includes(file));
+    insist(missing.length===0,`declared skill file missing: ${missing[0]}`);
+
+    return {dir:dirReal,envelope,body,skillText,resources,requiredCapabilities,authorityPlanes};
+  }
+
+  async function list(){
+    const names=(await readdir(rootReal)).sort((a,b)=>a.localeCompare(b,'en'));
+    const skills=[];
+    for(const name of names){
+      const full=path.join(rootReal,name);
+      const st=await lstat(full);
+      insist(st.isDirectory()&&!st.isSymbolicLink(),`skill registry contains non-directory entry: ${name}`);
+      const item=await verified(name);
+      skills.push({
+        name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
+        manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
+        authority_planes:item.authorityPlanes,resource_count:item.resources.length,provenance:item.body.provenance,verified:true
+      });
+    }
+    const registrySha=sha(Buffer.from(canonicalJson(skills.map(item=>({name:item.name,manifest_sha256:item.manifest_sha256}))),'utf8'));
+    return {status:'ok',skills,registry_sha256:registrySha,verify_key_id:keyId};
+  }
+  async function load({name}={}){
+    const item=await verified(name);
+    return {
+      status:'ok',name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
+      content:item.skillText,manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
+      authority_planes:item.authorityPlanes,resources:item.resources,provenance:item.body.provenance,verified:true,verify_key_id:keyId
+    };
+  }
+  async function readResource({name,resourcePath:requested}={}){
+    const item=await verified(name);
+    const rel=resourcePath(requested);
+    const resource=item.resources.find(entry=>entry.path===rel);
+    insist(resource,`resource not declared: ${rel}`);
+    const bytes=await readBounded(path.join(item.dir,...rel.split('/')),512*1024,`skill resource ${rel}`);
+    insist(sha(bytes)===resource.sha256,`resource hash mismatch: ${rel}`);
+    return {status:'ok',name:item.body.name,path:rel,kind:resource.kind,sha256:resource.sha256,content:strictUtf8(bytes),verified:true};
+  }
+  return Object.freeze({list,load,readResource,root:rootReal,verify_key_id:keyId});
+}

package/src/tunnel-stdio-compat-smoke.mjs

@@ -112,7 +112,7 @@ async function modernPassThrough() {
     if (era !== 'modern') throw new Error(`expected modern era through compat prefilter, got ${String(era)}`);
     const listed = await client.listTools();
     const names = listed.tools.map(tool => tool.name).sort();
-    const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open'];
+    const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
     const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
     const allowedCatalogs = [
       baseTools,

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.14.0';
+export const DEADBYTE_VERSION = '0.15.0';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/agent-backend-r44.test.mjs

