deadbyte-mcp 0.14.0 → 0.15.1

package/R44-DONORS.json

@@ -0,0 +1,99 @@
+{
+  "schema": "deadbyte.r44-donors.v1",
+  "observed_at_utc": "2026-09-21T00:00:00+07:00",
+  "policy": "reference-and-selective-port-only",
+  "donors": [
+    {
+      "id": "desktop-commander-mcp",
+      "url": "https://github.com/wonderwhy-er/DesktopCommanderMCP",
+      "license": "MIT",
+      "source_available": true,
+      "use": "implementation-reference",
+      "adopt": [
+        "interactive process/session UX",
+        "bounded output pagination",
+        "filesystem/search ergonomics",
+        "local audit history",
+        "remote-device lessons"
+      ],
+      "reject": [
+        "raw arbitrary authority widening",
+        "PID-as-authority",
+        "in-memory-only persistence assumptions",
+        "untyped background lifetime"
+      ]
+    },
+    {
+      "id": "remote-desktop-commander",
+      "url": "https://github.com/desktop-commander/remote-desktop-commander",
+      "license": "repository-docs/manifests-public; hosted-service-proprietary",
+      "source_available": false,
+      "use": "protocol-and-product-contract-reference",
+      "adopt": [
+        "OAuth2 PKCE client authorization",
+        "OAuth device authorization pairing",
+        "multi-machine naming/routing",
+        "device revoke semantics",
+        "Streamable HTTP remote MCP shape"
+      ],
+      "reject": [
+        "hosted relay dependency",
+        "online status without end-to-end reachability proof",
+        "remote authority mirroring local user permissions without DEADBYTE policy"
+      ]
+    },
+    {
+      "id": "desktop-commander-skills",
+      "url": "https://github.com/desktop-commander/skills",
+      "license": "repository-specific",
+      "source_available": true,
+      "use": "format-and-workflow-reference",
+      "adopt": [
+        "SKILL.md progressive disclosure",
+        "small metadata-first catalog",
+        "references/scripts separation"
+      ],
+      "extend": [
+        "content-addressed manifest",
+        "declared capability requirements",
+        "declared authority planes",
+        "resource hashes",
+        "provenance",
+        "cryptographic verification"
+      ],
+      "reject": [
+        "skill text as authority",
+        "skill-triggered self-arming"
+      ]
+    },
+    {
+      "id": "codex-app-server-provider",
+      "requested_url": "https://github.com/wonderwhy-er/ai-sdk-provider-codex-app-server",
+      "corroborating_public_url": "https://github.com/pablof7z/ai-sdk-provider-codex-app-server",
+      "license": "MIT on corroborating implementation",
+      "use": "agent-backend-contract-reference",
+      "adopt": [
+        "persistent JSON-RPC process",
+        "persistent/stateless thread modes",
+        "mid-execution message injection",
+        "interrupt",
+        "server-initiated request handling",
+        "model discovery"
+      ],
+      "reject": [
+        "auto-approval as authority",
+        "danger-full-access default",
+        "provider-owned permission semantics overriding DEADBYTE authority"
+      ]
+    }
+  ],
+  "adversarial_acceptance": [
+    "rotated credentials persist atomically before old credentials become unusable",
+    "registered is not reachable: online requires verified transport readiness and request acknowledgement",
+    "remote requests are idempotently identified and cannot disappear silently without a terminal transport result",
+    "shared state files commit by atomic rename and readers never accept truncated JSON",
+    "persistent jobs declare ownership and survive only under an explicit external supervisor contract",
+    "skills cannot widen or arm authority and every loaded byte is hash-bound",
+    "agent backend threads survive controller recreation through durable thread identity without granting new authority"
+  ]
+}

package/R44-PARENT.json

@@ -0,0 +1,18 @@
+{
+  "schema": "deadbyte.r44-parent.v1",
+  "parent_release_id": "v0.14.1-0a5a833892593283",
+  "parent_version": "0.14.1",
+  "parent_manifest_sha256": "0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9",
+  "parent_manifest_file_count": 1834,
+  "parent_release_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\releases\\v0.14.1-0a5a833892593283",
+  "parent_generation_manifest_sha256": "fcfcb5a47d55039b7bb5d42faa0739b57b13d8a420d4418ae09d96d2862967cb",
+  "parent_generation_file_count": 7,
+  "parent_generation_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\generations\\v0.14.1-0a5a833892593283-ga2198d593efd75bd",
+  "parent_launcher_sha256": "e054796810c3d7be99ff3036e7427c5b75cfd823ea82808edcd28e928252e37e",
+  "parent_final_closure_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\release\\r43-final-0a5a833892593283.json",
+  "parent_final_closure_file_sha256": "f24100212b55d2016ea9c4ff47df5f026c8edc0b9b8643933ed8bf26fde3803f",
+  "parent_final_closure_sha256": "2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b",
+  "parent_final_closure_signer_key_id": "c0727a7911e29a0f1edd3cd910e47f89f43edb484743988c89cd82bfd5e37936",
+  "parent_proof": "immutable-slot+generation+signed-final-closure",
+  "development_root": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev"
+}

