deadbyte-mcp 0.14.0 → 0.15.0

package/src/host-plane.mjs

@@ -157,6 +157,22 @@ export async function assertHostArmed(policy, now = new Date()) {
   return { arm, standing:false, remaining_ms: expires - now.getTime() };
 }
 
+export async function recheckHostAuthority(policy, initial, now = new Date()) {
+  if (!initial?.arm || typeof initial.arm.instance_nonce !== 'string') {
+    throw new Error('host authority recheck requires an armed initial snapshot');
+  }
+  let current;
+  try { current = await assertHostArmed(policy, now); }
+  catch (error) { throw new Error(`host authority changed during operation: ${String(error?.message ?? error)}`); }
+  const changed =
+    current.arm.schema !== initial.arm.schema ||
+    current.arm.instance_nonce !== initial.arm.instance_nonce ||
+    current.standing !== initial.standing ||
+    (current.arm.expires_at_utc ?? null) !== (initial.arm.expires_at_utc ?? null);
+  if (changed) throw new Error('host authority changed during operation');
+  return current;
+}
+
 function getRoot(policy, rootId, permission) {
   if (!ROOT_ID_RE.test(rootId)) throw new Error('invalid host root id');
   const root = policy.roots[rootId];
@@ -190,7 +206,7 @@ async function nearestExistingParent(candidate) {
   }
 }
 
-async function resolveHostWritable(policy, rootId, relativePath) {
+async function resolveHostWritable(policy, rootId, relativePath, authorityCheck = null) {
   validatePortableRelativePath(relativePath);
   const root = getRoot(policy, rootId, 'write');
   const lexical = path.resolve(root.real_path, relativePath);
@@ -201,6 +217,7 @@ async function resolveHostWritable(policy, rootId, relativePath) {
   const realExisting = await realpath(existingParent);
   if (!isInside(root.real_path, realExisting)) throw new Error('host parent symlink escapes allowed root');
 
+  if (authorityCheck) await authorityCheck();
   await mkdir(parent, { recursive: true });
   const realParent = await realpath(parent);
   if (!isInside(root.real_path, realParent)) throw new Error('host parent resolves outside allowed root');
@@ -265,8 +282,9 @@ function checkExpectedState(state, expectedSha256) {
 }
 
 export async function hostFileWrite(policy, { rootId, relativePath, content, encoding = 'utf8', expectedSha256 }) {
-  await assertHostArmed(policy);
-  const { lexical } = await resolveHostWritable(policy, rootId, relativePath);
+  const armed = await assertHostArmed(policy);
+  const authorityCheck = () => recheckHostAuthority(policy, armed);
+  const { lexical } = await resolveHostWritable(policy, rootId, relativePath, authorityCheck);
   const bytes = decodeWriteContent(content, encoding);
   if (bytes.length > policy.max_write_bytes) throw new Error(`host write exceeds ${policy.max_write_bytes} byte limit`);
 
@@ -276,6 +294,7 @@ export async function hostFileWrite(policy, { rootId, relativePath, content, enc
   const temp = path.join(path.dirname(lexical), `.${path.basename(lexical)}.deadbyte-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
   let handle;
   try {
+    await authorityCheck();
     handle = await open(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
     await handle.writeFile(bytes);
     await handle.sync();
@@ -284,6 +303,7 @@ export async function hostFileWrite(policy, { rootId, relativePath, content, enc
 
     const raceCheck = await currentTargetState(lexical);
     checkExpectedState(raceCheck, expectedSha256);
+    await authorityCheck();
     await rename(temp, lexical);
   } catch (error) {
     if (handle) await handle.close().catch(() => {});
@@ -366,10 +386,11 @@ export async function hostExec(policy, {
     cwdResolved = realCwd;
   }
 
-  if (Number.isFinite(armed.remaining_ms) && armed.remaining_ms < 100) throw new Error('privileged host plane arm lease expires too soon');
   const requestedTimeout = timeoutMs === null ? command.timeout_ms : finiteInteger(timeoutMs, 'timeout_ms', 100, command.timeout_ms, command.timeout_ms);
-  const grantBound = Number.isFinite(armed.remaining_ms) ? armed.remaining_ms : command.timeout_ms;
-  const effectiveTimeout = Math.max(100, Math.min(requestedTimeout, command.timeout_ms, grantBound));
+  const activeArm = await recheckHostAuthority(policy, armed);
+  const grantBound = Number.isFinite(activeArm.remaining_ms) ? Math.floor(activeArm.remaining_ms) : command.timeout_ms;
+  if (grantBound < 100) throw new Error('privileged host plane arm lease expires too soon');
+  const effectiveTimeout = Math.min(requestedTimeout, command.timeout_ms, grantBound);
   const argv = [...command.prefix_args, script.resolved, ...args];
 
