deadbyte-mcp 0.14.0 → 0.15.0

package/test/r44-finalizer.test.mjs

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { validateFinalizerAuthorityStatus, validateWindowsGateEvidence } from '../scripts/finalize-r44.mjs';
+import { windowsPowerShellEnvironment } from '../src/runtime-update.mjs';
+
+const manifest='a'.repeat(64);
+const parent={
+  release_id:'v0.14.1-0a5a833892593283',
+  manifest_sha256:'0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9',
+  generation_manifest_sha256:'fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb',
+  closure_sha256:'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b'
+};
+const features=()=>({skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+  remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,full_regression_required:true,
+  codex_live_binary_required:false});
+const valid=()=>({schema:'deadbyte.r44-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.0',
+  marker:'DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS',manifest_sha256:manifest,
+  parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+    generation_manifest_sha256:parent.generation_manifest_sha256,final_closure_sha256:parent.closure_sha256},
+  features:features()});
+
+test('R44 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED',()=>{
+  assert.equal(validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),true);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:false,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),/Process standing grant/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:true,host_armed:false}),/Desktop DISARMED/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:true}),/Host DISARMED/);
+});
+
+test('R44 detached finalizer accepts only exact signed-R43-parent feature gate evidence',()=>{
+  assert.equal(validateWindowsGateEvidence(valid(),manifest,parent),true);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),manifest_sha256:'b'.repeat(64)},manifest,parent),/candidate mismatch/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),parent:{...valid().parent,release_id:'v0.14.1-bad'}},manifest,parent),/parent mismatch/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),parent:{...valid().parent,final_closure_sha256:'b'.repeat(64)}},manifest,parent),/parent/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),features:{...features(),skill_integrity:false}},manifest,parent),/skill_integrity/);
+});
+
+test('R44 detached finalizer isolates Windows PowerShell modules from the parent runtime',()=>{
+  const env=windowsPowerShellEnvironment({
+    SystemRoot:'C:\\Windows',USERPROFILE:'C:\\Users\\operator',ProgramFiles:'C:\\Program Files',
+    PSModulePath:'C:\\poisoned-runtime-modules'
+  });
+  assert.equal(env.PSModulePath,[
+    'C:\\Users\\operator\\Documents\\WindowsPowerShell\\Modules',
+    'C:\\Program Files\\WindowsPowerShell\\Modules',
+    'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules'
+  ].join(';'));
+  assert.doesNotMatch(env.PSModulePath,/poisoned-runtime-modules/);
+});

package/test/r44-parent.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR44Parent } from '../scripts/verify-r44-parent.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+
+test('R44 parent is exact sealed R43 final baseline',async()=>{
+  const result=await verifyR44Parent(path.join(root,'R44-PARENT.json'));
+  assert.equal(result.ok,true);
+  assert.equal(result.release_id,'v0.14.1-0a5a833892593283');
+  assert.equal(result.manifest_sha256,'0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9');
+  assert.equal(result.generation_manifest_sha256,'fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb');
+  assert.equal(result.release_files,1834);
+  assert.equal(result.generation_files,7);
+  assert.equal(result.closure_sha256,'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b');
+  assert.equal(result.recorded_all_disarmed,true);
+});
+
+test('R44 parent proof is historical and does not require current grants to remain absent',async()=>{
+  const result=await verifyR44Parent(path.join(root,'R44-PARENT.json'));
+  assert.equal(result.proof_class,'immutable-slot+generation+signed-final-closure');
+});

