deadbyte-mcp 0.14.0 → 0.15.1

package/test/coding-runtime.test.mjs

@@ -5,7 +5,7 @@ import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { generateTrustKeypair } from '../src/trust.mjs';
-import { createCodingRuntime, loadCodingPolicy } from '../src/coding-plane.mjs';
+import { assertCodingArmed, createCodingRuntime, loadCodingPolicy, recheckCodingAuthority } from '../src/coding-plane.mjs';
 import { createCodingTaskRuntime } from '../src/coding-task-runtime.mjs';
 
 function sha256Bytes(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
@@ -78,6 +78,41 @@ test('coding plane rejects mutation when lease is absent or precondition is stal
     await assert.rejects(() => f.runtime.fileWrite({ rootId: 'project', relativePath: 'x.txt', content: 'x', expectedSha256: 'absent' }), /coding plane is disarmed/);
   } finally { await rm(f.root, { recursive: true, force: true }); }
 });
+
+test('coding authority recheck rejects lease generation or expiry drift before commit', async () => {
+  const f = await fixture();
+  try {
+    const initial = await assertCodingArmed(f.policy, 'project');
+    const lease = JSON.parse(await readFile(f.policy.lease_file, 'utf8'));
+    await writeFile(f.policy.lease_file, JSON.stringify({ ...lease, instance_nonce: 'b'.repeat(64) }));
+    await assert.rejects(() => recheckCodingAuthority(f.policy, initial, 'project'), /coding authority changed during operation/);
+    await writeFile(f.policy.lease_file, JSON.stringify({
+      ...lease,
+      expires_at_utc: new Date(Date.parse(lease.expires_at_utc) + 60000).toISOString()
+    }));
+    await assert.rejects(() => recheckCodingAuthority(f.policy, initial, 'project'), /coding authority changed during operation/);
+  } finally { await rm(f.root, { recursive: true, force: true }); }
+});
+test('coding execution deadline bounds runtime without changing the signed request identity', async () => {
+  const f = await fixture();
+  try {
+    const script = path.join(f.project, 'deadline.mjs');
+    await writeFile(script, "await new Promise(resolve => setTimeout(resolve, 10000));\n");
+    const scriptHash = await sha256File(script);
+    const args = { rootId:'project', commandId:'node_script', scriptPath:'deadline.mjs', scriptSha256:scriptHash,
+      timeoutMs:20000, executionDeadlineUtc:new Date(Date.now()+3000).toISOString() };
+    const expectedRequest = f.runtime.requestSha('coding_command_run', {
+      root_id:'project', command_id:'node_script', script_path:'deadline.mjs', script_sha256:scriptHash,
+      args:[], cwd:'.', timeout_ms:20000
+    });
+    const result = await f.runtime.commandRun(args);
+    assert.equal(result.status, 'observed_failure');
+    assert.equal(result.timed_out, true);
+    assert.ok(result.timeout_ms >= 500 && result.timeout_ms <= 3000);
+    assert.equal(result.request_sha256, expectedRequest);
+  } finally { await rm(f.root, { recursive:true, force:true }); }
+});
+
 test('coding command and benchmark produce signed observations', async () => {
   const f = await fixture();
   try {

package/test/compact-catalog-r36.test.mjs

@@ -10,7 +10,7 @@ const repoRoot=path.resolve(here,'..');
 const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
 const gatewayNames=['capability_manifest','coding_inspect','desktop_control','machine_fs','machine_observe','process_session'];
 
