deadbyte-mcp 0.14.0 → 0.15.1

package/scripts/finalize-r44.mjs

@@ -0,0 +1,217 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { lstat, mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { loadPowerShellDataFile, parseControllerStatus, runSlotUpdateCli, windowsPowerShellEnvironment } from '../src/runtime-update.mjs';
+import { verifyR44Parent } from './verify-r44-parent.mjs';
+import { runReleaseParity } from './release-parity-r44.mjs';
+import { writeFinalClosure } from './final-closure-r44.mjs';
+import { verifyFinalClosureObject } from './final-closure-verify-r44.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const EXPECTED_VERSION='0.15.0';
+const PARENT_RELEASE_ID='v0.14.1-0a5a833892593283';
+const PARENT_MANIFEST='0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9';
+const PARENT_FINAL_CLOSURE='2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b';
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','release','r44-finalization');
+const launcher=path.join(stateRoot,'bin','DEADBYTE-MCP.ps1');
+const ps=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+
+async function atomicJson(file,value){
+  await mkdir(path.dirname(file),{recursive:true});
+  const bytes=Buffer.from(`${JSON.stringify(value,null,2)}\n`,'utf8');
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,bytes,{flag:'wx'});
+  await rename(temp,file);
+  return {path:file,sha256:sha256(bytes)};
+}
+async function activePointer(){
+  return parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+}
+async function bridgeArgs(){
+  const pointer=await activePointer();
+  const config=await loadPowerShellDataFile(pointer.config_path);
+  const raw=config?.Bridge?.WorkingDirectory;
+  insist(typeof raw==='string'&&path.isAbsolute(raw),'active Bridge.WorkingDirectory must be absolute');
+  const root=await realpath(path.resolve(raw));
+  const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+  insist(pkg?.name==='deadbyte-chatgpt-bridge','active Bridge package identity mismatch');
+  const script=path.join(root,'src','bridge.mjs');
+  return ['--bridge-root',root,'--bridge-script-sha256',sha256(await readFile(script))];
+}
+async function activationArgs(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R44 finalizer manifest must be lowercase SHA-256');
+  const processPolicy=path.join(packageRoot,'controller','deadbyte-process-policy.json');
+  const desktopPolicy=path.join(packageRoot,'controller','deadbyte-desktop-policy.json');
+  const semantic=path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json');
+  return [
+    '--stage',packageRoot,'--development-root',packageRoot,'--expected-version',EXPECTED_VERSION,
+    '--expected-manifest',manifestSha256,
+    '--process-policy',processPolicy,'--process-policy-sha256',sha256(await readFile(processPolicy)),
+    '--desktop-policy',desktopPolicy,'--desktop-policy-sha256',sha256(await readFile(desktopPolicy)),
+    '--semantic-lsp-config',semantic,'--semantic-lsp-config-sha256',sha256(await readFile(semantic)),
+    '--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor',
+    '--restore-standing-grants',
+    ...await bridgeArgs()
+  ];
+}
+export function validateFinalizerAuthorityStatus(status){
+  insist(status?.process_armed===true,'R44 finalizer requires Process standing grant');
+  insist(status?.coding_armed===true,'R44 finalizer requires Coding standing grant');
+  insist(status?.autonomous_armed===true,'R44 finalizer requires Autonomous standing grant');
+  insist(status?.desktop_armed===false,'R44 finalizer requires Desktop DISARMED');
+  insist(status?.host_armed===false,'R44 finalizer requires Host DISARMED');
+  return true;
+}
+function currentAuthorityStatus(){
+  const result=spawnSync(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status'],
+    {encoding:'utf8',windowsHide:true,timeout:20000,env:windowsPowerShellEnvironment()});
+  if(result.error) throw result.error;
+  if(result.status!==0) throw new Error(`R44 finalizer controller status failed: ${result.stderr||result.stdout}`);
+  return parseControllerStatus(result.stdout??'');
+}
+export function validateWindowsGateEvidence(value,manifestSha256,parent){
+  insist(value?.schema==='deadbyte.r44-windows-gate.v1'&&value.status==='passed'&&value.exit_code===0,'R44 Windows gate evidence invalid');
