deadbyte-mcp 0.14.0 → 0.15.0

package/R44-DONORS.json

@@ -0,0 +1,99 @@
+{
+  "schema": "deadbyte.r44-donors.v1",
+  "observed_at_utc": "2026-09-21T00:00:00+07:00",
+  "policy": "reference-and-selective-port-only",
+  "donors": [
+    {
+      "id": "desktop-commander-mcp",
+      "url": "https://github.com/wonderwhy-er/DesktopCommanderMCP",
+      "license": "MIT",
+      "source_available": true,
+      "use": "implementation-reference",
+      "adopt": [
+        "interactive process/session UX",
+        "bounded output pagination",
+        "filesystem/search ergonomics",
+        "local audit history",
+        "remote-device lessons"
+      ],
+      "reject": [
+        "raw arbitrary authority widening",
+        "PID-as-authority",
+        "in-memory-only persistence assumptions",
+        "untyped background lifetime"
+      ]
+    },
+    {
+      "id": "remote-desktop-commander",
+      "url": "https://github.com/desktop-commander/remote-desktop-commander",
+      "license": "repository-docs/manifests-public; hosted-service-proprietary",
+      "source_available": false,
+      "use": "protocol-and-product-contract-reference",
+      "adopt": [
+        "OAuth2 PKCE client authorization",
+        "OAuth device authorization pairing",
+        "multi-machine naming/routing",
+        "device revoke semantics",
+        "Streamable HTTP remote MCP shape"
+      ],
+      "reject": [
+        "hosted relay dependency",
+        "online status without end-to-end reachability proof",
+        "remote authority mirroring local user permissions without DEADBYTE policy"
+      ]
+    },
+    {
+      "id": "desktop-commander-skills",
+      "url": "https://github.com/desktop-commander/skills",
+      "license": "repository-specific",
+      "source_available": true,
+      "use": "format-and-workflow-reference",
+      "adopt": [
+        "SKILL.md progressive disclosure",
+        "small metadata-first catalog",
+        "references/scripts separation"
+      ],
+      "extend": [
+        "content-addressed manifest",
+        "declared capability requirements",
+        "declared authority planes",
+        "resource hashes",
+        "provenance",
+        "cryptographic verification"
+      ],
+      "reject": [
+        "skill text as authority",
+        "skill-triggered self-arming"
+      ]
+    },
+    {
+      "id": "codex-app-server-provider",
+      "requested_url": "https://github.com/wonderwhy-er/ai-sdk-provider-codex-app-server",
+      "corroborating_public_url": "https://github.com/pablof7z/ai-sdk-provider-codex-app-server",
+      "license": "MIT on corroborating implementation",
+      "use": "agent-backend-contract-reference",
+      "adopt": [
+        "persistent JSON-RPC process",
+        "persistent/stateless thread modes",
+        "mid-execution message injection",
+        "interrupt",
+        "server-initiated request handling",
+        "model discovery"
+      ],
+      "reject": [
+        "auto-approval as authority",
+        "danger-full-access default",
+        "provider-owned permission semantics overriding DEADBYTE authority"
+      ]
+    }
+  ],
+  "adversarial_acceptance": [
+    "rotated credentials persist atomically before old credentials become unusable",
+    "registered is not reachable: online requires verified transport readiness and request acknowledgement",
+    "remote requests are idempotently identified and cannot disappear silently without a terminal transport result",
+    "shared state files commit by atomic rename and readers never accept truncated JSON",
+    "persistent jobs declare ownership and survive only under an explicit external supervisor contract",
+    "skills cannot widen or arm authority and every loaded byte is hash-bound",
+    "agent backend threads survive controller recreation through durable thread identity without granting new authority"
+  ]
+}

