deadbyte-mcp 0.15.0 → 0.15.2

package/test/r45-finalization.test.mjs

@@ -0,0 +1,84 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { validateFinalizerAuthorityStatus, validateWindowsGateEvidence } from '../scripts/finalize-r45.mjs';
+import { R45_PREDECESSOR_RELEASE_ID, R45_PREDECESSOR_MANIFEST } from '../scripts/release-parity-r45.mjs';
+
+const manifest='a'.repeat(64);
+const parent={
+  release_id:'v0.15.0-c15fa41719be61b3',
+  manifest_sha256:'c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483',
+  generation_manifest_sha256:'6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30',
+  closure_sha256:'533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667'
+};
+const features=()=>({
+  skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+  remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,
+  full_regression_required:true,codex_live_binary_required:false,
+  host_inline_native:true,native_hardware_observation:true,doctor_release_truth:true
+});
+const valid=()=>({
+  schema:'deadbyte.r45-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.1',
+  marker:'DEADBYTE V0.15.1 / R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS',
+  manifest_sha256:manifest,
+  parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+    generation_manifest_sha256:parent.generation_manifest_sha256,final_closure_sha256:parent.closure_sha256},
+  features:features()
+});
+
+test('R45 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED',()=>{
+  assert.equal(validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),true);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:false,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:false}),/Process standing grant/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:true,host_armed:false}),/Desktop DISARMED/);
+  assert.throws(()=>validateFinalizerAuthorityStatus({process_armed:true,coding_armed:true,autonomous_armed:true,desktop_armed:false,host_armed:true}),/Host DISARMED/);
+});
+
+test('R45 finalizer binds exact R44 parent and all Machine Freedom gate proofs',()=>{
+  assert.equal(validateWindowsGateEvidence(valid(),manifest,parent),true);
+  for(const key of ['host_inline_native','native_hardware_observation','doctor_release_truth']){
+    assert.throws(()=>validateWindowsGateEvidence({...valid(),features:{...features(),[key]:false}},manifest,parent),new RegExp(key));
+  }
+  assert.throws(()=>validateWindowsGateEvidence({...valid(),manifest_sha256:'b'.repeat(64)},manifest,parent),/candidate mismatch/);
+});
+
+test('R45 release machinery binds 0.15.1, 82/43 surfaces, Host v2 bootstrap and FINAL closure',async()=>{
+  const root=new URL('../',import.meta.url);
+  const text=rel=>readFile(new URL(rel,root),'utf8');
+  const [gate,parity,compactClient,writer,verifier,finalizer,evidence,manifestSource]=await Promise.all([
+    text('scripts/gate-windows-r45.ps1'),text('scripts/release-parity-r45.mjs'),text('src/remote-mcp-r45-parity-client.mjs'),text('scripts/final-closure-r45.mjs'),
+    text('scripts/final-closure-verify-r45.mjs'),text('scripts/finalize-r45.mjs'),text('scripts/windows-gate-evidence-r45.mjs'),text('scripts/release-manifest.mjs')
+  ]);
+  assert.equal(R45_PREDECESSOR_RELEASE_ID,parent.release_id);
+  assert.equal(R45_PREDECESSOR_MANIFEST,parent.manifest_sha256);
+  assert.match(gate,/host-policy-refresh/);assert.match(gate,/doctor/);assert.match(gate,/hardware-build/);
+  const hermetic=gate.indexOf('host-policy-hermetic-clean');
+  const focused=gate.indexOf('r45-feature-focused');
+  const regression=gate.indexOf("Invoke-GateStep -Name 'full-regression'");
+  const agentSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-agent-smoke'");
+  const containedSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-contained-smoke'");
+  const hostRefresh=gate.indexOf("Invoke-GateStep -Name 'host-policy-refresh'");
+  const manifestWrite=gate.indexOf("Invoke-GateStep -Name 'release-manifest-write'");
+  const hostSmoke=gate.indexOf("Invoke-GateStep -Name 'mcp-host-smoke'");
+  assert.ok(hermetic>=0&&focused>hermetic&&regression>focused&&agentSmoke>regression&&containedSmoke>agentSmoke&&hostRefresh>containedSmoke&&manifestWrite>hostRefresh&&hostSmoke>manifestWrite,'R45 gate must keep generated Host policy out of hermetic regression and non-Host smoke surfaces');
