deadbyte-mcp 0.15.1 → 0.15.2

package/scripts/gate-windows-r46.ps1

@@ -0,0 +1,56 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+
+function Invoke-GateStep {
+    param(
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $true)][string[]]$NpmArgs
+    )
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) {
+        throw "DEADBYTE V0.15.2 / R46 gate failed at $Name with exit code $LASTEXITCODE"
+    }
+}
+
+Invoke-GateStep -Name 'containment-build' -NpmArgs @('run','containment:build')
+Invoke-GateStep -Name 'process-policy-refresh' -NpmArgs @('run','process:policy:refresh')
+Invoke-GateStep -Name 'desktop-policy-refresh' -NpmArgs @('run','desktop:policy:refresh')
+Invoke-GateStep -Name 'hardware-build' -NpmArgs @('run','hardware:build')
+
+Write-Host '==== host-policy-hermetic-clean ===='
+$HostPolicyPath = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $HostPolicyPath -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $HostPolicyPath) {
+    throw "DEADBYTE V0.15.2 / R46 gate could not remove machine-local Host policy before hermetic regression"
+}
+Write-Host 'HOST_POLICY_HERMETIC_ABSENT'
+
+Invoke-GateStep -Name 'r46-fileless-focused' -NpmArgs @('run','r46:fileless:test')
+Invoke-GateStep -Name 'full-regression' -NpmArgs @('run','r46:full:test')
+Invoke-GateStep -Name 'mcp-smoke' -NpmArgs @('run','mcp:smoke')
+Invoke-GateStep -Name 'mcp-agent-smoke' -NpmArgs @('run','mcp:agent:smoke')
+Invoke-GateStep -Name 'mcp-coding-smoke' -NpmArgs @('run','mcp:coding:smoke')
+Invoke-GateStep -Name 'mcp-machine-fs-smoke' -NpmArgs @('run','mcp:machine-fs:smoke')
+Invoke-GateStep -Name 'mcp-observation-smoke' -NpmArgs @('run','mcp:observation:smoke')
+Invoke-GateStep -Name 'mcp-process-smoke' -NpmArgs @('run','mcp:process:smoke')
+Invoke-GateStep -Name 'mcp-autonomous-smoke' -NpmArgs @('run','mcp:autonomous:smoke')
+Invoke-GateStep -Name 'tunnel-stdio-compat-smoke' -NpmArgs @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep -Name 'containment-smoke' -NpmArgs @('run','containment:smoke')
+Invoke-GateStep -Name 'contained-smoke' -NpmArgs @('run','contained:smoke')
+Invoke-GateStep -Name 'mcp-contained-smoke' -NpmArgs @('run','mcp:contained:smoke')
+
+Invoke-GateStep -Name 'host-policy-refresh' -NpmArgs @('run','host:policy:init')
+Invoke-GateStep -Name 'release-manifest-write' -NpmArgs @('run','manifest:write')
+Invoke-GateStep -Name 'release-manifest' -NpmArgs @('run','manifest:verify')
+Invoke-GateStep -Name 'doctor' -NpmArgs @('run','doctor')
+Invoke-GateStep -Name 'mcp-host-smoke' -NpmArgs @('run','mcp:host:smoke')
+Invoke-GateStep -Name 'authority-smoke' -NpmArgs @('run','authority:smoke')
+Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run','manifest:verify')
+
+Write-Host '==== windows-gate-evidence ===='
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r46.mjs')
+if ($LASTEXITCODE -ne 0) {
+    throw "DEADBYTE V0.15.2 / R46 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
+}
+Write-Host '==== DEADBYTE V0.15.2 / R46 FILELESS POWERSHELL WINDOWS BATCH GATE: PASS ===='

package/scripts/refresh-process-policy.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { open, readFile, rename, rm } from 'node:fs/promises';
+import { lstat, open, readFile, rename, rm } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -14,7 +14,35 @@ function samePath(a, b) {
     : left === right;
 }
 
