deadbyte-mcp 0.15.10 → 0.15.11

package/MANIFEST.SHA256

@@ -1328,7 +1328,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-fc923c05c542ed4d3eeace06c1f782fe431d877ee0227c24096aeea45af5d03e  package.json
+34e5345b9f07fad9e3f7f54c496f3cf0cc4ff07c34c938c35244a9e1f209eeeb  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1388,7 +1388,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-2a17d078ccbf03b254509985b3cdf51496e8d02958b4f3bc878e5aac7bb15b10  PROVENANCE.json
+c7a11729f77023dd1d741d61b35ea0b75cca061a28f3a4cbe0062ca6a536f4ab  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1397,7 +1397,7 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 4d8bc9d61d7558a484269cc13263b42bb39417700bb3858069d64a2d1ae190e8  README.txt
-de2c63a505343a61cfbfe4a905d9021ccdc4cce39ccb3e681c2526518bf494c5  RELEASE.json
+be4640a1d9e47f904e758e0b88b6e2ef7ee8b1921c90a95e404d28d1eb01a69b  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1522,6 +1522,7 @@ cabfa63d5edb83f32b3e6e5ce22e76223644d81a3361d52a28de2dbc07e59a54  scripts/run-r4
 abf8ac3074e8964c9648b5b60069730c255faa5f4169f3aefc7a9eff350a1efc  scripts/run-skill-creator-scaffold.mjs
 caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtime-self-update.mjs
 b0cc75c38e0163dbcf7fb1b0d21f2dc34c71f2d0e2a156a53e570ff84afc64e6  scripts/semantic-preflight.ps1
+bf54d2dfa2a77c2c13cc0b8a9ac2eb926132ecd331ad56ebbf88cc5cc4280a96  scripts/sign-adaptive-skill.mjs
 0a115aa9829576c86cc247f754cae69ae09ba146b637d3a1c9fbc16420d20a5d  scripts/tool-surface-snapshot.mjs
 f8d9c6718cbe20e02e517297e8f35f51c7dcd51b62b8b4a483630a9cd3b1f788  scripts/verify-memory-r41.mjs
 e552634ca1f8673f5daaaf5e45302d2a7fc4b1a1eac256f60bed2c9136bafa05  scripts/verify-package.ps1
@@ -1577,13 +1578,14 @@ e5f944a310ed957e3b8f7b1cab54c082acf1b35f8fdd7d9b672ebe1a80dc37ac  src/canonical-
 da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability-benchmark-runner.mjs
 2b62295591f142ca4b3bc5b03e6434f7fc3c51d9502f9a40ef8a03d1f72a8899  src/capability-benchmark.mjs
 160199b25f45bd0490f6b21a9fa8194313e9673c4b2699afce68249d3d249a7b  src/capability-ledger.mjs
+1b0ba08c5d5a75d95953a84a00b551af8ba1ee21cf1995255daa198368017760  src/capability-resolver.mjs
 94e5aeff2453cdc0239aee4d547dbbefee183c71933cb84e5e8a418fa99bc1e8  src/codex-app-server-r44.mjs
 6d0a80daaa2711e67e2597bff3db5bd2802682f559107a492f3cd89b9c6785ed  src/coding-mcp-tools.mjs
 d6fc395575f49abbbf60bf6f6ef5ee9ad51034a7e770a381e6ec34f869788306  src/coding-output-contracts.mjs
 0857a458e9c5101eee94c0596b7699adc34c50687455688fe38d03d241d27935  src/coding-plane.mjs
 38a1b4e9f5aa14cd5fd9058345c3480ae72c4a6a6eeccdc46e71297c68b5b5a6  src/coding-search.mjs
 f87284dc71c167f6a17575b93730c258ed6c433831013c776bf2d14e2b77767f  src/coding-task-runtime.mjs
-bfe4b641b61e4e7da8848c6c39d256a39191639315fb9f3c17a0b11f999ec792  src/compact-gateway-mcp-tools.mjs
+8478ef1f7b3dc89480c4310a20268048f581041bddcc0b7de9298fa2bfc654ca  src/compact-gateway-mcp-tools.mjs
 4218d1d1478d9e9a044d9b61c5ae205cd2ca0651a314900fad03992d0b12d286  src/compact-gateway-output-contracts.mjs
 40ac70ece531de7709d3c51686b36b48e0ae60283d1fb18d0adc037bfe6f9063  src/contained-cli.mjs
 d2bacef2443705e372071d0de3c72d45d57febb1dcbb11e369fce8a78bf0bf3e  src/contained-executor.mjs
@@ -1632,7 +1634,7 @@ ad4ca3635cb228b57b5b98e9518f379380ee1a03ad07ab4d12f8b7f324be2517  src/machine-mc
 e81b3ac2955e5dfafe308c82da24356a14da396230cb9fc47b231ab672d5be48  src/machine-output-contracts.mjs
 ed85d41c494a334117661ddec8191d34974fe28cb2a3378f3c04ee0e4c5d3ccc  src/mcp-contained-smoke-client.mjs