+  assert.match(gate,/DEADBYTE V0\.15\.1 \/ R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS/);
+  assert.match(parity,/tool_count===82/);assert.match(parity,/tool_count===43/);assert.match(compactClient,/hardware_query/);
+  assert.match(parity,/waitForExactPointer/);
+  assert.match(parity,/rollbackPair\.completed\.active_release===R45_PREDECESSOR_RELEASE_ID/);
+  assert.match(parity,/version:'0\.15\.0',manifestSha256:R45_PREDECESSOR_MANIFEST/);
+  assert.match(parity,/restorePair\.completed\.active_release===active\.release_id/);
+  assert.match(parity,/version:'0\.15\.1',manifestSha256:candidateManifest/);
+  assert.match(parity,/predecessor_disarmed\?\.tool_count===43/);
+  assert.doesNotMatch(parity,/predecessor_disarmed\?\.tool_count===42/);
+  assert.doesNotMatch(parity,/R45 exact R44 predecessor identity mismatch[^\n]*0\.14\.1/);
+  for(const source of [writer,verifier]){
+    assert.match(source,/DEADBYTE-R45-FINAL-CLOSURE-V1/);
+    assert.match(source,/deadbyte\.r45-final-closure\.v1/);
+    assert.match(source,/R45 MACHINE FREEDOM FINAL BASELINE/);
+  }
+  assert.match(finalizer,/--host-policy/);assert.match(finalizer,/--host-policy-sha256/);
+  assert.match(finalizer,/host_inline_native/);assert.match(finalizer,/native_hardware_observation/);assert.match(finalizer,/doctor_release_truth/);
+  assert.match(evidence,/host_inline_native:true/);assert.match(evidence,/native_hardware_observation:true/);assert.match(evidence,/doctor_release_truth:true/);
+  assert.match(manifestSource,/excludedPackagePrefixes = \[[^\]]*'tmp\/'[^\]]*'\.deadbyte-machine-fs-recovery\/'[^\]]*\]/);
+  assert.match(manifestSource,/excludedPackagePaths = new Set\(\['controller\/deadbyte-host-policy\.json'\]\)/);
+  assert.match(manifestSource,/excludedPackagePrefixes\.some\(prefix => rel\.startsWith\(prefix\)\)/);
+});

package/test/release-generation.test.mjs

@@ -16,7 +16,12 @@ function command(executable='C:/Windows/System32/cmd.exe'){
 test('R27 generation bundle rebinds authority and mutable state outside the release slot', async () => {
   const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-generation-'));
   const state=path.join(base,'state'),release=path.join(base,'release'),workspace=path.join(base,'workspace');
-  await mkdir(path.join(release,'scripts'),{recursive:true}); await mkdir(path.join(release,'bin'),{recursive:true}); await mkdir(workspace,{recursive:true});
+  const systemRoot=path.join(base,'Windows'),system32=path.join(systemRoot,'System32');
+  const powershellDir=path.join(system32,'WindowsPowerShell','v1.0');
+  await mkdir(path.join(release,'scripts'),{recursive:true}); await mkdir(path.join(release,'bin'),{recursive:true}); await mkdir(workspace,{recursive:true}); await mkdir(powershellDir,{recursive:true});
+  const cmdPath=path.join(system32,'cmd.exe'),cmdBytes=Buffer.from('target-cmd-bytes\\n');
+  const powershellPath=path.join(powershellDir,'powershell.exe'),powershellBytes=Buffer.from('target-powershell-bytes\\n');
+  await writeFile(cmdPath,cmdBytes); await writeFile(powershellPath,powershellBytes);
   await writeFile(path.join(release,'scripts','gate.ps1'),'Write-Output gate\n');
   await writeFile(path.join(release,'bin','deadbyte-process-host.exe'),'process-host-bytes\n');
   const desktopObserver=Buffer.from('desktop-observer-bytes\n');
@@ -47,7 +52,10 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   const processPolicy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:'C:/old/process-grant.json',state_dir:'C:/old/process-state',
     native_host:{path:'C:/old/deadbyte-process-host.exe',sha256:'0'.repeat(64)},
     roots:{core:{path:'C:/old/core',deny_paths:['node_modules']}},
-    profiles:{probe:{executable:'C:/Windows/System32/ping.exe',executable_sha256:EXE,root_ids:['core'],prefix_args:['127.0.0.1','-n','2'],max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{}}}};
+    profiles:{
+      ping_hold:{executable:'C:/stale/cmd.exe',executable_sha256:EXE,root_ids:['core'],prefix_args:['/d','/q'],transport:'pipe',max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{ping:'echo DEADBYTE_ACTION_PING\\r\\n'}},
+      powershell:{executable:'C:/stale/powershell.exe',executable_sha256:EXE,root_ids:['core'],prefix_args:['-NoLogo','-NoProfile','-NonInteractive','-Command'],transport:'pipe',max_args:1,max_arg_bytes:8192,max_sessions:4,max_input_bytes:65536,max_retained_output_bytes:1048576,env_allow:['PATH','TEMP','TMP','SystemRoot','WINDIR','USERPROFILE','PSModulePath','COMSPEC','PATHEXT'],input_actions:{}}