package/test/release-version.test.mjs

@@ -3,23 +3,57 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 const root=new URL('../',import.meta.url);const text=rel=>readFile(new URL(rel,root),'utf8');
-const R42_PREDECESSOR_RELEASE_ID='v0.13.0-3255be10de4daf08';
-const R42_PREDECESSOR_MANIFEST='3255be10de4daf0837d67d1ab1913b785b8b8215bc7405823c2ff46968c4b98f';
-test('R42 authority agrees on V0.14.0 and preserves exact sealed public R41 predecessor',async()=>{
- const pkg=JSON.parse(await text('package.json'));
- const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,parent,semanticConfig]=await Promise.all([
- text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r42.ps1'),text('README.txt'),text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),text('scripts/deferred-slot-operation-r42.mjs'),text('scripts/release-parity-r42.mjs'),text('scripts/final-closure-r42.mjs'),text('scripts/final-closure-verify-r42.mjs'),text('scripts/windows-gate-evidence-r42.mjs'),text('R42-PARENT.json'),text('controller/deadbyte-semantic-lsp-config.json')]);
- assert.equal(pkg.version,'0.14.0');assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r42.ps1');
- assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r42.mjs');assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r42.mjs');
- assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r42.mjs');assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r42.mjs');
- assert.equal(pkg.scripts['desktop:policy:refresh'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1');
- assert.match(version,/DEADBYTE_VERSION = '0\.14\.0'/);assert.match(controller,/CONTROLLER V0\.14\.0 \/ R42/);assert.match(gate,/DEADBYTE V0\.14\.0 \/ R42 WINDOWS BATCH GATE: PASS/);
- assert.match(readme,/^DEADBYTE MCP V0\.14\.0 \/ R42 AGENTIC GOVERNANCE BASELINE$/m);assert.match(architecture,/^# DEADBYTE MCP V0\.14\.0 \/ R42 ARCHITECTURE$/m);assert.match(controllerReadme,/^DEADBYTE MCP V0\.14\.0 \/ R42 CONTROLLER$/m);
- assert.match(deferred,/--expected-version','0\.14\.0'/);assert.match(deferred,/--enable-desktop/);assert.match(parity,/R42_PREDECESSOR_RELEASE_ID='v0\.13\.0-3255be10de4daf08'/);assert.match(parity,new RegExp(R42_PREDECESSOR_MANIFEST));
- assert.match(parity,/version==='0\.14\.0'|version:'0\.14\.0'/);assert.match(closure,/version:'0\.14\.0'/);assert.match(closureVerify,/DEADBYTE V0\.14\.0 \/ R42 WINDOWS BATCH GATE: PASS/);assert.match(windowsGate,/version:'0\.14\.0'/);
- assert.equal(JSON.parse(parent).parent_manifest_sha256,R42_PREDECESSOR_MANIFEST);
- assert.equal(createHash('sha256').update(Buffer.from(semanticConfig,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');assert.equal(R42_PREDECESSOR_RELEASE_ID,'v0.13.0-3255be10de4daf08');
+const PARENT_RELEASE='v0.14.1-0a5a833892593283';
+const PARENT_MANIFEST='0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9';
+const PARENT_CLOSURE='2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b';
+
+test('R44 current authority agrees on V0.15.0 and preserves exact sealed R43 parent',async()=>{
+  const pkg=JSON.parse(await text('package.json'));
+  const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,parent,r43Gate,r43Parity,r43Closure]=await Promise.all([
+    text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r44.ps1'),text('README.txt'),
+    text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),text('scripts/deferred-slot-operation-r44.mjs'),
+    text('scripts/release-parity-r44.mjs'),text('scripts/final-closure-r44.mjs'),text('scripts/final-closure-verify-r44.mjs'),
+    text('scripts/windows-gate-evidence-r44.mjs'),text('R44-PARENT.json'),
+    text('scripts/gate-windows-r43.ps1'),text('scripts/release-parity-r43.mjs'),text('scripts/final-closure-r43.mjs')
+  ]);
+  assert.equal(pkg.version,'0.15.0');
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r44.ps1');
+  assert.equal(pkg.scripts['r44:parent:verify'],'node scripts/verify-r44-parent.mjs');
+  assert.equal(pkg.scripts['r44:full:test'],'node scripts/full-regression-r44.mjs');
+  assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r44.mjs');