   const child = spawn(command.executable, argv, {

package/src/job-supervisor-host-r44.mjs

@@ -0,0 +1,112 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, openSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, realpath, rename, rm } from 'node:fs/promises';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function insist(ok,message){if(!ok)throw new Error(message);}
+async function atomicJson(file,value){
+  const bytes=Buffer.from(`${JSON.stringify(value,null,2)}\n`,'utf8');
+  const temp=`${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  const h=await open(temp,'wx');try{await h.writeFile(bytes);await h.sync();}finally{await h.close();}
+  await rename(temp,file);
+}
+const arg=process.argv.indexOf('--state-dir');
+if(arg<0||!process.argv[arg+1])throw new Error('R44 job supervisor host requires --state-dir');
+const stateDir=await realpath(path.resolve(process.argv[arg+1]));
+const authPath=path.join(stateDir,'supervisor-auth.json');
+const endpointPath=path.join(stateDir,'supervisor-endpoint.json');
+const auth=JSON.parse(await readFile(authPath,'utf8'));
+insist(auth?.schema==='deadbyte.job-supervisor-auth.v1'&&HEX64.test(auth.token??''),'supervisor auth state invalid');
+const authBytes=Buffer.from(auth.token,'hex');
+const instanceId=randomBytes(32).toString('hex');
+const jobs=new Map();
+const logs=path.join(stateDir,'logs');await mkdir(logs,{recursive:true});
+
+function publicHandle(job){
+  return {handle_id:job.handle_id,pid:job.pid,creation_id:job.creation_id,profile_id:job.profile_id,state:job.state,exit_code:job.exit_code??null};
+}
+function exactJob(input){
+  insist(input&&typeof input==='object','supervisor handle missing');
+  const job=jobs.get(input.handle_id);insist(job,'unknown supervisor handle');
+  insist(job.pid===input.pid&&job.creation_id===input.creation_id&&job.profile_id===input.profile_id,'supervisor process identity mismatch');
+  return job;
+}
+async function verifyExecutable(file,expected){
+  insist(path.isAbsolute(file)&&HEX64.test(expected??''),'supervisor executable identity invalid');
+  const st=await lstat(file);insist(st.isFile()&&!st.isSymbolicLink(),'supervisor executable must be real file');
+  insist(sha(await readFile(file))===expected,'supervisor executable hash mismatch');
+}
+async function handle(op,args){
+  if(op==='hello')return {kind:'external-supervisor',instance_id:instanceId,pid:process.pid};
+  if(op==='start'){
+    insist(args&&HEX64.test(args.job_id??'')&&ID.test(args.profile_id??''),'supervisor start identity invalid');
+    insist(Array.isArray(args.argv)&&args.argv.length<=128&&args.argv.every(v=>typeof v==='string'&&v.length<=8192),'supervisor argv invalid');
+    await verifyExecutable(args.executable,args.executable_sha256);
+    insist(typeof args.cwd==='string'&&path.isAbsolute(args.cwd),'supervisor cwd must be absolute');
+    const cwd=await realpath(args.cwd);const cwdSt=await lstat(cwd);insist(cwdSt.isDirectory()&&!cwdSt.isSymbolicLink(),'supervisor cwd invalid');
+    const handleId=randomBytes(32).toString('hex'),creationId=randomBytes(32).toString('hex');
