deadbyte-mcp 0.14.0 → 0.15.1

package/native/deadbyte-hardware-observer.cpp

@@ -0,0 +1,308 @@
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <windows.h>
+#include <iphlpapi.h>
+#include <setupapi.h>
+#include <intrin.h>
+#include <stdint.h>
+
+#include <algorithm>
+#include <array>
+#include <cstring>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#pragma comment(lib, "iphlpapi.lib")
+#pragma comment(lib, "setupapi.lib")
+#pragma comment(lib, "user32.lib")
+
+static std::string utf8(const wchar_t* text) {
+    if (!text || !*text) return {};
+    const int needed = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, text, -1, nullptr, 0, nullptr, nullptr);
+    if (needed <= 1) return {};
+    std::string out(static_cast<size_t>(needed - 1), '\0');
+    if (WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, text, -1, out.data(), needed, nullptr, nullptr) == 0) return {};
+    return out;
+}
+
+static std::string json_escape(const std::string& value) {
+    std::ostringstream out;
+    for (const unsigned char ch : value) {
+        switch (ch) {
+            case '"': out << "\\\""; break;
+            case '\\': out << "\\\\"; break;
+            case '\b': out << "\\b"; break;
+            case '\f': out << "\\f"; break;
+            case '\n': out << "\\n"; break;
+            case '\r': out << "\\r"; break;
+            case '\t': out << "\\t"; break;
+            default:
+                if (ch < 0x20U) {
+                    const char hex[] = "0123456789abcdef";
+                    out << "\\u00" << hex[(ch >> 4U) & 0x0fU] << hex[ch & 0x0fU];
+                } else {
+                    out << static_cast<char>(ch);
+                }
+        }
+    }
+    return out.str();
+}
+
+static std::string quote(const std::string& value) {
+    return std::string("\"") + json_escape(value) + "\"";
+}
+
+static std::string trim_ascii(std::string value) {
+    while (!value.empty() && (value.back() == '\0' || value.back() == ' ')) value.pop_back();
+    size_t first = 0;
+    while (first < value.size() && value[first] == ' ') ++first;
+    return value.substr(first);
+}
+
+static std::string cpu_json() {
+    int regs[4] = {};
+    __cpuid(regs, 0);
+    const unsigned int max_basic = static_cast<unsigned int>(regs[0]);
+    std::array<char, 13> vendor{};
+    std::memcpy(vendor.data() + 0, &regs[1], 4);
+    std::memcpy(vendor.data() + 4, &regs[3], 4);
+    std::memcpy(vendor.data() + 8, &regs[2], 4);
+
+    __cpuid(regs, static_cast<int>(0x80000000U));
+    const unsigned int max_ext = static_cast<unsigned int>(regs[0]);
+    std::array<char, 49> brand{};
+    if (max_ext >= 0x80000004U) {
+        for (unsigned int leaf = 0; leaf < 3U; ++leaf) {
+            __cpuid(regs, static_cast<int>(0x80000002U + leaf));
+            std::memcpy(brand.data() + (leaf * 16U), regs, 16);
+        }
+    }
+
+    unsigned int family = 0U, model = 0U, stepping = 0U;
+    if (max_basic >= 1U) {
+        __cpuid(regs, 1);
+        const unsigned int eax = static_cast<unsigned int>(regs[0]);
+        stepping = eax & 0x0fU;
+        unsigned int base_model = (eax >> 4U) & 0x0fU;
+        unsigned int base_family = (eax >> 8U) & 0x0fU;
+        const unsigned int ext_model = (eax >> 16U) & 0x0fU;
+        const unsigned int ext_family = (eax >> 20U) & 0xffU;
+        family = base_family == 0x0fU ? base_family + ext_family : base_family;
+        model = (base_family == 0x06U || base_family == 0x0fU) ? (ext_model << 4U) | base_model : base_model;
+    }
+
+    std::ostringstream out;
+    out << "{\"vendor\":" << quote(vendor.data())
+        << ",\"brand\":" << quote(trim_ascii(brand.data()))
+        << ",\"family\":" << family
+        << ",\"model\":" << model