package/R45-PARENT.json

@@ -0,0 +1,18 @@
+{
+  "schema": "deadbyte.r45-parent.v1",
+  "parent_release_id": "v0.15.0-c15fa41719be61b3",
+  "parent_version": "0.15.0",
+  "parent_manifest_sha256": "c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483",
+  "parent_manifest_file_count": 1871,
+  "parent_generation_manifest_sha256": "6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30",
+  "parent_generation_file_count": 7,
+  "parent_final_closure_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\release\\r44-final-c15fa41719be61b3.json",
+  "parent_final_closure_file_sha256": "8aa9c31ab18dfde67275d7cd59295ba08099839d35d6c97ee277fb184c05cae0",
+  "parent_final_closure_sha256": "533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667",
+  "parent_final_closure_signer_key_id": "c0727a7911e29a0f1edd3cd910e47f89f43edb484743988c89cd82bfd5e37936",
+  "parent_release_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\releases\\v0.15.0-c15fa41719be61b3",
+  "parent_generation_root": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\generations\\v0.15.0-c15fa41719be61b3-g85724aec91800ce8",
+  "parent_launcher_sha256": "e054796810c3d7be99ff3036e7427c5b75cfd823ea82808edcd28e928252e37e",
+  "development_root": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev",
+  "parent_proof": "immutable-slot+generation+signed-final-closure"
+}

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.14.0 / R42 AGENTIC GOVERNANCE BASELINE
+DEADBYTE MCP V0.15.1 / R45 MACHINE FREEDOM FINAL BASELINE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.14.0 mcp
-  npx deadbyte-mcp@latest remote
-  npx deadbyte-mcp@latest remote status
-  npx deadbyte-mcp@latest remote restart
-  npx deadbyte-mcp@latest audit status
-  npx deadbyte-mcp@latest audit verify
+  npx -y deadbyte-mcp@0.15.1 mcp
+  npx -y deadbyte-mcp@0.15.1 remote
+  npx -y deadbyte-mcp@0.15.1 remote status
+  npx -y deadbyte-mcp@0.15.1 remote restart
+  npx -y deadbyte-mcp@0.15.1 audit status
+  npx -y deadbyte-mcp@0.15.1 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -213,7 +213,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx deadbyte-mcp@latest remote
+  npx -y deadbyte-mcp@0.15.1 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -274,7 +274,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.11.3 mcp
+  npx -y deadbyte-mcp@0.15.1 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -283,7 +283,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.11.3", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.1", "mcp"]
       }
     }
   }
@@ -296,7 +296,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.11.3", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.1", "mcp"]
       }
     }
   }
@@ -309,7 +309,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.11.3", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.1", "mcp"]
       }
     }
   }
@@ -319,9 +319,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.11.3", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.1", "mcp"]
 
-The remote device path remains `npx deadbyte-mcp@latest remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.1 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 
@@ -399,3 +399,8 @@ hosted convenience on one side; self-owned release/evidence authority on the oth
 NO RAW SHELL COMMAND STRING. NO CALLER-SELECTED EXECUTABLE. CODING AND AUTONOMOUS
 EXECUTION REQUIRE EXPLICIT LOCAL STANDING GRANTS. REPORTS ARE CLAIMS; VERIFIED
 OBSERVATIONS AND SIGNED EVIDENCE ARE AUTHORITY.
+
+
+R44 REMOTE AGENT / SKILL / DURABLE JOB
+---------------------------------------
+R44 keeps the R43 authority model and adds one read-only public skill_catalog, bringing the compact/full surfaces to exact 43/81. Skills are Ed25519/content-addressed and cannot arm authority. The optional codex_app_server planner is executable-hash pinned, uses approvalPolicy=never and read-only sandbox defaults, persists thread identity, and fails closed on interrupted requests. Remote devices require Ed25519 identity, epoch, verified reachability, local capability authorization, durable request IDs and terminal acknowledgement. Persistent jobs require the external supervisor and exact process identity.

