deadbyte-mcp 0.14.0 → 0.15.1

package/test/r44-finalization.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { validateParityEvidence,R44_PREDECESSOR_RELEASE_ID,R44_PREDECESSOR_MANIFEST } from '../scripts/release-parity-r44.mjs';
+import { verifyFinalClosureObject } from '../scripts/final-closure-verify-r44.mjs';
+
+const root=new URL('../',import.meta.url);const text=rel=>readFile(new URL(rel,root),'utf8');
+const featureGate=manifest=>({schema:'deadbyte.r44-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.0',
+  marker:'DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS',manifest_sha256:manifest,
+  features:{skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,remote_device_identity:true,
+    durable_job_supervisor:true,real_external_supervisor_smoke:true,full_regression_required:true,codex_live_binary_required:false}});
+function parity(){
+  const manifest='a'.repeat(64),gate=featureGate(manifest);
+  const requirements=Object.fromEntries(['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy',
+    'interrupted_recovery','evidence_verification','compact_closure','full_surface','desktop_readonly','desktop_guarded_input','deterministic_memory',
+    'skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke'].map(key=>[key,true]));
+  return {schema:'deadbyte.r44-parity.v1',status:'passed',execution_provider:'deadbyte_mcp',rdc_operation_count:0,
+    candidate:{release_id:`v0.15.0-${manifest.slice(0,16)}`,version:'0.15.0',manifest_sha256:manifest},
+    immutable_slot:{protected:true,release_root:'C:/immutable/r44',development_root:'D:/Projects/deadbyte-mcp/development/deadbyte-mcp-r42-agentic-dev'},
+    local_full:{status:'passed',tool_count:81,strict_output_schemas:true},
+    public_compact:{status:'passed',tool_count:43,capability_closure:true,gateway_count:6,skill_catalog_verified:true,
+      desktop_armed:false,desktop_observation_receipt_verified:true,desktop_grounding_receipt_verified:true},
+    autonomous:{status:'passed',signed_release_verified:true},desktop_guarded:{status:'passed',native_injected:true,replay_performed:false,
+      predispatch_retry_count:0,observation_receipts_verified:1,action_receipts_verified:3},
+    deterministic_memory:{status:'passed',goal_count:1,snapshot_count:1,index_count:1},
+    feature_gate:gate,feature_gate_sha256:'f'.repeat(64),
+    before_rollback_disarmed:{status:'passed',capability_closure:true,coding_armed:false,autonomous_armed:false,desktop_armed:false},
+    rollback:{state:'completed'},restore:{state:'completed'},stage_restore:{status:'restored',manifest_sha256:manifest},
+    predecessor:{release_id:R44_PREDECESSOR_RELEASE_ID,version:'0.14.1',manifest_sha256:R44_PREDECESSOR_MANIFEST},
+    predecessor_disarmed:{status:'passed',tool_count:42,capability_closure:true},
+    successor:{release_id:`v0.15.0-${manifest.slice(0,16)}`,version:'0.15.0',manifest_sha256:manifest},
+    successor_disarmed:{status:'passed',tool_count:43,capability_closure:true,skill_catalog_verified:true,coding_armed:false,autonomous_armed:false,desktop_armed:false},
+    requirements};
+}
+
+test('R44 parity requires exact R43 predecessor, 81/43 surface and feature contract',()=>{
+  const value=parity();assert.equal(validateParityEvidence(value),true);
+  assert.throws(()=>validateParityEvidence({...value,predecessor:{...value.predecessor,manifest_sha256:'b'.repeat(64)}}),/predecessor/i);
+  assert.throws(()=>validateParityEvidence({...value,local_full:{...value.local_full,tool_count:80}}),/81-tool/i);
+  assert.throws(()=>validateParityEvidence({...value,public_compact:{...value.public_compact,tool_count:42}}),/compact/i);
+  assert.throws(()=>validateParityEvidence({...value,feature_gate:{...value.feature_gate,features:{...value.feature_gate.features,codex_protocol_contract:false}}}),/codex_protocol_contract/);
+});
+
+test('R44 release machinery is isolated from R43 and binds 0.15.0 signed closure domains',async()=>{
+  const [gate,deferred,paritySource,writer,verifier,evidence,suite,finalizer,parent]=await Promise.all([
+    text('scripts/gate-windows-r44.ps1'),text('scripts/deferred-slot-operation-r44.mjs'),text('scripts/release-parity-r44.mjs'),
+    text('scripts/final-closure-r44.mjs'),text('scripts/final-closure-verify-r44.mjs'),text('scripts/windows-gate-evidence-r44.mjs'),
+    text('scripts/release-parity-tests-r44.ps1'),text('scripts/finalize-r44.mjs'),text('R44-PARENT.json')]);
+  assert.equal(R44_PREDECESSOR_RELEASE_ID,'v0.14.1-0a5a833892593283');
+  assert.equal(R44_PREDECESSOR_MANIFEST,'0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9');
+  assert.match(gate,/r44-parent-verify/);assert.match(gate,/r44:full:test/);assert.match(gate,/DEADBYTE V0\.15\.0 \/ R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS/);
+  assert.match(deferred,/--expected-version','0\.15\.0'/);assert.match(paritySource,/deadbyte\.r44-parity\.v1/);assert.match(paritySource,/tool_count===81/);assert.match(paritySource,/tool_count===43/);
+  for(const source of [writer,verifier]){assert.match(source,/DEADBYTE-R44-FINAL-CLOSURE-V1/);assert.match(source,/deadbyte\.r44-final-closure\.v1/);assert.match(source,/R44 REMOTE AGENT SKILL BASELINE/);}
+  assert.equal(typeof verifyFinalClosureObject,'function');assert.match(evidence,/deadbyte\.r44-windows-gate\.v1/);assert.match(evidence,/final_closure_sha256/);
+  assert.match(suite,/skill-plane-r44\.test\.mjs/);assert.match(suite,/codex-app-server-r44\.test\.mjs/);assert.match(suite,/external-job-provider-r44\.test\.mjs/);
+  assert.match(finalizer,/--restore-standing-grants/);assert.match(finalizer,/runReleaseParity/);assert.match(finalizer,/writeFinalClosure/);assert.match(finalizer,/verifyFinalClosureObject/);assert.match(finalizer,/--rollback-receipt/);
+  const parentRecord=JSON.parse(parent);assert.equal(parentRecord.parent_final_closure_sha256,'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b');
+});

