deadbyte-mcp 0.15.0 → 0.15.1

package/scripts/release-parity-r45.mjs

@@ -0,0 +1,253 @@
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import { loadPowerShellDataFile } from '../src/runtime-update.mjs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { probeR45FullSurface } from '../src/r45-full-surface-probe.mjs';
+import { runR45CompactParity } from '../src/remote-mcp-r45-parity-client.mjs';
+import { probeR45CompactDisarmed } from '../src/r45-compact-disarmed-probe.mjs';
+import { probeR44CompactDisarmed as probeR44PredecessorDisarmed } from '../src/r44-compact-disarmed-probe.mjs';
+import { probeR36CompactDisarmed } from '../src/r36-compact-disarmed-probe.mjs';
+import { runR40DesktopGuardedSmoke } from '../src/remote-mcp-desktop-r40-smoke-client.mjs';
+import { verifyR41Memory } from './verify-memory-r41.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const deferred=path.join(root,'scripts','deferred-slot-operation-r45.mjs');
+const ps='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+const launcher=path.join(stateRoot,'bin','DEADBYTE-MCP.ps1');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+export const R45_PREDECESSOR_RELEASE_ID='v0.15.0-c15fa41719be61b3';
+export const R45_PREDECESSOR_MANIFEST='c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483';
+
+function assert(condition,message){if(!condition) throw new Error(message);}
+function parseFrozenManifest(text){
+  const entries=[];const seen=new Set();
+  for(const [index,line] of text.split(/\r?\n/).entries()){
+    if(!line) continue;
+    const match=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line);
+    assert(match,`frozen manifest line ${index+1} malformed`);
+    const rel=match[2];
+    assert(!path.posix.isAbsolute(rel)&&!rel.split('/').includes('..')&&!seen.has(rel),`unsafe/duplicate frozen manifest path: ${rel}`);
+    seen.add(rel);entries.push({sha256:match[1],path:rel});
+  }
+  return entries;
+}
+// Restore the mutable development stage from the immutable active release after live parity work may drift it.
+export async function restoreFrozenStage({developmentRoot,releaseRoot,expectedManifestSha256}){
+  const dev=path.resolve(developmentRoot);const release=path.resolve(releaseRoot);
+  const manifestBytes=await readFile(path.join(release,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  assert(manifestSha256===expectedManifestSha256,`immutable release manifest drift: ${manifestSha256}`);
+  const entries=parseFrozenManifest(manifestBytes.toString('utf8'));
+  for(const entry of entries){
+    const source=path.join(release,...entry.path.split('/'));const bytes=await readFile(source);
+    assert(sha256(bytes)===entry.sha256,`immutable release file drift: ${entry.path}`);
+    const destination=path.join(dev,...entry.path.split('/'));await mkdir(path.dirname(destination),{recursive:true});
+    await writeFile(destination,bytes);assert(sha256(await readFile(destination))===entry.sha256,`development restore verification failed: ${entry.path}`);
+  }
+  await writeFile(path.join(dev,'MANIFEST.SHA256'),manifestBytes);
+  assert(sha256(await readFile(path.join(dev,'MANIFEST.SHA256')))===expectedManifestSha256,'development manifest restore verification failed');
+  return {status:'restored',file_count:entries.length,manifest_sha256:manifestSha256};
+}
+function parseJsonOutput(text,label){
+  const trimmed=String(text).trim();const starts=[...trimmed.matchAll(/\{/g)].map(match=>match.index);
+  for(const start of starts){try{return JSON.parse(trimmed.slice(start));}catch{}}
+  throw new Error(`${label} did not emit JSON`);
+}
+function run(command,args,{timeoutMs=900000,env=process.env,cwd=root}={}){
+  return new Promise((resolve,reject)=>{
+    const child=spawn(command,args,{cwd,shell:false,windowsHide:true,env,stdio:['ignore','pipe','pipe']});
+    const out=[],err=[];const timer=setTimeout(()=>{child.kill();reject(new Error(`command timeout: ${path.basename(command)}`));},timeoutMs);
+    child.stdout.on('data',chunk=>out.push(Buffer.from(chunk)));child.stderr.on('data',chunk=>err.push(Buffer.from(chunk)));
+    child.on('error',error=>{clearTimeout(timer);reject(error);});child.on('exit',code=>{
+      clearTimeout(timer);const stdout=Buffer.concat(out).toString('utf8');const stderr=Buffer.concat(err).toString('utf8');
+      if(code!==0) reject(new Error(`command failed exit=${code}: ${stderr||stdout}`));else resolve({stdout,stderr,exitCode:code});
+    });
+  });
+}
+async function publicUrl(){
+  const value=(await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim();const url=new URL(value);
+  if(url.protocol!=='https:') throw new Error('public MCP URL must be HTTPS');return value;
+}
+async function pointer(){return JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));}
+async function waitForExactPointer({releaseId,version,manifestSha256,timeoutMs=120000}){
+  const deadline=Date.now()+timeoutMs;let last=null;
+  while(Date.now()<deadline){
+    try{
+      last=await pointer();
+      if(last?.release_id===releaseId&&last?.version===version&&last?.manifest_sha256===manifestSha256) return last;
+    }catch{}
+    await sleep(500);
+  }
+  throw new Error(`active pointer convergence timeout expected=${releaseId}/${version}/${manifestSha256} observed=${last?.release_id??'unreadable'}/${last?.version??'unreadable'}/${last?.manifest_sha256??'unreadable'}`);
