deadbyte-mcp 0.14.0 → 0.15.1

package/AGENTS.md

@@ -1,25 +1,18 @@
-# DEADBYTE MCP R42 Agent Harness
+# DEADBYTE MCP R44 Remote Agent + Skill Baseline
 
-This repository is the mutable Git-backed R42 successor. Its immutable parent is R41 release `v0.13.0-3255be10de4daf08`; never edit the R41 source or release slot in place.
+This repository is the mutable R44 / V0.15.0 successor. Its immutable parent is sealed R43 release `v0.14.1-0a5a833892593283`; never edit the R43 release slot or signed final evidence in place.
 
 ## Operating contract
 
-- Start from observed state and exact identities. Prose, memory, signatures, and manifests support a claim but do not replace runtime behavior.
-- Keep every effect inside existing typed DEADBYTE runtimes. Never add generic shell, arbitrary executable/PID/stdin/environment control, implicit authority renewal, or a public authority-widening tool.
-- Treat Process, Coding, Autonomous, Desktop, and Host as separately revocable authority planes. Recheck the applicable authority immediately before every mutation.
-- Prefer Native Diff with exact SHA-256 preconditions for source changes. Use only policy-pinned profiles for builds, tests, debugging, deployment, and rollback.
-- Use bounded search/read/output and stable identifiers. On stale identity, interrupted execution, unknown side effect, policy drift, or receipt mismatch, fail closed and gather fresh evidence.
-- Ask one typed clarification only when a missing operator choice materially changes the result. Resume with the signed answer; never infer broader permission.
-
-## Change loop
-
-1. Record the task contract: scope, non-goals, constraints, risk, acceptance, and required evidence.
-2. Reproduce with a focused RED test.
-3. Make the smallest reversible change.
-4. Run focused GREEN and relevant adversarial tests.
-5. Commit a checkpoint before widening scope.
-6. Run the complete release gate after the final source mutation.
+- Machine truth outranks prose. Bind claims to exact bytes, policy, runtime identity, signed evidence, or observed behavior.
+- Keep effects inside typed DEADBYTE runtimes. Never add generic shell, caller-selected executable/PID/stdin/environment authority, implicit grant renewal, or donor-owned authority.
+- Process, Coding, Autonomous, Desktop, and Host remain independently revocable. Recheck authority immediately before each effect.
+- Skills are signed read-only instructions/resources. A skill cannot arm, renew, or widen authority.
+- Remote identity is Ed25519 SPKI + epoch; reported online is not reachable until an identity-bound readiness proof succeeds.
+- Persistent jobs require an external supervisor and exact handle + PID + creation identity; PID alone is never authority.
+- Model backends are transport/planning providers. Provider approvals never override DEADBYTE policy.
+- Prefer Native Diff with exact SHA-256 preconditions, bounded reads/search, deterministic tests, and fail-closed recovery.
 
 ## Release rule
 
-R42 is not Final until the exact release tree, Windows gate, full regression, model-backed evals, public/local catalogs, activation, exact R41 rollback, same-slot restore, signed receipt verification, runtime outcome, and all-disarmed closure have fresh evidence. Publishing must use the exact sealed tarball; never rebuild between local proof and registry upload.
+R44 is Final only when the exact 0.15.0 tree passes the Windows gate and full regression, full surface is exactly 81 tools, compact surface exactly 43 with verified `skill_catalog`, live parity rolls back to exact sealed R43 and restores exact R44, and the independent R44 closure verifier accepts the signed all-disarmed final state. A real Codex executable is optional; when configured it must be absolute-path and SHA-256 pinned.

package/CONTEXT.md

@@ -30,11 +30,11 @@ A failed tool call changes the hypothesis; it is not permission to retry blindly
 
 Prefer progressive disclosure: symbol navigation, bounded search, paged observation, multi-file reads, and named resources. Do not dump whole repositories into prompts. Load only the skill, resource, source slice, or evidence needed for the current decision.
 
-## R42 successor anchor
+## R44 successor anchor
 
-R42 / V0.14.0 is developed only as a Git-backed successor to sealed R41 release `v0.13.0-3255be10de4daf08`, whose immutable package manifest is `3255be10de4daf0837d67d1ab1913b785b8b8215bc7405823c2ff46968c4b98f` with exactly 1794 listed package files. The R41 source and release slot are immutable parent authority and are never edited in place.
+R44 / V0.15.0 is the remote-agent-and-skill successor to sealed R43 release `v0.14.1-0a5a833892593283`, manifest `0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9`. The R43 parent is proven by its immutable 1834-file slot, 7-file generation, and signed final closure `2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b`.
 
-R42 adds reasoning-harness capabilities without widening machine authority: an identity-bound task contract, bounded provider adapters, signed human clarification, model-quality evals, and bounded specialist review. Core and public compatibility remain separate evidence boundaries; exact catalog/schema identities must be derived and verified at release time rather than copied from historical counts.
+R44 adds a signed progressive-disclosure Skill Plane, persistent JSON-RPC/Codex app-server backend contracts, identity-bound Remote Device routing, and explicit-lifetime Durable Job supervision. None of these planes can manufacture Process, Coding, Autonomous, Desktop, or Host authority. Current compact/full public catalogs are 43/81; sealed R43 remains historical 42/80.
 
 ## Final-baseline rule