+        << ",\"stepping\":" << stepping
+        << ",\"logical_processors\":" << GetActiveProcessorCount(ALL_PROCESSOR_GROUPS)
+        << ",\"processor_groups\":" << GetActiveProcessorGroupCount()
+        << "}";
+    return out.str();
+}
+
+static std::string memory_json() {
+    MEMORYSTATUSEX ms{};
+    ms.dwLength = sizeof(ms);
+    if (!GlobalMemoryStatusEx(&ms)) throw std::runtime_error("GlobalMemoryStatusEx failed");
+    std::ostringstream out;
+    out << "{\"memory_load_pct\":" << ms.dwMemoryLoad
+        << ",\"total_physical_bytes\":" << ms.ullTotalPhys
+        << ",\"available_physical_bytes\":" << ms.ullAvailPhys
+        << ",\"total_pagefile_bytes\":" << ms.ullTotalPageFile
+        << ",\"available_pagefile_bytes\":" << ms.ullAvailPageFile
+        << ",\"total_virtual_bytes\":" << ms.ullTotalVirtual
+        << ",\"available_virtual_bytes\":" << ms.ullAvailVirtual
+        << "}";
+    return out.str();
+}
+
+static std::string drive_type_name(UINT type) {
+    switch (type) {
+        case DRIVE_REMOVABLE: return "removable";
+        case DRIVE_FIXED: return "fixed";
+        case DRIVE_REMOTE: return "remote";
+        case DRIVE_CDROM: return "cdrom";
+        case DRIVE_RAMDISK: return "ramdisk";
+        default: return "unknown";
+    }
+}
+
+static std::string storage_json() {
+    const DWORD needed = GetLogicalDriveStringsW(0, nullptr);
+    if (needed == 0) throw std::runtime_error("GetLogicalDriveStringsW size failed");
+    std::vector<wchar_t> buffer(static_cast<size_t>(needed) + 2U, L'\0');
+    if (GetLogicalDriveStringsW(needed + 1U, buffer.data()) == 0) throw std::runtime_error("GetLogicalDriveStringsW failed");
+
+    std::ostringstream out;
+    out << "{\"drives\":[";
+    bool first = true;
+    for (const wchar_t* root = buffer.data(); *root; root += wcslen(root) + 1U) {
+        ULARGE_INTEGER available{}, total{}, free_bytes{};
+        const BOOL space_ok = GetDiskFreeSpaceExW(root, &available, &total, &free_bytes);
+        wchar_t volume_name[MAX_PATH + 1] = {};
+        wchar_t filesystem[MAX_PATH + 1] = {};
+        DWORD serial = 0, max_component = 0, flags = 0;
+        const BOOL volume_ok = GetVolumeInformationW(root, volume_name, MAX_PATH, &serial, &max_component, &flags, filesystem, MAX_PATH);
+        if (!first) out << ',';
+        first = false;
+        out << "{\"root\":" << quote(utf8(root))
+            << ",\"type\":" << quote(drive_type_name(GetDriveTypeW(root)))
+            << ",\"volume\":" << quote(volume_ok ? utf8(volume_name) : std::string())
+            << ",\"filesystem\":" << quote(volume_ok ? utf8(filesystem) : std::string())
+            << ",\"serial\":" << (volume_ok ? serial : 0U)
+            << ",\"total_bytes\":" << (space_ok ? total.QuadPart : 0ULL)
+            << ",\"free_bytes\":" << (space_ok ? free_bytes.QuadPart : 0ULL)
+            << ",\"available_bytes\":" << (space_ok ? available.QuadPart : 0ULL)
+            << "}";
+    }
+    out << "]}";
+    return out.str();
+}
+
+static std::string mac_hex(const BYTE* bytes, ULONG length) {
+    static const char hex[] = "0123456789abcdef";
+    std::string out;
+    for (ULONG i = 0; i < length; ++i) {
+        if (i) out.push_back(':');
+        out.push_back(hex[(bytes[i] >> 4U) & 0x0fU]);
+        out.push_back(hex[bytes[i] & 0x0fU]);
+    }
+    return out;
+}
+
+static std::string network_json() {
+    ULONG size = 0;
+    DWORD rc = GetAdaptersAddresses(AF_UNSPEC, GAA_FLAG_INCLUDE_PREFIX, nullptr, nullptr, &size);
+    if (rc != ERROR_BUFFER_OVERFLOW) throw std::runtime_error("GetAdaptersAddresses size failed");
+    std::vector<unsigned char> storage(size);
+    auto* head = reinterpret_cast<IP_ADAPTER_ADDRESSES*>(storage.data());