+    }};
   const desktopPolicy={schema:'deadbyte.desktop-policy.v1',enabled:true,grant_file:'C:/old/desktop-grant.json',evidence_dir:'C:/old/desktop-evidence',
     allowed_input_desktops:['Default'],allowed_actions:['click_primary','key_chord'],
     limits:{max_frame_age_ms:2000,max_frame_bytes:8388608,capture_timeout_ms:5000,input_timeout_ms:2000,ground_timeout_ms:5000,post_observe_timeout_ms:5000,max_preview_bytes:1048576,max_text_bytes:4096},
@@ -59,7 +67,8 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   await writeFile(path.join(development,'scripts','gate-windows-old.ps1'),'Write-Output old-gate\n');
   await writeFile(path.join(development,'scripts','gate-windows-current.ps1'),'Write-Output current-gate\n');
   await writeFile(path.join(development,'package.json'),JSON.stringify({scripts:{'gate:windows':'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-current.ps1'}}));
-  const result=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const build=args=>createGenerationBundle({...args,systemRoot});
+  const result=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   const verified=await verifyGenerationBundle(result.generation_root,result.generation_manifest_sha256);
   assert.equal(verified.files,7);
   const generatedProcess=JSON.parse(await readFile(result.process_policy_path,'utf8'));
@@ -68,6 +77,11 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   assert.equal(generatedProcess.roots.core.path,path.resolve(development));
   assert.equal(generatedProcess.native_host.path,path.join(path.resolve(release),'bin','deadbyte-process-host.exe'));
   assert.equal(generatedProcess.native_host.sha256,sha(Buffer.from('process-host-bytes\n')));
+  assert.equal(generatedProcess.profiles.ping_hold.executable,cmdPath);
+  assert.equal(generatedProcess.profiles.ping_hold.executable_sha256,sha(cmdBytes));
+  assert.equal(generatedProcess.profiles.powershell.executable,powershellPath);
+  assert.equal(generatedProcess.profiles.powershell.executable_sha256,sha(powershellBytes));
+  assert.deepEqual(generatedProcess.profiles.powershell.prefix_args,['-NoLogo','-NoProfile','-NonInteractive','-Command']);
   const generatedDesktop=JSON.parse(await readFile(result.desktop_policy_path,'utf8'));
   assert.equal(generatedDesktop.grant_file,path.join(path.resolve(state),'runtime','desktop-grant.json'));
   assert.equal(generatedDesktop.evidence_dir,path.join(path.resolve(state),'runtime','desktop-evidence'));
@@ -92,6 +106,7 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   assert.equal(generatedAuto.profiles.gate.script_sha256,sha(Buffer.from('Write-Output gate\n')));
   assert.equal(generatedAuto.profiles['windows-release'].script_path,'scripts/gate-windows-current.ps1');
   assert.equal(generatedAuto.profiles['windows-release'].script_sha256,sha(Buffer.from('Write-Output current-gate\n')));
+  assert.equal(generatedAuto.profiles['windows-release'].timeout_ms,600000);
   assert.equal(generatedAuto.profiles['windows-release'].description,'Full Windows target release gate; runs only when finish is requested.');
   const generatedHost=JSON.parse(await readFile(result.host_policy_path,'utf8'));
   assert.equal(generatedHost.roots.core.path,path.resolve(development));
@@ -128,44 +143,44 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   assert.match(path.basename(result.generation_root),/^v0\.8\.3-aaaaaaaaaaaaaaaa-g[0-9a-f]{16}$/);
   const changedConfig=structuredClone(currentConfig);
   changedConfig.Bridge.Arguments='bridge-v2.mjs';
-  const second=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:changedConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const second=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:changedConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(second.generation_root,result.generation_root);
   assert.notEqual(second.generation_seed_sha256,result.generation_seed_sha256);
   const endpointChanged=structuredClone(currentConfig);
   endpointChanged.McpUrlFileSha256='2'.repeat(64);
-  const third=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:endpointChanged,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const third=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:endpointChanged,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(third.generation_root,result.generation_root);