-export async function refreshProcessPolicy({ repoRoot, policyPath }) {
+async function regularPinnedExecutable(file, label) {
+  const info = await lstat(file);
+  if (!info.isFile() || info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);
+  return sha256(await readFile(file));
+}
+
+function resolveSystemRoot(explicit) {
+  const value = explicit ?? process.env.SystemRoot ?? process.env.WINDIR ?? null;
+  if (typeof value !== 'string' || value.length < 1) {
+    throw new Error('process policy Windows system profiles require SystemRoot/WINDIR');
+  }
+  return path.resolve(value);
+}
+
+async function refreshSystemProfile(policy, id, expectedExecutable) {
+  const profile = policy?.profiles?.[id];
+  if (!profile || typeof profile !== 'object' || Array.isArray(profile)) {
+    throw new Error(`process policy profile '${id}' missing`);
+  }
+  if (typeof profile.executable !== 'string' || !samePath(profile.executable, expectedExecutable)) {
+    throw new Error(`process policy profile '${id}' executable path mismatch`);
+  }
+  const digest = await regularPinnedExecutable(expectedExecutable, `process profile '${id}'`);
+  profile.executable = expectedExecutable;
+  profile.executable_sha256 = digest;
+  return digest;
+}
+
+export async function refreshProcessPolicy({ repoRoot, policyPath, systemRoot = null }) {
   const root = path.resolve(repoRoot);
   const file = path.resolve(policyPath);
   const rawBytes = await readFile(file);
@@ -29,9 +57,16 @@ export async function refreshProcessPolicy({ repoRoot, policyPath }) {
   if (!samePath(policy.native_host.path, expectedHost)) {
     throw new Error('process policy native_host path must equal candidate bin/deadbyte-process-host.exe');
   }
-  const hostBytes = await readFile(expectedHost);
-  const hostSha = sha256(hostBytes);
+  const hostSha = await regularPinnedExecutable(expectedHost, 'process native host');
   policy.native_host.sha256 = hostSha;
+
+  const windowsRoot = resolveSystemRoot(systemRoot);
+  const cmdPath = path.join(windowsRoot, 'System32', 'cmd.exe');
+  const powershellPath = path.join(windowsRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+  const cmdSha = await refreshSystemProfile(policy, 'ping_hold', cmdPath);
+  const powershellSha = await refreshSystemProfile(policy, 'powershell', powershellPath);
+  const powershellReplSha = await refreshSystemProfile(policy, 'powershell_repl', powershellPath);
+
   const output = Buffer.from(`${JSON.stringify(policy, null, 2)}\n`, 'utf8');
   const temp = `${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
   const handle = await open(temp, 'wx');
@@ -47,8 +82,30 @@ export async function refreshProcessPolicy({ repoRoot, policyPath }) {
     await rm(temp, { force: true }).catch(() => {});
     throw error;
   }
-  if (sha256(await readFile(expectedHost)) !== hostSha) throw new Error('process native host changed during policy refresh');
-  return { policy_path: file, native_host_path: expectedHost, native_host_sha256: hostSha };
+
+  if (await regularPinnedExecutable(expectedHost, 'process native host') !== hostSha) {
+    throw new Error('process native host changed during policy refresh');
+  }
+  if (await regularPinnedExecutable(cmdPath, "process profile 'ping_hold'") !== cmdSha) {
+    throw new Error("process profile 'ping_hold' changed during policy refresh");
+  }
+  if (await regularPinnedExecutable(powershellPath, "process profile 'powershell'") !== powershellSha) {
+    throw new Error("process profile 'powershell' changed during policy refresh");
+  }
+  if (await regularPinnedExecutable(powershellPath, "process profile 'powershell_repl'") !== powershellReplSha) {
+    throw new Error("process profile 'powershell_repl' changed during policy refresh");
+  }
+
+  return {
+    policy_path: file,
+    native_host_path: expectedHost,
+    native_host_sha256: hostSha,
+    cmd_executable: cmdPath,
+    cmd_executable_sha256: cmdSha,
+    powershell_executable: powershellPath,
+    powershell_executable_sha256: powershellSha,
+    powershell_repl_executable_sha256: powershellReplSha
+  };
 }
 
 const invoked = process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url;
@@ -60,7 +117,7 @@ if (invoked) {
     : path.join(root, 'controller', 'deadbyte-process-policy.json');
   try {
     const result = await refreshProcessPolicy({ repoRoot: root, policyPath });
-    console.log(`PROCESS_POLICY_REFRESH_OK sha256=${result.native_host_sha256}`);
+    console.log(`PROCESS_POLICY_REFRESH_OK native=${result.native_host_sha256} cmd=${result.cmd_executable_sha256} powershell=${result.powershell_executable_sha256} powershell_repl=${result.powershell_repl_executable_sha256}`);
   } catch (error) {
     console.error(`PROCESS_POLICY_REFRESH_FAIL ${error?.message ?? error}`);
     process.exitCode = 1;