+    rc = GetAdaptersAddresses(AF_UNSPEC, GAA_FLAG_INCLUDE_PREFIX, nullptr, head, &size);
+    if (rc != NO_ERROR) throw std::runtime_error("GetAdaptersAddresses failed");
+
+    std::ostringstream out;
+    out << "{\"adapters\":[";
+    bool first = true;
+    for (auto* item = head; item; item = item->Next) {
+        if (!first) out << ',';
+        first = false;
+        out << "{\"name\":" << quote(item->AdapterName ? item->AdapterName : "")
+            << ",\"friendly_name\":" << quote(utf8(item->FriendlyName))
+            << ",\"description\":" << quote(utf8(item->Description))
+            << ",\"if_index\":" << item->IfIndex
+            << ",\"ipv6_if_index\":" << item->Ipv6IfIndex
+            << ",\"mtu\":" << item->Mtu
+            << ",\"oper_status\":" << static_cast<unsigned long>(item->OperStatus)
+            << ",\"physical_address\":" << quote(mac_hex(item->PhysicalAddress, item->PhysicalAddressLength))
+            << "}";
+    }
+    out << "]}";
+    return out.str();
+}
+
+static std::string gpu_json() {
+    std::ostringstream out;
+    out << "{\"devices\":[";
+    bool first = true;
+    for (DWORD index = 0;; ++index) {
+        DISPLAY_DEVICEW dd{};
+        dd.cb = sizeof(dd);
+        if (!EnumDisplayDevicesW(nullptr, index, &dd, 0)) break;
+        if (!first) out << ',';
+        first = false;
+        out << "{\"device_name\":" << quote(utf8(dd.DeviceName))
+            << ",\"device_string\":" << quote(utf8(dd.DeviceString))
+            << ",\"device_id\":" << quote(utf8(dd.DeviceID))
+            << ",\"device_key\":" << quote(utf8(dd.DeviceKey))
+            << ",\"state_flags\":" << dd.StateFlags
+            << "}";
+    }
+    out << "]}";
+    return out.str();
+}
+
+static std::string get_device_property(HDEVINFO info, SP_DEVINFO_DATA& data, DWORD property) {
+    DWORD type = 0, required = 0;
+    SetupDiGetDeviceRegistryPropertyW(info, &data, property, &type, nullptr, 0, &required);
+    if (required == 0) return {};
+    std::vector<BYTE> bytes(required + sizeof(wchar_t), 0);
+    if (!SetupDiGetDeviceRegistryPropertyW(info, &data, property, &type, bytes.data(), static_cast<DWORD>(bytes.size()), nullptr)) return {};
+    return utf8(reinterpret_cast<const wchar_t*>(bytes.data()));
+}
+
+static std::string get_instance_id(HDEVINFO info, SP_DEVINFO_DATA& data) {
+    DWORD required = 0;
+    SetupDiGetDeviceInstanceIdW(info, &data, nullptr, 0, &required);
+    if (required == 0) return {};
+    std::vector<wchar_t> buffer(static_cast<size_t>(required) + 1U, L'\0');
+    if (!SetupDiGetDeviceInstanceIdW(info, &data, buffer.data(), static_cast<DWORD>(buffer.size()), nullptr)) return {};
+    return utf8(buffer.data());
+}
+
+static std::string pci_json() {
+    HDEVINFO info = SetupDiGetClassDevsW(nullptr, L"PCI", nullptr, DIGCF_ALLCLASSES | DIGCF_PRESENT);
+    if (info == INVALID_HANDLE_VALUE) throw std::runtime_error("SetupDiGetClassDevsW PCI failed");
+
+    std::ostringstream out;
+    out << "{\"devices\":[";
+    bool first = true;
+    for (DWORD index = 0;; ++index) {
+        SP_DEVINFO_DATA data{};
+        data.cbSize = sizeof(data);
+        if (!SetupDiEnumDeviceInfo(info, index, &data)) {
+            if (GetLastError() == ERROR_NO_MORE_ITEMS) break;
+            SetupDiDestroyDeviceInfoList(info);
+            throw std::runtime_error("SetupDiEnumDeviceInfo failed");
+        }
+        std::string name = get_device_property(info, data, SPDRP_FRIENDLYNAME);
+        if (name.empty()) name = get_device_property(info, data, SPDRP_DEVICEDESC);
+        const std::string hardware = get_device_property(info, data, SPDRP_HARDWAREID);
+        const std::string instance = get_instance_id(info, data);
+        if (!first) out << ',';