+}
+async function disarmAll(){
+  for(const command of ['disarmdesktop','disarmautonomous','disarmcoding','disarmprocess','disarmhost']){
+    await run(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{timeoutMs:60000});
+  }
+}
+async function waitDeferred(statePath,timeoutMs=180000){
+  const deadline=Date.now()+timeoutMs;
+  while(Date.now()<deadline){const state=JSON.parse(await readFile(statePath,'utf8'));if(state.state==='completed') return state;if(state.state==='failed') throw new Error(`deferred ${state.mode} failed: ${state.error}`);await sleep(500);}
+  throw new Error(`deferred operation timeout: ${statePath}`);
+}
+async function scheduleDeferred(mode,value,{bridgeRoot=null,bridgeScriptSha256=null}={}){
+  if((bridgeRoot===null)!==(bridgeScriptSha256===null)) throw new Error('deferred bridge override requires exact root + SHA pair');
+  const args=[deferred,mode,value];
+  if(bridgeRoot!==null) args.push('--bridge-root',bridgeRoot,'--bridge-script-sha256',bridgeScriptSha256);
+  const scheduled=parseJsonOutput((await run(process.execPath,args,{timeoutMs:30000})).stdout,`deferred ${mode}`);
+  assert(scheduled.status==='scheduled',`deferred ${mode} was not scheduled`);
+  assert(scheduled.execution_provider==='deadbyte_mcp'&&scheduled.rdc_operation_count===0,'deferred operation provider mismatch');
+  return {scheduled,completed:await waitDeferred(scheduled.state_path)};
+}
+async function publicR44PredecessorDisarmed(url){
+  const result=await probeR44PredecessorDisarmed(url);
+  assert(result.status==='passed'&&result.tool_count===43&&result.capability_closure===true,'R44 predecessor public compact catalog mismatch');
+  assert(result.release_id===R45_PREDECESSOR_RELEASE_ID&&result.release_manifest_sha256===R45_PREDECESSOR_MANIFEST,'R44 predecessor machine binding mismatch');
+  assert(result.coding_armed===false&&result.autonomous_armed===false&&result.desktop_armed===false,'R44 predecessor authority remained armed');
+  return result;
+}
+async function mutableCore(pointerValue){
+  const policy=JSON.parse(await readFile(path.join(pointerValue.generation_root,'coding-policy.json'),'utf8'));
+  const raw=policy?.roots?.core?.path??policy?.roots?.core?.real_path;
+  assert(typeof raw==='string'&&raw,'R40 generation missing coding core root');
+  const core=path.resolve(raw);const release=path.resolve(pointerValue.release_root);
+  assert(core.toLowerCase()!==release.toLowerCase(),'R40 coding core must not point at immutable active release slot');
+  return core;
+}
+
+function validateFeatureGate(value,manifest){
+  assert(value?.schema==='deadbyte.r45-windows-gate.v1'&&value.status==='passed'&&value.exit_code===0,'R45 feature gate invalid');
+  assert(value.version==='0.15.1'&&value.manifest_sha256===manifest,'R45 feature gate candidate mismatch');
+  for(const key of ['skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke','full_regression_required','host_inline_native','native_hardware_observation','doctor_release_truth']) {
+    assert(value.features?.[key]===true,`R45 feature gate missing ${key}`);
+  }
+  return true;
+}
+async function readFeatureGate(manifest){
+  const file=path.join(stateRoot,'evidence','release',`r45-windows-gate-${manifest.slice(0,16)}.json`);
+  const bytes=await readFile(file);const value=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+  validateFeatureGate(value,manifest);
+  return {value,path:file,sha256:sha256(bytes)};
+}
+
+export function validateParityEvidence(value){
+  assert(value?.schema==='deadbyte.r45-parity.v1','R45 parity schema mismatch');
+  assert(value.status==='passed','R40 parity status is not passed');
+  assert(value.rdc_operation_count===0&&value.execution_provider==='deadbyte_mcp','R40 parity used non-DEADBYTE execution');
+  assert(value.candidate?.version==='0.15.1'&&/^[0-9a-f]{64}$/.test(value.candidate?.manifest_sha256??''),'R40 candidate identity missing');
+  assert(value.local_full?.status==='passed'&&value.local_full?.tool_count===82&&value.local_full?.strict_output_schemas===true,'R45 local full 82-tool proof missing');
+  assert(value.public_compact?.status==='passed'&&value.public_compact?.tool_count===43&&value.public_compact?.capability_closure===true&&value.public_compact?.gateway_count===6&&value.public_compact?.desktop_armed===false&&value.public_compact?.desktop_observation_receipt_verified===true&&value.public_compact?.desktop_grounding_receipt_verified===true,'R45 public compact/Desktop/skill closure missing');
+  assert(value.desktop_guarded?.status==='passed'&&value.desktop_guarded?.native_injected===true&&value.desktop_guarded?.replay_performed===false&&
+    Number.isInteger(value.desktop_guarded?.predispatch_retry_count)&&value.desktop_guarded.predispatch_retry_count>=0&&value.desktop_guarded.predispatch_retry_count<=2&&
+    value.desktop_guarded?.observation_receipts_verified===value.desktop_guarded.predispatch_retry_count+1&&value.desktop_guarded?.action_receipts_verified===3,
+    'R40 guarded Desktop proof missing');
+  assert(value.autonomous?.status==='passed'&&value.autonomous?.signed_release_verified===true,'R40 autonomous live proof missing');