package/scripts/release-parity-r46.mjs

@@ -0,0 +1,187 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyGenerationBundle } from '../src/release-generation.mjs';
+import { loadProcessPolicy, processSessionStatus } from '../src/process-policy.mjs';
+import { createProcessRuntime } from '../src/process-runtime.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+function insist(ok,message){if(!ok)throw new Error(message);}
+function samePath(a,b){return path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();}
+
+async function waitForExit(runtime,sessionId,timeoutMs=10000){
+  const deadline=Date.now()+timeoutMs;
+  let page=null,text='';
+  while(Date.now()<deadline){
+    page=await runtime.read({sessionId,offset:0,maxBytes:65536});
+    text=Buffer.from(page.data_base64,'base64').toString('utf8');
+    if(page.state==='exited'||page.state==='terminated') return {page,text};
+    await sleep(50);
+  }
+  throw new Error('R46 PowerShell parity timed out');
+}
+
+export async function runReleaseParity({
+  root=packageRoot,
+  runtimeStateRoot=stateRoot,
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(root);
+  const state=path.resolve(runtimeStateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.15.2','R46 parity requires package version 0.15.2');
+
+  const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+  insist(pointer.version==='0.15.2'&&pointer.manifest_sha256===manifestSha256,'R46 active pointer candidate mismatch');
+  insist(pointer.release_id===`v0.15.2-${manifestSha256.slice(0,16)}`,'R46 active release id mismatch');
+  const releaseManifest=await readFile(path.join(pointer.release_root,'MANIFEST.SHA256'));
+  insist(sha256(releaseManifest)===manifestSha256,'R46 immutable release manifest mismatch');
+
+  const generation=await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
+  const processPolicyPath=path.join(pointer.generation_root,'process-policy.json');
+  const policy=await loadProcessPolicy(processPolicyPath);
+  const status=await processSessionStatus(policy);
+  insist(status.armed===true&&status.reason==='standing-grant','R46 parity requires restored Process standing grant');
+  insist(status.profile_ids.includes('powershell')&&status.root_ids.includes('core'),'R46 parity Process grant missing powershell/core');
+
+  const systemRoot=process.env.SystemRoot||process.env.WINDIR;
+  insist(typeof systemRoot==='string'&&systemRoot.length>0,'R46 parity requires SystemRoot/WINDIR');
+  const expectedPowerShell=path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe');
+  const expectedCmd=path.join(systemRoot,'System32','cmd.exe');
+  insist(samePath(policy.profiles?.powershell?.executable,expectedPowerShell),'R46 generated PowerShell path is not target-bound');
+  insist(samePath(policy.profiles?.ping_hold?.executable,expectedCmd),'R46 generated cmd path is not target-bound');
+  insist(policy.profiles.powershell.executable_sha256===sha256(await readFile(expectedPowerShell)),'R46 generated PowerShell digest mismatch');
+  insist(policy.profiles.ping_hold.executable_sha256===sha256(await readFile(expectedCmd)),'R46 generated cmd digest mismatch');
+  insist(JSON.stringify(policy.profiles.powershell.prefix_args)===JSON.stringify(['-NoLogo','-NoProfile','-NonInteractive','-Command']),'R46 PowerShell prefix contract mismatch');
+  insist(policy.profiles.powershell.max_args===1&&policy.profiles.powershell.max_arg_bytes===8192,'R46 PowerShell argument bounds mismatch');
+
+  const runtime=createProcessRuntime({
+    policy,
+    signingKeyPath:path.join(state,'trust','ed25519-private.pem'),
+    verifyKeyPath:path.join(state,'trust','ed25519-public.pem')
+  });