package/test/r44-finalizer.test.mjs

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { validateFinalizerAuthorityStatus, validateWindowsGateEvidence } from '../scripts/finalize-r44.mjs';
+import { windowsPowerShellEnvironment } from '../src/runtime-update.mjs';
+
+const manifest='a'.repeat(64);
+const parent={
+  release_id:'v0.14.1-0a5a833892593283',
+  manifest_sha256:'0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9',
+  generation_manifest_sha256:'fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb',
+  closure_sha256:'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b'
+};
+const features=()=>({skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+  remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,full_regression_required:true,
+  codex_live_binary_required:false});
+const valid=()=>({schema:'deadbyte.r44-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.0',
+  marker:'DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS',manifest_sha256:manifest,
+  parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+    generation_manifest_sha256:parent.generation_manifest_sha256,final_closure_sha256:parent.closure_sha256},
+  features:features()});
+
+test('R44 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED',()=>{
+  assert.equal(validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),true);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:false,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),/Process standing grant/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:true,host_armed:false}),/Desktop DISARMED/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:true}),/Host DISARMED/);
+});
+
+test('R44 detached finalizer accepts only exact signed-R43-parent feature gate evidence',()=>{
+  assert.equal(validateWindowsGateEvidence(valid(),manifest,parent),true);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),manifest_sha256:'b'.repeat(64)},manifest,parent),/candidate mismatch/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),parent:{...valid().parent,release_id:'v0.14.1-bad'}},manifest,parent),/parent mismatch/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),parent:{...valid().parent,final_closure_sha256:'b'.repeat(64)}},manifest,parent),/parent/);
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),features:{...features(),skill_integrity:false}},manifest,parent),/skill_integrity/);
+});
+
+test('R44 detached finalizer isolates Windows PowerShell modules from the parent runtime',()=>{
+  const env=windowsPowerShellEnvironment({
+    SystemRoot:'C:\\Windows',USERPROFILE:'C:\\Users\\operator',ProgramFiles:'C:\\Program Files',
+    PSModulePath:'C:\\poisoned-runtime-modules'
+  });
+  assert.equal(env.PSModulePath,[
+    'C:\\Users\\operator\\Documents\\WindowsPowerShell\\Modules',
+    'C:\\Program Files\\WindowsPowerShell\\Modules',
+    'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules'
+  ].join(';'));
+  assert.doesNotMatch(env.PSModulePath,/poisoned-runtime-modules/);
+});

package/test/r44-parent.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR44Parent } from '../scripts/verify-r44-parent.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+
+test('R44 parent is exact sealed R43 final baseline',async()=>{
+  const result=await verifyR44Parent(path.join(root,'R44-PARENT.json'));
+  assert.equal(result.ok,true);
+  assert.equal(result.release_id,'v0.14.1-0a5a833892593283');
+  assert.equal(result.manifest_sha256,'0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9');
+  assert.equal(result.generation_manifest_sha256,'fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb');
+  assert.equal(result.release_files,1834);
+  assert.equal(result.generation_files,7);
+  assert.equal(result.closure_sha256,'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b');
+  assert.equal(result.recorded_all_disarmed,true);
+});
+
+test('R44 parent proof is historical and does not require current grants to remain absent',async()=>{
+  const result=await verifyR44Parent(path.join(root,'R44-PARENT.json'));
+  assert.equal(result.proof_class,'immutable-slot+generation+signed-final-closure');
+});