 b705345aa432b6a6ebbf62aabce1f78ba7e392bdfe998e79217eba8289ed0a7e  src/mcp-host-smoke-client.mjs
-02f6f0d456491dbd7687c4c81c7a2c3d9dd9db411d97617fcb9927b766f75a67  src/mcp-server.mjs
+3300d50f8a015bb090d5820dafe42edcc3d16a741e3ff12232ec03aadf115158  src/mcp-server.mjs
 b490c4152b16adae658b3af20a4827847866cec352e1b0c9eb6b36094116b83b  src/mcp-smoke-client.mjs
 cde7c813f5a2e9a69f09849455d1504e766963845a1f4b201ecc84090fa260d5  src/memory-r41.mjs
 9525aee66944023603f6d1ebb0768b8e8ab8bb93582a10dd7f9cd4459ee07454  src/native-diff-v2.mjs
@@ -1649,7 +1651,7 @@ b8e4e38fc38bd8d2efb01b58028944bc8133dcc42de12b1035784c5e01beca35  src/output-con
 974b5e9a5f60c4b2ac8bed629fb39a4e3c06b591995bec3f5f4756da8f3fd2e1  src/process-mcp-tools.mjs
 4c90265628194d989ac78f2b06eadbfffceb9c006d5b6c2e982f5667f7a385ed  src/process-output-contracts.mjs
 f5322664c669bc193214a803f9723e3728053f60bc008530db39a9af7f7bab75  src/process-policy.mjs
-23fb2a9394c6039d4238577eea377679fdd4be7a753e35452799ef9705aad894  src/process-runtime.mjs
+622b984e577932ed0c342a6d7e0e8a17d08e888caa2ca67c5ecc1bbcca16042a  src/process-runtime.mjs
 65d81b6cbdf4f4ce34ccef11793e79cfed6883288288915d077c11674f0873bb  src/process-smoke-client.mjs
 bb4d1532684b8f81a42377c4b0a9d4c61207856edfff496e878ffbb885b52442  src/proof-cli.mjs
 be4a4f7f16e473ac842559a5a18eccb59e3693bded59a1abc71e75ff448cc755  src/proof-worker.mjs
@@ -1686,7 +1688,7 @@ c8fd6fd3e49e866f2c3be326ab07222b36a44528ee0fc3f7b371c34a60e3c45b  src/remote-ses
 827b156eac01cc9ec6f5ca9a49219612f0da511fde770a9eb1235aa913b5e514  src/request-identity.mjs
 39251ab165bb0a0b8ea9b4c533aa0cd674934c0fa2c7f63145eac680d1d67be9  src/resource-identity.mjs
 ce2223bf6075e96cc02505c1439acce18bb1f204c5e86cf9152bb7194daf3cd2  src/runtime-identity.mjs
-9ea6bbebe732a2925b14807228cf5d74848def69b10216495498ae20f3a919ad  src/runtime-update.mjs
+88fe013cc2474e7e015235df39e54c3c6cd8afb8ac50a97b15a9dee590fed541  src/runtime-update.mjs
 c61335adb38bfc415fe1cdabfe2c0a87e61579dfd1e52cce91c44d6993479457  src/search-cursor.mjs
 fc5407ef8338ebeeede16225b3249166dc4d45e903d873eb46c15c3df07dc9ad  src/semantic-backend-registry.mjs
 686e9b55b9f4352b941579f186a9b9d348d86af53d052cbd5da953e7d15470ff  src/semantic-code.mjs
@@ -1704,7 +1706,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-afb1d220f824f94a3c1b654213f50e25af380d22e89cba6efb0d58324026e62a  src/version.mjs
+87f3f4370c3e0e8db4ce0816a205836bb7736000b95d6fd24348944bb739bf6a  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
@@ -1745,6 +1747,7 @@ bad448d7bfd0c66b8d0dc0fa601fc22d69ccc3f447140ed0f77b68957984daea  test/capabilit
 c343906ca0878e13c576cd9f615802b1139c693bf6769a780dfb052637cf0d83  test/capability-benchmark.test.mjs
 b9a8faa4b86683ac5aea891fe6bc95f8e425fb31635176aa4603f9d582b52a79  test/capability-claims-r36.test.mjs
 a466a490759d438a8ac68919f79ddcb52253bdbecb5e4448a4fbf62af118184e  test/capability-ledger-r36.test.mjs
+5cdf20eace97fa87563c6b139390e6bd8ccbe80215f53aacd041579bfbad20d6  test/capability-resolver.test.mjs
 84eefe1a43474927fdc6fb7ef269309c662cefb229d6af2c91d9e2f0b9ba5c23  test/cli-entrypoint.test.mjs
 bec565ffa8550d56a5bb21927177c37d9d05f8353e3bc2541fc156886fe23688  test/codex-app-server-r44.test.mjs
 c43105a78ee4c93417d720ee660cfebc75b17f142a6484568e3cbaa583457f8c  test/codex-autonomous-r44.test.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "builder": "deadbyte-r46-fileless-powershell",
   "source_model": "development-root -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed final closure",
   "signing": "ed25519",