+  const source="$ErrorActionPreference='Stop';$before=@(Get-ChildItem -LiteralPath $env:TEMP -Filter '*.ps1' -File -ErrorAction SilentlyContinue|ForEach-Object{$_.FullName});[Console]::WriteLine('DB_R46_FILELESS_PARITY');[Console]::WriteLine('PSCommandPath=' + [string]$PSCommandPath);[Console]::WriteLine('InvocationPath=' + [string]$MyInvocation.MyCommand.Path);$after=@(Get-ChildItem -LiteralPath $env:TEMP -Filter '*.ps1' -File -ErrorAction SilentlyContinue|ForEach-Object{$_.FullName});$new=@($after|Where-Object{$_ -notin $before});[Console]::WriteLine('NEW_TEMP_PS1_COUNT=' + $new.Count)";
+  const started=await runtime.start({profileId:'powershell',rootId:'core',cwd:'.',args:[source]});
+  const observed=await waitForExit(runtime,started.session_id);
+  insist(observed.page.state==='exited'&&observed.page.exit_code===0,'R46 PowerShell parity process did not exit cleanly');
+  insist(/DB_R46_FILELESS_PARITY/.test(observed.text),'R46 PowerShell parity marker missing');
+  insist(/PSCommandPath=\r?\n/.test(observed.text),'R46 PowerShell unexpectedly materialized PSCommandPath');
+  insist(/InvocationPath=\r?\n/.test(observed.text),'R46 PowerShell invocation path is not fileless');
+  insist(/NEW_TEMP_PS1_COUNT=0/.test(observed.text),'R46 PowerShell parity created a temp ps1');
+  const journal=await runtime.verifyEventJournal({sessionId:started.session_id});
+  insist(journal.ok===true,'R46 PowerShell process journal verification failed');
+
+
+  insist(status.profile_ids.includes('powershell_repl'),'R46 parity Process grant missing powershell_repl');
+  insist(samePath(policy.profiles?.powershell_repl?.executable,expectedPowerShell),'R46 generated PowerShell REPL path is not target-bound');
+  insist(policy.profiles.powershell_repl.executable_sha256===sha256(await readFile(expectedPowerShell)),'R46 generated PowerShell REPL digest mismatch');
+  insist(policy.profiles.powershell_repl.allow_raw_input===true&&policy.profiles.powershell_repl.transport==='pipe','R46 PowerShell REPL raw-input contract mismatch');
+
+  const repl=await runtime.start({profileId:'powershell_repl',rootId:'core',cwd:'.',args:[]});
+  const firstWrite=await runtime.write({sessionId:repl.session_id,input:"$x=41;[Console]::WriteLine('DB_R46_REPL_SET')",appendNewline:true});
+  insist(firstWrite.session.state==='running','R46 PowerShell REPL did not remain running after first write');
+  const firstRead=await runtime.read({sessionId:repl.session_id,offset:0,maxBytes:65536,waitMs:5000,waitFor:'DB_R46_REPL_SET'});
+  insist(firstRead.wait_satisfied===true,'R46 PowerShell REPL first wait was not satisfied');
+  const beforeSecond=(await runtime.status({sessionId:repl.session_id})).stream_head;
+  await runtime.write({sessionId:repl.session_id,input:"[Console]::WriteLine('DB_R46_REPL_VALUE=' + ($x+1))",appendNewline:true});
+  const secondRead=await runtime.read({sessionId:repl.session_id,offset:beforeSecond,maxBytes:65536,waitMs:5000,waitFor:'DB_R46_REPL_VALUE=42'});
+  const secondText=Buffer.from(secondRead.data_base64,'base64').toString('utf8');
+  insist(secondRead.wait_satisfied===true&&/DB_R46_REPL_VALUE=42/.test(secondText),'R46 PowerShell REPL state did not persist across writes');
+  const tailRead=await runtime.read({sessionId:repl.session_id,offset:-4096,maxBytes:4096});
+  insist(/DB_R46_REPL_VALUE=42/.test(Buffer.from(tailRead.data_base64,'base64').toString('utf8')),'R46 PowerShell REPL tail read missing state proof');
+  await runtime.terminate({sessionId:repl.session_id});
+  const replJournal=await runtime.verifyEventJournal({sessionId:repl.session_id});
+  insist(replJournal.ok===true,'R46 PowerShell REPL journal verification failed');
+  const replJournalText=await readFile(path.join(policy.state_dir,`${repl.session_id}.jsonl`),'utf8');