   assert.notEqual(third.generation_seed_sha256,result.generation_seed_sha256);
   const machineDisabled=structuredClone(currentConfig);
   machineDisabled.MachineRuntimeEnabled=false;
-  const fourth=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:machineDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const fourth=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:machineDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(fourth.generation_root,result.generation_root);
   assert.notEqual(fourth.generation_seed_sha256,result.generation_seed_sha256);
   const machineFsDisabled=structuredClone(currentConfig);
   machineFsDisabled.MachineFsRuntimeEnabled=false;
-  const fifth=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:machineFsDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const fifth=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:machineFsDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(fifth.generation_root,result.generation_root);
   assert.notEqual(fifth.generation_seed_sha256,result.generation_seed_sha256);
   const observationDisabled=structuredClone(currentConfig);
   observationDisabled.ObservationRuntimeEnabled=false;
-  const sixth=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:observationDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const sixth=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:observationDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(sixth.generation_root,result.generation_root);
   assert.notEqual(sixth.generation_seed_sha256,result.generation_seed_sha256);
   const desktopDisabled=structuredClone(currentConfig);
   desktopDisabled.DesktopRuntimeEnabled=false;
-  const desktopVariant=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:desktopDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const desktopVariant=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:desktopDisabled,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(desktopVariant.generation_root,result.generation_root);
   assert.notEqual(desktopVariant.generation_seed_sha256,result.generation_seed_sha256);
   const desktopTampered=structuredClone(desktopPolicy);
   desktopTampered.input.sha256='f'.repeat(64);
-  await assert.rejects(createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy:desktopTampered}),/desktop input helper SHA-256 mismatch/);
+  await assert.rejects(build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy:desktopTampered}),/desktop input helper SHA-256 mismatch/);
   const semanticConfig2Path=path.join(base,'semantic-lsp-v2.json');
   const semanticConfig2Bytes=Buffer.from(JSON.stringify({schema:'deadbyte.semantic-lsp-config.v1',servers:[{id:'changed'}]})+'\n','utf8');
   await writeFile(semanticConfig2Path,semanticConfig2Bytes);
   const semanticChanged=structuredClone(currentConfig);
   semanticChanged.SemanticLspConfigFile=semanticConfig2Path;
   semanticChanged.SemanticLspConfigSha256=sha(semanticConfig2Bytes);
-  const seventh=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:semanticChanged,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  const seventh=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:semanticChanged,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(seventh.generation_root,result.generation_root);
   assert.notEqual(seventh.generation_seed_sha256,result.generation_seed_sha256);
   await verifyGenerationBundle(result.generation_root,result.generation_manifest_sha256);

package/test/release-version.test.mjs

@@ -2,58 +2,124 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
-const root=new URL('../',import.meta.url);const text=rel=>readFile(new URL(rel,root),'utf8');
-const PARENT_RELEASE='v0.14.1-0a5a833892593283';
-const PARENT_MANIFEST='0a5a8338925932830986421dda60ec5643f62f600404de4992fda2a5e79d09a9';
-const PARENT_CLOSURE='2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b';
 
-test('R44 current authority agrees on V0.15.0 and preserves exact sealed R43 parent',async()=>{
+const root=new URL('../',import.meta.url);
+const text=rel=>readFile(new URL(rel,root),'utf8');
+const PARENT_RELEASE='v0.15.1-d55f00b5144dc31a';
+const PARENT_MANIFEST='d55f00b5144dc31a7fe39e4dc60d640a94780da6aaeca0918e87636b816d7854';