package/R44-PARENT.json

@@ -0,0 +1,18 @@
+{
+  "schema": "deadbyte.r44-parent.v1",
+  "parent_release_id": "v0.14.1-0a5a833892593283",
+  "parent_version": "0.14.1",
+  "parent_manifest_sha256": "0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9",
+  "parent_manifest_file_count": 1834,
+  "parent_release_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\releases\\v0.14.1-0a5a833892593283",
+  "parent_generation_manifest_sha256": "fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb",
+  "parent_generation_file_count": 7,
+  "parent_generation_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\generations\\v0.14.1-0a5a833892593283-ga2198d593efd75bd",
+  "parent_launcher_sha256": "e054796810c3d7be99ff3036e7427c5b75cfd823ea82808edcd28e928252e37e",
+  "parent_final_closure_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\release\\r43-final-0a5a833892593283.json",
+  "parent_final_closure_file_sha256": "f24100212b55d2016ea9c4ff47df5f026c8edc0b9b8643933ed8bf26fde3803f",
+  "parent_final_closure_sha256": "2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b",
+  "parent_final_closure_signer_key_id": "c0727a7911e29a0f1edd3cd910e47f89f43edb484743988c89cd82bfd5e37936",
+  "parent_proof": "immutable-slot+generation+signed-final-closure",
+  "development_root": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev"
+}

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.14.0 / R42 AGENTIC GOVERNANCE BASELINE
+DEADBYTE MCP V0.15.0 / R44 REMOTE AGENT + SKILL BASELINE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,7 +7,7 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.14.0 mcp
+  npx -y deadbyte-mcp@0.15.0 mcp
   npx deadbyte-mcp@latest remote
   npx deadbyte-mcp@latest remote status
   npx deadbyte-mcp@latest remote restart
@@ -399,3 +399,8 @@ hosted convenience on one side; self-owned release/evidence authority on the oth
 NO RAW SHELL COMMAND STRING. NO CALLER-SELECTED EXECUTABLE. CODING AND AUTONOMOUS
 EXECUTION REQUIRE EXPLICIT LOCAL STANDING GRANTS. REPORTS ARE CLAIMS; VERIFIED
 OBSERVATIONS AND SIGNED EVIDENCE ARE AUTHORITY.
+
+
+R44 REMOTE AGENT / SKILL / DURABLE JOB
+---------------------------------------
+R44 keeps the R43 authority model and adds one read-only public skill_catalog, bringing the compact/full surfaces to exact 43/81. Skills are Ed25519/content-addressed and cannot arm authority. The optional codex_app_server planner is executable-hash pinned, uses approvalPolicy=never and read-only sandbox defaults, persists thread identity, and fails closed on interrupted requests. Remote devices require Ed25519 identity, epoch, verified reachability, local capability authorization, durable request IDs and terminal acknowledgement. Persistent jobs require the external supervisor and exact process identity.

package/controller/README.TXT

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.14.0 / R42 CONTROLLER
+DEADBYTE MCP V0.15.0 / R44 CONTROLLER
 ====================================
 
 ENTRY POINT
@@ -11,8 +11,8 @@ Bare `remote` is a foreground device session. It starts the verified runtime, ar
 coding, and autonomous authority, verifies those three planes are ARMED, and requires Desktop and Host
 to stay DISARMED. R40 Desktop observation/UIA grounding remains available read-only; GUI mutation needs
 the separate explicit Desktop standing grant and Autonomous authority cannot substitute for it.
-The production Bridge uses the compact capability profile (exact 42 tools / 6 gateways) while local
-stdio MCP keeps the exact full 80-tool profile. The compact console shows request-before-result
+The production Bridge uses the compact capability profile (exact 43 tools / 6 gateways) while local
+stdio MCP keeps the exact full 81-tool profile. The compact console shows request-before-result
 Live Activity without raw SHA text, request IDs, payload JSON, or duplicate Bridge stdout by
 default; use `remote --verbose` for the detailed audit/runtime stream. Ctrl+C/SIGTERM or foreground
 input closure revokes Desktop/process/coding/autonomous authority, applies fail-safe Host disarm, and parks
@@ -101,8 +101,7 @@ policy digests and profile hashes to the explicit mutable development root; the
   autonomoustest     run the R37 compact public capability-closure MRTR production gate
 
 disarmcoding also revokes autonomous authority. No MCP tool creates or widens either
-grant. With an openai_compatible planner the MCP server starts a background supervisor;
-client_sampling uses the connected MCP client's model with durable resume state.
+grant. Provider-backed planners (openai_compatible, openai_responses, or hash-pinned codex_app_server) use the background supervisor; client_sampling uses the connected MCP client's model with durable resume state.
 