-test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
+test('R44 real compact stdio catalog stays <=43 and exposes all gateways plus skill_catalog',async()=>{
   const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
   const env={
     ...getDefaultEnvironment(),
@@ -24,8 +24,8 @@ test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async(
     await client.connect(transport);
     const listed=await client.listTools();
     const names=listed.tools.map(tool=>tool.name).sort();
-    assert.ok(names.length<=42,`compact tool count ${names.length} exceeds 42`);
-    for(const name of gatewayNames) assert.ok(names.includes(name),`missing ${name}`);
+    assert.ok(names.length<=43,`compact tool count ${names.length} exceeds 43`);
+    for(const name of [...gatewayNames,'skill_catalog']) assert.ok(names.includes(name),`missing ${name}`);
     for(const legacy of ['workspace_open','file_read','proof_execute','contained_transform']) assert.equal(names.includes(legacy),false,`legacy full-only tool leaked: ${legacy}`);
     const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
     assert.equal(manifest.isError,false);

package/test/compact-max-catalog-r40.test.mjs

@@ -10,7 +10,9 @@ import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
 
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
-const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const parent=JSON.parse(await readFile(path.join(repoRoot,'R44-PARENT.json'),'utf8'));
+const parentRoot=parent.parent_release_root;
+const serverPath=path.join(parentRoot,'src','mcp-server.mjs');
 const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
@@ -70,7 +72,7 @@ test('R40 real max-runtime compact stdio catalog is exactly 42 while all authori
     DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
     DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
   };
-  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:parentRoot,env,stderr:'pipe'});
   try{
     await client.connect(transport);
     const listed=await client.listTools();

package/test/compact-max-catalog-r44.test.mjs

@@ -0,0 +1,97 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R44 real max-runtime compact stdio catalog is exactly 43 with verified skill_catalog while all authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-max-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.equal(names.length,43,'expected exact compact max catalog 43, got '+names.length+': '+names.join(','));
+    for(const name of ['capability_manifest','desktop_control','coding_inspect','machine_fs','machine_observe','process_session',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    const m=manifest.structuredContent.result;
+    assert.equal(m.schema,'deadbyte.capability-manifest.v2');
+    assert.equal(m.profile,'compact');
+    assert.equal(m.tool_count,43);
+    assert.deepEqual(m.tool_catalog,names);
+    assert.match(m.catalog_sha256,/^[0-9a-f]{64}$/);
+    const skill=m.capabilities.find(item=>item.id==='skill.catalog');
+    assert.ok(skill);assert.equal(skill.authority,'none');assert.equal(skill.mutating,false);
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/compact-max-catalog-r45.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R45 real max-runtime compact stdio catalog is exactly 43 with verified skill_catalog while all authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-max-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.equal(names.length,43,'expected exact compact max catalog 43, got '+names.length+': '+names.join(','));
+    for(const name of ['capability_manifest','desktop_control','coding_inspect','machine_fs','machine_observe','process_session',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    const m=manifest.structuredContent.result;
+    assert.equal(m.schema,'deadbyte.capability-manifest.v2');
+    assert.equal(m.profile,'compact');
+    assert.equal(m.tool_count,43);
+    assert.deepEqual(m.tool_catalog,names);
+    assert.match(m.catalog_sha256,/^[0-9a-f]{64}$/);
+    const hardware=m.capabilities.find(item=>item.id==='observation.hardware_query');
+    assert.ok(hardware);assert.equal(hardware.authority,'none');assert.equal(hardware.compact_tool,'machine_observe');assert.equal(hardware.compact_op,'hardware_query');
+    const skill=m.capabilities.find(item=>item.id==='skill.catalog');
+    assert.ok(skill);assert.equal(skill.authority,'none');assert.equal(skill.mutating,false);
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,hardware_query:true,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/contained.test.mjs

@@ -352,6 +352,10 @@ test('contained execution source has a compile-time worker registry and no user
   const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
   const registry = await readFile(fileURLToPath(new URL('../src/worker-registry.mjs', import.meta.url)), 'utf8');
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
   assert.match(registry, /contained-transform-worker\.exe/);
   assert.match(registry, /contained-reverse-worker\.exe/);
   assert.match(registry, /CONTAINED_EXECUTION_REGISTRY/);
@@ -360,9 +364,9 @@ test('contained execution source has a compile-time worker registry and no user
   assert.match(registry, /lowercase_ascii/);
   assert.match(registry, /reverse_bytes/);
   assert.match(executor, /loadVerifiedWorkerRegistry/);
-  assert.match(server, /'contained_transform'/);
-  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
-  assert.doesNotMatch(server, /executable:\s*z\./);
+  assert.match(contained, /'contained_transform'/);
+  assert.match(contained, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.doesNotMatch(contained, /executable:\s*z\./);
   assert.doesNotMatch(executor, /--worker/);
   assert.doesNotMatch(server, /registerTool\(\s*['"](?:command_run|shell_execute|powershell_run)['"]/);
 });
@@ -706,12 +710,16 @@ test('contained execution validator rejects missing or altered worker manifest e
 