package/test/r45-autonomous-quick-test.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+test('R45 autonomous quick-test is fixture-scoped and does not invoke legacy npm test matrix', async () => {
+  const text=await readFile(new URL('../scripts/autonomous-tests.ps1',import.meta.url),'utf8');
+  assert.match(text,/node\.exe --test test\/autonomous-live-fixture\.test\.mjs/);
+  assert.doesNotMatch(text,/npm\.cmd test/);
+  assert.match(text,/R24 QUICK TEST PASS/);
+});

package/test/r45-finalization.test.mjs

@@ -0,0 +1,84 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { validateFinalizerAuthorityStatus, validateWindowsGateEvidence } from '../scripts/finalize-r45.mjs';
+import { R45_PREDECESSOR_RELEASE_ID, R45_PREDECESSOR_MANIFEST } from '../scripts/release-parity-r45.mjs';
+
+const manifest='a'.repeat(64);
+const parent={
+  release_id:'v0.15.0-c15fa41719be61b3',
+  manifest_sha256:'c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483',
+  generation_manifest_sha256:'6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30',
+  closure_sha256:'533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667'
+};
+const features=()=>({
+  skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+  remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,
+  full_regression_required:true,codex_live_binary_required:false,
+  host_inline_native:true,native_hardware_observation:true,doctor_release_truth:true
+});
+const valid=()=>({
+  schema:'deadbyte.r45-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.1',
+  marker:'DEADBYTE V0.15.1 / R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS',
+  manifest_sha256:manifest,
+  parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+    generation_manifest_sha256:parent.generation_manifest_sha256,final_closure_sha256:parent.closure_sha256},
+  features:features()
+});
+
+test('R45 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED',()=>{
+  assert.equal(validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),true);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:false,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),/Process standing grant/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:true,host_armed:false}),/Desktop DISARMED/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:true}),/Host DISARMED/);
+});
+
+test('R45 finalizer binds exact R44 parent and all Machine Freedom gate proofs',()=>{
+  assert.equal(validateWindowsGateEvidence(valid(),manifest,parent),true);
+  for(const key of ['host_inline_native','native_hardware_observation','doctor_release_truth']){
+    assert.throws(()=>validateWindowsGateEvidence({...valid(),features:{...features(),[key]:false}},manifest,parent),new RegExp(key));
+  }
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),manifest_sha256:'b'.repeat(64)},manifest,parent),/candidate mismatch/);
+});
+
+test('R45 release machinery binds 0.15.1, 82/43 surfaces, Host v2 bootstrap and FINAL closure',async()=>{
+  const root=new URL('../',import.meta.url);
+  const text=rel=>readFile(new URL(rel,root),'utf8');
+  const [gate,parity,compactClient,writer,verifier,finalizer,evidence,manifestSource]=await Promise.all([
+    text('scripts/gate-windows-r45.ps1'),text('scripts/release-parity-r45.mjs'),text('src/remote-mcp-r45-parity-client.mjs'),text('scripts/final-closure-r45.mjs'),
+    text('scripts/final-closure-verify-r45.mjs'),text('scripts/finalize-r45.mjs'),text('scripts/windows-gate-evidence-r45.mjs'),text('scripts/release-manifest.mjs')
+  ]);
+  assert.equal(R45_PREDECESSOR_RELEASE_ID,parent.release_id);
+  assert.equal(R45_PREDECESSOR_MANIFEST,parent.manifest_sha256);
+  assert.match(gate,/host-policy-refresh/);assert.match(gate,/doctor/);assert.match(gate,/hardware-build/);
+  const hermetic=gate.indexOf('host-policy-hermetic-clean');
+  const focused=gate.indexOf('r45-feature-focused');
+  const regression=gate.indexOf("Invoke-GateStep -Name 'full-regression'");
+  const agentSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-agent-smoke'");
+  const containedSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-contained-smoke'");
+  const hostRefresh=gate.indexOf("Invoke-GateStep -Name 'host-policy-refresh'");
+  const manifestWrite=gate.indexOf("Invoke-GateStep -Name 'release-manifest-write'");
+  const hostSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-host-smoke'");
+  assert.ok(hermetic>=0&&focused>hermetic&&regression>focused&&agentSmoke>regression&&containedSmoke>agentSmoke&&hostRefresh>containedSmoke&&manifestWrite>hostRefresh&&hostSmoke>manifestWrite,'R45 gate must keep generated Host policy out of hermetic regression and non-Host smoke surfaces');
+  assert.match(gate,/DEADBYTE V0\.15\.1 \/ R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS/);
+  assert.match(parity,/tool_count===82/);assert.match(parity,/tool_count===43/);assert.match(compactClient,/hardware_query/);
+  assert.match(parity,/waitForExactPointer/);
+  assert.match(parity,/rollbackPair\.completed\.active_release===R45_PREDECESSOR_RELEASE_ID/);
+  assert.match(parity,/version:'0\.15\.0',manifestSha256:R45_PREDECESSOR_MANIFEST/);
+  assert.match(parity,/restorePair\.completed\.active_release===active\.release_id/);
+  assert.match(parity,/version:'0\.15\.1',manifestSha256:candidateManifest/);
+  assert.match(parity,/predecessor_disarmed\?\.tool_count===43/);
+  assert.doesNotMatch(parity,/predecessor_disarmed\?\.tool_count===42/);
+  assert.doesNotMatch(parity,/R45 exact R44 predecessor identity mismatch[^\n]*0\.14\.1/);
+  for(const source of [writer,verifier]){
+    assert.match(source,/DEADBYTE-R45-FINAL-CLOSURE-V1/);
+    assert.match(source,/deadbyte\.r45-final-closure\.v1/);
+    assert.match(source,/R45 MACHINE FREEDOM FINAL BASELINE/);
+  }
+  assert.match(finalizer,/--host-policy/);assert.match(finalizer,/--host-policy-sha256/);
+  assert.match(finalizer,/host_inline_native/);assert.match(finalizer,/native_hardware_observation/);assert.match(finalizer,/doctor_release_truth/);
+  assert.match(evidence,/host_inline_native:true/);assert.match(evidence,/native_hardware_observation:true/);assert.match(evidence,/doctor_release_truth:true/);
+  assert.match(manifestSource,/excludedPackagePrefixes = \[[^\]]*'tmp\/'[^\]]*'\.deadbyte-machine-fs-recovery\/'[^\]]*\]/);
+  assert.match(manifestSource,/excludedPackagePaths = new Set\(\['controller\/deadbyte-host-policy\.json'\]\)/);
+  assert.match(manifestSource,/excludedPackagePrefixes\.some\(prefix => rel\.startsWith\(prefix\)\)/);
+});