+const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
+
+test('R46 current authority agrees on V0.15.2 and preserves exact R45 parent identity',async()=>{
   const pkg=JSON.parse(await text('package.json'));
-  const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,parent,r43Gate,r43Parity,r43Closure]=await Promise.all([
-    text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r44.ps1'),text('README.txt'),
-    text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),text('scripts/deferred-slot-operation-r44.mjs'),
-    text('scripts/release-parity-r44.mjs'),text('scripts/final-closure-r44.mjs'),text('scripts/final-closure-verify-r44.mjs'),
-    text('scripts/windows-gate-evidence-r44.mjs'),text('R44-PARENT.json'),
-    text('scripts/gate-windows-r43.ps1'),text('scripts/release-parity-r43.mjs'),text('scripts/final-closure-r43.mjs')
+  const release=JSON.parse(await text('RELEASE.json'));
+  const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,processPolicy]=await Promise.all([
+    text('src/version.mjs'),
+    text('controller/deadbyte-controller.ps1'),
+    text('scripts/gate-windows-r46.ps1'),
+    text('README.txt'),
+    text('docs/ARCHITECTURE.md'),
+    text('controller/README.TXT'),
+    text('scripts/deferred-slot-operation-r46.mjs'),
+    text('scripts/release-parity-r46.mjs'),
+    text('scripts/final-closure-r46.mjs'),
+    text('scripts/final-closure-verify-r46.mjs'),
+    text('scripts/windows-gate-evidence-r46.mjs'),
+    text('controller/deadbyte-process-policy.json')
   ]);
-  assert.equal(pkg.version,'0.15.0');
-  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r44.ps1');
-  assert.equal(pkg.scripts['r44:parent:verify'],'node scripts/verify-r44-parent.mjs');
-  assert.equal(pkg.scripts['r44:full:test'],'node scripts/full-regression-r44.mjs');
-  assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r44.mjs');
-  assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r44.mjs');
-  assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r44.mjs');
-  assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r44.mjs');
-  assert.equal(pkg.scripts['finalize:r44'],'node scripts/finalize-r44.mjs');
-  assert.match(version,/DEADBYTE_VERSION = '0\.15\.0'/);
-  assert.match(controller,/CONTROLLER V0\.15\.0 \/ R44/);
-  assert.match(gate,/DEADBYTE V0\.15\.0 \/ R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS/);
-  assert.match(readme,/^DEADBYTE MCP V0\.15\.0 \/ R44 REMOTE AGENT \+ SKILL BASELINE$/m);
-  assert.match(architecture,/^# DEADBYTE MCP V0\.15\.0 \/ R44 ARCHITECTURE$/m);
-  assert.match(controllerReadme,/^DEADBYTE MCP V0\.15\.0 \/ R44 CONTROLLER$/m);
-  assert.match(deferred,/--expected-version','0\.15\.0'/);
-  assert.match(parity,/R44_PREDECESSOR_RELEASE_ID='v0\.14\.1-0a5a833892593283'/);assert.match(parity,new RegExp(PARENT_MANIFEST));
-  assert.match(parity,/tool_count===81/);assert.match(parity,/tool_count===43/);
-  assert.match(closure,/version:'0\.15\.0'/);assert.match(closure,/DEADBYTE-R44-FINAL-CLOSURE-V1/);
-  assert.match(closureVerify,/R44_FULL_TOOL_COUNT=81/);assert.match(closureVerify,/R44_COMPACT_TOOL_COUNT=43/);
-  assert.match(windowsGate,/deadbyte\.r44-windows-gate\.v1/);
-  const parentRecord=JSON.parse(parent);
-  assert.equal(parentRecord.parent_release_id,PARENT_RELEASE);assert.equal(parentRecord.parent_manifest_sha256,PARENT_MANIFEST);
-  assert.equal(parentRecord.parent_final_closure_sha256,PARENT_CLOSURE);
-  assert.match(r43Gate,/DEADBYTE V0\.14\.1 \/ R43 AUTHORITY HARDENING WINDOWS BATCH GATE: PASS/);
-  assert.match(r43Parity,/deadbyte\.r43-parity\.v1/);assert.match(r43Closure,/version:'0\.14\.1'/);
+
+  assert.equal(pkg.version,'0.15.2');
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1');
+  assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r46.mjs');
+  assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r46.mjs');
+  assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r46.mjs');
+  assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r46.mjs');
+  assert.equal(pkg.scripts['r46:fileless:test'],"node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs");
+  assert.equal(pkg.scripts['r46:full:test'],'node scripts/full-regression-r46.mjs');
+
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.2'/);
+  assert.match(controller,/CONTROLLER V0\.15\.2 \/ R46/);
+  assert.match(gate,/DEADBYTE V0\.15\.2 \/ R46 FILELESS POWERSHELL WINDOWS BATCH GATE: PASS/);