+  assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r44.mjs');
+  assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r44.mjs');
+  assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r44.mjs');
+  assert.equal(pkg.scripts['finalize:r44'],'node scripts/finalize-r44.mjs');
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.0'/);
+  assert.match(controller,/CONTROLLER V0\.15\.0 \/ R44/);
+  assert.match(gate,/DEADBYTE V0\.15\.0 \/ R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS/);
+  assert.match(readme,/^DEADBYTE MCP V0\.15\.0 \/ R44 REMOTE AGENT \+ SKILL BASELINE$/m);
+  assert.match(architecture,/^# DEADBYTE MCP V0\.15\.0 \/ R44 ARCHITECTURE$/m);
+  assert.match(controllerReadme,/^DEADBYTE MCP V0\.15\.0 \/ R44 CONTROLLER$/m);
+  assert.match(deferred,/--expected-version','0\.15\.0'/);
+  assert.match(parity,/R44_PREDECESSOR_RELEASE_ID='v0\.14\.1-0a5a833892593283'/);assert.match(parity,new RegExp(PARENT_MANIFEST));
+  assert.match(parity,/tool_count===81/);assert.match(parity,/tool_count===43/);
+  assert.match(closure,/version:'0\.15\.0'/);assert.match(closure,/DEADBYTE-R44-FINAL-CLOSURE-V1/);
+  assert.match(closureVerify,/R44_FULL_TOOL_COUNT=81/);assert.match(closureVerify,/R44_COMPACT_TOOL_COUNT=43/);
+  assert.match(windowsGate,/deadbyte\.r44-windows-gate\.v1/);
+  const parentRecord=JSON.parse(parent);
+  assert.equal(parentRecord.parent_release_id,PARENT_RELEASE);assert.equal(parentRecord.parent_manifest_sha256,PARENT_MANIFEST);
+  assert.equal(parentRecord.parent_final_closure_sha256,PARENT_CLOSURE);
+  assert.match(r43Gate,/DEADBYTE V0\.14\.1 \/ R43 AUTHORITY HARDENING WINDOWS BATCH GATE: PASS/);
+  assert.match(r43Parity,/deadbyte\.r43-parity\.v1/);assert.match(r43Closure,/version:'0\.14\.1'/);
+});
+
+test('R44 keeps ONLINE reuse and explicit Desktop authority',async()=>{
+  const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);
+  assert.match(cli,/controllerRuntimeReady/);assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);
+  const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);
+  assert.ok(start>=0&&end>start);const block=controller.slice(start,end);
+  assert.doesNotMatch(block,/\$host\s*=/i);assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);
+  assert.match(controller,/armdesktop/);assert.match(controller,/disarmdesktop/);
+});
+
+test('semantic config remains byte-pinned across R44 feature work',async()=>{
+  const semantic=await text('controller/deadbyte-semantic-lsp-config.json');
+  assert.equal(createHash('sha256').update(Buffer.from(semantic,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');
 });
-test('R40 keeps ONLINE reuse and PowerShell Host collision fix while Desktop stays explicit',async()=>{const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);assert.match(cli,/controllerRuntimeReady/);assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);assert.ok(start>=0&&end>start);const block=controller.slice(start,end);assert.doesNotMatch(block,/\$host\s*=/i);assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);assert.match(controller,/armdesktop/);assert.match(controller,/disarmdesktop/);});
-test('sealed R39 tooling remains historical 0.11.3 authority with exact 0.11.2 predecessor',async()=>{const [parity,gate,closure]=await Promise.all([text('scripts/release-parity-r39.mjs'),text('scripts/gate-windows-r39.ps1'),text('scripts/final-closure-r39.mjs')]);assert.match(parity,/R39_PREDECESSOR_RELEASE_ID='v0\.11\.2-058605dfccaa3035'/);assert.match(parity,/version==='0\.11\.3'|version:'0\.11\.3'/);assert.match(gate,/DEADBYTE V0\.11\.3 \/ R39 WINDOWS BATCH GATE: PASS/);assert.match(closure,/version:'0\.11\.3'/);});
-test('sealed R37 tooling remains historical 0.11.1 authority',async()=>{const [parity,gate,closure]=await Promise.all([text('scripts/release-parity.mjs'),text('scripts/gate-windows.ps1'),text('scripts/final-closure.mjs')]);assert.match(parity,/R37_PREDECESSOR_RELEASE_ID='v0\.11\.0-08c2a0008b1f84c9'/);assert.match(parity,/version==='0\.11\.1'|version:'0\.11\.1'/);assert.match(gate,/DEADBYTE V0\.11\.1 \/ R37 WINDOWS BATCH GATE: PASS/);assert.match(closure,/version:'0\.11\.1'/);});