+    const stdoutPath=path.join(logs,`${handleId}.stdout.log`),stderrPath=path.join(logs,`${handleId}.stderr.log`);
+    const outFd=openSync(stdoutPath,'a'),errFd=openSync(stderrPath,'a');
+    let child;
+    try{
+      child=spawn(args.executable,args.argv,{cwd,windowsHide:true,shell:false,detached:true,stdio:['ignore',outFd,errFd]});
+    }finally{closeSync(outFd);closeSync(errFd);}
+    insist(Number.isInteger(child.pid)&&child.pid>0,'supervisor child spawn failed');
+    const job={handle_id:handleId,pid:child.pid,creation_id:creationId,profile_id:args.profile_id,state:'running',exit_code:null,
+      child,stdout_path:stdoutPath,stderr_path:stderrPath,started_at_utc:new Date().toISOString()};
+    jobs.set(handleId,job);
+    child.once('exit',(code)=>{job.state='terminated';job.exit_code=Number.isInteger(code)?code:null;});
+    child.once('error',()=>{job.state='failed';});
+    child.unref();
+    return publicHandle(job);
+  }
+  if(op==='reattach'||op==='status')return publicHandle(exactJob(args));
+  if(op==='terminate'){
+    const job=exactJob(args);
+    if(job.state==='running'){
+      const exited=new Promise(resolve=>job.child.once('exit',resolve));
+      job.child.kill();
+      await Promise.race([exited,new Promise(resolve=>setTimeout(resolve,3000))]);
+      if(job.state==='running')job.state='terminated';
+    }
+    return publicHandle(job);
+  }
+  if(op==='shutdown'){
+    for(const job of jobs.values())if(job.state==='running')job.child.kill();
+    return {status:'shutting_down'};
+  }
+  throw new Error('unknown supervisor operation');
+}
+function authOk(token){
+  if(!HEX64.test(token??''))return false;
+  const candidate=Buffer.from(token,'hex');return candidate.length===authBytes.length&&timingSafeEqual(candidate,authBytes);
+}
+
+const server=net.createServer(socket=>{
+  socket.setEncoding('utf8');let buffer='';
+  socket.on('data',chunk=>{
+    buffer+=chunk;
+    if(Buffer.byteLength(buffer,'utf8')>1024*1024){socket.destroy();return;}
+    const nl=buffer.indexOf('\n');if(nl<0)return;
+    const line=buffer.slice(0,nl);buffer='';
+    void(async()=>{
+      let request;try{request=JSON.parse(line);}catch{socket.end(JSON.stringify({ok:false,error:'invalid JSON'})+'\n');return;}
+      if(!authOk(request?.token)){socket.end(JSON.stringify({ok:false,error:'unauthorized'})+'\n');return;}
+      try{
+        const result=await handle(request.op,request.args??{});
+        socket.end(JSON.stringify({ok:true,result})+'\n');
+        if(request.op==='shutdown'){
+          setTimeout(async()=>{server.close();await rm(endpointPath,{force:true}).catch(()=>{});process.exit(0);},50).unref();
+        }
+      }catch(error){socket.end(JSON.stringify({ok:false,error:String(error?.message??error)})+'\n');}
+    })();
+  });
+});
+await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(0,'127.0.0.1',resolve);});
+const address=server.address();insist(address&&typeof address==='object','supervisor listen address invalid');
+await atomicJson(endpointPath,{schema:'deadbyte.job-supervisor-endpoint.v1',host:'127.0.0.1',port:address.port,instance_id:instanceId,pid:process.pid,created_at_utc:new Date().toISOString()});