 R27 IMMUTABLE SLOT UPDATE
 -------------------------

package/controller/deadbyte-controller.ps1

@@ -1336,7 +1336,7 @@ while ($true) {
     Clear-Host
     $cfg = Get-Config
     Assert-ControllerRootBound $cfg
-    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.14.0 / R42'
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.15.0 / R44'
     Write-Host '======================================'
     Show-State $cfg | Out-Null
     Write-Host ''

package/docs/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# DEADBYTE MCP V0.14.0 / R42 ARCHITECTURE
+# DEADBYTE MCP V0.15.0 / R44 ARCHITECTURE
 
 ```mermaid
 flowchart TD
@@ -180,3 +180,10 @@ The controller defaults `MachineRuntimeEnabled` on, forwards it only to the Brid
 non-mutating `machinetest` public HTTPS gate. That gate cross-checks status/list, derives machine_id
 from public SPKI, issues a random nonce, and verifies the Ed25519 signature without target-local key
 access. See `V085-R29-MACHINE-IDENTITY.md`.
+
+
+## R44 remote-agent and skill boundary
+
+R44 adds one read-only public `skill_catalog`, making the current full/compact catalogs exactly 81/43 while sealed R43 remains 80/42. Skill manifests are Ed25519-authenticated, content-addressed closed-world resource sets; skill content is never authority.
+
+The Agent Backend commits pending requests before send and classifies unresolved restart work as interrupted. The Codex app-server adapter binds current thread/turn identities, defaults approvals to never and sandbox to read-only, and persists logical thread identity. Remote Device routing requires Ed25519 SPKI + epoch, verified reachability, local capability authorization, stable request identity and terminal state. Only the external Durable Job supervisor may own persistent jobs; reattachment requires exact handle, PID, creation identity and profile.

package/docs/R44-ARCHITECTURE.md

@@ -0,0 +1,37 @@
+# DEADBYTE MCP R44 Architecture
+
+R44 / V0.15.0 is the remote-agent-and-skill successor to sealed R43 `v0.14.1-0a5a833892593283`. R43 is immutable parent authority.
+
+## Decision
+
+R44 keeps DEADBYTE authority, evidence, release slots, typed tools, hash preconditions, signed journals, rollback and all-disarmed closure as the foundation. External projects are donors and failure corpora, never authority.
+
+## New planes
+
+### Skill Plane
+
+Metadata-first progressive disclosure. A catalog entry exposes only name, version, description, capability requirements and authority declarations. Loading a skill verifies a content-addressed manifest, every declared resource hash, provenance, and Ed25519 attestation before returning instructions. Skill text cannot arm or renew Process, Coding, Autonomous, Desktop or Host.
+
+### Agent Backend Plane
+
+A persistent JSON-RPC process contract for Codex app-server style providers. Session identity is durable and explicit. Threads support resume, bounded injection and interrupt. Server-initiated approval requests are translated into DEADBYTE policy/consent checks; provider auto-approval never widens authority.
+
+### Remote Device Plane
+
+Device identity is a public-key identity plus epoch, not a display name. Pairing and AI-client authorization are separate. OAuth2/PKCE and device authorization may establish authentication, but a remote call is executable only when the local device reports a verified ready transport and the requested DEADBYTE capability is locally authorized. Delivery uses stable request IDs and terminal acknowledgement states.
+
+### Durable Job Supervisor
+
+Every job declares one lifetime: controller-owned, session-owned, or persistent. Persistent means an out-of-process supervisor owns execution, durable status/log identity exists, and restart recovery proves the same job identity. A timeout is never silently rebranded as persistence.
+
+## R44 hard rules
+
+- R43 release slot and final evidence are read-only.
+- No external donor may add raw shell/PID/stdin/environment authority to the public surface.
+- No skill, remote relay, provider, model, or client can arm a DEADBYTE authority plane.
+- Shared JSON state is atomic temp+fsync+rename; corrupted/truncated state fails closed.