+  insist(value.version===EXPECTED_VERSION&&value.manifest_sha256===manifestSha256,'R44 Windows gate candidate mismatch');
+  insist(value.marker==='DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS','R44 Windows gate marker mismatch');
+  insist(value.parent?.release_id===parent.release_id&&value.parent?.manifest_sha256===parent.manifest_sha256,'R44 Windows gate parent mismatch');
+  insist(value.parent?.generation_manifest_sha256===parent.generation_manifest_sha256,'R44 Windows gate parent generation mismatch');
+  insist(value.parent?.final_closure_sha256===PARENT_FINAL_CLOSURE&&value.parent?.final_closure_sha256===parent.closure_sha256,'R44 Windows gate parent final closure mismatch');
+  for(const key of ['skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke','full_regression_required']) {
+    insist(value.features?.[key]===true,`R44 Windows gate feature contract missing ${key}`);
+  }
+  return true;
+}
+function disarmFailClosed(){
+  const results=[];
+  for(const command of ['disarmdesktop','disarmautonomous','disarmcoding','disarmprocess','disarmhost']){
+    const result=spawnSync(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],
+      {encoding:'utf8',windowsHide:true,timeout:20000,env:windowsPowerShellEnvironment()});
+    results.push({command,status:result.status,signal:result.signal??null});
+  }
+  return results;
+}
+async function mirrorRoot(){
+  const pointer=await activePointer();
+  const policy=JSON.parse(await readFile(path.join(pointer.generation_root,'coding-policy.json'),'utf8'));
+  const raw=policy?.roots?.parity_scratch?.path??policy?.roots?.parity_scratch?.real_path;
+  if(typeof raw!=='string'||!path.isAbsolute(raw)) throw new Error('active generation parity_scratch root unavailable');
+  const stat=await lstat(raw);
+  if(!stat.isDirectory()||stat.isSymbolicLink()) throw new Error('parity_scratch root must be a real directory');
+  return raw;
+}
+async function writeMirror(manifestSha256,value){
+  const root=await mirrorRoot();
+  const file=path.join(root,`r44-final-${manifestSha256.slice(0,16)}.json`);
+  return atomicJson(file,value);
+}
+async function verifyInputs(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R44 finalizer manifest invalid');
+  const manifestBytes=await readFile(path.join(packageRoot,'MANIFEST.SHA256'));
+  insist(sha256(manifestBytes)===manifestSha256,'R44 finalizer manifest drift');
+  const pkg=JSON.parse(await readFile(path.join(packageRoot,'package.json'),'utf8'));
+  insist(pkg?.name==='deadbyte-mcp'&&pkg?.version===EXPECTED_VERSION,'R44 finalizer package identity mismatch');
+  const parent=await verifyR44Parent(path.join(packageRoot,'R44-PARENT.json'));
+  const authorityStatus=currentAuthorityStatus();
+  validateFinalizerAuthorityStatus(authorityStatus);
+  const before=await activePointer();
+  insist(before.release_id===PARENT_RELEASE_ID&&before.manifest_sha256===PARENT_MANIFEST,'R44 finalizer must start from exact sealed R43 parent');
+  const windowsGatePath=path.join(stateRoot,'evidence','release',`r44-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  const windowsGateBytes=await readFile(windowsGatePath);
+  const windowsGate=JSON.parse(windowsGateBytes.toString('utf8').replace(/^\uFEFF/,''));
+  validateWindowsGateEvidence(windowsGate,manifestSha256,parent);
+  return {parent,before,authorityStatus,windowsGatePath,windowsGateFileSha256:sha256(windowsGateBytes)};
+}
+async function runWorker(manifestSha256,operationId){
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  let activation=null;
+  let parity=null;
+  try{
+    await atomicJson(statePath,{schema:'deadbyte.r44-finalization-state.v1',operation_id:operationId,status:'running',
+      manifest_sha256:manifestSha256,started_at_utc:new Date().toISOString()});
+    const inputs=await verifyInputs(manifestSha256);
+    activation=await runSlotUpdateCli(await activationArgs(manifestSha256),{stateRoot});
+    insist(activation?.pointer?.version===EXPECTED_VERSION&&activation.pointer.manifest_sha256===manifestSha256,'R44 activation result mismatch');
+    insist(activation?.final_authority?.process_armed===true&&activation?.final_authority?.coding_armed===true&&activation?.final_authority?.autonomous_armed===true,
+      'R44 activation must restore prior Process+Coding+Autonomous standing grants for detached parity');