package/src/machine-fs-smoke-client.mjs

@@ -56,7 +56,7 @@ const transport = new StdioClientTransport({
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','workspace_open'];
+const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
 const codingTools = [
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat',

package/src/machine-fs.mjs

@@ -3,7 +3,7 @@ import { createReadStream } from 'node:fs';
 import { lstat, mkdir as fsMkdir, open, readFile, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
-import { assertCodingArmed } from './coding-plane.mjs';
+import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
@@ -219,18 +219,20 @@ function requestSha(operation, args) {
   return sha256Object({ schema: 'deadbyte.machine-fs-request.v1', operation, args });
 }
 
-async function atomicWrite(target, bytes, expectedSha256) {
+async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
   const before = await regularState(target);
   checkExpectedFile(before, expectedSha256);
   const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-machine-fs-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
   let handle;
   try {
+    if (authorityCheck) await authorityCheck();
     handle = await open(temp, 'wx', 0o600);
     await handle.writeFile(bytes);
     await handle.sync();
     await handle.close();
     handle = null;
     checkExpectedFile(await regularState(target), expectedSha256);
+    if (authorityCheck) await authorityCheck();
     await rename(temp, target);
   } catch (error) {
     if (handle) await handle.close().catch(() => {});
@@ -322,8 +324,10 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
       content_sha256: sha256Bytes(bytes)
     });
     const started = nowUtc();
-    const { before, after } = await atomicWrite(target.lexical, bytes, expectedSha256);
-    const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_write', request, {
+    let activeGrant = grant;
+    const authorityCheck = async () => { activeGrant = await recheckCodingAuthority(policy, grant, rootId); return activeGrant; };
+    const { before, after } = await atomicWrite(target.lexical, bytes, expectedSha256, authorityCheck);
+    const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_write', request, {
       root_id: rootId, path: target.relative, started_at_utc: started, completed_at_utc: nowUtc(),
       before_sha256: before.sha256, after_sha256: after.sha256, bytes: after.bytes
     }, receiptId);
@@ -358,8 +362,10 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
       old_sha256: sha256Bytes(Buffer.from(oldString, 'utf8')), new_sha256: sha256Bytes(Buffer.from(newString, 'utf8'))
     });
     const started = nowUtc();
-    const { after } = await atomicWrite(found.lexical, nextBytes, expectedSha256);
-    const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_edit_exact', request, {
+    let activeGrant = grant;
+    const authorityCheck = async () => { activeGrant = await recheckCodingAuthority(policy, grant, rootId); return activeGrant; };
+    const { after } = await atomicWrite(found.lexical, nextBytes, expectedSha256, authorityCheck);
+    const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_edit_exact', request, {
       root_id: rootId, path: found.relative, started_at_utc: started, completed_at_utc: nowUtc(),
       before_sha256: beforeSha, after_sha256: after.sha256, replacements: count, bytes: after.bytes
     });
@@ -376,11 +382,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     const request = requestSha('machine_fs_mkdir', { root_id: rootId, path: target.relative, expected: 'absent' });
     const started = nowUtc();
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await fsMkdir(target.lexical, { recursive: false });
     try {
       const identity = await objectIdentity(target.lexical);
       if (identity.kind !== 'directory') throw new Error('machine fs mkdir post-commit type mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_mkdir', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_mkdir', request, {
         root_id: rootId, path: target.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         before_identity_sha256: null, after_identity_sha256: identity.identity_sha256
       }, receiptId);
@@ -409,11 +416,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const started = nowUtc();
     const race = await objectIdentity(source.resolved);
     if (race.identity_sha256 !== expectedSourceIdentity) throw new Error(`machine fs source identity mismatch before commit: expected ${expectedSourceIdentity}, found ${race.identity_sha256}`);
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rename(source.lexical, destination.lexical);
     try {
       const after = await objectIdentity(destination.lexical);
       if (after.identity_sha256 !== expectedSourceIdentity) throw new Error('machine fs move post-commit identity mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_move', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_move', request, {
         root_id: rootId, source_path: source.relative, destination_path: destination.relative,
         started_at_utc: started, completed_at_utc: nowUtc(), source_identity_sha256: expectedSourceIdentity
       }, receiptId);
@@ -436,6 +444,7 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const before = await objectIdentity(source.resolved);
     if (before.identity_sha256 !== expectedSourceIdentity) throw new Error(`machine fs source identity mismatch: expected ${expectedSourceIdentity}, found ${before.identity_sha256}`);
     const recoveryRoot = path.join(source.root.real_path, '.deadbyte-machine-fs-recovery');
+    let activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await fsMkdir(recoveryRoot, { recursive: true });
     const recoveryKey = sha256Object({ source_path: source.relative, identity_sha256: expectedSourceIdentity });
     const recoveryTarget = path.join(recoveryRoot, recoveryKey);
@@ -443,11 +452,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     const request = requestSha('machine_fs_delete', { root_id: rootId, path: source.relative, expected_source_identity: expectedSourceIdentity });
     const started = nowUtc();
+    activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rename(source.lexical, recoveryTarget);
     try {
       const recovered = await objectIdentity(recoveryTarget);
       if (recovered.identity_sha256 !== expectedSourceIdentity) throw new Error('machine fs delete recovery identity mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_delete', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_delete', request, {
         root_id: rootId, path: source.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         source_identity_sha256: expectedSourceIdentity, recovery_key: recoveryKey
       });
@@ -485,11 +495,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     if (race.kind !== 'directory' || race.entries.length !== 0 || race.identity_sha256 !== expectedSourceIdentity) {
       throw new Error('machine fs rmdir precondition changed before commit');
     }
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rmdir(source.lexical);
     try {
       try { await lstat(source.lexical); throw new Error('machine fs rmdir post-commit path still exists'); }
       catch (error) { if (error?.code !== 'ENOENT') throw error; }
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_rmdir_empty', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_rmdir_empty', request, {
         root_id: rootId, path: source.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         before_identity_sha256: expectedSourceIdentity, after_identity_sha256: null
       }, receiptId);

package/src/mcp-host-smoke-client.mjs

@@ -84,7 +84,7 @@ function structured(result, label) {
 try {
   await client.connect(transport);
   const names = (await client.listTools()).tools.map(t => t.name).sort();
-  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'workspace_open'];
+  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'skill_catalog', 'workspace_open'];
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`privileged catalog mismatch: ${JSON.stringify(names)}`);
 