+- Online/reachable are distinct states; only reachable may accept routed work.
+- Remote calls have stable IDs, replay classification, acknowledgement and terminal result/error.
+- Credential rotation is persisted atomically before the superseded credential is discarded.
+- All new public tools have strict input and output schemas.
+- R44 Final requires exact R43 parent proof, full regression, restart/recovery adversarial tests, remote/skill/backend gates, reversible activation, exact R43 rollback, same-slot R44 restore, and signed all-disarmed closure.

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "private": false,
   "type": "module",
-  "description": "Authenticated MCP agentic runtime with identity-bound task contracts, typed human clarification, bounded model providers, signed audit chains, immutable release slots, and separately revocable machine authority.",
+  "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
   "engines": {
     "node": ">=22"
   },
@@ -16,10 +16,10 @@
     "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
     "r42:eval": "node scripts/agent-eval-r42.mjs",
     "self-update:runtime": "node scripts/runtime-self-update.mjs",
-    "self-update:deferred": "node scripts/deferred-slot-operation-r42.mjs",
-    "release:parity": "node scripts/release-parity-r42.mjs",
-    "release:final:write": "node scripts/final-closure-r42.mjs",
-    "release:final:verify": "node scripts/final-closure-verify-r42.mjs",
+    "self-update:deferred": "node scripts/deferred-slot-operation-r44.mjs",
+    "release:parity": "node scripts/release-parity-r44.mjs",
+    "release:final:write": "node scripts/final-closure-r44.mjs",
+    "release:final:verify": "node scripts/final-closure-verify-r44.mjs",
     "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
     "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
     "trust:init": "node src/trust-init.mjs",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r42.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r44.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -53,7 +53,12 @@
     "audit:verify": "node src/deadbyte-cli.mjs audit verify",
     "audit:status": "node src/deadbyte-cli.mjs audit status",
     "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1"
+    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+    "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+    "r43:full:test": "node scripts/full-regression-r43.mjs",
+    "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+    "r44:full:test": "node scripts/full-regression-r44.mjs",
+    "finalize:r44": "node scripts/finalize-r44.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/deferred-slot-operation-r43.mjs

@@ -0,0 +1,126 @@
+import { createHash, createPublicKey, randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { loadPowerShellDataFile, runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const RECEIPT_ID=/^r27-[A-Za-z0-9-]+$/;
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','deferred-slot-operations');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const atomicJson=async(file,value)=>{
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,`${JSON.stringify(value,null,2)}\n`,{flag:'wx'});
+  await import('node:fs/promises').then(fs=>fs.rename(temp,file));
+};
+function activationArgs(manifestSha){
+  if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.14.1',
+    '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
+    '--process-policy-sha256',null,'--desktop-policy',path.join(packageRoot,'controller','deadbyte-desktop-policy.json'),
+    '--desktop-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
+    '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor'];
+}
+async function bridgeBootstrapArgs(explicitBridgeRoot=null,explicitBridgeSha256=null){
+  const hasRoot=typeof explicitBridgeRoot==='string'&&explicitBridgeRoot.length>0;
+  const hasSha=typeof explicitBridgeSha256==='string'&&explicitBridgeSha256.length>0;
+  if(hasRoot!==hasSha) throw new Error('bridge override requires exact root + SHA pair');
+  let bridgeRootRaw,expectedSha256=null;
+  if(hasRoot){
+    if(!path.isAbsolute(explicitBridgeRoot)||!HEX64.test(explicitBridgeSha256)) throw new Error('bridge override requires exact root + SHA pair');