+  assert(value.deterministic_memory?.status==='passed'&&value.deterministic_memory?.goal_count>=1&&value.deterministic_memory?.snapshot_count>=1&&value.deterministic_memory?.index_count>=1,'R41 deterministic memory proof missing');
+  assert(value.before_rollback_disarmed?.status==='passed'&&value.before_rollback_disarmed?.capability_closure===true&&value.before_rollback_disarmed?.coding_armed===false&&value.before_rollback_disarmed?.autonomous_armed===false&&value.before_rollback_disarmed?.desktop_armed===false,'R40 pre-rollback disarm proof missing');
+  assert(value.rollback?.state==='completed'&&value.restore?.state==='completed','R40 rollback/restore not completed');
+  assert(value.stage_restore?.status==='restored'&&value.stage_restore?.manifest_sha256===value.candidate.manifest_sha256,'R40 stage restore proof missing');
+  assert(value.predecessor?.release_id===R45_PREDECESSOR_RELEASE_ID&&value.predecessor?.manifest_sha256===R45_PREDECESSOR_MANIFEST&&value.predecessor?.version==='0.15.0','R45 exact R44 predecessor identity mismatch');
+  assert(value.predecessor_disarmed?.status==='passed'&&value.predecessor_disarmed?.tool_count===43&&value.predecessor_disarmed?.capability_closure===true,'R44 predecessor public proof missing');
+  assert(value.successor?.version==='0.15.1'&&value.successor?.manifest_sha256===value.candidate.manifest_sha256,'R45 exact successor restore identity mismatch');
+  assert(value.successor_disarmed?.status==='passed'&&value.successor_disarmed?.capability_closure===true&&value.successor_disarmed?.coding_armed===false&&value.successor_disarmed?.autonomous_armed===false&&value.successor_disarmed?.desktop_armed===false,'R40 successor disarmed proof missing');
+  assert(value.immutable_slot?.protected===true&&value.immutable_slot?.development_root!==value.immutable_slot?.release_root,'R40 immutable-slot separation missing');
+  for(const key of ['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification','compact_closure','full_surface','desktop_readonly','desktop_guarded_input','deterministic_memory','skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke']) assert(value.requirements?.[key]===true,`R45 parity requirement not proven: ${key}`);
+  validateFeatureGate(value.feature_gate,value.candidate.manifest_sha256);
+  return true;
+}
+
+export async function runReleaseParity(activationReceiptPath){
+  const active=await pointer();const candidateManifest=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+  assert(active.version==='0.15.1','R45 parity requires active 0.15.1 candidate');
+  assert(active.manifest_sha256===candidateManifest,'active release is not canonical R40 candidate');
+  const activeConfig=await loadPowerShellDataFile(active.config_path);
+  const successorBridgeRootRaw=activeConfig?.Bridge?.WorkingDirectory;
+  const successorBridgeConfiguredSha=activeConfig?.Bridge?.ScriptSha256;
+  assert(typeof successorBridgeRootRaw==='string'&&path.isAbsolute(successorBridgeRootRaw),'R40 active bridge root missing');
+  assert(typeof successorBridgeConfiguredSha==='string'&&/^[0-9a-f]{64}$/.test(successorBridgeConfiguredSha),'R40 active bridge SHA missing');
+  const successorBridgeRoot=await realpath(path.resolve(successorBridgeRootRaw));
+  const successorBridgeActualSha=sha256(await readFile(path.join(successorBridgeRoot,'src','bridge.mjs')));
+  assert(successorBridgeActualSha===successorBridgeConfiguredSha,'R40 active bridge bytes do not match generation pin');
+  const successorBridge={root:successorBridgeRoot,sha256:successorBridgeActualSha};
+  const developmentRoot=await mutableCore(active);
+  const localFull=await probeR45FullSurface({packageRoot:active.release_root,generationRoot:active.generation_root,stateRoot});
+  const url=await publicUrl();
+  let publicCompact,autonomous,desktopGuarded;
+  try{
+    publicCompact=await runR45CompactParity(url);
+    autonomous=parseJsonOutput((await run(process.execPath,[path.join(root,'src','remote-mcp-autonomous-smoke-client.mjs'),url],{timeoutMs:900000})).stdout,'R40 autonomous compact parity');
+    assert(autonomous.status==='passed'&&autonomous.signed_release_verified===true,'R40 autonomous compact parity failed');
+    await run(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'armdesktop'],{timeoutMs:60000});
+    try{desktopGuarded=await runR40DesktopGuardedSmoke(url);}
+    finally{await run(ps,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'disarmdesktop'],{timeoutMs:60000}).catch(()=>{});}
+    assert(desktopGuarded.status==='passed'&&desktopGuarded.native_injected===true&&desktopGuarded.action_receipts_verified===3,'R40 guarded Desktop public smoke failed');
+  }catch(error){await disarmAll().catch(()=>{});throw error;}
+  const deterministicMemory=await verifyR41Memory({memoryRoot:path.join(stateRoot,'evidence','autonomous','memory-r41',candidateManifest),
+    journalRoot:path.join(stateRoot,'evidence','autonomous','goals'),sourceReleaseManifest:candidateManifest,
+    publicKeyPath:path.join(stateRoot,'trust','ed25519-public.pem')});
+  assert(deterministicMemory.goal_count>=1&&deterministicMemory.snapshot_count>=1&&deterministicMemory.index_count>=1,'R41 live deterministic memory evidence missing');
+  await disarmAll();
+  const beforeRollback=await probeR45CompactDisarmed(url);