   const writeText = structured(await client.callTool({

package/src/mcp-server.mjs

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { access, readFile } from 'node:fs/promises';
+import { access, mkdir, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -43,6 +43,7 @@ import { registerDesktopTools } from './desktop-mcp-tools-r40.mjs';
 import { loadAutonomousPolicy } from './autonomous-policy.mjs';
 import { createNativeDiffRuntime } from './native-diff.mjs';
 import { createAutonomousRuntime } from './autonomous-runtime.mjs';
+import { createCodexAppServerR44 } from './codex-app-server-r44.mjs';
 import { startAutonomousSupervisor } from './autonomous-supervisor.mjs';
 import { registerAutonomousTools } from './autonomous-mcp-tools.mjs';
 import { createToolAudit, installToolAudit } from './tool-audit.mjs';
@@ -50,6 +51,8 @@ import { createAuditContextProvider } from './audit-context.mjs';
 import { registerOperatorSurface } from './operator-surface.mjs';
 import { capabilityProfileFromEnv, COMPACT_SURFACE_TOOL_LIMIT, R36_CAPABILITY_LEDGER } from './capability-ledger.mjs';
 import { registerCompactGatewayTools } from './compact-gateway-mcp-tools.mjs';
+import { createSkillPlane } from './skill-plane-r44.mjs';
+import { registerSkillToolsR44 } from './skill-mcp-tools-r44.mjs';
 import {
   containedTransformOutputSchema,
   evidenceVerifyOutputSchema,
@@ -200,9 +203,18 @@ const memoryProvider=autonomousPolicy?createR41MemoryProvider({
   publicKey:autonomousMemoryVerifyKey.publicKey,keyId:autonomousMemorySigningKey.keyId,
   byteBudget:Math.min(262144,Math.max(65536,Math.floor(autonomousPolicy.limits.max_context_bytes/2))),semantic:{enabled:false}
 }):null;
+const plannerProviderRuntime=autonomousPolicy?.planner.backend==='codex_app_server'
+  ? await createCodexAppServerR44({
+      stateDir:path.join(autonomousPolicy.evidence_dir,'provider-r44','codex-app-server'),
+      model:autonomousPolicy.planner.model,cwd:codingPolicy.roots[autonomousPolicy.planner.root_id].real_path,
+      clientVersion:DEADBYTE_VERSION,executable:autonomousPolicy.planner.executable,
+      executableSha256:autonomousPolicy.planner.executable_sha256,args:autonomousPolicy.planner.args
+    })
+  : null;
 const autonomousRuntime = autonomousPolicy ? createAutonomousRuntime({ policy:autonomousPolicy,codingRuntime,nativeDiffRuntime,
-  machineFsRuntime,observationRuntime,processRuntime,semanticRuntime,desktopRuntime,desktopMemoryProvider,memoryProvider,signingKeyPath,verifyKeyPath }) : null;
-const autonomousSupervisor = autonomousRuntime && ['openai_compatible','openai_responses'].includes(autonomousPolicy.planner.backend) &&
+  machineFsRuntime,observationRuntime,processRuntime,semanticRuntime,desktopRuntime,desktopMemoryProvider,memoryProvider,
+  plannerProviderRuntime,signingKeyPath,verifyKeyPath }) : null;
+const autonomousSupervisor = autonomousRuntime && ['openai_compatible','openai_responses','codex_app_server'].includes(autonomousPolicy.planner.backend) &&
   autonomousSupervisorMode === 'in_process'
   ? startAutonomousSupervisor({ runtime: autonomousRuntime, policy: autonomousPolicy })
   : null;
@@ -214,6 +226,9 @@ const auditContextProvider = auditRuntimeMode === '1' ? createAuditContextProvid
 const toolAudit = auditRuntimeMode === '1' ? await createToolAudit({
   stateRoot:runtimeStateRoot,signingKeyPath,contextProvider:auditContextProvider
 }) : null;
+const skillRoot=path.join(runtimeStateRoot,'skills');
+await mkdir(skillRoot,{recursive:true});
+const skillRuntime=await createSkillPlane({root:skillRoot,verifyKeyPath});
 
 const ingressAdapterMode = currentIngressAdapterMode();
 installTunnelStdioProbeCompat({
@@ -429,6 +444,8 @@ serveStdio(() => {
     registerAutonomousTools(toolServer, { autonomousRuntime, nativeDiffRuntime });
   }
 
+  registerSkillToolsR44(toolServer,{runtime:skillRuntime});
+
   registerCompactGatewayTools(toolServer,{
     profile:surfaceProfile,ledger:R36_CAPABILITY_LEDGER,codingRuntime,semanticRuntime,machineFsRuntime,
     processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider:()=>[...registeredToolNames]

package/src/mcp-smoke-client.mjs

@@ -64,7 +64,7 @@ try {
 
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
-  const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open'];
+  const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
   const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
   const allowedCatalogs = [
     baseTools,

package/src/native-diff-v2.mjs

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
 import { validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
-import { assertAutonomousArmed } from './autonomous-policy.mjs';
+import { assertAutonomousArmed, recheckAutonomousAuthority } from './autonomous-policy.mjs';
 