+  assert.match(readme,/^DEADBYTE MCP V0\.15\.2 \/ R46 FILELESS POWERSHELL PRODUCT BASELINE$/m);
+  assert.match(readme,/powershell\.exe -Command <source>/);
+  assert.match(architecture,/^# DEADBYTE MCP V0\.15\.2 \/ R46 ARCHITECTURE$/m);
+  assert.match(controllerReadme,/^DEADBYTE MCP V0\.15\.2 \/ R46 CONTROLLER$/m);
+  assert.match(deferred,/--expected-version','0\.15\.2'/);
+  assert.match(parity,/deadbyte\.r46-parity\.v1/);
+  assert.match(parity,/DB_R46_FILELESS_PARITY/);
+  assert.match(parity,/target_repin_verified:true/);
+  assert.match(parity,/DB_R46_REPL_VALUE=42/);
+  assert.match(parity,/raw_input_not_journaled:true/);
+  assert.match(parity,/eviction_verified:true/);
+  assert.match(windowsGate,/full_tool_count:83/);
+  assert.match(windowsGate,/remote_reachability_ttl:true/);
+  assert.match(windowsGate,/observation_search_terminal_ttl:true/);
+  assert.match(windowsGate,/observation_search_hard_cap:128/);
+  assert.match(closure,/deadbyte\.r46-final-closure\.v1/);
+  assert.match(closure,/DEADBYTE-R46-FINAL-CLOSURE-V1/);
+  assert.match(closureVerify,/DEADBYTE-R46-FINAL-CLOSURE-V1/);
+  assert.match(windowsGate,/deadbyte\.r46-windows-gate\.v1/);
+
+  assert.equal(release.version,'0.15.2');
+  assert.equal(release.train,'R46');
+  assert.equal(release.label,'FILELESS POWERSHELL PRODUCT BASELINE');
+  assert.equal(release.parent.release_id,PARENT_RELEASE);
+  assert.equal(release.parent.manifest_sha256,PARENT_MANIFEST);
+  assert.equal(release.parent.generation_manifest_sha256,PARENT_GENERATION);
+  assert.deepEqual(release.capabilities.process_profiles,['ping_hold','powershell','powershell_repl']);
+  assert.equal(release.capabilities.full_tool_count,83);
+  assert.equal(release.capabilities.compact_tool_count,43);
+  assert.equal(release.capabilities.powershell_persistent_repl,true);
+  assert.equal(release.capabilities.process_raw_input_profile_opt_in,true);
+  assert.equal(release.capabilities.powershell_fileless,true);
+  assert.equal(release.capabilities.powershell_source_max_arg_bytes,8192);
+
+  const policy=JSON.parse(processPolicy);
+  assert.ok(policy.profiles.ping_hold);
+  assert.ok(policy.profiles.powershell);
+  assert.ok(policy.profiles.powershell_repl);
+  assert.equal(policy.profiles.powershell_repl.allow_raw_input,true);
+  assert.deepEqual(policy.profiles.powershell_repl.prefix_args,['-NoLogo','-NoProfile','-NonInteractive']);
+  assert.deepEqual(policy.profiles.powershell.prefix_args,['-NoLogo','-NoProfile','-NonInteractive','-Command']);
+  assert.equal(policy.profiles.powershell.max_args,1);
+  assert.equal(policy.profiles.powershell.max_arg_bytes,8192);
+  assert.equal(policy.profiles.powershell.transport,'pipe');
 });
 
-test('R44 keeps ONLINE reuse and explicit Desktop authority',async()=>{
-  const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);
-  assert.match(cli,/controllerRuntimeReady/);assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);
-  const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);
-  assert.ok(start>=0&&end>start);const block=controller.slice(start,end);
-  assert.doesNotMatch(block,/\$host\s*=/i);assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);
-  assert.match(controller,/armdesktop/);assert.match(controller,/disarmdesktop/);
+test('R46 leaves sealed R45 release artifacts historical and unchanged in identity',async()=>{
+  const [gate,deferred,parity,closure,closureVerify,finalizer,parent]=await Promise.all([
+    text('scripts/gate-windows-r45.ps1'),
+    text('scripts/deferred-slot-operation-r45.mjs'),
+    text('scripts/release-parity-r45.mjs'),
+    text('scripts/final-closure-r45.mjs'),
+    text('scripts/final-closure-verify-r45.mjs'),
+    text('scripts/finalize-r45.mjs'),
+    text('R45-PARENT.json')
+  ]);
+  assert.match(gate,/DEADBYTE V0\.15\.1 \/ R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS/);
+  assert.match(deferred,/--expected-version','0\.15\.1'/);
+  assert.match(parity,/deadbyte\.r45-parity\.v1/);
+  assert.match(closure,/version:'0\.15\.1'/);
+  assert.match(closure,/DEADBYTE-R45-FINAL-CLOSURE-V1/);
+  assert.match(closureVerify,/R45_FULL_TOOL_COUNT=82/);
+  assert.match(finalizer,/EXPECTED_VERSION='0\.15\.1'/);
+  const parentRecord=JSON.parse(parent);
+  assert.equal(parentRecord.parent_release_id,'v0.15.0-c15fa41719be61b3');