+  const rollbackPair=await scheduleDeferred('rollback',path.resolve(activationReceiptPath));
+  assert(rollbackPair.completed.active_release===R45_PREDECESSOR_RELEASE_ID,'rollback worker completed without exact R44 active release');
+  const predecessor=await waitForExactPointer({releaseId:R45_PREDECESSOR_RELEASE_ID,version:'0.15.0',manifestSha256:R45_PREDECESSOR_MANIFEST});
+  const predecessorDisarmed=await publicR44PredecessorDisarmed(url);
+  const stageRestore=await restoreFrozenStage({developmentRoot,releaseRoot:active.release_root,expectedManifestSha256:candidateManifest});
+  const restorePair=await scheduleDeferred('activate',candidateManifest,{bridgeRoot:successorBridge.root,bridgeScriptSha256:successorBridge.sha256});
+  assert(restorePair.completed.active_release===active.release_id,'restore worker completed without exact R45 active release');
+  const successor=await waitForExactPointer({releaseId:active.release_id,version:'0.15.1',manifestSha256:candidateManifest});
+  const successorDisarmed=await probeR45CompactDisarmed(url);
+  await disarmAll();
+
+  const featureGate=await readFeatureGate(candidateManifest);
+  const evidence={
+    schema:'deadbyte.r45-parity.v1',status:'passed',completed_at_utc:new Date().toISOString(),execution_provider:'deadbyte_mcp',rdc_operation_count:0,
+    candidate:{release_id:active.release_id,version:active.version,manifest_sha256:candidateManifest},
+    immutable_slot:{protected:true,release_root:path.resolve(active.release_root),development_root:developmentRoot},
+    local_full:localFull,public_compact:publicCompact,autonomous,deterministic_memory:deterministicMemory,desktop_guarded:desktopGuarded,feature_gate:featureGate.value,feature_gate_sha256:featureGate.sha256,before_rollback_disarmed:beforeRollback,
+    rollback:{...rollbackPair.completed,scheduled_operation_id:rollbackPair.scheduled.operation_id},
+    predecessor:{release_id:predecessor.release_id,version:predecessor.version,manifest_sha256:predecessor.manifest_sha256},predecessor_disarmed:predecessorDisarmed,
+    stage_restore:stageRestore,
+    restore:{...restorePair.completed,scheduled_operation_id:restorePair.scheduled.operation_id},
+    successor:{release_id:successor.release_id,version:successor.version,manifest_sha256:successor.manifest_sha256},successor_disarmed:successorDisarmed,
+    requirements:{
+      tree_read:publicCompact.tree_entries>=0&&publicCompact.coding_stat_verified===true,
+      precondition_mutation:publicCompact.machine_fs_receipts_verified>=3,
+      search:publicCompact.coding_search_result_count>=1&&publicCompact.observation_search_result_count>=1,
+      owned_process:typeof publicCompact.process_session_id==='string'&&publicCompact.process_output_bytes>0,
+      observation:publicCompact.observation_receipts_verified>=2,
+      coding_loop:publicCompact.coding_receipts_verified===2,
+      autonomy:autonomous.signed_release_verified===true&&autonomous.observed_failure_before_replan===true,
+      interrupted_recovery:rollbackPair.completed.state==='completed'&&restorePair.completed.state==='completed',
+      evidence_verification:publicCompact.machine_fs_receipts_verified>=3&&autonomous.signed_release_verified===true,
+      compact_closure:publicCompact.capability_closure===true&&successorDisarmed.capability_closure===true,
+      full_surface:localFull.tool_count===82&&localFull.strict_output_schemas===true,
+      desktop_readonly:publicCompact.desktop_armed===false&&publicCompact.desktop_observation_receipt_verified===true&&publicCompact.desktop_grounding_receipt_verified===true,
+      desktop_guarded_input:desktopGuarded.native_injected===true&&desktopGuarded.replay_performed===false&&desktopGuarded.action_receipts_verified===3,
+      deterministic_memory:deterministicMemory.status==='passed'&&deterministicMemory.goal_count>=1&&deterministicMemory.snapshot_count>=1,
+      skill_integrity:publicCompact.skill_catalog_verified===true&&successorDisarmed.skill_catalog_verified===true&&featureGate.value.features.skill_integrity===true,
+      agent_backend_persistence:featureGate.value.features.agent_backend_persistence===true,
+      codex_protocol_contract:featureGate.value.features.codex_protocol_contract===true,
+      remote_device_identity:featureGate.value.features.remote_device_identity===true,
+      durable_job_supervisor:featureGate.value.features.durable_job_supervisor===true,
+      real_external_supervisor_smoke:featureGate.value.features.real_external_supervisor_smoke===true
+    }
+  };
+  validateParityEvidence(evidence);
+  const evidenceDir=path.join(stateRoot,'evidence','release');await mkdir(evidenceDir,{recursive:true});
+  const evidencePath=path.join(evidenceDir,`r45-parity-${candidateManifest.slice(0,16)}.json`);
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');await writeFile(evidencePath,bytes);
+  return {evidence,evidence_path:evidencePath,evidence_sha256:sha256(bytes)};
+}
+
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){
+  const receipt=process.argv[2];if(!receipt) throw new Error('usage: node scripts/release-parity-r45.mjs <activation-receipt.json>');
+  runReleaseParity(receipt).then(result=>console.log(JSON.stringify({status:'passed',...result},null,2))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}