package/RELEASE.json

@@ -0,0 +1,37 @@
+{
+  "schema": "deadbyte.release.v1",
+  "name": "deadbyte-mcp",
+  "version": "0.15.1",
+  "train": "R45",
+  "label": "MACHINE FREEDOM FINAL BASELINE",
+  "protocol_revision": "2026-07-28",
+  "parent": {
+    "release_id": "v0.15.0-c15fa41719be61b3",
+    "manifest_sha256": "c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483",
+    "generation_manifest_sha256": "6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30",
+    "final_closure_sha256": "533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667"
+  },
+  "platform": {
+    "primary": "win32",
+    "architectures": [
+      "x64"
+    ]
+  },
+  "capabilities": {
+    "host_execution_modes": [
+      "script",
+      "inline",
+      "native"
+    ],
+    "hardware_queries": [
+      "cpu",
+      "gpu",
+      "memory",
+      "storage",
+      "network",
+      "pci"
+    ],
+    "compact_tool_count": 43,
+    "full_tool_count": 82
+  }
+}

package/SBOM.cdx.json

@@ -0,0 +1,46 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:deadbyte-mcp-r45-0-15-1",
+  "version": 1,
+  "metadata": {
+    "component": {
+      "type": "application",
+      "name": "deadbyte-mcp",
+      "version": "0.15.1"
+    }
+  },
+  "components": [
+    {
+      "type": "library",
+      "name": "@modelcontextprotocol/client",
+      "version": "2.0.0"
+    },
+    {
+      "type": "library",
+      "name": "@modelcontextprotocol/server",
+      "version": "2.0.0"
+    },
+    {
+      "type": "library",
+      "name": "typescript",
+      "version": "5.9.3"
+    },
+    {
+      "type": "library",
+      "name": "zod",
+      "version": "4.4.3"
+    },
+    {
+      "type": "file",
+      "name": "deadbyte-hardware-observer-r45.exe",
+      "version": "0.15.1",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "46bcd3768bb95f8c63fc3118e031efc2818a92929611cabf6c3b29c5162a6591"
+        }
+      ]
+    }
+  ]
+}

package/TEST-MATRIX.json

@@ -0,0 +1,31 @@
+{
+  "schema": "deadbyte.test-matrix.v1",
+  "version": "0.15.1",
+  "primary_platform": "win32-x64",
+  "required": [
+    {
+      "id": "parent-chain",
+      "command": "npm run r45:parent:verify",
+      "expected": "PASS"
+    },
+    {
+      "id": "machine-freedom",
+      "command": "node --test test/host-inline-r45.test.mjs test/hardware-observation-r45.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "full-regression",
+      "command": "npm run r45:full:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "windows-gate",
+      "command": "npm run gate:windows",
+      "expected": "PASS"
+    }
+  ],
+  "non_win32": {
+    "portable_tests": "supported where platform-independent",
+    "windows_native_tests": "SKIP/unsupported"
+  }
+}

package/controller/README.TXT

@@ -1,18 +1,18 @@
-DEADBYTE MCP V0.14.0 / R42 CONTROLLER
+DEADBYTE MCP V0.15.1 / R45 CONTROLLER
 ====================================
 
 ENTRY POINT
 -----------
 Primary operator entry point:
 
-  npx deadbyte-mcp@latest remote
+  npx -y deadbyte-mcp@0.15.1 remote
 
 Bare `remote` is a foreground device session. It starts the verified runtime, arms process,
 coding, and autonomous authority, verifies those three planes are ARMED, and requires Desktop and Host
 to stay DISARMED. R40 Desktop observation/UIA grounding remains available read-only; GUI mutation needs
 the separate explicit Desktop standing grant and Autonomous authority cannot substitute for it.
-The production Bridge uses the compact capability profile (exact 42 tools / 6 gateways) while local
-stdio MCP keeps the exact full 80-tool profile. The compact console shows request-before-result
+The production Bridge uses the compact capability profile (exact 43 tools / 6 gateways) while local
+stdio MCP keeps the exact full 81-tool profile. The compact console shows request-before-result
 Live Activity without raw SHA text, request IDs, payload JSON, or duplicate Bridge stdout by
 default; use `remote --verbose` for the detailed audit/runtime stream. Ctrl+C/SIGTERM or foreground
 input closure revokes Desktop/process/coding/autonomous authority, applies fail-safe Host disarm, and parks
@@ -101,8 +101,7 @@ policy digests and profile hashes to the explicit mutable development root; the
   autonomoustest     run the R37 compact public capability-closure MRTR production gate
 
 disarmcoding also revokes autonomous authority. No MCP tool creates or widens either
-grant. With an openai_compatible planner the MCP server starts a background supervisor;
-client_sampling uses the connected MCP client's model with durable resume state.
+grant. Provider-backed planners (openai_compatible, openai_responses, or hash-pinned codex_app_server) use the background supervisor; client_sampling uses the connected MCP client's model with durable resume state.
 