+  insist(!replJournalText.includes('$x=41')&&!replJournalText.includes('DB_R46_REPL_VALUE'),'R46 raw process input leaked into signed journal');
+
+  const ringSource="[Console]::Write(('A'*2097152));[Console]::WriteLine('DB_R46_RING_TAIL')";
+  const ring=await runtime.start({profileId:'powershell',rootId:'core',cwd:'.',args:[ringSource]});
+  const ringObserved=await waitForExit(runtime,ring.session_id,15000);
+  const ringStatus=await runtime.status({sessionId:ring.session_id});
+  insist(ringObserved.page.exit_code===0&&ringStatus.earliest_offset>0,'R46 retained-output ring did not evict under heavy output');
+  const ringTail=await runtime.read({sessionId:ring.session_id,offset:-4096,maxBytes:4096});
+  insist(/DB_R46_RING_TAIL/.test(Buffer.from(ringTail.data_base64,'base64').toString('utf8')),'R46 retained-output ring lost tail marker');
+
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'R46 parity clock invalid');
+  const evidence={
+    schema:'deadbyte.r46-parity.v1',
+    status:'passed',
+    version:'0.15.2',
+    completed_at_utc:completed.toISOString(),
+    candidate:{
+      release_id:pointer.release_id,
+      manifest_sha256:pointer.manifest_sha256,
+      generation_manifest_sha256:pointer.generation_manifest_sha256
+    },
+    generation:{files:generation.files,generation_manifest_sha256:generation.generation_manifest_sha256},
+    process_policy:{
+      sha256:policy.policy_sha256,
+      profile_ids:Object.keys(policy.profiles).sort(),
+      powershell_executable:policy.profiles.powershell.executable,
+      powershell_executable_sha256:policy.profiles.powershell.executable_sha256,
+      cmd_executable:policy.profiles.ping_hold.executable,
+      cmd_executable_sha256:policy.profiles.ping_hold.executable_sha256,
+      target_repin_verified:true
+    },
+    fileless_powershell:{
+      session_id:started.session_id,
+      child_pid:started.child_pid,
+      exit_code:observed.page.exit_code,
+      stream_sha256:observed.page.stream_sha256,
+      pscommandpath_empty:true,
+      invocation_path_empty:true,
+      new_temp_ps1_count:0,
+      journal_head_sha256:journal.head_sha256,
+      journal_event_count:journal.event_count
+    },
+    persistent_powershell_repl:{
+      session_id:repl.session_id,
+      child_pid:repl.child_pid,
+      state_persisted:true,
+      observed_value:42,
+      wait_for_verified:true,
+      tail_read_verified:true,
+      raw_input_not_journaled:true,
+      journal_head_sha256:replJournal.head_sha256,
+      journal_event_count:replJournal.event_count
+    },
+    retained_output_ring:{
+      session_id:ring.session_id,
+      stream_head:ringStatus.stream_head,
+      earliest_offset:ringStatus.earliest_offset,
+      eviction_verified:true,
+      tail_marker_verified:true
+    },
+    execution_provider:'deadbyte_mcp',
+    rdc_operation_count:0
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(state,'evidence','release');
+  await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r46-parity-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);
+    try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',evidence_path:file,evidence_sha256:sha256(bytes),evidence};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed','existing R46 parity evidence invalid');
+    insist(existing.candidate?.manifest_sha256===manifestSha256,'existing R46 parity candidate mismatch');
+    return {status:'existing',evidence_path:file,evidence_sha256:sha256(existingBytes),evidence:existing};
+  }
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)runReleaseParity().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/scripts/windows-gate-evidence-r46.mjs