+        first = false;
+        out << "{\"name\":" << quote(name)
+            << ",\"hardware_id\":" << quote(hardware)
+            << ",\"instance_id\":" << quote(instance)
+            << "}";
+    }
+    SetupDiDestroyDeviceInfoList(info);
+    out << "]}";
+    return out.str();
+}
+
+static std::string build_data(const std::string& query) {
+    if (query == "cpu") return cpu_json();
+    if (query == "memory") return memory_json();
+    if (query == "storage") return storage_json();
+    if (query == "network") return network_json();
+    if (query == "gpu") return gpu_json();
+    if (query == "pci") return pci_json();
+    throw std::runtime_error("unsupported hardware query");
+}
+
+int wmain(int argc, wchar_t** argv) {
+    try {
+        if (argc == 2 && std::wstring(argv[1]) == L"--selftest") {
+            const std::string probe = cpu_json();
+            if (probe.empty()) return 3;
+            std::cout << "{\"status\":\"passed\",\"schema\":\"deadbyte.hardware-observer-selftest.v1\"}\n";
+            return 0;
+        }
+        if (argc != 2) {
+            std::cerr << "usage: deadbyte-hardware-observer-r45.exe <cpu|gpu|memory|storage|network|pci>\n";
+            return 2;
+        }
+        const std::string query = utf8(argv[1]);
+        const std::string data = build_data(query);
+        std::cout << "{\"schema\":\"deadbyte.hardware-query.v1\",\"query\":" << quote(query) << ",\"data\":" << data << "}\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "private": false,
   "type": "module",
-  "description": "Authenticated MCP agentic runtime with identity-bound task contracts, typed human clarification, bounded model providers, signed audit chains, immutable release slots, and separately revocable machine authority.",
+  "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
   "engines": {
     "node": ">=22"
   },
@@ -16,10 +16,10 @@
     "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
     "r42:eval": "node scripts/agent-eval-r42.mjs",
     "self-update:runtime": "node scripts/runtime-self-update.mjs",
-    "self-update:deferred": "node scripts/deferred-slot-operation-r42.mjs",
-    "release:parity": "node scripts/release-parity-r42.mjs",
-    "release:final:write": "node scripts/final-closure-r42.mjs",
-    "release:final:verify": "node scripts/final-closure-verify-r42.mjs",
+    "self-update:deferred": "node scripts/deferred-slot-operation-r45.mjs",
+    "release:parity": "node scripts/release-parity-r45.mjs",
+    "release:final:write": "node scripts/final-closure-r45.mjs",
+    "release:final:verify": "node scripts/final-closure-verify-r45.mjs",
     "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
     "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
     "trust:init": "node src/trust-init.mjs",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r42.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r45.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -53,7 +53,17 @@
     "audit:verify": "node src/deadbyte-cli.mjs audit verify",
     "audit:status": "node src/deadbyte-cli.mjs audit status",
     "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1"
+    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+    "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+    "r43:full:test": "node scripts/full-regression-r43.mjs",
+    "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+    "r44:full:test": "node scripts/full-regression-r44.mjs",
+    "finalize:r44": "node scripts/finalize-r44.mjs",
+    "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+    "doctor": "node src/deadbyte-cli.mjs doctor",
+    "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+    "r45:full:test": "node scripts/full-regression-r45.mjs",