package/test/release-generation.test.mjs

@@ -92,6 +92,7 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   assert.equal(generatedAuto.profiles.gate.script_sha256,sha(Buffer.from('Write-Output gate\n')));
   assert.equal(generatedAuto.profiles['windows-release'].script_path,'scripts/gate-windows-current.ps1');
   assert.equal(generatedAuto.profiles['windows-release'].script_sha256,sha(Buffer.from('Write-Output current-gate\n')));
+  assert.equal(generatedAuto.profiles['windows-release'].timeout_ms,600000);
   assert.equal(generatedAuto.profiles['windows-release'].description,'Full Windows target release gate; runs only when finish is requested.');
   const generatedHost=JSON.parse(await readFile(result.host_policy_path,'utf8'));
   assert.equal(generatedHost.roots.core.path,path.resolve(development));

package/test/release-version.test.mjs

@@ -2,24 +2,69 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
-const root=new URL('../',import.meta.url);const text=rel=>readFile(new URL(rel,root),'utf8');
-const R42_PREDECESSOR_RELEASE_ID='v0.13.0-3255be10de4daf08';
-const R42_PREDECESSOR_MANIFEST='3255be10de4daf0837d67d1ab1913b785b8b8215bc7405823c2ff46968c4b98f';
-test('R42 authority agrees on V0.14.0 and preserves exact sealed public R41 predecessor',async()=>{
- const pkg=JSON.parse(await text('package.json'));
- const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,parent,semanticConfig]=await Promise.all([
- text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r42.ps1'),text('README.txt'),text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),text('scripts/deferred-slot-operation-r42.mjs'),text('scripts/release-parity-r42.mjs'),text('scripts/final-closure-r42.mjs'),text('scripts/final-closure-verify-r42.mjs'),text('scripts/windows-gate-evidence-r42.mjs'),text('R42-PARENT.json'),text('controller/deadbyte-semantic-lsp-config.json')]);
- assert.equal(pkg.version,'0.14.0');assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r42.ps1');
- assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r42.mjs');assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r42.mjs');
- assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r42.mjs');assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r42.mjs');
- assert.equal(pkg.scripts['desktop:policy:refresh'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1');
- assert.match(version,/DEADBYTE_VERSION = '0\.14\.0'/);assert.match(controller,/CONTROLLER V0\.14\.0 \/ R42/);assert.match(gate,/DEADBYTE V0\.14\.0 \/ R42 WINDOWS BATCH GATE: PASS/);
- assert.match(readme,/^DEADBYTE MCP V0\.14\.0 \/ R42 AGENTIC GOVERNANCE BASELINE$/m);assert.match(architecture,/^# DEADBYTE MCP V0\.14\.0 \/ R42 ARCHITECTURE$/m);assert.match(controllerReadme,/^DEADBYTE MCP V0\.14\.0 \/ R42 CONTROLLER$/m);
- assert.match(deferred,/--expected-version','0\.14\.0'/);assert.match(deferred,/--enable-desktop/);assert.match(parity,/R42_PREDECESSOR_RELEASE_ID='v0\.13\.0-3255be10de4daf08'/);assert.match(parity,new RegExp(R42_PREDECESSOR_MANIFEST));
- assert.match(parity,/version==='0\.14\.0'|version:'0\.14\.0'/);assert.match(closure,/version:'0\.14\.0'/);assert.match(closureVerify,/DEADBYTE V0\.14\.0 \/ R42 WINDOWS BATCH GATE: PASS/);assert.match(windowsGate,/version:'0\.14\.0'/);
- assert.equal(JSON.parse(parent).parent_manifest_sha256,R42_PREDECESSOR_MANIFEST);
- assert.equal(createHash('sha256').update(Buffer.from(semanticConfig,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');assert.equal(R42_PREDECESSOR_RELEASE_ID,'v0.13.0-3255be10de4daf08');
+
+const root=new URL('../',import.meta.url);
+const text=rel=>readFile(new URL(rel,root),'utf8');
+const PARENT_RELEASE='v0.15.0-c15fa41719be61b3';
+const PARENT_MANIFEST='c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483';
+const PARENT_GENERATION='6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30';
+const PARENT_CLOSURE='533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667';
+
+test('R45 current authority agrees on V0.15.1 and preserves exact sealed R44 parent',async()=>{
+  const pkg=JSON.parse(await text('package.json'));
+  const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,parent,r44Gate,r44Parity,r44Closure]=await Promise.all([
+    text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r45.ps1'),text('README.txt'),
+    text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),text('scripts/deferred-slot-operation-r45.mjs'),
+    text('scripts/release-parity-r45.mjs'),text('scripts/final-closure-r45.mjs'),text('scripts/final-closure-verify-r45.mjs'),
+    text('scripts/windows-gate-evidence-r45.mjs'),text('R45-PARENT.json'),
+    text('scripts/gate-windows-r44.ps1'),text('scripts/release-parity-r44.mjs'),text('scripts/final-closure-r44.mjs')