package/test/remote-device-r44.test.mjs

@@ -0,0 +1,104 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createRemoteDevicePlaneR44 } from '../src/remote-device-r44.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+function deviceKey(){
+  const {publicKey}=generateKeyPairSync('ed25519');
+  const der=Buffer.from(publicKey.export({type:'spki',format:'der'}));
+  return {spki:der.toString('base64'),deviceId:sha(der)};
+}
+class FakeRelay{
+  constructor(){this.probes=[];this.requests=[];this.drop=false;}
+  async probe(value){this.probes.push(structuredClone(value));return {device_id:value.device_id,epoch:value.epoch,nonce:value.nonce,ready:true};}
+  async request(value){this.requests.push(structuredClone(value));if(this.drop)return null;return {ack:'accepted',request_id:value.request_id,terminal:{status:'completed',result_sha256:'a'.repeat(64)}};}
+}
+
+test('R44 remote device reported online is not reachable until identity-bound probe ACK',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true});
+    const paired=await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    assert.equal(paired.device_id,key.deviceId);assert.equal(paired.epoch,1);
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'conn-1'});
+    assert.equal((await plane.status({deviceId:key.deviceId})).reachable,false);
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.search',payload:{q:'x'},requestId:'1'.repeat(64)}),/not reachable/);
+    const ready=await plane.probe({deviceId:key.deviceId,epoch:1});
+    assert.equal(ready.reachable,true);assert.equal(relay.probes.length,1);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote dispatch is durable-before-send, replay-idempotent and silent drop is terminal',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-dispatch-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'c'});
+    await plane.probe({deviceId:key.deviceId,epoch:1});
+    const requestId='2'.repeat(64), payload={path:'README.md'};
+    const done=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId});
+    assert.equal(done.state,'completed');assert.equal(relay.requests.length,1);
+    const stored=JSON.parse(await readFile(path.join(root,'remote-devices.json'),'utf8'));
+    assert.equal(stored.requests[requestId].state,'completed');
+    const replay=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId});
+    assert.equal(replay.replay,true);assert.equal(relay.requests.length,1);
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload:{path:'other'},requestId}),/request id conflict/);
+
+    relay.drop=true;
+    const droppedId='3'.repeat(64);
+    const dropped=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId:droppedId});
+    assert.equal(dropped.state,'failed');assert.equal(dropped.error_code,'transport_no_ack');
+    const after=JSON.parse(await readFile(path.join(root,'remote-devices.json'),'utf8'));
+    assert.equal(after.requests[droppedId].state,'failed');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote routing requires local capability authorization and revoke invalidates epoch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-auth-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async({capabilityId})=>capabilityId==='machine.status'});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'c'});await plane.probe({deviceId:key.deviceId,epoch:1});
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'host.exec',payload:{},requestId:'4'.repeat(64)}),/capability denied/);
+    assert.equal(relay.requests.length,0);
+    const revoked=await plane.revoke({deviceId:key.deviceId,epoch:1});
+    assert.equal(revoked.revoked,true);
+    await assert.rejects(plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'new'}),/revoked|epoch/i);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 credential rotation commits encrypted replacement before supersede callback',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-rotate-'));
+  const relay=new FakeRelay(), key=deviceKey(), observed=[];
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true,
+      onCredentialSuperseded:async info=>{
+        const current=JSON.parse(await readFile(path.join(root,'credentials',`${key.deviceId}.json`),'utf8'));
+        observed.push({info,current});
+      }});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    const one=Buffer.from('encrypted-token-one').toString('base64');
+    const first=await plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:one,expectedPreviousSha256:null});
+    const two=Buffer.from('encrypted-token-two').toString('base64');
+    const second=await plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:two,expectedPreviousSha256:first.credential_sha256});
+    assert.notEqual(second.credential_sha256,first.credential_sha256);
+    assert.equal(observed.length,1);
+    assert.equal(observed[0].current.credential_sha256,second.credential_sha256,'new credential must be durable before supersede');
+    await assert.rejects(plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:one,expectedPreviousSha256:first.credential_sha256}),/precondition/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote state corruption fails closed',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-corrupt-'));
+  try{
+    await writeFile(path.join(root,'remote-devices.json'),'{"schema":','utf8');
+    await assert.rejects(createRemoteDevicePlaneR44({stateDir:root,relay:new FakeRelay(),authorizeCapability:async()=>true}),/state JSON invalid/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/runtime-self-update.test.mjs