@@ -0,0 +1,115 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createAgentBackendR44 } from '../src/agent-backend-r44.mjs';
+
+async function waitFor(predicate,timeoutMs=2000){
+  const deadline=Date.now()+timeoutMs;
+  while(Date.now()<deadline){if(predicate())return;await new Promise(resolve=>setTimeout(resolve,5));}
+  throw new Error('waitFor timeout');
+}
+
+class FakeTransport extends EventEmitter {
+  constructor(){super();this.sent=[];this.started=false;this.stopped=false;}
+  async start(){this.started=true;}
+  async send(value){this.sent.push(structuredClone(value));}
+  async stop(){this.stopped=true;}
+  reply(id,result){this.emit('message',{jsonrpc:'2.0',id,result});}
+  serverRequest(id,method,params={}){this.emit('message',{jsonrpc:'2.0',id,method,params});}
+}
+
+test('R44 agent backend persists thread identity and request lifecycle atomically',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-backend-'));
+  const transport=new FakeTransport();
+  try{
+    const backend=await createAgentBackendR44({backendId:'codex',stateDir:root,transportFactory:async()=>transport});
+    await backend.start();
+    await backend.bindThread({logicalId:'main',threadId:'thread-abc'});
+    assert.equal((await backend.status()).threads.main,'thread-abc');
+    const pending=backend.request({method:'thread/read',params:{threadId:'thread-abc'},timeoutMs:2000});
+    await waitFor(()=>transport.sent.length===1);
+    assert.equal(transport.sent.length,1);
+    const call=transport.sent[0];
+    assert.equal(call.jsonrpc,'2.0');assert.equal(call.method,'thread/read');assert.match(call.id,/^[0-9a-f]{64}$/);
+    transport.reply(call.id,{ok:true});
+    assert.deepEqual(await pending,{ok:true});
+    const state=JSON.parse(await readFile(path.join(root,'codex.json'),'utf8'));
+    assert.equal(state.schema,'deadbyte.agent-backend-state.v1');
+    assert.equal(state.threads.main,'thread-abc');
+    assert.equal(state.requests[call.id].state,'completed');
+    assert.deepEqual(state.requests[call.id].result,{ok:true});
+    assert.equal('token' in state,false);assert.equal('api_key' in state,false);
+    await backend.close();
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 agent backend denies server approval by default and never auto-approves',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-backend-deny-'));
+  const transport=new FakeTransport();
+  try{
+    const backend=await createAgentBackendR44({backendId:'codex',stateDir:root,transportFactory:async()=>transport});
+    await backend.start();
+    transport.serverRequest('srv-1','approval/request',{kind:'shell'});
+    await waitFor(()=>transport.sent.some(x=>x.id==='srv-1'));
+    const response=transport.sent.find(x=>x.id==='srv-1');
+    assert.ok(response);assert.equal(response.error.code,-32001);assert.match(response.error.message,/denied/i);
+    assert.equal(response.result,undefined);
+    await backend.close();
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 backend restart classifies unresolved requests interrupted and preserves threads',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-backend-restart-'));
+  const firstTransport=new FakeTransport();
+  try{
+    const first=await createAgentBackendR44({backendId:'codex',stateDir:root,transportFactory:async()=>firstTransport});
+    await first.start();await first.bindThread({logicalId:'main',threadId:'thread-persist'});
+    const promise=first.request({method:'turn/start',params:{threadId:'thread-persist'},timeoutMs:10000});
+    promise.catch(()=>{});
+    await waitFor(()=>firstTransport.sent.length===1);
+    const id=firstTransport.sent[0].id;
+    await first.simulateCrashForTest();
+    const secondTransport=new FakeTransport();
+    const second=await createAgentBackendR44({backendId:'codex',stateDir:root,transportFactory:async()=>secondTransport});
+    const status=await second.status();
+    assert.equal(status.threads.main,'thread-persist');
+    assert.equal(status.requests[id].state,'interrupted');
+    assert.equal(secondTransport.sent.length,0,'interrupted request must not auto-replay');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 backend fails closed on truncated state and binds production executable hash',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-backend-corrupt-'));
+  try{
+    await writeFile(path.join(root,'codex.json'),'{"schema":','utf8');
+    await assert.rejects(createAgentBackendR44({backendId:'codex',stateDir:root,transportFactory:async()=>new FakeTransport()}),/state JSON invalid/);
+    await rm(path.join(root,'codex.json'));
+    await assert.rejects(createAgentBackendR44({backendId:'codex',stateDir:root,executable:process.execPath,executableSha256:'0'.repeat(64),args:[]}),/executable hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+
+test('R44 agent backend supports Codex wire mode notifications without jsonrpc envelope',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-backend-codex-wire-'));
+  const transport=new FakeTransport();const seen=[];
+  try{
+    const backend=await createAgentBackendR44({backendId:'codex-wire',stateDir:root,transportFactory:async()=>transport,
+      wireMode:'codex-app-server',notificationHandler:async event=>seen.push(event)});
+    await backend.start();
+    const pending=backend.request({method:'initialize',params:{clientInfo:{name:'deadbyte',version:'0.15.0'}},timeoutMs:2000});
+    await waitFor(()=>transport.sent.length===1);
+    const request=transport.sent[0];
+    assert.equal('jsonrpc' in request,false);assert.equal(request.method,'initialize');
+    transport.reply(request.id,{userAgent:'codex-test'});
+    assert.deepEqual(await pending,{userAgent:'codex-test'});
+    await backend.notify({method:'initialized',params:{}});
+    assert.equal(transport.sent[1].method,'initialized');assert.equal('id' in transport.sent[1],false);assert.equal('jsonrpc' in transport.sent[1],false);
+    transport.emit('message',{method:'turn/completed',params:{threadId:'t',turn:{id:'turn-1',status:'completed'}}});
+    await waitFor(()=>seen.length===1);
+    assert.deepEqual(seen[0],{method:'turn/completed',params:{threadId:'t',turn:{id:'turn-1',status:'completed'}},backendId:'codex-wire'});
+    await backend.close();
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/agent-runtime.test.mjs

@@ -1,4 +1,4 @@
-import test from 'node:test';
+import test from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
@@ -20,7 +20,7 @@ const AGENT_TOOLS = [
   'agent_task_submit',
   'agent_task_verify'
 ];
-const BASE_TOOLS = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open'];
+const BASE_TOOLS = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
 
 function structured(result, label) {
   if (result.isError) throw new Error(`${label}: ${JSON.stringify(result.structuredContent ?? result.content)}`);
@@ -68,7 +68,7 @@ async function cleanup(f, client) {
   await rm(f.trust, { recursive: true, force: true }).catch(() => {});
 }
 
-test('agent runtime without an explicit host policy exposes only base plus durable task tools', async () => {
+test('R44 agent runtime exposes base skill catalog plus durable task tools without host authority', async () => {
   const f = await fixture();
   let client;
   try {