@@ -0,0 +1,110 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const marker='DEADBYTE V0.15.2 / R46 FILELESS POWERSHELL WINDOWS BATCH GATE: PASS';
+const PARENT_RELEASE_ID='v0.15.1-d55f00b5144dc31a';
+const PARENT_MANIFEST='d55f00b5144dc31a7fe39e4dc60d640a94780da6aaeca0918e87636b816d7854';
+const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
+const REOPENED_RUNTIME_RELEASE_ID='v0.15.2-0fb46542f6a4345f';
+const REOPENED_RUNTIME_MANIFEST='0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34';
+const REOPENED_RUNTIME_GENERATION='4717e0eb9c515ce4b1e90b8496c49c68abde765a6de7490176b803912385afe4';
+function insist(ok,message){if(!ok)throw new Error(message);}
+
+export async function writeWindowsGateEvidence({
+  candidateRoot=root,
+  stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp')),
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(candidateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.15.2',`R46 Windows gate evidence requires V0.15.2, found ${pkg.version}`);
+  const release=JSON.parse(await readFile(path.join(candidate,'RELEASE.json'),'utf8'));
+  insist(release.version==='0.15.2'&&release.train==='R46','R46 release metadata mismatch');
+  const active=JSON.parse(await readFile(path.join(path.resolve(stateRoot),'active-release.json'),'utf8'));
+  const originalParent=active.release_id===PARENT_RELEASE_ID&&active.manifest_sha256===PARENT_MANIFEST&&active.generation_manifest_sha256===PARENT_GENERATION;
+  const reopenedPredecessor=active.release_id===REOPENED_RUNTIME_RELEASE_ID&&active.manifest_sha256===REOPENED_RUNTIME_MANIFEST&&active.generation_manifest_sha256===REOPENED_RUNTIME_GENERATION;
+  insist(originalParent||reopenedPredecessor,'R46 runtime predecessor identity mismatch');
+  const parent={release_id:PARENT_RELEASE_ID,version:'0.15.1',manifest_sha256:PARENT_MANIFEST,generation_manifest_sha256:PARENT_GENERATION};
+
+  const doctorResult=await doctor();
+  insist(doctorResult?.status==='ok'&&doctorResult?.package_version==='0.15.2'&&doctorResult?.manifest?.verified===true,'R46 doctor evidence invalid');
+  insist(doctorResult?.policy?.host_v2_ready===true,'R46 doctor did not verify Host policy v2');
+
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'R46 Windows gate evidence clock invalid');
+  const evidence={
+    schema:'deadbyte.r46-windows-gate.v1',
+    status:'passed',
+    exit_code:0,
+    version:'0.15.2',
+    train:'R46',
+    marker,
+    completed_at_utc:completed.toISOString(),
+    manifest_sha256:manifestSha256,
+    doctor:{
+      status:doctorResult.status,
+      manifest_sha256:doctorResult.manifest.sha256,
+      verified_entries:doctorResult.manifest.verified_entries,
+      host_v2_ready:doctorResult.policy.host_v2_ready
+    },
+    parent,
+    runtime_predecessor:{
+      release_id:active.release_id,
+      version:active.version,
+      manifest_sha256:active.manifest_sha256,
+      generation_manifest_sha256:active.generation_manifest_sha256,
+      mode:reopenedPredecessor?'reopened-unpublished-0.15.2':'sealed-0.15.1-parent'
+    },
+    features:{
+      fileless_powershell:true,
+      powershell_source_via_process_argv:true,
+      no_ps1_materialization_regression:true,
+      target_machine_process_profile_repin:true,
+      target_machine_cmd_repin:true,
+      target_machine_powershell_repin:true,
+      powershell_persistent_repl:true,
+      guarded_process_raw_input:true,
+      process_tail_reads:true,
+      process_wait_reads:true,
+      process_chunked_output_ring:true,
+      remote_reachability_ttl:true,
+      remote_probe_timeout_retry:true,
+      remote_dispatch_timeout_no_retry:true,
+      observation_search_terminal_ttl:true,
+      observation_search_hard_cap:128,
+      full_regression_required:true,
+      compact_tool_count:43,
+      full_tool_count:83
+    }
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(path.resolve(stateRoot),'evidence','release');
+  await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r46-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);
+    try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',path:file,sha256:sha256(bytes),manifest_sha256:manifestSha256,parent:evidence.parent};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing R46 Windows gate evidence invalid');
+    insist(existing.version==='0.15.2'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing R46 Windows gate identity mismatch');
+    insist(existing.parent?.release_id===parent.release_id&&existing.parent?.manifest_sha256===parent.manifest_sha256,'existing R46 parent evidence mismatch');
+    insist(existing.runtime_predecessor?.release_id===active.release_id&&existing.runtime_predecessor?.manifest_sha256===active.manifest_sha256,'existing R46 runtime predecessor evidence mismatch');
+    return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256,parent:existing.parent};
+  }
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)writeWindowsGateEvidence().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/src/capability-ledger.mjs