@@ -53,6 +53,29 @@ test('R27 slot-update CLI requires exact stage/development/version/manifest bind
   assert.ok(path.isAbsolute(parsed.developmentRoot));
 });
 
+test('R43 slot authority restore plan carries prior Process grant without restoring Desktop or Host', () => {
+  assert.equal(typeof runtimeUpdate.standingAuthorityRestorePlan,'function');
+  const parsed=runtimeUpdate.parseControllerStatus([
+    'DEADBYTE MCP = ONLINE',
+    'Process plane  : ARMED [standing-grant]',
+    'Coding plane  : ARMED [standing-grant]',
+    'Autonomous     : ARMED [standing-grant]',
+    'Desktop plane : ARMED [standing-grant]',
+    'Host plane    : DISARMED [disarmed]'
+  ].join('\n'));
+  assert.equal(parsed.process_armed,true);
+  const plan=runtimeUpdate.standingAuthorityRestorePlan(parsed,true);
+  assert.deepEqual(plan.commands,['armcoding','armautonomous','armprocess']);
+  assert.deepEqual(plan.expected,{
+    process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false
+  });
+  const disabled=runtimeUpdate.standingAuthorityRestorePlan(parsed,false);
+  assert.deepEqual(disabled.commands,[]);
+  assert.deepEqual(disabled.expected,{
+    process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false
+  });
+});
+
 test('R27 development root is outside immutable/runtime state stores', async () => {
   const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-state-'));
   const dev=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-dev-'));
@@ -410,6 +433,25 @@ test('R29 bridge bootstrap rebinds only the pinned external bridge script', asyn
   await assert.rejects(runtimeUpdate.prepareBridgeSpec(config,{root,scriptSha256:hex('f')}),/bridge script SHA-256 mismatch/i);
 });
 
+test('R44 downstream core selection accepts only one exact visible or one opaque child of the verified Bridge', () => {
+  assert.equal(typeof runtimeUpdate.selectCoreProcess,'function');
+  const root=path.resolve('C:/release'),bridgePid=1200;
+  const visible={ProcessId:1300,ParentProcessId:bridgePid,CreationDate:'20260921010000.000000+000',
+    ExecutablePath:'C:\\Program Files\\nodejs\\node.exe',CommandLine:`node "${path.join(root,'src','mcp-server.mjs')}"`};
+  const exact=runtimeUpdate.selectCoreProcess([visible],root,bridgePid);
+  assert.equal(exact.pid,1300);
+  assert.equal(exact.identity_basis,'command_line');
+  const opaque={ProcessId:1301,ParentProcessId:bridgePid,CreationDate:'20260921010100.000000+000',ExecutablePath:null,CommandLine:null};
+  const verifiedBridge={component:'bridge',pid:bridgePid,script_path:'C:\\bridge\\src\\bridge.mjs',script_sha256:hex('a')};
+  const fallback=runtimeUpdate.selectCoreProcess([opaque],root,bridgePid,verifiedBridge);
+  assert.equal(fallback.pid,1301);
+  assert.equal(fallback.identity_basis,'verified_bridge_single_opaque_node_child');
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([opaque],root,bridgePid),/requires verified Bridge script binding/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([opaque,{...opaque,ProcessId:1302}],root,bridgePid,verifiedBridge),/unambiguous downstream core/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([{...visible,CommandLine:'node C:\\other\\server.mjs'}],root,bridgePid),/unambiguous downstream core/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([{...opaque,CreationDate:''}],root,bridgePid,verifiedBridge),/identity incomplete/i);
+});
+
 test('R31 updater threads pinned process policy and machine-FS enable into successor generation', async () => {
   const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
   assert.match(source,/prepareProcessPolicyBootstrap\(processPolicyBootstrap\)/);