 R27 IMMUTABLE SLOT UPDATE
 -------------------------

package/controller/deadbyte-controller.ps1

@@ -787,7 +787,7 @@ function Get-HostPolicyMetadata($Cfg) {
     if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
     $policyPath = [string]$Cfg.HostPolicyFile
     try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid host policy JSON: $policyPath" }
-    if ($policy.schema -ne 'deadbyte.host-policy.v1' -or $policy.enabled -ne $true) { Fail 'host policy schema/enabled mismatch' }
+    if (@('deadbyte.host-policy.v1','deadbyte.host-policy.v2') -notcontains [string]$policy.schema -or $policy.enabled -ne $true) { Fail 'host policy schema/enabled mismatch' }
     if ([string]::IsNullOrWhiteSpace([string]$policy.arm_file)) { Fail 'host policy arm_file missing' }
     $armFile = [System.IO.Path]::GetFullPath([string]$policy.arm_file)
     $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
@@ -1336,7 +1336,7 @@ while ($true) {
     Clear-Host
     $cfg = Get-Config
     Assert-ControllerRootBound $cfg
-    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.14.0 / R42'
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.15.1 / R45'
     Write-Host '======================================'
     Show-State $cfg | Out-Null
     Write-Host ''

package/docs/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# DEADBYTE MCP V0.14.0 / R42 ARCHITECTURE
+# DEADBYTE MCP V0.15.1 / R45 ARCHITECTURE
 
 ```mermaid
 flowchart TD
@@ -180,3 +180,10 @@ The controller defaults `MachineRuntimeEnabled` on, forwards it only to the Brid
 non-mutating `machinetest` public HTTPS gate. That gate cross-checks status/list, derives machine_id
 from public SPKI, issues a random nonce, and verifies the Ed25519 signature without target-local key
 access. See `V085-R29-MACHINE-IDENTITY.md`.
+
+
+## R44 remote-agent and skill boundary
+
+R44 adds one read-only public `skill_catalog`, making the current full/compact catalogs exactly 81/43 while sealed R43 remains 80/42. Skill manifests are Ed25519-authenticated, content-addressed closed-world resource sets; skill content is never authority.
+
+The Agent Backend commits pending requests before send and classifies unresolved restart work as interrupted. The Codex app-server adapter binds current thread/turn identities, defaults approvals to never and sandbox to read-only, and persists logical thread identity. Remote Device routing requires Ed25519 SPKI + epoch, verified reachability, local capability authorization, stable request identity and terminal state. Only the external Durable Job supervisor may own persistent jobs; reattachment requires exact handle, PID, creation identity and profile.

package/docs/R44-ARCHITECTURE.md

@@ -0,0 +1,37 @@
+# DEADBYTE MCP R44 Architecture
+
+R44 / V0.15.0 is the remote-agent-and-skill successor to sealed R43 `v0.14.1-0a5a833892593283`. R43 is immutable parent authority.
+
+## Decision
+
+R44 keeps DEADBYTE authority, evidence, release slots, typed tools, hash preconditions, signed journals, rollback and all-disarmed closure as the foundation. External projects are donors and failure corpora, never authority.
+
+## New planes
+
+### Skill Plane
+
+Metadata-first progressive disclosure. A catalog entry exposes only name, version, description, capability requirements and authority declarations. Loading a skill verifies a content-addressed manifest, every declared resource hash, provenance, and Ed25519 attestation before returning instructions. Skill text cannot arm or renew Process, Coding, Autonomous, Desktop or Host.
+
+### Agent Backend Plane
+
+A persistent JSON-RPC process contract for Codex app-server style providers. Session identity is durable and explicit. Threads support resume, bounded injection and interrupt. Server-initiated approval requests are translated into DEADBYTE policy/consent checks; provider auto-approval never widens authority.
+
+### Remote Device Plane
+
+Device identity is a public-key identity plus epoch, not a display name. Pairing and AI-client authorization are separate. OAuth2/PKCE and device authorization may establish authentication, but a remote call is executable only when the local device reports a verified ready transport and the requested DEADBYTE capability is locally authorized. Delivery uses stable request IDs and terminal acknowledgement states.
+
+### Durable Job Supervisor
+
+Every job declares one lifetime: controller-owned, session-owned, or persistent. Persistent means an out-of-process supervisor owns execution, durable status/log identity exists, and restart recovery proves the same job identity. A timeout is never silently rebranded as persistence.
+
+## R44 hard rules
+
+- R43 release slot and final evidence are read-only.
+- No external donor may add raw shell/PID/stdin/environment authority to the public surface.
+- No skill, remote relay, provider, model, or client can arm a DEADBYTE authority plane.
+- Shared JSON state is atomic temp+fsync+rename; corrupted/truncated state fails closed.
+- Online/reachable are distinct states; only reachable may accept routed work.
+- Remote calls have stable IDs, replay classification, acknowledgement and terminal result/error.
+- Credential rotation is persisted atomically before the superseded credential is discarded.
+- All new public tools have strict input and output schemas.
+- R44 Final requires exact R43 parent proof, full regression, restart/recovery adversarial tests, remote/skill/backend gates, reversible activation, exact R43 rollback, same-slot R44 restore, and signed all-disarmed closure.