+    insist(activation?.final_authority?.desktop_armed===false&&activation?.final_authority?.host_armed===false,
+      'R44 activation must keep Desktop+Host disarmed');
+
+    parity=await runReleaseParity(activation.receipt_path);
+    insist(parity?.evidence?.status==='passed'&&parity.evidence?.candidate?.manifest_sha256===manifestSha256,'R44 parity result mismatch');
+
+    const closure=await writeFinalClosure({parityPath:parity.evidence_path,activationPath:activation.receipt_path,
+      windowsGatePath:inputs.windowsGatePath});
+    const envelope=JSON.parse(await readFile(closure.path,'utf8'));
+    const verified=await verifyFinalClosureObject(envelope,{stateRoot});
+    insist(verified?.ok===true&&verified.status==='passed'&&verified.manifest_sha256===manifestSha256,'R44 independent final closure verification failed');
+
+    const pointer=await activePointer();
+    const result={schema:'deadbyte.r44-finalization-result.v1',status:'passed',verified:true,
+      completed_at_utc:new Date().toISOString(),release_id:pointer.release_id,version:pointer.version,
+      manifest_sha256:pointer.manifest_sha256,generation_manifest_sha256:pointer.generation_manifest_sha256,
+      activation_receipt_sha256:activation.receipt_sha256,
+      parity_sha256:parity.evidence_sha256,windows_gate_sha256:inputs.windowsGateFileSha256,
+      closure_file_sha256:closure.sha256,closure_sha256:closure.closure_sha256,
+      full_tool_count:verified.full_tool_count,compact_tool_count:verified.compact_tool_count,
+      parent_release_id:inputs.parent.release_id,parent_manifest_sha256:inputs.parent.manifest_sha256};
+    const mirror=await writeMirror(manifestSha256,result);
+    await atomicJson(statePath,{...result,operation_id:operationId,mirror_path:mirror.path,mirror_sha256:mirror.sha256,
+      activation_receipt_path:activation.receipt_path,parity_path:parity.evidence_path,closure_path:closure.path});
+    return result;
+  }catch(error){
+    let rollback=null;
+    try{
+      if(activation?.receipt_path){
+        const pointer=await activePointer().catch(()=>null);
+        if(pointer?.version===EXPECTED_VERSION&&pointer?.manifest_sha256===manifestSha256){
+          rollback=await runSlotUpdateCli(['--rollback-receipt',activation.receipt_path],{stateRoot});
+        }
+      }
+    }catch(rollbackError){rollback={error:String(rollbackError?.message??rollbackError)};}
+    const disarm=disarmFailClosed();
+    const failed={schema:'deadbyte.r44-finalization-result.v1',status:'failed',verified:false,
+      completed_at_utc:new Date().toISOString(),manifest_sha256:manifestSha256,
+      error:String(error?.message??error),rollback:rollback?{ok:rollback?.ok===true,error:rollback?.error??null}:null,disarm};
+    await atomicJson(statePath,{...failed,operation_id:operationId}).catch(()=>{});
+    await writeMirror(manifestSha256,failed).catch(()=>{});
+    throw error;
+  }
+}
+export async function scheduleFinalization(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R44 finalizer manifest invalid');
+  const operationId=`r44-${manifestSha256.slice(0,16)}-${randomBytes(8).toString('hex')}`;
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.r44-finalization-state.v1',operation_id:operationId,status:'scheduled',
+    manifest_sha256:manifestSha256,scheduled_at_utc:new Date().toISOString()});
+  const child=spawn(process.execPath,[fileURLToPath(import.meta.url),manifestSha256,'--worker',operationId],{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  return {status:'scheduled',operation_id:operationId,state_path:statePath,manifest_sha256:manifestSha256,
+    execution_provider:'deadbyte_mcp',rdc_operation_count:0};
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const [manifestSha256,flag,operationId]=process.argv.slice(2);
+  try{
+    if(flag==='--worker'){
+      insist(/^r44-[0-9a-f]{16}-[0-9a-f]{16}$/.test(operationId??''),'R44 finalizer worker operation id invalid');
+      await sleep(4000);
+      await runWorker(manifestSha256,operationId);
+    }else{
+      insist(flag===undefined&&operationId===undefined,'usage: node scripts/finalize-r44.mjs <manifest_sha256>');
+      console.log(JSON.stringify(await scheduleFinalization(manifestSha256)));
+    }
+  }catch(error){console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;}
+}