@@ -89,6 +89,7 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
 
   gateway('process.start','process_session_start','process_session','start','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),
   gateway('process.read','process_session_read','process_session','read','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
+  gateway('process.write','process_session_write','process_session','write','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),
   gateway('process.status','process_session_status','process_session','status','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
   gateway('process.list','process_session_list','process_session','list','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
   gateway('process.action','process_session_action','process_session','action','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),

package/src/compact-gateway-mcp-tools.mjs

@@ -26,7 +26,7 @@ export const codingInspectInputSchema=z.discriminatedUnion('op',[
 export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('stat'),root_id:id,path:rel.default('.'),hash:z.boolean().default(false)}),
   z.strictObject({op:z.literal('list'),root_id:id,path:rel.default('.'),cursor,limit:z.number().int().min(1).max(1000).default(100),hash_files:z.boolean().default(false)}),
-  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false)}),
+  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false),timeout_ms:z.number().int().min(100).max(180000).default(30000)}),
   z.strictObject({op:z.literal('write'),root_id:id,path:rel,content:z.string().max(12*1024*1024),encoding:z.enum(['utf8','base64']).default('utf8'),expected_sha256:z.string().regex(/^(?:absent|[0-9a-f]{64})$/)}),
   z.strictObject({op:z.literal('edit_exact'),root_id:id,path:rel,expected_sha256:hex64,old_string:z.string().min(1).max(262144),new_string:z.string().max(524288),expected_replacements:z.number().int().min(1).max(64).default(1)}),
   z.strictObject({op:z.literal('mkdir'),root_id:id,path:rel}),
@@ -36,7 +36,8 @@ export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
 
 export const processSessionGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('start'),profile_id:id,root_id:id,cwd:rel.default('.'),args:z.array(z.string().max(8192)).max(64).default([])}),
-  z.strictObject({op:z.literal('read'),session_id:hex64,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(262144).default(65536)}),
+  z.strictObject({op:z.literal('read'),session_id:hex64,offset:z.number().int().min(-(16*1024*1024)).default(0),max_bytes:z.number().int().min(1).max(262144).default(65536),wait_ms:z.number().int().min(0).max(30000).default(0),wait_for:z.string().min(1).max(256).nullable().default(null)}),
+  z.strictObject({op:z.literal('write'),session_id:hex64,input:z.string().min(1).max(1024*1024),append_newline:z.boolean().default(true)}),
   z.strictObject({op:z.literal('status'),session_id:hex64}),
   z.strictObject({op:z.literal('list')}),
   z.strictObject({op:z.literal('action'),session_id:hex64,action_id:id}),
@@ -83,7 +84,7 @@ async function machineFs(args,runtime){
   const map={
     stat:r=>r.stat({rootId:args.root_id,relativePath:args.path,hash:args.hash}),
     list:r=>r.list({rootId:args.root_id,relativePath:args.path,cursor:args.cursor,limit:args.limit,hashFiles:args.hash_files}),
-    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file}),
+    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file,timeoutMs:args.timeout_ms}),
     write:r=>r.write({rootId:args.root_id,relativePath:args.path,content:args.content,encoding:args.encoding,expectedSha256:args.expected_sha256}),
     edit_exact:r=>r.editExact({rootId:args.root_id,relativePath:args.path,expectedSha256:args.expected_sha256,oldString:args.old_string,newString:args.new_string,expectedReplacements:args.expected_replacements}),
     mkdir:r=>r.mkdir({rootId:args.root_id,relativePath:args.path}),
@@ -96,7 +97,8 @@ async function machineFs(args,runtime){
 async function processSession(args,runtime){
   const map={
     start:r=>r.start({profileId:args.profile_id,rootId:args.root_id,cwd:args.cwd,args:args.args}),
-    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes}),
+    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes,waitMs:args.wait_ms,waitFor:args.wait_for}),
+    write:r=>r.write({sessionId:args.session_id,input:args.input,appendNewline:args.append_newline}),
     status:r=>r.status({sessionId:args.session_id}),
     list:r=>r.list(),
     action:r=>r.action({sessionId:args.session_id,actionId:args.action_id}),
@@ -136,7 +138,7 @@ export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));
   server.registerTool('machine_fs',{description:'Typed compact machine filesystem gateway preserving root policy and mutation preconditions.',inputSchema:machineFsGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineFs(args,machineFsRuntime));
-  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. No raw stdin or PID authority.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
+  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. Raw input is available only for locally opt-in profiles and remains grant-bounded; numeric PID authority is never exposed.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
   server.registerTool('machine_observe',{description:'Typed compact machine identity and read-only observation gateway. Revoke is intentionally excluded.',inputSchema:machineObserveInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineObserve(args,machineRuntime,observationRuntime));
   server.registerTool('desktop_control',{description:'Typed Desktop observe, target, status and guarded action gateway. No arbitrary dispatch; mutation still requires separate Desktop authority.',inputSchema:desktopControlInputSchema,outputSchema:compactGatewayOutputSchema},args=>invokeDesktopOperation(args,desktopRuntime));
 }