+    bridgeRootRaw=explicitBridgeRoot;expectedSha256=explicitBridgeSha256;
+  }else{
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    const config=await loadPowerShellDataFile(pointer.config_path);
+    bridgeRootRaw=config?.Bridge?.WorkingDirectory;
+    if(typeof bridgeRootRaw!=='string'||!path.isAbsolute(bridgeRootRaw)) throw new Error('active controller Bridge.WorkingDirectory must be absolute');
+  }
+  const bridgeRoot=await realpath(path.resolve(bridgeRootRaw));
+  const packageFile=path.join(bridgeRoot,'package.json');
+  const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
+  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
+  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('active Bridge package identity mismatch');
+  const scriptSha256=sha256(await readFile(bridgeScript));
+  if(expectedSha256&&scriptSha256!==expectedSha256) throw new Error('bridge override SHA-256 mismatch');
+  return ['--bridge-root',bridgeRoot,'--bridge-script-sha256',scriptSha256];
+}
+async function rollbackArgs(receiptPath){
+  const resolved=await realpath(path.resolve(receiptPath));
+  const allowed=path.join(stateRoot,'evidence','updates')+path.sep;
+  if(!resolved.startsWith(allowed)||path.basename(resolved).toLowerCase()!=='receipt.json'||!RECEIPT_ID.test(path.basename(path.dirname(resolved)))) {
+    throw new Error('rollback receipt must be one signed activation receipt under the update evidence store');
+  }
+  const envelope=JSON.parse(await readFile(resolved,'utf8'));
+  const publicKey=createPublicKey(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  if(!verifySlotUpdateEnvelope(envelope,publicKey)||envelope.body?.rollback_performed!==false) throw new Error('rollback activation receipt verification failed');
+  const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  if(pointer.release_id!==envelope.body?.active_pointer?.release_id||pointer.generation_root!==envelope.body?.active_pointer?.generation_root) {
+    throw new Error('rollback receipt does not identify the active release generation');
+  }
+  return ['--rollback-receipt',resolved];
+}
+async function normalizedArgs(mode,value,{explicitBridgeRoot=null,explicitBridgeSha256=null}={}){
+  if(mode==='activate'){
+    const args=activationArgs(value);
+    args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
+    args[args.indexOf('--desktop-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-desktop-policy.json')));
+    args[args.indexOf('--semantic-lsp-config-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json')));
+    args.push(...await bridgeBootstrapArgs(explicitBridgeRoot,explicitBridgeSha256));
+    return args;
+  }
+  if(mode==='rollback'){
+    if(explicitBridgeRoot||explicitBridgeSha256) throw new Error('rollback does not accept bridge override');
+    return rollbackArgs(value);
+  }
+  throw new Error("operation must be exactly 'activate' or 'rollback'");
+}
+const rawArgs=process.argv.slice(2);
+const mode=rawArgs[0],value=rawArgs[1];
+if(!value||!['activate','rollback'].includes(mode)) throw new Error('usage: deferred-slot-operation-r43.mjs <activate manifest_sha256|rollback activation_receipt> [--bridge-root ABS --bridge-script-sha256 HEX64]');
+let cursor=2,explicitBridgeRoot=null,explicitBridgeSha256=null;
+if(rawArgs[cursor]==='--bridge-root'){
+  explicitBridgeRoot=rawArgs[cursor+1]??null;
+  if(rawArgs[cursor+2]!=='--bridge-script-sha256') throw new Error('bridge override requires exact root + SHA pair');
+  explicitBridgeSha256=rawArgs[cursor+3]??null;cursor+=4;
+}
+let workerFlag=null,operationIdArg=null;
+if(rawArgs[cursor]==='--worker'){workerFlag='--worker';operationIdArg=rawArgs[cursor+1]??null;cursor+=2;}
+if(cursor!==rawArgs.length) throw new Error('deferred slot operation arguments invalid');
+if((explicitBridgeRoot===null)!==(explicitBridgeSha256===null)) throw new Error('bridge override requires exact root + SHA pair');
+if(mode==='rollback'&&(explicitBridgeRoot||explicitBridgeSha256)) throw new Error('rollback does not accept bridge override');
+if(workerFlag==='--worker'){
+  if(!/^[0-9a-f]{32}$/.test(operationIdArg??'')) throw new Error('deferred worker operation id invalid');