 test('MCP contained_transform schema is a compile-time operation enum with no executable or invocation-control surface', async () => {
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
-  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
-  assert.equal((server.match(/inputSchema: z\.strictObject\(\{/g) ?? []).length, 8);
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
+  assert.match(contained, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.match(contained, /inputSchema: z\.strictObject\(\{/);
   assert.match(server, /if \(hostPolicy\)/);
   for (const name of ['host_file_read', 'host_file_write', 'host_exec']) assert.match(server, new RegExp(`'${name}'`));
-  assert.doesNotMatch(server, /inputSchema: z\.object\(\{/);
-  assert.doesNotMatch(server, /executable:\s*z\.|argv:\s*z\.|environment:\s*z\.|challenge:\s*z\.|request_digest:\s*z\.|worker_id:\s*z\./);
+  assert.doesNotMatch(contained, /inputSchema: z\.object\(\{/);
+  assert.doesNotMatch(contained, /executable:\s*z\.|argv:\s*z\.|environment:\s*z\.|challenge:\s*z\.|request_digest:\s*z\.|worker_id:\s*z\./);
 });
 
 test('R27 Windows batch gate builds native payload before freezing and verifying the candidate', async () => {
@@ -914,13 +922,17 @@ test('contained execution validator fails closed on active network evidence', ()
 
 test('execution authority is strict at MCP and native argv boundaries', async () => {
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
   const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
   const helper = await readFile(fileURLToPath(new URL('../native/contained-network-proof.h', import.meta.url)), 'utf8');
   const authority = await readFile(fileURLToPath(new URL('../src/authority-smoke.mjs', import.meta.url)), 'utf8');
-  assert.match(server, /inputSchema: z\.strictObject\(/);
-  assert.doesNotMatch(server, /worker_id:\s*z\./);
-  assert.doesNotMatch(server, /executable:\s*z\./);
-  assert.doesNotMatch(server, /argv:\s*z\./);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
+  assert.match(contained, /inputSchema: z\.strictObject\(/);
+  assert.doesNotMatch(contained, /worker_id:\s*z\./);
+  assert.doesNotMatch(contained, /executable:\s*z\./);
+  assert.doesNotMatch(contained, /argv:\s*z\./);
   assert.match(launcher, /argc != 7/);
   assert.match(launcher, /invalid fixed argument contract/);
   assert.match(helper, /HasExactContainedWorkerArguments/);

package/test/controller.test.mjs

@@ -82,11 +82,15 @@ test('controller keeps privileged policy optional and propagates it only to the
 
 test('Windows host policy bootstrap pins executables and creates only explicit local roots', async () => {
   const init = await readFile(fileURLToPath(new URL('../scripts/init-host-policy.ps1', import.meta.url)), 'utf8');
-  assert.match(init, /deadbyte\.host-policy\.v1/);
+  assert.match(init, /deadbyte\.host-policy\.v2/);
   assert.match(init, /Get-FileHash/);
   assert.match(init, /powershell_script/);
   assert.match(init, /cmd_script/);
   assert.match(init, /node_script/);
+  assert.match(init, /powershell_inline/);
+  assert.match(init, /cmd_inline/);
+  assert.match(init, /node_inline/);
+  assert.match(init, /native_exec/);
   assert.match(init, /D:\\Projects/);
   assert.match(init, /State\s+: DISARMED/);
 });

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.14.0');
+  assert.equal(result.receipt.runtime.package_version, '0.15.1');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/durable-job-r44.test.mjs