package/scripts/release-parity-tests-r45.ps1

@@ -0,0 +1,8 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 2.0
+& node.exe --test --test-concurrency=1 test\host-inline-r45.test.mjs test\hardware-observation-r45.test.mjs test\runtime-host-bootstrap-r45.test.mjs test\full-max-catalog-r45.test.mjs test\compact-max-catalog-r45.test.mjs test\r45-finalization.test.mjs test\skill-plane-r44.test.mjs test\skill-mcp-r44.test.mjs test\agent-backend-r44.test.mjs test\codex-app-server-r44.test.mjs test\codex-autonomous-r44.test.mjs test\remote-device-r44.test.mjs test\durable-job-r44.test.mjs test\external-job-provider-r44.test.mjs test\coding-runtime.test.mjs test\host-plane.test.mjs test\process-policy.test.mjs test\process-runtime.test.mjs test\native-diff.test.mjs test\native-diff-topology-r36.test.mjs test\autonomous-loop.test.mjs test\autonomous-adversarial.test.mjs test\standing-grants.test.mjs test\runtime-self-update.test.mjs
+if($LASTEXITCODE -ne 0){exit $LASTEXITCODE}
+& node.exe --test --test-concurrency=1 test\r44-finalization.test.mjs test\r43-finalization.test.mjs test\provider-responses-r42.test.mjs test\task-contract-r42.test.mjs test\human-clarification-r42.test.mjs test\agent-governance-r42.test.mjs test\evidence-publisher-r42.test.mjs test\agent-eval-r42.test.mjs test\agent-eval-runner-r42.test.mjs test\r42-finalization.test.mjs
+if($LASTEXITCODE -ne 0){exit $LASTEXITCODE}
+& node.exe --test --test-concurrency=1 test\memory-snapshot-r41.test.mjs test\memory-projections-r41.test.mjs test\memory-retrieval-r41.test.mjs test\memory-history-r41.test.mjs test\memory-autonomous-integration-r41.test.mjs
+exit $LASTEXITCODE