 export const NATIVE_DIFF_V2_SCHEMA='deadbyte.native-diff.v2';
 export const NATIVE_DIFF_V2_PREIMAGE_SCHEMA='deadbyte.native-diff-preimage.v2';
@@ -312,11 +312,11 @@ export function createNativeDiffV2Runtime({policy,codingRuntime,machineFsRuntime
   async function apply({diffId,expectedOperationCount=null}){
     const {ctx,identity}=await loadDiff(diffId);
     if(expectedOperationCount!==null&&(!Number.isInteger(expectedOperationCount)||expectedOperationCount<1||expectedOperationCount>policy.limits.max_files_per_diff||identity.operations.length!==expectedOperationCount))throw new Error(`native diff V2 operation count mismatch: expected ${String(expectedOperationCount)}, signed ${identity.operations.length}`);
-    await assertAutonomousArmed(policy,identity.root_id); const codingStatus=await codingRuntime.sessionStatus(); if(!codingStatus.armed)throw new Error(`coding plane is disarmed: ${codingStatus.reason}`);
+    const autonomousAuthority=await assertAutonomousArmed(policy,identity.root_id); const codingStatus=await codingRuntime.sessionStatus(); if(!codingStatus.armed)throw new Error(`coding plane is disarmed: ${codingStatus.reason}`);
     if(await exists(ctx.receiptPath)){const checked=await verify({diffId});if(!checked.ok)throw new Error(`existing native diff V2 receipt invalid: ${checked.reason}`);return {status:'existing',diff_id:diffId,receipt_sha256:checked.receipt_sha256,operation_count:identity.operations.length,current_state_matches:checked.current_state_matches};}
     const preimage=await ensurePreimage(ctx,diffId,identity); const events=await readEvents(ctx); if(!events.some(e=>e.type==='transaction_started'))await appendEvent(ctx,events,diffId,'transaction_started',{operation_count:identity.operations.length,preimage_sha256:preimage.preimage_sha256});
     try{
-      for(let index=0;index<identity.operations.length;index+=1){const op=identity.operations[index];const prior=events.find(e=>e.type==='operation_committed'&&e.payload?.index===index);if(prior){if(!(await stateMatches(identity.root_id,op,'after')))throw new Error(`native diff V2 committed state changed index ${index}`);continue;}let executed;if(await stateMatches(identity.root_id,op,'after')){const receiptId=receiptIdFor(diffId,index,'apply');const checked=await verifyOperationReceipt(op,receiptId);if(!checked.ok)throw new Error(`native diff V2 unreceipted mutation index ${index}`);executed={recovered:true,receipt_id:receiptId,receipt_sha256:checked.receipt_sha256,request_sha256:checked.request_sha256,operation:checked.operation,receipt_class:receiptClass(op)};}else if(await stateMatches(identity.root_id,op,'before')) executed=await executeOperation(diffId,identity.root_id,op,index);else throw new Error(`native diff V2 concurrent state conflict index ${index}`);if(!(await stateMatches(identity.root_id,op,'after')))throw new Error(`native diff V2 post-operation mismatch index ${index}`);await appendEvent(ctx,events,diffId,'operation_committed',{index,kind:op.kind,path:op.path??null,source_path:op.source_path??null,destination_path:op.destination_path??null,receipt_class:executed.receipt_class,receipt_id:executed.receipt_id,receipt_sha256:executed.receipt_sha256,request_sha256:executed.request_sha256,recovered:executed.recovered});}
+      for(let index=0;index<identity.operations.length;index+=1){const op=identity.operations[index];const prior=events.find(e=>e.type==='operation_committed'&&e.payload?.index===index);if(prior){if(!(await stateMatches(identity.root_id,op,'after')))throw new Error(`native diff V2 committed state changed index ${index}`);continue;}let executed;if(await stateMatches(identity.root_id,op,'after')){const receiptId=receiptIdFor(diffId,index,'apply');const checked=await verifyOperationReceipt(op,receiptId);if(!checked.ok)throw new Error(`native diff V2 unreceipted mutation index ${index}`);executed={recovered:true,receipt_id:receiptId,receipt_sha256:checked.receipt_sha256,request_sha256:checked.request_sha256,operation:checked.operation,receipt_class:receiptClass(op)};}else if(await stateMatches(identity.root_id,op,'before')){await recheckAutonomousAuthority(policy,autonomousAuthority,identity.root_id);executed=await executeOperation(diffId,identity.root_id,op,index);}else throw new Error(`native diff V2 concurrent state conflict index ${index}`);if(!(await stateMatches(identity.root_id,op,'after')))throw new Error(`native diff V2 post-operation mismatch index ${index}`);await appendEvent(ctx,events,diffId,'operation_committed',{index,kind:op.kind,path:op.path??null,source_path:op.source_path??null,destination_path:op.destination_path??null,receipt_class:executed.receipt_class,receipt_id:executed.receipt_id,receipt_sha256:executed.receipt_sha256,request_sha256:executed.request_sha256,recovered:executed.recovered});}
     }catch(error){try{const rollbackReceipts=await rollbackToPreimage(diffId,identity,preimage);await appendEvent(ctx,events,diffId,'transaction_rolled_back',{reason:String(error).slice(0,2048),rollback_receipts:rollbackReceipts});}catch(rollbackError){await appendEvent(ctx,events,diffId,'transaction_paused',{reason:String(error).slice(0,1024),rollback_error:String(rollbackError).slice(0,1024)}).catch(()=>{});throw new Error(`native diff V2 apply failed and rollback incomplete: ${String(error)}; ${String(rollbackError)}`);}throw new Error(`native diff V2 apply rolled back: ${String(error)}`);}
     const receipt=await createApplyReceipt(ctx,diffId,identity,preimage,events);return {status:'committed',diff_id:diffId,receipt_sha256:receipt.receipt_sha256,operation_count:identity.operations.length,operation_receipts:receipt.operation_receipts.map(x=>({index:x.index,kind:x.kind,receipt_class:x.receipt_class,receipt_id:x.receipt_id,receipt_sha256:x.receipt_sha256}))};
   }

package/src/native-diff.mjs

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
 import { validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
-import { assertAutonomousArmed } from './autonomous-policy.mjs';
+import { assertAutonomousArmed, recheckAutonomousAuthority } from './autonomous-policy.mjs';
 import { createNativeDiffV2Runtime, NATIVE_DIFF_V2_SCHEMA } from './native-diff-v2.mjs';
 