+  const statePath=path.join(evidenceRoot,`${operationIdArg}.json`);
+  await new Promise(resolve=>setTimeout(resolve,4000));
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  try{
+    const args=await normalizedArgs(mode,value,{explicitBridgeRoot,explicitBridgeSha256});
+    const result=await runSlotUpdateCli(args,{stateRoot});
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'completed',
+      completed_at_utc:new Date().toISOString(),receipt_path:result.receipt_path,receipt_sha256:result.receipt_sha256,
+      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  }catch(error){
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'failed',
+      completed_at_utc:new Date().toISOString(),error:String(error?.message??error),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+    process.exitCode=1;
+  }
+}else{
+  const operationId=randomBytes(16).toString('hex');
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  const workerArgs=[fileURLToPath(import.meta.url),mode,value];
+  if(explicitBridgeRoot) workerArgs.push('--bridge-root',explicitBridgeRoot,'--bridge-script-sha256',explicitBridgeSha256);
+  workerArgs.push('--worker',operationId);
+  const child=spawn(process.execPath,workerArgs,{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256}));
+}

package/scripts/deferred-slot-operation-r44.mjs

@@ -0,0 +1,126 @@
+import { createHash, createPublicKey, randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { loadPowerShellDataFile, runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const RECEIPT_ID=/^r27-[A-Za-z0-9-]+$/;
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','deferred-slot-operations');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const atomicJson=async(file,value)=>{
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,`${JSON.stringify(value,null,2)}\n`,{flag:'wx'});
+  await import('node:fs/promises').then(fs=>fs.rename(temp,file));
+};
+function activationArgs(manifestSha){
+  if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.15.0',
+    '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
+    '--process-policy-sha256',null,'--desktop-policy',path.join(packageRoot,'controller','deadbyte-desktop-policy.json'),
+    '--desktop-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
+    '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor'];
+}
+async function bridgeBootstrapArgs(explicitBridgeRoot=null,explicitBridgeSha256=null){
+  const hasRoot=typeof explicitBridgeRoot==='string'&&explicitBridgeRoot.length>0;
+  const hasSha=typeof explicitBridgeSha256==='string'&&explicitBridgeSha256.length>0;
+  if(hasRoot!==hasSha) throw new Error('bridge override requires exact root + SHA pair');
+  let bridgeRootRaw,expectedSha256=null;
+  if(hasRoot){
+    if(!path.isAbsolute(explicitBridgeRoot)||!HEX64.test(explicitBridgeSha256)) throw new Error('bridge override requires exact root + SHA pair');
+    bridgeRootRaw=explicitBridgeRoot;expectedSha256=explicitBridgeSha256;
+  }else{
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    const config=await loadPowerShellDataFile(pointer.config_path);
+    bridgeRootRaw=config?.Bridge?.WorkingDirectory;
+    if(typeof bridgeRootRaw!=='string'||!path.isAbsolute(bridgeRootRaw)) throw new Error('active controller Bridge.WorkingDirectory must be absolute');
+  }
+  const bridgeRoot=await realpath(path.resolve(bridgeRootRaw));
+  const packageFile=path.join(bridgeRoot,'package.json');
+  const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
+  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
+  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('active Bridge package identity mismatch');
+  const scriptSha256=sha256(await readFile(bridgeScript));
+  if(expectedSha256&&scriptSha256!==expectedSha256) throw new Error('bridge override SHA-256 mismatch');
+  return ['--bridge-root',bridgeRoot,'--bridge-script-sha256',scriptSha256];
+}
+async function rollbackArgs(receiptPath){
+  const resolved=await realpath(path.resolve(receiptPath));
+  const allowed=path.join(stateRoot,'evidence','updates')+path.sep;
+  if(!resolved.startsWith(allowed)||path.basename(resolved).toLowerCase()!=='receipt.json'||!RECEIPT_ID.test(path.basename(path.dirname(resolved)))) {