package/scripts/finalize-r45.mjs

@@ -0,0 +1,219 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { lstat, mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { loadPowerShellDataFile, parseControllerStatus, runSlotUpdateCli, windowsPowerShellEnvironment } from '../src/runtime-update.mjs';
+import { verifyR45Parent } from './verify-r45-parent.mjs';
+import { runReleaseParity } from './release-parity-r45.mjs';
+import { writeFinalClosure } from './final-closure-r45.mjs';
+import { verifyFinalClosureObject } from './final-closure-verify-r45.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const EXPECTED_VERSION='0.15.1';
+const PARENT_RELEASE_ID='v0.15.0-c15fa41719be61b3';
+const PARENT_MANIFEST='c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483';
+const PARENT_FINAL_CLOSURE='533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667';
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','release','r45-finalization');
+const launcher=path.join(stateRoot,'bin','DEADBYTE-MCP.ps1');
+const ps=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+
+async function atomicJson(file,value){
+  await mkdir(path.dirname(file),{recursive:true});
+  const bytes=Buffer.from(`${JSON.stringify(value,null,2)}\n`,'utf8');
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,bytes,{flag:'wx'});
+  await rename(temp,file);
+  return {path:file,sha256:sha256(bytes)};
+}
+async function activePointer(){
+  return parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+}
+async function bridgeArgs(){
+  const pointer=await activePointer();
+  const config=await loadPowerShellDataFile(pointer.config_path);
+  const raw=config?.Bridge?.WorkingDirectory;
+  insist(typeof raw==='string'&&path.isAbsolute(raw),'active Bridge.WorkingDirectory must be absolute');
+  const root=await realpath(path.resolve(raw));
+  const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+  insist(pkg?.name==='deadbyte-chatgpt-bridge','active Bridge package identity mismatch');
+  const script=path.join(root,'src','bridge.mjs');
+  return ['--bridge-root',root,'--bridge-script-sha256',sha256(await readFile(script))];
+}
+async function activationArgs(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R45 finalizer manifest must be lowercase SHA-256');
+  const processPolicy=path.join(packageRoot,'controller','deadbyte-process-policy.json');
+  const hostPolicy=path.join(packageRoot,'controller','deadbyte-host-policy.json');
+  const desktopPolicy=path.join(packageRoot,'controller','deadbyte-desktop-policy.json');
+  const semantic=path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json');
+  return [
+    '--stage',packageRoot,'--development-root',packageRoot,'--expected-version',EXPECTED_VERSION,
+    '--expected-manifest',manifestSha256,
+    '--process-policy',processPolicy,'--process-policy-sha256',sha256(await readFile(processPolicy)),
+    '--host-policy',hostPolicy,'--host-policy-sha256',sha256(await readFile(hostPolicy)),
+    '--desktop-policy',desktopPolicy,'--desktop-policy-sha256',sha256(await readFile(desktopPolicy)),
+    '--semantic-lsp-config',semantic,'--semantic-lsp-config-sha256',sha256(await readFile(semantic)),
+    '--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor',
+    '--restore-standing-grants',
+    ...await bridgeArgs()
+  ];
+}
+export function validateFinalizerAuthorityStatus(status){
+  insist(status?.process_armed===true,'R45 finalizer requires Process standing grant');
+  insist(status?.coding_armed===true,'R45 finalizer requires Coding standing grant');
+  insist(status?.autonomous_armed===true,'R45 finalizer requires Autonomous standing grant');
+  insist(status?.desktop_armed===false,'R45 finalizer requires Desktop DISARMED');
+  insist(status?.host_armed===false,'R45 finalizer requires Host DISARMED');
+  return true;
+}
+function currentAuthorityStatus(){
+  const result=spawnSync(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status'],
+    {encoding:'utf8',windowsHide:true,timeout:20000,env:windowsPowerShellEnvironment()});
+  if(result.error) throw result.error;
+  if(result.status!==0) throw new Error(`R45 finalizer controller status failed: ${result.stderr||result.stdout}`);
+  return parseControllerStatus(result.stdout??'');
+}
+export function validateWindowsGateEvidence(value,manifestSha256,parent){
+  insist(value?.schema==='deadbyte.r45-windows-gate.v1'&&value.status==='passed'&&value.exit_code===0,'R45 Windows gate evidence invalid');