package/scripts/verify-r45-parent.mjs

@@ -0,0 +1,142 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { lstat, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R44-FINAL-CLOSURE-V1\0','utf8');
+const HEX64=/^[0-9a-f]{64}$/;
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const same=(a,b)=>canonicalJson(a)===canonicalJson(b);
+const samePath=(a,b)=>path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();
+function insist(ok,message){if(!ok) throw new Error(message);}
+
+function parseManifest(text){
+  const out=new Map();
+  for(const [i,line] of text.split(/\r?\n/).entries()){
+    if(!line) continue;
+    const m=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line);
+    insist(m,`manifest line ${i+1} malformed`);
+    const rel=m[2];
+    insist(!path.posix.isAbsolute(rel)&&!rel.split('/').includes('..')&&!out.has(rel),`unsafe/duplicate manifest path ${rel}`);
+    out.set(rel,m[1]);
+  }
+  return out;
+}
+async function walk(root,rel=''){
+  const dir=path.join(root,...(rel?rel.split('/'):[]));
+  const names=(await readdir(dir)).sort((a,b)=>a.localeCompare(b,'en'));
+  const files=[];
+  for(const name of names){
+    const childRel=rel?`${rel}/${name}`:name;
+    const full=path.join(root,...childRel.split('/'));
+    const st=await lstat(full);
+    insist(!st.isSymbolicLink(),`symlink forbidden: ${childRel}`);
+    if(st.isDirectory()) files.push(...await walk(root,childRel));
+    else { insist(st.isFile(),`non-file forbidden: ${childRel}`); files.push(childRel); }
+  }
+  return files;
+}
+async function verifyTree(root,manifestName,expectedDigest,expectedCount){
+  const manifestBytes=await readFile(path.join(root,manifestName));
+  insist(sha256(manifestBytes)===expectedDigest,`${manifestName} digest mismatch`);
+  const entries=parseManifest(manifestBytes.toString('utf8'));
+  insist(entries.size===expectedCount,`${manifestName} file count mismatch`);
+  const actual=(await walk(root)).filter(rel=>rel!==manifestName).sort((a,b)=>a.localeCompare(b,'en'));
+  const expected=[...entries.keys()].sort((a,b)=>a.localeCompare(b,'en'));
+  insist(same(actual,expected),`${manifestName} exact tree mismatch`);
+  for(const [rel,digest] of entries){
+    insist(sha256(await readFile(path.join(root,...rel.split('/'))))===digest,`${manifestName} file hash mismatch: ${rel}`);
+  }
+  return entries.size;
+}
+
+export async function verifyR45Parent(parentFile,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
+  const parentPath=path.resolve(parentFile);
+  const parent=JSON.parse(await readFile(parentPath,'utf8'));
+  insist(parent?.schema==='deadbyte.r45-parent.v1','R45 parent schema mismatch');
+  insist(parent.parent_release_id==='v0.15.0-c15fa41719be61b3','R45 parent release id mismatch');
+  insist(parent.parent_version==='0.15.0','R45 parent version mismatch');
+  insist(parent.parent_manifest_sha256==='c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483','R45 parent manifest mismatch');
+  insist(parent.parent_manifest_file_count===1871,'R45 parent file count mismatch');
+  insist(parent.parent_generation_manifest_sha256==='6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30','R45 parent generation mismatch');
+  insist(parent.parent_generation_file_count===7,'R45 parent generation file count mismatch');
+  insist(parent.parent_final_closure_file_sha256==='8aa9c31ab18dfde67275d7cd59295ba08099839d35d6c97ee277fb184c05cae0','R45 parent closure file hash mismatch');
+  insist(parent.parent_final_closure_sha256==='533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667','R45 parent closure hash mismatch');
+  insist(parent.parent_final_closure_signer_key_id==='c0727a7911e29a0f1edd3cd910e47f89f43edb484743988c89cd82bfd5e37936','R45 parent closure signer mismatch');
+  insist(parent.parent_proof==='immutable-slot+generation+signed-final-closure','R45 parent proof class mismatch');
+
+  const closureBytes=await readFile(path.resolve(parent.parent_final_closure_path));
+  insist(sha256(closureBytes)===parent.parent_final_closure_file_sha256,'R45 parent closure file bytes mismatch');
+  const envelope=JSON.parse(closureBytes.toString('utf8'));
+  insist(envelope?.body?.schema==='deadbyte.r44-final-closure.v1','R45 parent closure schema mismatch');
+  insist(envelope.body.version===parent.parent_version,'R45 parent closure version mismatch');
+  insist(envelope.body.release_label==='R44 REMOTE AGENT SKILL BASELINE','R45 parent closure label mismatch');
+
+  const publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+  insist(publicKey.asymmetricKeyType==='ed25519','R45 parent trust key must be Ed25519');
+  const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
+  insist(keyId===parent.parent_final_closure_signer_key_id,'R45 parent trust key id mismatch');
+  const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
+  insist(sha256(bodyBytes)===envelope.body_sha256,'R45 parent closure body hash mismatch');
+  const {closure_sha256,...unsigned}=envelope;
+  insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===closure_sha256,'R45 parent closure envelope hash mismatch');
+  insist(closure_sha256===parent.parent_final_closure_sha256,'R45 parent closure content address mismatch');
+  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R44-FINAL-CLOSURE-V1','R45 parent closure attestation contract mismatch');
+  insist(envelope.attestation.key_id===keyId,'R45 parent closure attestation signer mismatch');
+  insist(cryptoVerify(null,Buffer.concat([CLOSURE_DOMAIN,bodyBytes]),publicKey,Buffer.from(envelope.attestation.signature_base64,'base64')),'R45 parent closure signature invalid');
+
+  const pointer=envelope.body.active_pointer;
+  insist(pointer?.release_id===parent.parent_release_id&&pointer?.version===parent.parent_version&&pointer?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent closure release binding mismatch');
+  insist(pointer.generation_manifest_sha256===parent.parent_generation_manifest_sha256,'R45 parent closure generation binding mismatch');
+  insist(pointer.launcher_sha256===parent.parent_launcher_sha256,'R45 parent launcher binding mismatch');
+  insist(samePath(pointer.release_root,parent.parent_release_root),'R45 parent release root mismatch');
+  insist(samePath(pointer.generation_root,parent.parent_generation_root),'R45 parent generation root mismatch');
+  insist(envelope.body.immutable_slot?.protected===true,'R45 parent immutable slot proof missing');
+  insist(samePath(envelope.body.immutable_slot.release_root,parent.parent_release_root),'R45 parent immutable release root mismatch');
+  insist(!samePath(envelope.body.immutable_slot.development_root,parent.parent_release_root),'R45 parent development root aliases release slot');
+  insist(samePath(envelope.body.immutable_slot.development_root,parent.development_root),'R45 parent development root mismatch');
+  insist(envelope.body.authority?.all_disarmed===true,'R45 parent closure did not record all-disarmed state');
+  for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+    insist(envelope.body.authority.grants_absent?.[name]===true,`R45 parent closure grant absence missing: ${name}`);
+  }
+
+  const evidence=envelope.body.evidence;
+  insist(evidence&&evidence.parity&&evidence.activation&&evidence.rollback&&evidence.restore&&evidence.windows_gate,'R45 parent closure evidence set incomplete');
+  for(const [name,item] of Object.entries(evidence)){
+    insist(typeof item?.path==='string'&&HEX64.test(item?.sha256??''),`R45 parent ${name} evidence identity malformed`);
+    insist(sha256(await readFile(item.path))===item.sha256,`R45 parent ${name} evidence hash mismatch`);
+  }
+  const parity=JSON.parse(await readFile(evidence.parity.path,'utf8'));
+  insist(parity?.schema==='deadbyte.r44-parity.v1'&&parity.status==='passed','R45 parent parity status mismatch');
+  insist(parity.candidate?.release_id===parent.parent_release_id&&parity.candidate?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent parity candidate mismatch');
+  insist(parity.successor?.release_id===parent.parent_release_id&&parity.successor?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent parity successor mismatch');
+  insist(parity.successor_disarmed?.status==='passed','R45 parent successor-disarmed proof missing');
+
+  const releaseFiles=await verifyTree(parent.parent_release_root,'MANIFEST.SHA256',parent.parent_manifest_sha256,parent.parent_manifest_file_count);
+  const generationFiles=await verifyTree(parent.parent_generation_root,'GENERATION.SHA256',parent.parent_generation_manifest_sha256,parent.parent_generation_file_count);
+  return {
+    ok:true,
+    status:'passed',
+    proof_class:parent.parent_proof,
+    release_id:parent.parent_release_id,
+    manifest_sha256:parent.parent_manifest_sha256,
+    generation_manifest_sha256:parent.parent_generation_manifest_sha256,
+    release_files:releaseFiles,
+    generation_files:generationFiles,
+    closure_sha256:parent.parent_final_closure_sha256,
+    closure_file_sha256:parent.parent_final_closure_file_sha256,
+    signer_key_id:keyId,
+    recorded_all_disarmed:true
+  };
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const file=process.argv[2]??path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','R45-PARENT.json');
+  verifyR45Parent(file).then(result=>console.log(JSON.stringify(result,null,2)))
+    .catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}