 });
 
-test('semantic config remains byte-pinned across R44 feature work',async()=>{
-  const semantic=await text('controller/deadbyte-semantic-lsp-config.json');
+test('R46 keeps ONLINE reuse, explicit Desktop authority, and semantic config pin',async()=>{
+  const [cli,controller,semantic]=await Promise.all([
+    text('src/deadbyte-cli.mjs'),
+    text('controller/deadbyte-controller.ps1'),
+    text('controller/deadbyte-semantic-lsp-config.json')
+  ]);
+  assert.match(cli,/controllerRuntimeReady/);
+  assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);
+  const start=controller.indexOf('function Recover-AutonomousSupervisor'),end=controller.indexOf('function Show-State',start);
+  assert.ok(start>=0&&end>start);
+  const block=controller.slice(start,end);
+  assert.doesNotMatch(block,/\$host\s*=/i);
+  assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);
+  assert.match(controller,/armdesktop/);
+  assert.match(controller,/disarmdesktop/);
   assert.equal(createHash('sha256').update(Buffer.from(semantic,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');
 });

package/test/remote-device-r44.test.mjs

@@ -102,3 +102,78 @@ test('R44 remote state corruption fails closed',async()=>{
     await assert.rejects(createRemoteDevicePlaneR44({stateDir:root,relay:new FakeRelay(),authorizeCapability:async()=>true}),/state JSON invalid/);
   }finally{await rm(root,{recursive:true,force:true});}
 });
+
+
+test('R46 remote readiness probe retries only the idempotent probe and remains bounded by timeout',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r46-remote-probe-timeout-'));
+  const key=deviceKey();
+  let attempts=0;
+  const relay={
+    requests:[],
+    async probe(value){
+      attempts+=1;
+      if(attempts===1) return await new Promise(()=>{});
+      return {device_id:value.device_id,epoch:value.epoch,nonce:value.nonce,ready:true};
+    },
+    async request(value){this.requests.push(value);return {ack:'accepted',request_id:value.request_id,terminal:{status:'completed',result_sha256:'a'.repeat(64)}};}
+  };
+  try{
+    const plane=await createRemoteDevicePlaneR44({
+      stateDir:root,relay,authorizeCapability:async()=>true,
+      relayTimeoutMs:100,probeRetries:1,reachableTtlMs:5000
+    });
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'retry-c'});
+    const ready=await plane.probe({deviceId:key.deviceId,epoch:1});
+    assert.equal(attempts,2);
+    assert.equal(ready.reachable,true);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R46 remote reachability expires after the bounded probe freshness window',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r46-remote-stale-'));
+  const relay=new FakeRelay(),key=deviceKey();
+  try{
+    const plane=await createRemoteDevicePlaneR44({
+      stateDir:root,relay,authorizeCapability:async()=>true,
+      relayTimeoutMs:1000,probeRetries:0,reachableTtlMs:1000
+    });
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'stale-c'});
+    await plane.probe({deviceId:key.deviceId,epoch:1});
+    assert.equal((await plane.status({deviceId:key.deviceId})).reachable,true);
+    await new Promise(resolve=>setTimeout(resolve,1100));
+    assert.equal((await plane.status({deviceId:key.deviceId})).reachable,false);
+    await assert.rejects(
+      plane.dispatch({deviceId:key.deviceId,epoch:1,capabilityId:'machine.status',payload:{},requestId:'8'.repeat(64)}),
+      /not reachable|stale/i
+    );
+    assert.equal(relay.requests.length,0);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('R46 remote dispatch timeout is not retried and downgrades reachability',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r46-remote-dispatch-timeout-'));
+  const key=deviceKey();
+  let requestCount=0;
+  const relay={
+    async probe(value){return {device_id:value.device_id,epoch:value.epoch,nonce:value.nonce,ready:true};},
+    async request(){requestCount+=1;return await new Promise(()=>{});}
+  };
+  try{
+    const plane=await createRemoteDevicePlaneR44({
+      stateDir:root,relay,authorizeCapability:async()=>true,
+      relayTimeoutMs:100,probeRetries:0,reachableTtlMs:5000
+    });
+    await plane.pair({publicKeySpkiBase64:key.spki,displayName:'lab'});
+    await plane.reportOnline({deviceId:key.deviceId,epoch:1,connectionId:'dispatch-c'});
+    await plane.probe({deviceId:key.deviceId,epoch:1});