package/test/skill-mcp-r44.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+
+test('R44 compact surface exposes one read-only skill_catalog without authority',async()=>{
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-skill-mcp-'));
+  const client=new Client({name:'deadbyte-r44-skill-mcp',version:'0.15.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={...getDefaultEnvironment(),DEADBYTE_STATE_ROOT:state,DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'};
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const names=(await client.listTools()).tools.map(t=>t.name).sort();
+    assert.ok(names.includes('skill_catalog'),'R44 skill_catalog missing from compact surface');
+    assert.equal(names.filter(name=>name.startsWith('skill_')).length,1,'skill plane must remain one-tool surface');
+    const listed=await client.callTool({name:'skill_catalog',arguments:{op:'list'}});
+    assert.equal(listed.isError,false,JSON.stringify(listed));
+    assert.equal(listed.structuredContent.status,'ok');
+    assert.equal(listed.structuredContent.op,'list');
+    assert.deepEqual(listed.structuredContent.result.skills,[]);
+    assert.match(listed.structuredContent.result.registry_sha256,/^[0-9a-f]{64}$/);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    const cap=manifest.structuredContent.result.capabilities.find(x=>x.id==='skill.catalog');
+    assert.ok(cap,'skill.catalog capability missing');
+    assert.equal(cap.authority,'none');assert.equal(cap.mutating,false);assert.equal(cap.compact_tool,'skill_catalog');
+  }finally{await client.close().catch(()=>{});await rm(state,{recursive:true,force:true});}
+});