+  insist(value.version===EXPECTED_VERSION&&value.manifest_sha256===manifestSha256,'R45 Windows gate candidate mismatch');
+  insist(value.marker==='DEADBYTE V0.15.1 / R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS','R45 Windows gate marker mismatch');
+  insist(value.parent?.release_id===parent.release_id&&value.parent?.manifest_sha256===parent.manifest_sha256,'R45 Windows gate parent mismatch');
+  insist(value.parent?.generation_manifest_sha256===parent.generation_manifest_sha256,'R45 Windows gate parent generation mismatch');
+  insist(value.parent?.final_closure_sha256===PARENT_FINAL_CLOSURE&&value.parent?.final_closure_sha256===parent.closure_sha256,'R45 Windows gate parent final closure mismatch');
+  for(const key of ['skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke','full_regression_required','host_inline_native','native_hardware_observation','doctor_release_truth']) {
+    insist(value.features?.[key]===true,`R45 Windows gate feature contract missing ${key}`);
+  }
+  return true;
+}
+function disarmFailClosed(){
+  const results=[];
+  for(const command of ['disarmdesktop','disarmautonomous','disarmcoding','disarmprocess','disarmhost']){
+    const result=spawnSync(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],
+      {encoding:'utf8',windowsHide:true,timeout:20000,env:windowsPowerShellEnvironment()});
+    results.push({command,status:result.status,signal:result.signal??null});
+  }
+  return results;
+}
+async function mirrorRoot(){
+  const pointer=await activePointer();
+  const policy=JSON.parse(await readFile(path.join(pointer.generation_root,'coding-policy.json'),'utf8'));
+  const raw=policy?.roots?.parity_scratch?.path??policy?.roots?.parity_scratch?.real_path;
+  if(typeof raw!=='string'||!path.isAbsolute(raw)) throw new Error('active generation parity_scratch root unavailable');
+  const stat=await lstat(raw);
+  if(!stat.isDirectory()||stat.isSymbolicLink()) throw new Error('parity_scratch root must be a real directory');
+  return raw;
+}
+async function writeMirror(manifestSha256,value){
+  const root=await mirrorRoot();
+  const file=path.join(root,`r45-final-${manifestSha256.slice(0,16)}.json`);
+  return atomicJson(file,value);
+}
+async function verifyInputs(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R45 finalizer manifest invalid');
+  const manifestBytes=await readFile(path.join(packageRoot,'MANIFEST.SHA256'));
+  insist(sha256(manifestBytes)===manifestSha256,'R45 finalizer manifest drift');
+  const pkg=JSON.parse(await readFile(path.join(packageRoot,'package.json'),'utf8'));
+  insist(pkg?.name==='deadbyte-mcp'&&pkg?.version===EXPECTED_VERSION,'R45 finalizer package identity mismatch');
+  const parent=await verifyR45Parent(path.join(packageRoot,'R45-PARENT.json'));
+  const authorityStatus=currentAuthorityStatus();
+  validateFinalizerAuthorityStatus(authorityStatus);
+  const before=await activePointer();
+  insist(before.release_id===PARENT_RELEASE_ID&&before.manifest_sha256===PARENT_MANIFEST,'R45 finalizer must start from exact sealed R44 parent');
+  const windowsGatePath=path.join(stateRoot,'evidence','release',`r45-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  const windowsGateBytes=await readFile(windowsGatePath);
+  const windowsGate=JSON.parse(windowsGateBytes.toString('utf8').replace(/^\uFEFF/,''));
+  validateWindowsGateEvidence(windowsGate,manifestSha256,parent);
+  return {parent,before,authorityStatus,windowsGatePath,windowsGateFileSha256:sha256(windowsGateBytes)};
+}
+async function runWorker(manifestSha256,operationId){
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  let activation=null;
+  let parity=null;
+  try{
+    await atomicJson(statePath,{schema:'deadbyte.r45-finalization-state.v1',operation_id:operationId,status:'running',
+      manifest_sha256:manifestSha256,started_at_utc:new Date().toISOString()});
+    const inputs=await verifyInputs(manifestSha256);
+    activation=await runSlotUpdateCli(await activationArgs(manifestSha256),{stateRoot});
+    insist(activation?.pointer?.version===EXPECTED_VERSION&&activation.pointer.manifest_sha256===manifestSha256,'R45 activation result mismatch');
+    insist(activation?.final_authority?.process_armed===true&&activation?.final_authority?.coding_armed===true&&activation?.final_authority?.autonomous_armed===true,