+    const result=await plane.dispatch({
+      deviceId:key.deviceId,epoch:1,capabilityId:'coding.file_read',payload:{path:'README.md'},requestId:'9'.repeat(64)
+    });
+    assert.equal(result.state,'failed');
+    assert.equal(result.error_code,'transport_error');
+    assert.equal(requestCount,1,'side-effecting dispatch must never auto-retry');
+    assert.equal((await plane.status({deviceId:key.deviceId})).reachable,false);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/remote-r24-catalog.test.mjs

@@ -32,10 +32,10 @@ test('R29 remote gate accepts machine plane as an exact optional catalog dimensi
   assert.match(source, /if \(machine\) items\.push\(\.\.\.machineTools\)/);
   assert.match(source, /machine_runtime: machineRuntime/);
 });
-test('R32 remote gate accepts six-tool process supervision as one exact optional catalog dimension', async () => {
+test('R46 remote gate accepts seven-tool process supervision as one exact optional catalog dimension', async () => {
   const source = await readFile(sourcePath, 'utf8');
   assert.match(source, /const processTools = \[/);
-  for (const name of ['process_session_start','process_session_read','process_session_status','process_session_list','process_session_terminate','process_session_action']) {
+  for (const name of ['process_session_start','process_session_read','process_session_status','process_session_list','process_session_terminate','process_session_action','process_session_write']) {
     assert.match(source, new RegExp(`'${name}'`));
   }
   assert.match(source, /for \(const processPlane of \[false, true\]\)/);

package/test/runtime-host-bootstrap-r45.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { parseUpdateArgs, prepareHostPolicyBootstrap } from '../scripts/runtime-self-update.mjs';
+
+const hex=ch=>ch.repeat(64);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('R45 slot-update CLI binds Host policy bootstrap as one exact path plus SHA-256 pair',()=>{
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.15.1','--expected-manifest',hex('a')];
+  assert.throws(()=>parseUpdateArgs([...base,'--host-policy','C:/candidate/host.json']),/host policy.*pair/i);
+  assert.throws(()=>parseUpdateArgs([...base,'--host-policy-sha256',hex('b')]),/host policy.*pair/i);
+  const parsed=parseUpdateArgs([...base,'--host-policy','C:/candidate/host.json','--host-policy-sha256',hex('b')]);
+  assert.equal(parsed.hostPolicyBootstrap.path,path.resolve('C:/candidate/host.json'));
+  assert.equal(parsed.hostPolicyBootstrap.sha256,hex('b'));
+});
+
+test('R45 Host policy bootstrap accepts exact v2 bytes and rejects hash or native contract drift',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r45-host-bootstrap-'));
+  const file=path.join(root,'host.json');
+  const policy={
+    schema:'deadbyte.host-policy.v2',enabled:true,arm_file:'C:/state/host-grant.json',
+    roots:{core:{path:'C:/core',read:true,write:true,exec:true}},
+    commands:{node_inline:{kind:'inline',executable:'C:/node.exe',executable_sha256:hex('1'),root_ids:['core'],prefix_args:['-e'],timeout_ms:1000,max_output_bytes:4096,max_command_chars:1024}},
+    native_exec:{enabled:true,root_ids:['core'],timeout_ms:1000,max_output_bytes:4096,max_args:8,max_arg_chars:1024}
+  };
+  const bytes=Buffer.from(JSON.stringify(policy)+'\n','utf8'); await writeFile(file,bytes);
+  const accepted=await prepareHostPolicyBootstrap({path:file,sha256:sha(bytes)});
+  assert.equal(accepted.sha256,sha(bytes)); assert.deepEqual(accepted.policy,policy);
+  await assert.rejects(prepareHostPolicyBootstrap({path:file,sha256:hex('f')}),/host policy.*SHA-256 mismatch/i);
+  const bad=path.join(root,'bad.json');
+  const badBytes=Buffer.from(JSON.stringify({...policy,native_exec:{...policy.native_exec,enabled:false}})+'\n','utf8');
+  await writeFile(bad,badBytes);
+  await assert.rejects(prepareHostPolicyBootstrap({path:bad,sha256:sha(await readFile(bad))}),/native_exec contract/i);
+});
+
+test('R45 updater threads the bootstrapped Host v2 policy into successor generation',async()=>{
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/prepareHostPolicyBootstrap\(hostPolicyBootstrap\)/);
+  assert.match(source,/control\.hostPolicy=hostBootstrap\.policy/);
+  assert.match(source,/hostPolicy:control\.hostPolicy/);
+  assert.match(source,/hostPolicyBootstrap:args\.hostPolicyBootstrap/);
+});