 export const NATIVE_DIFF_SCHEMA = 'deadbyte.native-diff.v1';
@@ -294,7 +294,7 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
     if (expectedOperationCount !== null && (!Number.isInteger(expectedOperationCount) || expectedOperationCount < 1 || expectedOperationCount > policy.limits.max_files_per_diff || identity.operations.length !== expectedOperationCount)) {
       throw new Error(`native diff operation count mismatch: expected ${String(expectedOperationCount)}, signed ${identity.operations.length}`);
     }
-    await assertAutonomousArmed(policy, identity.root_id);
+    const autonomousAuthority = await assertAutonomousArmed(policy, identity.root_id);
     const codingStatus = await codingRuntime.sessionStatus();
     if (!codingStatus.armed) throw new Error(`coding plane is disarmed: ${codingStatus.reason}`);
     if (await exists(ctx.receiptPath)) {
@@ -327,6 +327,7 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
           executed = { recovered:true, receipt_id:receiptId, receipt_sha256:checked.receipt_sha256,
             request_sha256:checked.request_sha256, operation:checked.operation };
         } else if (stateMatches(current, op.before_sha256)) {
+          await recheckAutonomousAuthority(policy, autonomousAuthority, identity.root_id);
           executed = await executeOperation(diffId, identity.root_id, op, index);
         } else {
           throw new Error(`native diff concurrent state conflict '${op.path}'`);

package/src/observation-smoke-client.mjs

@@ -51,7 +51,7 @@ const transport=new StdioClientTransport({command:process.execPath,args:[serverP
   env:{...getDefaultEnvironment(),DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
     DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_STATE_ROOT:state,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath},stderr:'pipe'});
 const stderr=[]; transport.stderr?.on('data',chunk=>stderr.push(Buffer.from(chunk)));
-const base=['contained_transform','evidence_verify','file_read','proof_execute','workspace_open'];
+const base=['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
 const machine=['machine_list','machine_ping','machine_revoke','machine_status'];
 const coding=['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read','coding_receipt_verify','coding_search',
   'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',

package/src/operator-surface.mjs

@@ -14,7 +14,7 @@ function workflow(goal,verb){
   ].join('\n');
 }
 
-export function registerOperatorSurface(server,{packageRoot,surfaceProfile='full',compactToolLimit=42}){
+export function registerOperatorSurface(server,{packageRoot,surfaceProfile='full',compactToolLimit=43}){
   if(!server||!packageRoot) throw new Error('operator surface requires server and packageRoot');
   if(!['full','compact'].includes(surfaceProfile)) throw new Error('operator surface profile must be full or compact');
   const contextPath=path.join(packageRoot,'CONTEXT.md');
@@ -36,7 +36,7 @@ export function registerOperatorSurface(server,{packageRoot,surfaceProfile='full
     title:'DEADBYTE MCP Architecture',description:'Production module seams, tracer bullet, policy, telemetry, semantic and remote decisions.',mimeType:'text/markdown'
   },async uri=>({contents:[{uri:uri.href,mimeType:'text/markdown',text:await readFile(architecturePath,'utf8')}]}));
   server.registerResource('deadbyte-surface-profile','deadbyte://surface-profile',{
-    title:'DEADBYTE MCP Surface Profile',description:'Active R36 MCP surface profile and compact tool ceiling.',mimeType:'application/json'
+    title:'DEADBYTE MCP Surface Profile',description:'Active DEADBYTE MCP surface profile and compact tool ceiling.',mimeType:'application/json'
   },async uri=>({contents:[{uri:uri.href,mimeType:'application/json',text:JSON.stringify({
     schema:'deadbyte.surface-profile.v1',profile:surfaceProfile,compact_tool_limit:compactToolLimit
   })}]}));

package/src/process-policy.mjs

@@ -147,4 +147,23 @@ export async function assertProcessArmed(policy, profileId = null, rootId = null
   if (profileId !== null && !status.profile_ids.includes(profileId)) throw new Error(`process profile '${profileId}' is not included in the active grant`);
   if (rootId !== null && !status.root_ids.includes(rootId)) throw new Error(`process root '${rootId}' is not included in the active grant`);
   return status;
+}
+
+export async function recheckProcessAuthority(policy, initial, profileId = null, rootId = null) {
+  if (!initial?.armed || typeof initial.instance_nonce !== 'string' ||
+      !Array.isArray(initial.profile_ids) || !Array.isArray(initial.root_ids)) {
+    throw new Error('process authority recheck requires an armed initial snapshot');
+  }
+  let current;
+  try { current = await assertProcessArmed(policy, profileId, rootId); }
+  catch (error) { throw new Error(`process authority changed during operation: ${String(error?.message ?? error)}`); }
+  const changed =
+    current.instance_nonce !== initial.instance_nonce ||
+    current.standing !== initial.standing ||
+    current.profile_ids.length !== initial.profile_ids.length ||
+    current.root_ids.length !== initial.root_ids.length ||
+    current.profile_ids.some((id, index) => id !== initial.profile_ids[index]) ||
+    current.root_ids.some((id, index) => id !== initial.root_ids[index]);
+  if (changed) throw new Error('process authority changed during operation');
+  return current;
 }