@@ -0,0 +1,75 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createDurableJobSupervisorR44 } from '../src/durable-job-r44.mjs';
+
+class FakeProvider{
+  constructor({external=true}={}){this.external=external;this.handles=new Map();this.starts=0;}
+  descriptor(){return {kind:this.external?'external-supervisor':'controller-local',instance_id:'sup-1'};}
+  async start(spec){
+    const handle={handle_id:`h-${++this.starts}`,pid:1000+this.starts,creation_id:`c-${this.starts}`,profile_id:spec.profile_id};
+    const running={...handle,state:'running'};this.handles.set(handle.handle_id,running);return {...running};
+  }
+  async reattach(handle){
+    const current=this.handles.get(handle.handle_id);return current?{...current}:null;
+  }
+  async status(handle){return this.handles.get(handle.handle_id)??null;}
+  async terminate(handle){const current=this.handles.get(handle.handle_id);if(current){current.state='terminated';return {...current};}return null;}
+}
+
+test('R44 controller/session jobs never masquerade as persistent after owner restart',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-job-'));const provider=new FakeProvider();
+  try{
+    const one=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-1'});
+    const c=await one.start({lifetime:'controller',profileId:'build',rootId:'core',cwd:'.',args:[]});
+    const s=await one.start({lifetime:'session',profileId:'test',rootId:'core',cwd:'.',args:[]});
+    assert.equal(c.state,'running');assert.equal(s.state,'running');
+    const two=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-2'});
+    assert.equal((await two.status({jobId:c.job_id})).state,'interrupted');
+    assert.equal((await two.status({jobId:s.job_id})).state,'interrupted');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 persistent job reattaches only through external supervisor with exact process identity',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-job-persist-'));const provider=new FakeProvider();
+  try{
+    const one=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-1'});
+    const job=await one.start({lifetime:'persistent',profileId:'watch',rootId:'core',cwd:'.',args:[]});
+    const two=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-2'});
+    const recovered=await two.status({jobId:job.job_id});
+    assert.equal(recovered.state,'running');assert.equal(recovered.recovered,true);
+    assert.equal(recovered.pid,job.pid);assert.equal(recovered.creation_id,job.creation_id);
+
+    const live=provider.handles.get(job.handle_id);live.creation_id='spoofed';
+    const three=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-3'});
+    assert.equal((await three.status({jobId:job.job_id})).state,'orphaned');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 persistent lifetime rejects controller-local provider and state corruption',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-job-local-'));
+  try{
+    const local=await createDurableJobSupervisorR44({stateDir:root,provider:new FakeProvider({external:false}),ownerInstanceId:'owner'});
+    await assert.rejects(local.start({lifetime:'persistent',profileId:'x',rootId:'core',cwd:'.',args:[]}),/external supervisor/);
+  }finally{await rm(root,{recursive:true,force:true});}
+
+  const corrupt=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-job-corrupt-'));
+  try{
+    await writeFile(path.join(corrupt,'jobs.json'),'{"schema":','utf8');
+    await assert.rejects(createDurableJobSupervisorR44({stateDir:corrupt,provider:new FakeProvider(),ownerInstanceId:'owner'}),/state JSON invalid/);
+  }finally{await rm(corrupt,{recursive:true,force:true});}
+});
+
+test('R44 terminate binds exact supervisor handle and becomes durable terminal state',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-job-term-'));const provider=new FakeProvider();
+  try{
+    const sup=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner'});
+    const job=await sup.start({lifetime:'persistent',profileId:'watch',rootId:'core',cwd:'.',args:[]});
+    const ended=await sup.terminate({jobId:job.job_id});
+    assert.equal(ended.state,'terminated');
+    const restarted=await createDurableJobSupervisorR44({stateDir:root,provider,ownerInstanceId:'owner-2'});
+    assert.equal((await restarted.status({jobId:job.job_id})).state,'terminated');
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/external-job-provider-r44.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm, writeFile, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createDurableJobSupervisorR44 } from '../src/durable-job-r44.mjs';
+import { createExternalJobProviderR44 } from '../src/external-job-provider-r44.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const workerPath=path.join(repoRoot,'src','job-supervisor-host-r44.mjs');
+
+test('R44 real external supervisor preserves persistent job identity across controller recreation',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-real-supervisor-'));
+  const supervisorState=path.join(root,'host'),jobsState=path.join(root,'jobs'),project=path.join(root,'project');
+  await mkdir(project,{recursive:true});
+  const script=path.join(project,'hold.mjs');
+  await writeFile(script,`process.stdout.write('READY\\n');setInterval(()=>{},1000);\n`,'utf8');
+  const nodeSha=sha(await readFile(process.execPath)), workerSha=sha(await readFile(workerPath));
+  const config={stateDir:supervisorState,nodeExecutable:process.execPath,nodeExecutableSha256:nodeSha,
+    workerPath,workerSha256:workerSha,roots:{core:project},profiles:{
+      hold:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],prefix_args:[script],max_args:4,max_arg_bytes:1024}
+    }};
+  let providerA=null,providerB=null;
+  try{
+    providerA=await createExternalJobProviderR44(config);
+    const one=await createDurableJobSupervisorR44({stateDir:jobsState,provider:providerA,ownerInstanceId:'controller-a'});
+    const started=await one.start({lifetime:'persistent',profileId:'hold',rootId:'core',cwd:'.',args:[]});
+    assert.equal(started.state,'running');assert.ok(started.pid>0);assert.match(started.creation_id,/^[0-9a-f]{64}$/);
+
+    providerB=await createExternalJobProviderR44(config);
+    assert.equal(providerB.descriptor().instance_id,providerA.descriptor().instance_id,'must reconnect same external supervisor');
+    const two=await createDurableJobSupervisorR44({stateDir:jobsState,provider:providerB,ownerInstanceId:'controller-b'});
+    const recovered=await two.status({jobId:started.job_id});
+    assert.equal(recovered.state,'running');assert.equal(recovered.recovered,true);
+    assert.equal(recovered.handle_id,started.handle_id);assert.equal(recovered.pid,started.pid);assert.equal(recovered.creation_id,started.creation_id);
+    const ended=await two.terminate({jobId:started.job_id});assert.equal(ended.state,'terminated');
+  }finally{
+    if(providerB)await providerB.shutdown().catch(()=>{});
+    else if(providerA)await providerA.shutdown().catch(()=>{});
+    await rm(root,{recursive:true,force:true});
+  }
+});