package/scripts/windows-gate-evidence-r45.mjs

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR45Parent } from './verify-r45-parent.mjs';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const marker='DEADBYTE V0.15.1 / R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS';
+function insist(ok,message){if(!ok)throw new Error(message);}
+
+export async function writeWindowsGateEvidence({
+  candidateRoot=root,
+  stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp')),
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(candidateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.15.1',`Windows gate evidence requires V0.15.1, found ${pkg.version}`);
+  const parent=await verifyR45Parent(path.join(candidate,'R45-PARENT.json'));
+  const doctorResult=await doctor();
+  insist(doctorResult?.status==='ok'&&doctorResult?.package_version==='0.15.1'&&doctorResult?.manifest?.verified===true,'R45 doctor evidence invalid');
+  insist(doctorResult?.policy?.host_v2_ready===true,'R45 doctor did not verify Host policy v2');
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'Windows gate evidence clock invalid');
+  const evidence={
+    schema:'deadbyte.r45-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.1',
+    marker,completed_at_utc:completed.toISOString(),manifest_sha256:manifestSha256,
+    doctor:{status:doctorResult.status,manifest_sha256:doctorResult.manifest.sha256,verified_entries:doctorResult.manifest.verified_entries,host_v2_ready:doctorResult.policy.host_v2_ready},
+    parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+      generation_manifest_sha256:parent.generation_manifest_sha256,
+      final_closure_sha256:parent.closure_sha256,final_closure_file_sha256:parent.closure_file_sha256,
+      signer_key_id:parent.signer_key_id},
+    features:{skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+      remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,
+      full_regression_required:true,codex_live_binary_required:false,host_inline_native:true,native_hardware_observation:true,doctor_release_truth:true}
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(path.resolve(stateRoot),'evidence','release');await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r45-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',path:file,sha256:sha256(bytes),manifest_sha256:manifestSha256,parent:evidence.parent};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing R45 Windows gate evidence invalid');
+    insist(existing.version==='0.15.1'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing R45 Windows gate identity mismatch');
+    insist(existing.parent?.release_id===parent.release_id&&existing.parent?.final_closure_sha256===parent.closure_sha256,'existing R45 parent evidence mismatch');
+    return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256,parent:existing.parent};
+  }
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)writeWindowsGateEvidence().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/src/autonomous-runtime.mjs

@@ -1230,10 +1230,13 @@ async function runRequiredReleaseProfiles({ ctx, events, goal, state, policy, co
   return results;
 }
 
-async function collectNativeHead(state, nativeDiffRuntime, codingRuntime) {
+async function collectNativeHead(state, nativeDiffRuntime, codingRuntime, { requireCurrentState = true } = {}) {
   const diffBindings = []; const head = new Map();
   for (const item of state.diffs) {
-    const checked = await nativeDiffRuntime.verify({ diffId:item.diff_id });
+    const verifier = requireCurrentState
+      ? nativeDiffRuntime.verify.bind(nativeDiffRuntime)
+      : (nativeDiffRuntime.verifyEvidence ?? nativeDiffRuntime.verify).bind(nativeDiffRuntime);
+    const checked = await verifier({ diffId:item.diff_id });
     if (!checked.ok || !Array.isArray(checked.final_states)) throw new Error(`release diff '${item.diff_id}' verification failed`);
     diffBindings.push({ diff_id:item.diff_id, receipt_sha256:checked.receipt_sha256,
       coding_receipts_verified:checked.coding_receipts_verified });
@@ -1243,10 +1246,12 @@ async function collectNativeHead(state, nativeDiffRuntime, codingRuntime) {
     }
   }
   const finalSourceStates = [...head.values()].sort((a,b) => `${a.root_id}/${a.path}`.localeCompare(`${b.root_id}/${b.path}`));
-  for (const expected of finalSourceStates) {
-    const current = await codingRuntime.fileState({ rootId:expected.root_id, relativePath:expected.path });
-    if (current.exists !== expected.exists || current.sha256 !== expected.sha256) {
-      throw new Error(`release native HEAD mismatch '${expected.path}'`);
+  if (requireCurrentState) {
+    for (const expected of finalSourceStates) {
+      const current = await codingRuntime.fileState({ rootId:expected.root_id, relativePath:expected.path });
+      if (current.exists !== expected.exists || current.sha256 !== expected.sha256) {
+        throw new Error(`release native HEAD mismatch '${expected.path}'`);
+      }
     }
   }
   return { diffBindings, finalSourceStates };
@@ -1309,7 +1314,7 @@ async function verifyReleaseReceipt({ ctx, goal, events, policy, verifyKeyPath,
     return { ok:false, reason:'release profile evidence mismatch' };
   }
   let nativeHead;
-  try { nativeHead = await collectNativeHead(preCompletionState,nativeDiffRuntime,codingRuntime); }
+  try { nativeHead = await collectNativeHead(preCompletionState,nativeDiffRuntime,codingRuntime,{requireCurrentState:false}); }
   catch (error) { return { ok:false, reason:truncated(error) }; }
   if (canonicalJson(nativeHead.diffBindings) !== canonicalJson(body.native_diffs ?? [])) {
     return { ok:false, reason:'release native diff binding mismatch' };