package/src/process-runtime.mjs

@@ -5,7 +5,7 @@ import { spawn } from 'node:child_process';
 import { canonicalJson } from './canonical-json.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
-import { assertProcessArmed } from './process-policy.mjs';
+import { assertProcessArmed, recheckProcessAuthority } from './process-policy.mjs';
 
 const EVENT_SCHEMA = 'deadbyte.process-event.v1';
 const EVENT_DOMAIN = Buffer.from('DEADBYTE-PROCESS-EVENT-V1\0', 'utf8');
@@ -256,6 +256,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     if (sha256Bytes(await readFile(policy.native_host.path)) !== policy.native_host.sha256) throw new Error('process native_host executable hash changed');
     if (sha256Bytes(await readFile(profile.executable)) !== profile.executable_sha256) throw new Error(`process profile '${profileId}' executable hash changed`);
     const cwdInfo = await resolveCwd(policy, grant, profile, rootId, cwd);
+    await recheckProcessAuthority(policy, grant, profileId, rootId);
     await mkdir(policy.state_dir, { recursive: true });
     const sessionId = randomBytes(32).toString('hex');
     const session = {
@@ -267,6 +268,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
       transport: profile.transport,
       win32_input_mode: false
     };
+    await recheckProcessAuthority(policy, grant, profileId, rootId);
     const host = spawn(policy.native_host.path,
       [profile.executable, cwdInfo.resolved, session.job_id, `--deadbyte-transport=${profile.transport}`, ...profile.prefix_args, ...args],
       { cwd: cwdInfo.resolved, env: processEnvironment(profile), windowsHide: true, shell: false, stdio: ['pipe','pipe','pipe'] });
@@ -327,7 +329,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
   async function action({ sessionId, actionId }) {
     const session = await sessionFor(sessionId);
     if (session.state !== 'running') throw new Error('process action requires a running session');
-    await assertProcessArmed(policy, session.profile_id, session.root_id);
+    const grant = await assertProcessArmed(policy, session.profile_id, session.root_id);
     const profile = policy.profiles[session.profile_id];
     if (!profile || !Object.prototype.hasOwnProperty.call(profile.input_actions, actionId)) {
       throw new Error(`process action '${actionId}' is not configured`);
@@ -340,6 +342,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     if (!session.host?.stdin || session.host.stdin.destroyed || !session.host.stdin.writable) {
       throw new Error('process session input is not writable');
     }
+    await recheckProcessAuthority(policy, grant, session.profile_id, session.root_id);
     await new Promise((resolve, reject) => session.host.stdin.write(logicalBytes, error => error ? reject(error) : resolve()));
     const logicalSha256 = sha256Bytes(logicalBytes);
     await appendEvent(runtime, session, 'action', { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256 });

package/src/process-smoke-client.mjs

@@ -55,7 +55,7 @@ try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
-  const expected = ['contained_transform','evidence_verify','file_read','proof_execute','workspace_open',
+  const expected = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open',
     'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'].sort();
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`process smoke catalog mismatch: ${JSON.stringify(names)}`);
   const started = structured(await client.callTool({ name: 'process_session_start', arguments: {
@@ -114,7 +114,7 @@ try {
   }
   if (sequence < 3 || previous !== finalHead) throw new Error('process journal head mismatch');
   if ((await readFile(journalPath, 'utf8')).includes('DEADBYTE_ACTION_PING')) throw new Error('process journal leaked action payload');
-  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 11,
+  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 12,
     profile_id: 'ping_hold', session_id: sessionId, observed_output_bytes: read.stream_head,
     action_id: action.action_id, logical_bytes: action.logical_bytes, logical_sha256: action.logical_sha256,
     final_state: terminated.session.state, event_count: sequence, journal_head_sha256: previous,

package/src/provider-circuit.mjs

@@ -48,10 +48,16 @@ function openAt(state,ms,policy){
 }
 
 export function providerCircuitId(planner){
-  if(!['openai_compatible','openai_responses'].includes(planner?.backend)||typeof planner.endpoint!=='string'||typeof planner.model!=='string') {
+  if(!planner||typeof planner.model!=='string') throw new Error('provider circuit planner identity invalid');
+  let identity;
+  if(['openai_compatible','openai_responses'].includes(planner.backend)&&typeof planner.endpoint==='string') {
+    identity=`${planner.backend}\0${planner.endpoint}\0${planner.model}`;
+  } else if(planner.backend==='codex_app_server'&&HEX64.test(planner.executable_sha256??'')&&typeof planner.root_id==='string') {
+    identity=`${planner.backend}\0${planner.executable_sha256}\0${planner.model}\0${planner.root_id}`;
+  } else {
     throw new Error('provider circuit planner identity invalid');
   }
-  const digest=createHash('sha256').update(Buffer.from(`${planner.backend}\0${planner.endpoint}\0${planner.model}`,'utf8')).digest('hex');
+  const digest=createHash('sha256').update(Buffer.from(identity,'utf8')).digest('hex');
   return `${planner.backend}:${digest}`;
 }