+      'R45 activation must restore prior Process+Coding+Autonomous standing grants for detached parity');
+    insist(activation?.final_authority?.desktop_armed===false&&activation?.final_authority?.host_armed===false,
+      'R45 activation must keep Desktop+Host disarmed');
+
+    parity=await runReleaseParity(activation.receipt_path);
+    insist(parity?.evidence?.status==='passed'&&parity.evidence?.candidate?.manifest_sha256===manifestSha256,'R45 parity result mismatch');
+
+    const closure=await writeFinalClosure({parityPath:parity.evidence_path,activationPath:activation.receipt_path,
+      windowsGatePath:inputs.windowsGatePath});
+    const envelope=JSON.parse(await readFile(closure.path,'utf8'));
+    const verified=await verifyFinalClosureObject(envelope,{stateRoot});
+    insist(verified?.ok===true&&verified.status==='passed'&&verified.manifest_sha256===manifestSha256,'R45 independent final closure verification failed');
+
+    const pointer=await activePointer();
+    const result={schema:'deadbyte.r45-finalization-result.v1',status:'passed',verified:true,
+      completed_at_utc:new Date().toISOString(),release_id:pointer.release_id,version:pointer.version,
+      manifest_sha256:pointer.manifest_sha256,generation_manifest_sha256:pointer.generation_manifest_sha256,
+      activation_receipt_sha256:activation.receipt_sha256,
+      parity_sha256:parity.evidence_sha256,windows_gate_sha256:inputs.windowsGateFileSha256,
+      closure_file_sha256:closure.sha256,closure_sha256:closure.closure_sha256,
+      full_tool_count:verified.full_tool_count,compact_tool_count:verified.compact_tool_count,
+      parent_release_id:inputs.parent.release_id,parent_manifest_sha256:inputs.parent.manifest_sha256};
+    const mirror=await writeMirror(manifestSha256,result);
+    await atomicJson(statePath,{...result,operation_id:operationId,mirror_path:mirror.path,mirror_sha256:mirror.sha256,
+      activation_receipt_path:activation.receipt_path,parity_path:parity.evidence_path,closure_path:closure.path});
+    return result;
+  }catch(error){
+    let rollback=null;
+    try{
+      if(activation?.receipt_path){
+        const pointer=await activePointer().catch(()=>null);
+        if(pointer?.version===EXPECTED_VERSION&&pointer?.manifest_sha256===manifestSha256){
+          rollback=await runSlotUpdateCli(['--rollback-receipt',activation.receipt_path],{stateRoot});
+        }
+      }
+    }catch(rollbackError){rollback={error:String(rollbackError?.message??rollbackError)};}
+    const disarm=disarmFailClosed();
+    const failed={schema:'deadbyte.r45-finalization-result.v1',status:'failed',verified:false,
+      completed_at_utc:new Date().toISOString(),manifest_sha256:manifestSha256,
+      error:String(error?.message??error),rollback:rollback?{ok:rollback?.ok===true,error:rollback?.error??null}:null,disarm};
+    await atomicJson(statePath,{...failed,operation_id:operationId}).catch(()=>{});
+    await writeMirror(manifestSha256,failed).catch(()=>{});
+    throw error;
+  }
+}
+export async function scheduleFinalization(manifestSha256){
+  insist(HEX64.test(manifestSha256??''),'R45 finalizer manifest invalid');
+  const operationId=`r45-${manifestSha256.slice(0,16)}-${randomBytes(8).toString('hex')}`;
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.r45-finalization-state.v1',operation_id:operationId,status:'scheduled',
+    manifest_sha256:manifestSha256,scheduled_at_utc:new Date().toISOString()});
+  const child=spawn(process.execPath,[fileURLToPath(import.meta.url),manifestSha256,'--worker',operationId],{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  return {status:'scheduled',operation_id:operationId,state_path:statePath,manifest_sha256:manifestSha256,
+    execution_provider:'deadbyte_mcp',rdc_operation_count:0};
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const [manifestSha256,flag,operationId]=process.argv.slice(2);
+  try{
+    if(flag==='--worker'){
+      insist(/^r45-[0-9a-f]{16}-[0-9a-f]{16}$/.test(operationId??''),'R45 finalizer worker operation id invalid');
+      await sleep(4000);
+      await runWorker(manifestSha256,operationId);
+    }else{
+      insist(flag===undefined&&operationId===undefined,'usage: node scripts/finalize-r45.mjs <manifest_sha256>');
+      console.log(JSON.stringify(await scheduleFinalization(manifestSha256)));
+    }
+  }catch(error){console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;}
+}