+    "finalize:r45": "node scripts/finalize-r45.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/autonomous-tests.ps1

@@ -3,7 +3,7 @@ Set-StrictMode -Version 2.0
 $root = Split-Path -Parent $PSScriptRoot
 Push-Location $root
 try {
-    & npm.cmd test
-    if ($LASTEXITCODE -ne 0) { throw "npm test failed with exit code $LASTEXITCODE" }
+    & node.exe --test test/autonomous-live-fixture.test.mjs
+    if ($LASTEXITCODE -ne 0) { throw "autonomous fixture test failed with exit code $LASTEXITCODE" }
     Write-Output 'R24 QUICK TEST PASS'
 } finally { Pop-Location }

package/scripts/build-hardware-r45.ps1

@@ -0,0 +1,71 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+
+function Get-Sha256Hex {
+  param([Parameter(Mandatory=$true)][string]$Path)
+  $Stream=[System.IO.File]::OpenRead([System.IO.Path]::GetFullPath($Path))
+  try {
+    $Hasher=[System.Security.Cryptography.SHA256]::Create()
+    try { return ([System.BitConverter]::ToString($Hasher.ComputeHash($Stream))).Replace('-','').ToLowerInvariant() }
+    finally { $Hasher.Dispose() }
+  } finally { $Stream.Dispose() }
+}
+
+$Root=Split-Path -Parent $PSScriptRoot
+$Src=Join-Path $Root 'native\deadbyte-hardware-observer.cpp'
+$Bin=Join-Path $Root 'bin'
+$Exe=Join-Path $Bin 'deadbyte-hardware-observer-r45.exe'
+$Obj=Join-Path $Bin 'deadbyte-hardware-observer-r45.obj'
+New-Item -ItemType Directory -Force -Path $Bin | Out-Null
+
+$vswhere='C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe'
+if(-not (Test-Path -LiteralPath $vswhere)){throw 'vswhere.exe not found'}
+$install=(& $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath | Select-Object -First 1)
+if(-not $install){throw 'MSVC x64 C++ toolchain not found'}
+$dev=Join-Path $install 'Common7\Tools\VsDevCmd.bat'
+if(-not (Test-Path -LiteralPath $dev)){throw "VsDevCmd.bat missing: $dev"}
+$cmd=if($env:ComSpec){$env:ComSpec}else{Join-Path $env:SystemRoot 'System32\cmd.exe'}
+
+Remove-Item -Force -ErrorAction SilentlyContinue $Exe,$Obj
+$common='/nologo /std:c++17 /permissive- /W4 /WX /O2 /MT /EHsc /guard:cf /diagnostics:caret /FC /utf-8 /Brepro /DUNICODE /D_UNICODE /D_WIN32_WINNT=0x0A00 /DWINVER=0x0A00'
+$compile='cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" iphlpapi.lib setupapi.lib user32.lib /link /Brepro /INCREMENTAL:NO' -f $common,$Src,$Obj,$Exe
+$line='call "{0}" -no_logo -arch=x64 -host_arch=x64 && {1}' -f $dev,$compile
+$out=& $cmd /d /s /c $line 2>&1
+$exit=$LASTEXITCODE
+$out | ForEach-Object { Write-Host ([string]$_) }
+if($exit -ne 0){throw "hardware observer compile failed exit=$exit"}
+if(-not (Test-Path -LiteralPath $Exe -PathType Leaf)){throw 'hardware observer exe missing after compile'}
+
+$self=& $Exe --selftest 2>&1
+$selfExit=$LASTEXITCODE
+$self | ForEach-Object { Write-Host ([string]$_) }
+if($selfExit -ne 0){throw "hardware observer selftest failed exit=$selfExit"}
+if(-not (($self -join [Environment]::NewLine) -match '"status":"passed"')){throw 'hardware observer selftest did not report pass'}
+
+$queries=[ordered]@{}
+foreach($query in @('cpu','gpu','memory','storage','network','pci')){
+  $raw=& $Exe $query 2>&1
+  $queryExit=$LASTEXITCODE
+  if($queryExit -ne 0){throw "hardware query $query failed exit=$queryExit output=$($raw -join ' ')"}
+  $text=($raw -join [Environment]::NewLine)
+  $parsed=$text | ConvertFrom-Json
+  if($parsed.schema -ne 'deadbyte.hardware-query.v1' -or $parsed.query -ne $query){throw "hardware query $query contract mismatch"}
+  $queries[$query]=Get-Sha256Hex -Path $Exe
+}
+
+$depLine='call "{0}" -no_logo -arch=x64 -host_arch=x64 && dumpbin /nologo /dependents "{1}"' -f $dev,$Exe
+$deps=& $cmd /d /s /c $depLine 2>&1
+$depExit=$LASTEXITCODE
+$deps | ForEach-Object { Write-Host ([string]$_) }