+  ]);
+  assert.equal(pkg.version,'0.15.1');
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r45.ps1');
+  assert.equal(pkg.scripts['r45:parent:verify'],'node scripts/verify-r45-parent.mjs');
+  assert.equal(pkg.scripts['r45:full:test'],'node scripts/full-regression-r45.mjs');
+  assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r45.mjs');
+  assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r45.mjs');
+  assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r45.mjs');
+  assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r45.mjs');
+  assert.equal(pkg.scripts['finalize:r45'],'node scripts/finalize-r45.mjs');
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.1'/);
+  assert.match(controller,/CONTROLLER V0\.15\.1 \/ R45/);
+  assert.match(gate,/DEADBYTE V0\.15\.1 \/ R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS/);
+  assert.match(readme,/^DEADBYTE MCP V0\.15\.1 \/ R45 MACHINE FREEDOM FINAL BASELINE$/m);
+  assert.match(architecture,/^# DEADBYTE MCP V0\.15\.1 \/ R45 ARCHITECTURE$/m);
+  assert.match(controllerReadme,/^DEADBYTE MCP V0\.15\.1 \/ R45 CONTROLLER$/m);
+  assert.match(deferred,/--expected-version','0\.15\.1'/);
+  assert.match(parity,/R45_PREDECESSOR_RELEASE_ID='v0\.15\.0-c15fa41719be61b3'/);
+  assert.match(parity,new RegExp(PARENT_MANIFEST));
+  assert.match(parity,/tool_count===82/);assert.match(parity,/tool_count===43/);
+  assert.match(closure,/version:'0\.15\.1'/);assert.match(closure,/DEADBYTE-R45-FINAL-CLOSURE-V1/);
+  assert.match(closureVerify,/R45_FULL_TOOL_COUNT=82/);assert.match(closureVerify,/R45_COMPACT_TOOL_COUNT=43/);
+  assert.match(windowsGate,/deadbyte\.r45-windows-gate\.v1/);
+  const parentRecord=JSON.parse(parent);
+  assert.equal(parentRecord.parent_release_id,PARENT_RELEASE);
+  assert.equal(parentRecord.parent_manifest_sha256,PARENT_MANIFEST);
+  assert.equal(parentRecord.parent_generation_manifest_sha256,PARENT_GENERATION);
+  assert.equal(parentRecord.parent_final_closure_sha256,PARENT_CLOSURE);
+  assert.match(r44Gate,/DEADBYTE V0\.15\.0 \/ R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS/);
+  assert.match(r44Parity,/deadbyte\.r44-parity\.v1/);
+  assert.match(r44Closure,/version:'0\.15\.0'/);
+});
+
+test('R45 keeps ONLINE reuse and explicit Desktop authority',async()=>{
+  const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);
+  assert.match(cli,/controllerRuntimeReady/);
+  assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);
+  const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);
+  assert.ok(start>=0&&end>start);
+  const block=controller.slice(start,end);
+  assert.doesNotMatch(block,/\$host\s*=/i);
+  assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);
+  assert.match(controller,/armdesktop/);
+  assert.match(controller,/disarmdesktop/);
+});
+
+test('semantic config remains byte-pinned across R45 machine-freedom work',async()=>{
+  const semantic=await text('controller/deadbyte-semantic-lsp-config.json');
+  assert.equal(createHash('sha256').update(Buffer.from(semantic,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');
 });
-test('R40 keeps ONLINE reuse and PowerShell Host collision fix while Desktop stays explicit',async()=>{const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);assert.match(cli,/controllerRuntimeReady/);assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);assert.ok(start>=0&&end>start);const block=controller.slice(start,end);assert.doesNotMatch(block,/\$host\s*=/i);assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);assert.match(controller,/armdesktop/);assert.match(controller,/disarmdesktop/);});
-test('sealed R39 tooling remains historical 0.11.3 authority with exact 0.11.2 predecessor',async()=>{const [parity,gate,closure]=await Promise.all([text('scripts/release-parity-r39.mjs'),text('scripts/gate-windows-r39.ps1'),text('scripts/final-closure-r39.mjs')]);assert.match(parity,/R39_PREDECESSOR_RELEASE_ID='v0\.11\.2-058605dfccaa3035'/);assert.match(parity,/version==='0\.11\.3'|version:'0\.11\.3'/);assert.match(gate,/DEADBYTE V0\.11\.3 \/ R39 WINDOWS BATCH GATE: PASS/);assert.match(closure,/version:'0\.11\.3'/);});
-test('sealed R37 tooling remains historical 0.11.1 authority',async()=>{const [parity,gate,closure]=await Promise.all([text('scripts/release-parity.mjs'),text('scripts/gate-windows.ps1'),text('scripts/final-closure.mjs')]);assert.match(parity,/R37_PREDECESSOR_RELEASE_ID='v0\.11\.0-08c2a0008b1f84c9'/);assert.match(parity,/version==='0\.11\.1'|version:'0\.11\.1'/);assert.match(gate,/DEADBYTE V0\.11\.1 \/ R37 WINDOWS BATCH GATE: PASS/);assert.match(closure,/version:'0\.11\.1'/);});