package/scripts/full-regression-r43.mjs

@@ -0,0 +1,20 @@
+import { spawnSync } from 'node:child_process';
+import { readdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs'))
+  .map(entry=>path.join('test',entry.name))
+  .sort((a,b)=>a.localeCompare(b,'en'));
+if(files.length<1) throw new Error('R43 full regression found no test files');
+console.log(`R43-FULL-REGRESSION files=${files.length}`);
+const result=spawnSync(process.execPath,['--test',...files],{
+  cwd:root,stdio:'inherit',windowsHide:true,shell:false
+});
+if(result.error) throw result.error;
+if(result.signal) throw new Error(`R43 full regression terminated by ${result.signal}`);
+process.exitCode=Number.isInteger(result.status)?result.status:1;

package/scripts/full-regression-r44.mjs

@@ -0,0 +1,20 @@
+import { spawnSync } from 'node:child_process';
+import { readdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs'))
+  .map(entry=>path.join('test',entry.name))
+  .sort((a,b)=>a.localeCompare(b,'en'));
+if(files.length<1) throw new Error('R44 full regression found no test files');
+console.log(`R44-FULL-REGRESSION files=${files.length}`);
+const result=spawnSync(process.execPath,['--test',...files],{
+  cwd:root,stdio:'inherit',windowsHide:true,shell:false
+});
+if(result.error) throw result.error;
+if(result.signal) throw new Error(`R44 full regression terminated by ${result.signal}`);
+process.exitCode=Number.isInteger(result.status)?result.status:1;

package/scripts/full-regression-r45.mjs

@@ -0,0 +1,20 @@
+import { spawnSync } from 'node:child_process';
+import { readdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs')&&entry.name!=='full-max-catalog-r44.test.mjs')
+  .map(entry=>path.join('test',entry.name))
+  .sort((a,b)=>a.localeCompare(b,'en'));
+if(files.length<1) throw new Error('R45 full regression found no test files');
+console.log(`R45-FULL-REGRESSION files=${files.length}`);
+const result=spawnSync(process.execPath,['--test','--test-concurrency=1',...files],{
+  cwd:root,stdio:'inherit',windowsHide:true,shell:false
+});
+if(result.error) throw result.error;
+if(result.signal) throw new Error(`R45 full regression terminated by ${result.signal}`);
+process.exitCode=Number.isInteger(result.status)?result.status:1;

package/scripts/full-regression-summary-r45.mjs

@@ -0,0 +1,14 @@
+import { spawnSync } from 'node:child_process';
+import { readdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const files=(await readdir(path.join(root,'test'),{withFileTypes:true})).filter(e=>e.isFile()&&e.name.endsWith('.test.mjs')).map(e=>path.join('test',e.name)).sort();
+const r=spawnSync(process.execPath,['--test','--test-reporter=spec',...files],{cwd:root,encoding:'utf8',windowsHide:true,shell:false,maxBuffer:64*1024*1024});
+if(r.error) throw r.error;
+const lines=(String(r.stdout||'')+'\n'+String(r.stderr||'')).split(/\r?\n/);
+for(let i=0;i<lines.length;i++){
+  if(lines[i].startsWith('✖ ')||/^ℹ fail /.test(lines[i])||/^test at /.test(lines[i])) console.log(lines[i]);
+}
+console.log('EXIT='+String(r.status));
+process.exitCode=Number.isInteger(r.status)?r.status:1;