+if($depExit -ne 0){throw "hardware observer dumpbin failed exit=$depExit"}
+
+[pscustomobject]@{
+  status='built'
+  source_sha256=Get-Sha256Hex -Path $Src
+  exe=$Exe
+  exe_sha256=Get-Sha256Hex -Path $Exe
+  obj_sha256=Get-Sha256Hex -Path $Obj
+  selftest=@($self | ForEach-Object {[string]$_})
+  queries=@($queries.Keys)
+  dependencies=@($deps | ForEach-Object {[string]$_})
+}|ConvertTo-Json -Depth 5

package/scripts/deferred-slot-operation-r43.mjs

@@ -0,0 +1,126 @@
+import { createHash, createPublicKey, randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { loadPowerShellDataFile, runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const RECEIPT_ID=/^r27-[A-Za-z0-9-]+$/;
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','deferred-slot-operations');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const atomicJson=async(file,value)=>{
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,`${JSON.stringify(value,null,2)}\n`,{flag:'wx'});
+  await import('node:fs/promises').then(fs=>fs.rename(temp,file));
+};
+function activationArgs(manifestSha){
+  if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.14.1',
+    '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
+    '--process-policy-sha256',null,'--desktop-policy',path.join(packageRoot,'controller','deadbyte-desktop-policy.json'),
+    '--desktop-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
+    '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor'];
+}
+async function bridgeBootstrapArgs(explicitBridgeRoot=null,explicitBridgeSha256=null){
+  const hasRoot=typeof explicitBridgeRoot==='string'&&explicitBridgeRoot.length>0;
+  const hasSha=typeof explicitBridgeSha256==='string'&&explicitBridgeSha256.length>0;
+  if(hasRoot!==hasSha) throw new Error('bridge override requires exact root + SHA pair');
+  let bridgeRootRaw,expectedSha256=null;
+  if(hasRoot){
+    if(!path.isAbsolute(explicitBridgeRoot)||!HEX64.test(explicitBridgeSha256)) throw new Error('bridge override requires exact root + SHA pair');
+    bridgeRootRaw=explicitBridgeRoot;expectedSha256=explicitBridgeSha256;
+  }else{
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    const config=await loadPowerShellDataFile(pointer.config_path);
+    bridgeRootRaw=config?.Bridge?.WorkingDirectory;
+    if(typeof bridgeRootRaw!=='string'||!path.isAbsolute(bridgeRootRaw)) throw new Error('active controller Bridge.WorkingDirectory must be absolute');
+  }
+  const bridgeRoot=await realpath(path.resolve(bridgeRootRaw));
+  const packageFile=path.join(bridgeRoot,'package.json');
+  const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
+  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
+  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('active Bridge package identity mismatch');
+  const scriptSha256=sha256(await readFile(bridgeScript));
+  if(expectedSha256&&scriptSha256!==expectedSha256) throw new Error('bridge override SHA-256 mismatch');
+  return ['--bridge-root',bridgeRoot,'--bridge-script-sha256',scriptSha256];
+}
+async function rollbackArgs(receiptPath){
+  const resolved=await realpath(path.resolve(receiptPath));
+  const allowed=path.join(stateRoot,'evidence','updates')+path.sep;
+  if(!resolved.startsWith(allowed)||path.basename(resolved).toLowerCase()!=='receipt.json'||!RECEIPT_ID.test(path.basename(path.dirname(resolved)))) {
+    throw new Error('rollback receipt must be one signed activation receipt under the update evidence store');
+  }
+  const envelope=JSON.parse(await readFile(resolved,'utf8'));
+  const publicKey=createPublicKey(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  if(!verifySlotUpdateEnvelope(envelope,publicKey)||envelope.body?.rollback_performed!==false) throw new Error('rollback activation receipt verification failed');