package/test/remote-device-r44.test.mjs

@@ -0,0 +1,104 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createRemoteDevicePlaneR44 } from '../src/remote-device-r44.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+function deviceKey(){
+  const {publicKey}=generateKeyPairSync('ed25519');
+  const der=Buffer.from(publicKey.export({type:'spki',format:'der'}));
+  return {spki:der.toString('base64'),deviceId:sha(der)};
+}
+class FakeRelay{
+  constructor(){this.probes=[];this.requests=[];this.drop=false;}
+  async probe(value){this.probes.push(structuredClone(value));return {device_id:value.device_id,epoch:value.epoch,nonce:value.nonce,ready:true};}
+  async request(value){this.requests.push(structuredClone(value));if(this.drop)return null;return {ack:'accepted',request_id:value.request_id,terminal:{status:'completed',result_sha256:'a'.repeat(64)}};}
+}
+
+test('R44 remote device reported online is not reachable until identity-bound probe ACK',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true});
+    const paired=await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    assert.equal(paired.device_id,key.deviceId);assert.equal(paired.epoch,1);
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'conn-1'});
+    assert.equal((await plane.status({deviceId:key.deviceId})).reachable,false);
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.search',payload:{q:'x'},requestId:'1'.repeat(64)}),/not reachable/);
+    const ready=await plane.probe({deviceId:key.deviceId,epoch:1});
+    assert.equal(ready.reachable,true);assert.equal(relay.probes.length,1);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote dispatch is durable-before-send, replay-idempotent and silent drop is terminal',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-dispatch-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'c'});
+    await plane.probe({deviceId:key.deviceId,epoch:1});
+    const requestId='2'.repeat(64), payload={path:'README.md'};
+    const done=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId});
+    assert.equal(done.state,'completed');assert.equal(relay.requests.length,1);
+    const stored=JSON.parse(await readFile(path.join(root,'remote-devices.json'),'utf8'));
+    assert.equal(stored.requests[requestId].state,'completed');
+    const replay=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId});
+    assert.equal(replay.replay,true);assert.equal(relay.requests.length,1);
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload:{path:'other'},requestId}),/request id conflict/);
+
+    relay.drop=true;
+    const droppedId='3'.repeat(64);
+    const dropped=await plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload,requestId:droppedId});
+    assert.equal(dropped.state,'failed');assert.equal(dropped.error_code,'transport_no_ack');
+    const after=JSON.parse(await readFile(path.join(root,'remote-devices.json'),'utf8'));
+    assert.equal(after.requests[droppedId].state,'failed');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote routing requires local capability authorization and revoke invalidates epoch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-auth-'));
+  const relay=new FakeRelay(), key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async({capabilityId})=>capabilityId==='machine.status'});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'c'});await plane.probe({deviceId:key.deviceId,epoch:1});
+    await assert.rejects(plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'host.exec',payload:{},requestId:'4'.repeat(64)}),/capability denied/);
+    assert.equal(relay.requests.length,0);
+    const revoked=await plane.revoke({deviceId:key.deviceId,epoch:1});
+    assert.equal(revoked.revoked,true);
+    await assert.rejects(plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'new'}),/revoked|epoch/i);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 credential rotation commits encrypted replacement before supersede callback',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-rotate-'));
+  const relay=new FakeRelay(), key=deviceKey(), observed=[];
+  try{
+    const plane=await createRemoteDevicePlaneR44({stateDir:root,relay,authorizeCapability:async()=>true,
+      onCredentialSuperseded:async info=>{
+        const current=JSON.parse(await readFile(path.join(root,'credentials',`${key.deviceId}.json`),'utf8'));