package/src/capability-ledger.mjs

@@ -135,6 +135,7 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
   gateway('observation.search_cancel','machine_search_cancel','machine_observe','search_cancel','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.process_list','machine_process_list','machine_observe','process_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.system_status','machine_system_status','machine_observe','system_status','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.hardware_query','machine_hardware_query','machine_observe','hardware_query','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
 
   gateway('desktop.status','desktop_status','desktop_control','status','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.observe','desktop_observe','desktop_control','observe','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),

package/src/compact-gateway-mcp-tools.mjs

@@ -52,7 +52,8 @@ export const machineObserveInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('search_status'),search_id:hex64}),
   z.strictObject({op:z.literal('search_cancel'),search_id:hex64}),
   z.strictObject({op:z.literal('process_list'),limit:z.number().int().min(1).max(256).default(100),include_external:z.boolean().default(false),cursor:z.string().max(512).nullable().default(null)}),
-  z.strictObject({op:z.literal('system_status')})
+  z.strictObject({op:z.literal('system_status')}),
+  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])})
 ]);
 
 const capabilityManifestInputSchema=z.strictObject({});
@@ -114,7 +115,8 @@ async function machineObserve(args,machineRuntime,observationRuntime){
     search_status:r=>r.searchStatus({searchId:args.search_id}),
     search_cancel:r=>r.searchCancel({searchId:args.search_id}),
     process_list:r=>r.processList({limit:args.limit,includeExternal:args.include_external,cursor:args.cursor}),
-    system_status:r=>r.systemStatus()
+    system_status:r=>r.systemStatus(),
+    hardware_query:r=>r.hardwareQuery({query:args.query})
   };
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }

package/src/deadbyte-cli.mjs

@@ -10,12 +10,14 @@ import { defaultPublicKeyPath } from './trust.mjs';
 import { verifyAuditChain } from './audit-verify.mjs';
 import { openRemoteResultJournal, parseRemoteResultCursor } from './remote-result-journal.mjs';
 import { DEADBYTE_VERSION } from './version.mjs';
+import { printDoctor } from './doctor-r45.mjs';
 import { createLiveTimelineTracker, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine } from './remote-live-log.mjs';
 import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
   'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
+  'armdesktop','disarmdesktop','desktopstatus',
   'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
 ]);
 const SESSION_ARM=['armprocess','armcoding','armautonomous'];
@@ -35,17 +37,19 @@ const SUPERVISOR_COMMANDS=Object.freeze({
 function stateRoot(){return path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));}
 async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
 function printHelp(){
+  const exact=`deadbyte-mcp@${DEADBYTE_VERSION}`;
   process.stdout.write([
     'DEADBYTE MCP CLI','',
-    '  npx deadbyte-mcp@latest mcp                 # stdio MCP server for local clients',
-    '  npx deadbyte-mcp@latest remote              # unified foreground device session + live timeline',
-    '  npx deadbyte-mcp@latest remote --resume <cursor> # replay missed results, then reconnect',
-    '  npx deadbyte-mcp@latest remote status',
-    '  npx deadbyte-mcp@latest remote restart',
-    '  npx deadbyte-mcp@latest supervisor status',
-    '  npx deadbyte-mcp@latest supervisor recover',
-    '  npx deadbyte-mcp@latest audit verify',
-    '  npx deadbyte-mcp@latest audit status',''
+    `  npx -y ${exact} doctor              # verify current package/release truth`,
+    `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
+    `  npx -y ${exact} remote              # unified foreground device session + live timeline`,
+    `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
+    `  npx -y ${exact} remote status`,
+    `  npx -y ${exact} remote restart`,
+    `  npx -y ${exact} supervisor status`,
+    `  npx -y ${exact} supervisor recover`,
+    `  npx -y ${exact} audit verify`,
+    `  npx -y ${exact} audit status`,''
   ].join('\n'));
 }
 async function remoteContext(){
@@ -388,6 +392,10 @@ async function main(argv){
     process.stdout.write(`${DEADBYTE_VERSION}\n`);return;
   }
   if(!command||command==='help'||command==='--help'||command==='-h'){printHelp();return;}
+  if(command==='doctor'){
+    if(rest.length) throw new Error('doctor accepts no arguments');
+    await printDoctor();return;
+  }
   if(command==='mcp'){
     if(rest.length) throw new Error('mcp accepts no arguments');
     await import('./mcp-server.mjs');