package/test/full-max-catalog-r40.test.mjs

@@ -10,8 +10,10 @@ import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
 
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
-const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
-const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const parent=JSON.parse(await readFile(path.join(repoRoot,'R44-PARENT.json'),'utf8'));
+const parentRoot=parent.parent_release_root;
+const serverPath=path.join(parentRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(parentRoot,'controller','deadbyte-desktop-policy.json');
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
 
@@ -70,7 +72,7 @@ test('R40 real max-runtime full stdio catalog is exactly 80 with four Desktop pr
     DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
     DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
   };
-  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:parentRoot,env,stderr:'pipe'});
   try{
     await client.connect(transport);
     const listed=await client.listTools();

package/test/full-max-catalog-r44.test.mjs

@@ -0,0 +1,91 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R44 real max-runtime full stdio catalog is exactly 81 with skill and four Desktop primitives while authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r44-full-catalog',version:'0.15.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'full',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    const {R44_EXPECTED_TOOLS}=await import('../src/remote-mcp-r44-parity-client.mjs');
+    assert.equal(names.length,81,'expected exact full R44 catalog 81, got '+names.length+': '+names.join(','));
+    assert.deepEqual(names,R44_EXPECTED_TOOLS);
+    for(const name of ['desktop_status','desktop_observe','desktop_target','desktop_action',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    for(const tool of listed.tools) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
+    const catalog_sha256=sha(Buffer.from(JSON.stringify(names),'utf8'));
+    console.log(JSON.stringify({tool_count:names.length,catalog_sha256,desktop_tools:4,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});