+        observed.push({info,current});
+      }});
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    const one=Buffer.from('encrypted-token-one').toString('base64');
+    const first=await plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:one,expectedPreviousSha256:null});
+    const two=Buffer.from('encrypted-token-two').toString('base64');
+    const second=await plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:two,expectedPreviousSha256:first.credential_sha256});
+    assert.notEqual(second.credential_sha256,first.credential_sha256);
+    assert.equal(observed.length,1);
+    assert.equal(observed[0].current.credential_sha256,second.credential_sha256,'new credential must be durable before supersede');
+    await assert.rejects(plane.rotateCredential({deviceId:key.deviceId,epoch:1,encryptedBundleBase64:one,expectedPreviousSha256:first.credential_sha256}),/precondition/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R44 remote state corruption fails closed',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-remote-corrupt-'));
+  try{
+    await writeFile(path.join(root,'remote-devices.json'),'{"schema":','utf8');
+    await assert.rejects(createRemoteDevicePlaneR44({stateDir:root,relay:new FakeRelay(),authorizeCapability:async()=>true}),/state JSON invalid/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/runtime-host-bootstrap-r45.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { parseUpdateArgs, prepareHostPolicyBootstrap } from '../scripts/runtime-self-update.mjs';
+
+const hex=ch=>ch.repeat(64);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('R45 slot-update CLI binds Host policy bootstrap as one exact path plus SHA-256 pair',()=>{
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.15.1','--expected-manifest',hex('a')];
+  assert.throws(()=>parseUpdateArgs([...base,'--host-policy','C:/candidate/host.json']),/host policy.*pair/i);
+  assert.throws(()=>parseUpdateArgs([...base,'--host-policy-sha256',hex('b')]),/host policy.*pair/i);
+  const parsed=parseUpdateArgs([...base,'--host-policy','C:/candidate/host.json','--host-policy-sha256',hex('b')]);
+  assert.equal(parsed.hostPolicyBootstrap.path,path.resolve('C:/candidate/host.json'));
+  assert.equal(parsed.hostPolicyBootstrap.sha256,hex('b'));
+});
+
+test('R45 Host policy bootstrap accepts exact v2 bytes and rejects hash or native contract drift',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r45-host-bootstrap-'));
+  const file=path.join(root,'host.json');
+  const policy={
+    schema:'deadbyte.host-policy.v2',enabled:true,arm_file:'C:/state/host-grant.json',
+    roots:{core:{path:'C:/core',read:true,write:true,exec:true}},
+    commands:{node_inline:{kind:'inline',executable:'C:/node.exe',executable_sha256:hex('1'),root_ids:['core'],prefix_args:['-e'],timeout_ms:1000,max_output_bytes:4096,max_command_chars:1024}},
+    native_exec:{enabled:true,root_ids:['core'],timeout_ms:1000,max_output_bytes:4096,max_args:8,max_arg_chars:1024}
+  };
+  const bytes=Buffer.from(JSON.stringify(policy)+'\n','utf8'); await writeFile(file,bytes);
+  const accepted=await prepareHostPolicyBootstrap({path:file,sha256:sha(bytes)});
+  assert.equal(accepted.sha256,sha(bytes)); assert.deepEqual(accepted.policy,policy);
+  await assert.rejects(prepareHostPolicyBootstrap({path:file,sha256:hex('f')}),/host policy.*SHA-256 mismatch/i);
+  const bad=path.join(root,'bad.json');
+  const badBytes=Buffer.from(JSON.stringify({...policy,native_exec:{...policy.native_exec,enabled:false}})+'\n','utf8');
+  await writeFile(bad,badBytes);
+  await assert.rejects(prepareHostPolicyBootstrap({path:bad,sha256:sha(await readFile(bad))}),/native_exec contract/i);
+});
+
+test('R45 updater threads the bootstrapped Host v2 policy into successor generation',async()=>{
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/prepareHostPolicyBootstrap\(hostPolicyBootstrap\)/);
+  assert.match(source,/control\.hostPolicy=hostBootstrap\.policy/);
+  assert.match(source,/hostPolicy:control\.hostPolicy/);
+  assert.match(source,/hostPolicyBootstrap:args\.hostPolicyBootstrap/);
+});

package/test/runtime-self-update.test.mjs

@@ -53,6 +53,29 @@ test('R27 slot-update CLI requires exact stage/development/version/manifest bind
   assert.ok(path.isAbsolute(parsed.developmentRoot));
 });
 