+    throw new Error('rollback receipt must be one signed activation receipt under the update evidence store');
+  }
+  const envelope=JSON.parse(await readFile(resolved,'utf8'));
+  const publicKey=createPublicKey(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  if(!verifySlotUpdateEnvelope(envelope,publicKey)||envelope.body?.rollback_performed!==false) throw new Error('rollback activation receipt verification failed');
+  const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  if(pointer.release_id!==envelope.body?.active_pointer?.release_id||pointer.generation_root!==envelope.body?.active_pointer?.generation_root) {
+    throw new Error('rollback receipt does not identify the active release generation');
+  }
+  return ['--rollback-receipt',resolved];
+}
+async function normalizedArgs(mode,value,{explicitBridgeRoot=null,explicitBridgeSha256=null}={}){
+  if(mode==='activate'){
+    const args=activationArgs(value);
+    args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
+    args[args.indexOf('--desktop-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-desktop-policy.json')));
+    args[args.indexOf('--semantic-lsp-config-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json')));
+    args.push(...await bridgeBootstrapArgs(explicitBridgeRoot,explicitBridgeSha256));
+    return args;
+  }
+  if(mode==='rollback'){
+    if(explicitBridgeRoot||explicitBridgeSha256) throw new Error('rollback does not accept bridge override');
+    return rollbackArgs(value);
+  }
+  throw new Error("operation must be exactly 'activate' or 'rollback'");
+}
+const rawArgs=process.argv.slice(2);
+const mode=rawArgs[0],value=rawArgs[1];
+if(!value||!['activate','rollback'].includes(mode)) throw new Error('usage: deferred-slot-operation-r44.mjs <activate manifest_sha256|rollback activation_receipt> [--bridge-root ABS --bridge-script-sha256 HEX64]');
+let cursor=2,explicitBridgeRoot=null,explicitBridgeSha256=null;
+if(rawArgs[cursor]==='--bridge-root'){
+  explicitBridgeRoot=rawArgs[cursor+1]??null;
+  if(rawArgs[cursor+2]!=='--bridge-script-sha256') throw new Error('bridge override requires exact root + SHA pair');
+  explicitBridgeSha256=rawArgs[cursor+3]??null;cursor+=4;
+}
+let workerFlag=null,operationIdArg=null;
+if(rawArgs[cursor]==='--worker'){workerFlag='--worker';operationIdArg=rawArgs[cursor+1]??null;cursor+=2;}
+if(cursor!==rawArgs.length) throw new Error('deferred slot operation arguments invalid');
+if((explicitBridgeRoot===null)!==(explicitBridgeSha256===null)) throw new Error('bridge override requires exact root + SHA pair');
+if(mode==='rollback'&&(explicitBridgeRoot||explicitBridgeSha256)) throw new Error('rollback does not accept bridge override');
+if(workerFlag==='--worker'){
+  if(!/^[0-9a-f]{32}$/.test(operationIdArg??'')) throw new Error('deferred worker operation id invalid');
+  const statePath=path.join(evidenceRoot,`${operationIdArg}.json`);
+  await new Promise(resolve=>setTimeout(resolve,4000));
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  try{
+    const args=await normalizedArgs(mode,value,{explicitBridgeRoot,explicitBridgeSha256});
+    const result=await runSlotUpdateCli(args,{stateRoot});
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'completed',
+      completed_at_utc:new Date().toISOString(),receipt_path:result.receipt_path,receipt_sha256:result.receipt_sha256,
+      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  }catch(error){
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'failed',
+      completed_at_utc:new Date().toISOString(),error:String(error?.message??error),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+    process.exitCode=1;
+  }
+}else{
+  const operationId=randomBytes(16).toString('hex');
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  const workerArgs=[fileURLToPath(import.meta.url),mode,value];
+  if(explicitBridgeRoot) workerArgs.push('--bridge-root',explicitBridgeRoot,'--bridge-script-sha256',explicitBridgeSha256);
+  workerArgs.push('--worker',operationId);
+  const child=spawn(process.execPath,workerArgs,{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256}));
+}