package/test/skill-plane-r44.test.mjs

@@ -0,0 +1,93 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, createPrivateKey, sign as cryptoSign } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createSkillPlane } from '../src/skill-plane-r44.mjs';
+
+const DOMAIN=Buffer.from('DEADBYTE-SKILL-MANIFEST-V1\0','utf8');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-skill-'));
+  const registry=path.join(root,'skills');
+  const trust=path.join(root,'trust');
+  await mkdir(registry,{recursive:true});await mkdir(trust,{recursive:true});
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  return {root,registry,keys};
+}
+async function installSkill(f,{name='repo-audit',authorityPlanes=['coding'],requiredCapabilities=['coding.search'],extraBody={}}={}){
+  const dir=path.join(f.registry,name);await mkdir(path.join(dir,'references'),{recursive:true});
+  const skill=`---\nname: ${name}\ndescription: Audit one repository with bounded evidence\nversion: 1.0.0\naudience: agent\n---\n\n# Repo Audit\n\nInspect before mutation.\n`;
+  const ref='Use bounded search and cite exact observed files.\n';
+  await writeFile(path.join(dir,'SKILL.md'),skill,'utf8');
+  await writeFile(path.join(dir,'references','guide.md'),ref,'utf8');
+  const body={
+    schema:'deadbyte.skill-manifest.v1',name,version:'1.0.0',description:'Audit one repository with bounded evidence',audience:'agent',
+    skill_md_sha256:sha(Buffer.from(skill)),resources:[{path:'references/guide.md',sha256:sha(Buffer.from(ref)),kind:'reference'}],
+    required_capabilities:requiredCapabilities,authority_planes:authorityPlanes,
+    provenance:{source:'test-fixture',origin_url:null,source_revision:null},...extraBody
+  };
+  const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+  const privateKey=createPrivateKey(await readFile(f.keys.privateKeyPath));
+  const envelope={body,body_sha256:sha(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-SKILL-MANIFEST-V1',
+    key_id:f.keys.keyId,signature_base64:cryptoSign(null,Buffer.concat([DOMAIN,bodyBytes]),privateKey).toString('base64')}};
+  envelope.manifest_sha256=sha(Buffer.from(canonicalJson(envelope),'utf8'));
+  await writeFile(path.join(dir,'skill.json'),`${JSON.stringify(envelope,null,2)}\n`,'utf8');
+  return {dir,skill,ref,envelope};
+}
+
+test('R44 skill catalog is metadata-only and load is signature/content bound',async()=>{
+  const f=await fixture();
+  try{
+    await installSkill(f,{});
+    const plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    const listed=await plane.list();
+    assert.equal(listed.status,'ok');assert.equal(listed.skills.length,1);
+    assert.equal(listed.skills[0].name,'repo-audit');assert.equal(listed.skills[0].authority_planes[0],'coding');
+    assert.equal('content' in listed.skills[0],false,'catalog must not leak instructions');
+    const loaded=await plane.load({name:'repo-audit'});
+    assert.equal(loaded.status,'ok');assert.match(loaded.content,/Inspect before mutation/);
+    assert.equal(loaded.verified,true);assert.match(loaded.manifest_sha256,/^[0-9a-f]{64}$/);
+    const resource=await plane.readResource({name:'repo-audit',resourcePath:'references/guide.md'});
+    assert.equal(resource.content,'Use bounded search and cite exact observed files.\n');
+    assert.equal(typeof plane.arm,'undefined');assert.equal(typeof plane.renew,'undefined');
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R44 skill plane fails closed on SKILL.md and resource tampering',async()=>{
+  const f=await fixture();
+  try{
+    const installed=await installSkill(f,{});
+    const plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    await writeFile(path.join(installed.dir,'SKILL.md'),'tampered\n','utf8');
+    await assert.rejects(plane.load({name:'repo-audit'}),/SKILL\.md hash mismatch/);
+    await installSkill(f,{});
+    await writeFile(path.join(installed.dir,'references','guide.md'),'tampered\n','utf8');
+    await assert.rejects(plane.readResource({name:'repo-audit',resourcePath:'references/guide.md'}),/resource hash mismatch/);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R44 skill plane rejects undeclared payloads, unknown authority and signature drift',async()=>{
+  const f=await fixture();
+  try{
+    const installed=await installSkill(f,{});
+    let plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    await writeFile(path.join(installed.dir,'hidden.ps1'),'Write-Host pwn\n','utf8');
+    await assert.rejects(plane.load({name:'repo-audit'}),/undeclared skill file/);
+    await rm(path.join(installed.dir,'hidden.ps1'));
+    await installSkill(f,{authorityPlanes:['root']});
+    await assert.rejects(plane.load({name:'repo-audit'}),/unknown authority plane/);
+    await installSkill(f,{});
+    const env=JSON.parse(await readFile(path.join(installed.dir,'skill.json'),'utf8'));
+    env.body.description='signature drift';
+    await writeFile(path.join(installed.dir,'skill.json'),JSON.stringify(env,null,2)+'\n');
+    plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    await assert.rejects(plane.load({name:'repo-audit'}),/body hash mismatch/);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/standing-grants.test.mjs

@@ -4,7 +4,7 @@ import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { loadCodingPolicy, codingSessionStatus } from '../src/coding-plane.mjs';
-import { loadAutonomousPolicy, autonomousSessionStatus } from '../src/autonomous-policy.mjs';
+import { assertAutonomousArmed, loadAutonomousPolicy, autonomousSessionStatus, recheckAutonomousAuthority } from '../src/autonomous-policy.mjs';
 import { loadHostPolicy, assertHostArmed } from '../src/host-plane.mjs';
 import { createHash } from 'node:crypto';
 
@@ -48,6 +48,10 @@ test('autonomous standing grant remains armed until explicit revocation', async
   assert.equal(status.armed, true);
   assert.equal(status.reason, 'standing-grant');
   assert.equal(status.expires_at_utc, null);
+  const initial = await assertAutonomousArmed(policy, 'project', farFuture);
+  const grant = JSON.parse(await import('node:fs/promises').then(fs => fs.readFile(policy.lease_file, 'utf8')));
+  await writeFile(policy.lease_file, JSON.stringify({ ...grant, instance_nonce:'d'.repeat(64) }));
+  await assert.rejects(() => recheckAutonomousAuthority(policy, initial, 'project', farFuture), /autonomous authority changed during operation/);
 });
 test('host standing grant remains armed until explicit revocation', async () => {
   const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-host-standing-'));