package/src/deadbyte-cli.mjs

@@ -87,6 +87,9 @@ function controllerRuntimeReady(text){
     /^Local ready\s*:\s*True\s*$/m.test(value)&&
     /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
 }
+function controllerRuntimeDegraded(text){
+  return /^DEADBYTE MCP\s*=\s*DEGRADED\s*$/m.test(String(text||''));
+}
 async function listLogFiles(root){
   const files=[];
   const audit=path.join(root,'audit');
@@ -319,10 +322,11 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
     if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
       process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     }else{
-      process.stdout.write('[BOOT] Starting bridge/runtime...\n');
-      invokeController(ctx,'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
+      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
+      process.stdout.write(recovery?'[RECOVERY] Runtime DEGRADED; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      invokeController(ctx,recovery?'restart':'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
       const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error('remote controller start returned without a verified ONLINE runtime');
+      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
       startText=started.stdout||'';
     }
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);

package/src/machine-fs-mcp-tools.mjs

@@ -32,10 +32,10 @@ export function registerMachineFsTools(server, { runtime }) {
   });
   server.registerTool('machine_fs_read', {
     description:'Read one bounded byte range from a root-relative regular file.',
-    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false) }),
+    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
     outputSchema:machineFsReadOutputSchema
-  }, async ({root_id,path,offset,max_bytes,hash_file}) => {
-    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file})); }
+  }, async ({root_id,path,offset,max_bytes,hash_file,timeout_ms}) => {
+    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file,timeoutMs:timeout_ms})); }
     catch (error) { return fail(machineFsReadOutputSchema,error); }
   });
   server.registerTool('machine_fs_write', {

package/src/machine-fs-output-contracts.mjs

@@ -33,7 +33,7 @@ export const machineFsReadOutputSchema = z.strictObject({
   offset: z.number().int().nonnegative().optional(), next_offset: z.number().int().nonnegative().optional(),
   file_size: z.number().int().nonnegative().optional(), eof: z.boolean().optional(),
   data_base64: z.string().max(12 * 1024 * 1024).optional(), data_sha256: hex64.optional(),
-  file_sha256: hex64.nullable().optional()
+  file_sha256: hex64.nullable().optional(), timeout_ms: z.number().int().min(100).max(180000).optional()
 });
 
 const commitBase = {

package/src/machine-fs-read-worker.mjs

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, promises as fs } from 'node:fs';
+
+const [file, offsetText, lengthText, hashText] = process.argv.slice(2);
+const offset = Number(offsetText);
+const length = Number(lengthText);
+if (typeof file !== 'string' || !Number.isSafeInteger(offset) || offset < 0 ||
+    !Number.isSafeInteger(length) || length < 0 || length > 4 * 1024 * 1024 ||
+    !['0','1'].includes(hashText ?? '0')) {
+  process.stderr.write('invalid machine-fs read worker arguments\n');
+  process.exit(64);
+}
+
+try {
+  const handle = await fs.open(file, 'r');
+  let bytes;
+  try {
+    const buffer = Buffer.alloc(length);
+    const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
+    bytes = buffer.subarray(0, result.bytesRead);
+  } finally {
+    await handle.close();
+  }
+
+  let fileSha256 = null;
+  if (hashText === '1') {
+    const hash = createHash('sha256');
+    await new Promise((resolve, reject) => {
+      const stream = createReadStream(file);
+      stream.on('data', chunk => hash.update(chunk));
+      stream.once('error', reject);
+      stream.once('end', resolve);
+    });
+    fileSha256 = hash.digest('hex');
+  }
+
+  process.stdout.write(JSON.stringify({
+    schema: 'deadbyte.machine-fs-read-worker.v1',
+    bytes_read: bytes.length,
+    data_base64: bytes.toString('base64'),
+    file_sha256: fileSha256
+  }));
+} catch (error) {
+  process.stderr.write(String(error?.stack ?? error));
+  process.exit(1);
+}