+test('R43 slot authority restore plan carries prior Process grant without restoring Desktop or Host', () => {
+  assert.equal(typeof runtimeUpdate.standingAuthorityRestorePlan,'function');
+  const parsed=runtimeUpdate.parseControllerStatus([
+    'DEADBYTE MCP = ONLINE',
+    'Process plane  : ARMED [standing-grant]',
+    'Coding plane  : ARMED [standing-grant]',
+    'Autonomous     : ARMED [standing-grant]',
+    'Desktop plane : ARMED [standing-grant]',
+    'Host plane    : DISARMED [disarmed]'
+  ].join('\n'));
+  assert.equal(parsed.process_armed,true);
+  const plan=runtimeUpdate.standingAuthorityRestorePlan(parsed,true);
+  assert.deepEqual(plan.commands,['armcoding','armautonomous','armprocess']);
+  assert.deepEqual(plan.expected,{
+    process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false
+  });
+  const disabled=runtimeUpdate.standingAuthorityRestorePlan(parsed,false);
+  assert.deepEqual(disabled.commands,[]);
+  assert.deepEqual(disabled.expected,{
+    process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false
+  });
+});
+
 test('R27 development root is outside immutable/runtime state stores', async () => {
   const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-state-'));
   const dev=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-dev-'));
@@ -410,6 +433,25 @@ test('R29 bridge bootstrap rebinds only the pinned external bridge script', asyn
   await assert.rejects(runtimeUpdate.prepareBridgeSpec(config,{root,scriptSha256:hex('f')}),/bridge script SHA-256 mismatch/i);
 });
 
+test('R44 downstream core selection accepts only one exact visible or one opaque child of the verified Bridge', () => {
+  assert.equal(typeof runtimeUpdate.selectCoreProcess,'function');
+  const root=path.resolve('C:/release'),bridgePid=1200;
+  const visible={ProcessId:1300,ParentProcessId:bridgePid,CreationDate:'20260921010000.000000+000',
+    ExecutablePath:'C:\\Program Files\\nodejs\\node.exe',CommandLine:`node "${path.join(root,'src','mcp-server.mjs')}"`};
+  const exact=runtimeUpdate.selectCoreProcess([visible],root,bridgePid);
+  assert.equal(exact.pid,1300);
+  assert.equal(exact.identity_basis,'command_line');
+  const opaque={ProcessId:1301,ParentProcessId:bridgePid,CreationDate:'20260921010100.000000+000',ExecutablePath:null,CommandLine:null};
+  const verifiedBridge={component:'bridge',pid:bridgePid,script_path:'C:\\bridge\\src\\bridge.mjs',script_sha256:hex('a')};
+  const fallback=runtimeUpdate.selectCoreProcess([opaque],root,bridgePid,verifiedBridge);
+  assert.equal(fallback.pid,1301);
+  assert.equal(fallback.identity_basis,'verified_bridge_single_opaque_node_child');
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([opaque],root,bridgePid),/requires verified Bridge script binding/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([opaque,{...opaque,ProcessId:1302}],root,bridgePid,verifiedBridge),/unambiguous downstream core/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([{...visible,CommandLine:'node C:\\other\\server.mjs'}],root,bridgePid),/unambiguous downstream core/i);
+  assert.throws(()=>runtimeUpdate.selectCoreProcess([{...opaque,CreationDate:''}],root,bridgePid,verifiedBridge),/identity incomplete/i);
+});
+
 test('R31 updater threads pinned process policy and machine-FS enable into successor generation', async () => {
   const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
   assert.match(source,/prepareProcessPolicyBootstrap\(processPolicyBootstrap\)/);

package/test/skill-mcp-r44.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+
+test('R44 compact surface exposes one read-only skill_catalog without authority',async()=>{
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r44-skill-mcp-'));
+  const client=new Client({name:'deadbyte-r44-skill-mcp',version:'0.15.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={...getDefaultEnvironment(),DEADBYTE_STATE_ROOT:state,DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'};
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const names=(await client.listTools()).tools.map(t=>t.name).sort();
+    assert.ok(names.includes('skill_catalog'),'R44 skill_catalog missing from compact surface');
+    assert.equal(names.filter(name=>name.startsWith('skill_')).length,1,'skill plane must remain one-tool surface');
+    const listed=await client.callTool({name:'skill_catalog',arguments:{op:'list'}});
+    assert.equal(listed.isError,false,JSON.stringify(listed));
+    assert.equal(listed.structuredContent.status,'ok');
+    assert.equal(listed.structuredContent.op,'list');
+    assert.deepEqual(listed.structuredContent.result.skills,[]);
+    assert.match(listed.structuredContent.result.registry_sha256,/^[0-9a-f]{64}$/);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    const cap=manifest.structuredContent.result.capabilities.find(x=>x.id==='skill.catalog');
+    assert.ok(cap,'skill.catalog capability missing');
+    assert.equal(cap.authority,'none');assert.equal(cap.mutating,false);assert.equal(cap.compact_tool,'skill_catalog');
+  }finally{await client.close().catch(()=>{});await rm(state,{recursive:true,force:true});}
+});