package/scripts/gate-windows-r43.ps1

@@ -0,0 +1,36 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+function Invoke-GateStep {
+    param([Parameter(Mandatory = $true)][string]$Name,[Parameter(Mandatory = $true)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.14.1 / R43 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+Invoke-GateStep -Name 'r43-parent-verify' -NpmArgs @('run','r43:parent:verify')
+Invoke-GateStep -Name 'containment-build' -NpmArgs @('run','containment:build')
+Invoke-GateStep -Name 'process-policy-refresh' -NpmArgs @('run','process:policy:refresh')
+Invoke-GateStep -Name 'desktop-policy-refresh' -NpmArgs @('run','desktop:policy:refresh')
+Invoke-GateStep -Name 'release-manifest-write' -NpmArgs @('run','manifest:write')
+Invoke-GateStep -Name 'release-manifest' -NpmArgs @('run','manifest:verify')
+Write-Host '==== r43-hardening-focused ===='
+& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot 'release-parity-tests-r43.ps1')
+if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.14.1 / R43 gate failed at r43-hardening-focused with exit code $LASTEXITCODE" }
+Invoke-GateStep -Name 'full-regression' -NpmArgs @('run','r43:full:test')
+Invoke-GateStep -Name 'mcp-smoke' -NpmArgs @('run','mcp:smoke')
+Invoke-GateStep -Name 'mcp-agent-smoke' -NpmArgs @('run','mcp:agent:smoke')
+Invoke-GateStep -Name 'mcp-coding-smoke' -NpmArgs @('run','mcp:coding:smoke')
+Invoke-GateStep -Name 'mcp-machine-fs-smoke' -NpmArgs @('run','mcp:machine-fs:smoke')
+Invoke-GateStep -Name 'mcp-observation-smoke' -NpmArgs @('run','mcp:observation:smoke')
+Invoke-GateStep -Name 'mcp-process-smoke' -NpmArgs @('run','mcp:process:smoke')
+Invoke-GateStep -Name 'mcp-autonomous-smoke' -NpmArgs @('run','mcp:autonomous:smoke')
+Invoke-GateStep -Name 'tunnel-stdio-compat-smoke' -NpmArgs @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep -Name 'mcp-host-smoke' -NpmArgs @('run','mcp:host:smoke')
+Invoke-GateStep -Name 'authority-smoke' -NpmArgs @('run','authority:smoke')
+Invoke-GateStep -Name 'containment-smoke' -NpmArgs @('run','containment:smoke')
+Invoke-GateStep -Name 'contained-smoke' -NpmArgs @('run','contained:smoke')
+Invoke-GateStep -Name 'mcp-contained-smoke' -NpmArgs @('run','mcp:contained:smoke')
+Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run','manifest:verify')
+Write-Host '==== windows-gate-evidence ===='
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r43.mjs')
+if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.14.1 / R43 gate failed at windows-gate-evidence with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE V0.14.1 / R43 AUTHORITY HARDENING WINDOWS BATCH GATE: PASS ===='

package/scripts/gate-windows-r44.ps1

@@ -0,0 +1,36 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+function Invoke-GateStep {
+    param([Parameter(Mandatory = $true)][string]$Name,[Parameter(Mandatory = $true)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.15.0 / R44 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+Invoke-GateStep -Name 'r44-parent-verify' -NpmArgs @('run','r44:parent:verify')
+Invoke-GateStep -Name 'containment-build' -NpmArgs @('run','containment:build')
+Invoke-GateStep -Name 'process-policy-refresh' -NpmArgs @('run','process:policy:refresh')
+Invoke-GateStep -Name 'desktop-policy-refresh' -NpmArgs @('run','desktop:policy:refresh')
+Invoke-GateStep -Name 'release-manifest-write' -NpmArgs @('run','manifest:write')
+Invoke-GateStep -Name 'release-manifest' -NpmArgs @('run','manifest:verify')
+Write-Host '==== r44-feature-focused ===='
+& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot 'release-parity-tests-r44.ps1')
+if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.15.0 / R44 gate failed at r44-feature-focused with exit code $LASTEXITCODE" }
+Invoke-GateStep -Name 'full-regression' -NpmArgs @('run','r44:full:test')
+Invoke-GateStep -Name 'mcp-smoke' -NpmArgs @('run','mcp:smoke')
+Invoke-GateStep -Name 'mcp-agent-smoke' -NpmArgs @('run','mcp:agent:smoke')
+Invoke-GateStep -Name 'mcp-coding-smoke' -NpmArgs @('run','mcp:coding:smoke')
+Invoke-GateStep -Name 'mcp-machine-fs-smoke' -NpmArgs @('run','mcp:machine-fs:smoke')
+Invoke-GateStep -Name 'mcp-observation-smoke' -NpmArgs @('run','mcp:observation:smoke')
+Invoke-GateStep -Name 'mcp-process-smoke' -NpmArgs @('run','mcp:process:smoke')
+Invoke-GateStep -Name 'mcp-autonomous-smoke' -NpmArgs @('run','mcp:autonomous:smoke')
+Invoke-GateStep -Name 'tunnel-stdio-compat-smoke' -NpmArgs @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep -Name 'mcp-host-smoke' -NpmArgs @('run','mcp:host:smoke')
+Invoke-GateStep -Name 'authority-smoke' -NpmArgs @('run','authority:smoke')
+Invoke-GateStep -Name 'containment-smoke' -NpmArgs @('run','containment:smoke')
+Invoke-GateStep -Name 'contained-smoke' -NpmArgs @('run','contained:smoke')
+Invoke-GateStep -Name 'mcp-contained-smoke' -NpmArgs @('run','mcp:contained:smoke')
+Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run','manifest:verify')
+Write-Host '==== windows-gate-evidence ===='
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r44.mjs')
+if ($LASTEXITCODE -ne 0) { throw "DEADBYTE V0.15.0 / R44 gate failed at windows-gate-evidence with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS ===='