+  const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  if(pointer.release_id!==envelope.body?.active_pointer?.release_id||pointer.generation_root!==envelope.body?.active_pointer?.generation_root) {
+    throw new Error('rollback receipt does not identify the active release generation');
+  }
+  return ['--rollback-receipt',resolved];
+}
+async function normalizedArgs(mode,value,{explicitBridgeRoot=null,explicitBridgeSha256=null}={}){
+  if(mode==='activate'){
+    const args=activationArgs(value);
+    args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
+    args[args.indexOf('--desktop-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-desktop-policy.json')));
+    args[args.indexOf('--semantic-lsp-config-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json')));
+    args.push(...await bridgeBootstrapArgs(explicitBridgeRoot,explicitBridgeSha256));
+    return args;
+  }
+  if(mode==='rollback'){
+    if(explicitBridgeRoot||explicitBridgeSha256) throw new Error('rollback does not accept bridge override');
+    return rollbackArgs(value);
+  }
+  throw new Error("operation must be exactly 'activate' or 'rollback'");
+}
+const rawArgs=process.argv.slice(2);
+const mode=rawArgs[0],value=rawArgs[1];
+if(!value||!['activate','rollback'].includes(mode)) throw new Error('usage: deferred-slot-operation-r43.mjs <activate manifest_sha256|rollback activation_receipt> [--bridge-root ABS --bridge-script-sha256 HEX64]');
+let cursor=2,explicitBridgeRoot=null,explicitBridgeSha256=null;
+if(rawArgs[cursor]==='--bridge-root'){
+  explicitBridgeRoot=rawArgs[cursor+1]??null;
+  if(rawArgs[cursor+2]!=='--bridge-script-sha256') throw new Error('bridge override requires exact root + SHA pair');
+  explicitBridgeSha256=rawArgs[cursor+3]??null;cursor+=4;
+}
+let workerFlag=null,operationIdArg=null;
+if(rawArgs[cursor]==='--worker'){workerFlag='--worker';operationIdArg=rawArgs[cursor+1]??null;cursor+=2;}
+if(cursor!==rawArgs.length) throw new Error('deferred slot operation arguments invalid');
+if((explicitBridgeRoot===null)!==(explicitBridgeSha256===null)) throw new Error('bridge override requires exact root + SHA pair');
+if(mode==='rollback'&&(explicitBridgeRoot||explicitBridgeSha256)) throw new Error('rollback does not accept bridge override');
+if(workerFlag==='--worker'){
+  if(!/^[0-9a-f]{32}$/.test(operationIdArg??'')) throw new Error('deferred worker operation id invalid');
+  const statePath=path.join(evidenceRoot,`${operationIdArg}.json`);
+  await new Promise(resolve=>setTimeout(resolve,4000));
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  try{
+    const args=await normalizedArgs(mode,value,{explicitBridgeRoot,explicitBridgeSha256});
+    const result=await runSlotUpdateCli(args,{stateRoot});
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'completed',
+      completed_at_utc:new Date().toISOString(),receipt_path:result.receipt_path,receipt_sha256:result.receipt_sha256,
+      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  }catch(error){
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'failed',
+      completed_at_utc:new Date().toISOString(),error:String(error?.message??error),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+    process.exitCode=1;
+  }
+}else{
+  const operationId=randomBytes(16).toString('hex');
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  const workerArgs=[fileURLToPath(import.meta.url),mode,value];
+  if(explicitBridgeRoot) workerArgs.push('--bridge-root',explicitBridgeRoot,'--bridge-script-sha256',explicitBridgeSha256);
+  workerArgs.push('--worker',operationId);
+  const child=spawn(process.execPath,workerArgs,{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256}));
+}