package/README.txt

@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.9 mcp
-  npx -y deadbyte-mcp@0.15.9 remote
-  npx -y deadbyte-mcp@0.15.9 remote status
-  npx -y deadbyte-mcp@0.15.9 remote restart
-  npx -y deadbyte-mcp@0.15.9 audit status
-  npx -y deadbyte-mcp@0.15.9 audit verify
+  npx -y deadbyte-mcp@0.15.11 mcp
+  npx -y deadbyte-mcp@0.15.11 remote
+  npx -y deadbyte-mcp@0.15.11 remote status
+  npx -y deadbyte-mcp@0.15.11 remote restart
+  npx -y deadbyte-mcp@0.15.11 audit status
+  npx -y deadbyte-mcp@0.15.11 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "train": "R46",
   "label": "FILELESS POWERSHELL PRODUCT BASELINE",
   "protocol_revision": "2026-07-28",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/sign-adaptive-skill.mjs

@@ -0,0 +1,86 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto';
+import { createSkillPlane } from '../src/skill-plane-r44.mjs';
+
+const home = os.homedir();
+const stateDir = path.join(home, '.deadbyte-mcp');
+const skillDir = path.join(stateDir, 'skills', 'deadbyte-adaptive-reverse-engineering');
+const sha = b => createHash('sha256').update(b).digest('hex');
+function canonical(v) {
+  return Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object'
+    ? Object.fromEntries(Object.keys(v).sort((a, b) => a.localeCompare(b, 'en')).map(k => [k, canonical(v[k])])) : v;
+}
+
+const skillBytes = await readFile(path.join(skillDir, 'SKILL.md'));
+const skillText = new TextDecoder('utf-8').decode(skillBytes);
+const skillSha = sha(skillBytes);
+
+const refFiles = ['references/adaptive-routing.md', 'references/evidence-correlation.md'].sort((a, b) => a.localeCompare(b, 'en'));
+const resources = [];
+for (const rel of refFiles) {
+  const bytes = await readFile(path.join(skillDir, ...rel.split('/')));
+  resources.push({
+    path: rel,
+    sha256: sha(bytes),
+    kind: 'reference'
+  });
+}
+
+const body = {
+  schema: 'deadbyte.skill-manifest.v1',
+  name: 'deadbyte-adaptive-reverse-engineering',
+  version: '1.1.0',
+  description: 'Adaptive evidence-driven low-level reverse-engineering workflow that selects the smallest discriminating analysis path, allocates evidence budget by information gain, tracks contradictions, correlates bytes with semantics, and closes every claim with fresh verification.',
+  audience: 'agent',
+  skill_md_sha256: skillSha,
+  resources,
+  required_capabilities: [],
+  authority_planes: ['coding'],
+  provenance: {
+    source: 'skill-creator',
+    origin_url: null,
+    source_revision: 'local-draft-2026-09-24-v1.1'
+  }
+};
+
+const bodyBytes = Buffer.from(JSON.stringify(canonical(body)), 'utf8');
+const bodySha256 = sha(bodyBytes);
+
+const privPem = await readFile(path.join(stateDir, 'trust', 'ed25519-private.pem'));
+const priv = createPrivateKey(privPem);
+const pub = createPublicKey(priv);
+const keyId = sha(pub.export({ type: 'spki', format: 'der' }));
+
+const DOMAIN = Buffer.from('DEADBYTE-SKILL-MANIFEST-V1\0', 'utf8');
+const signature = sign(null, Buffer.concat([DOMAIN, bodyBytes]), priv);
+const attestation = {
+  algorithm: 'ed25519',
+  domain: 'DEADBYTE-SKILL-MANIFEST-V1',
+  key_id: keyId,
+  signature_base64: signature.toString('base64')
+};
+
+const unsigned = { body, body_sha256: bodySha256, attestation };
+const envelope = {
+  ...unsigned,
+  manifest_sha256: sha(Buffer.from(JSON.stringify(canonical(unsigned)), 'utf8'))
+};
+
+await writeFile(path.join(skillDir, 'skill.json'), JSON.stringify(envelope, null, 2), 'utf8');
+console.log('Skill envelope written successfully:', envelope.manifest_sha256);
+
+// Verify with createSkillPlane
+const plane = await createSkillPlane({
+  root: path.join(stateDir, 'skills'),
+  verifyKeyPath: path.join(stateDir, 'trust', 'ed25519-public.pem')
+});
+const list = await plane.list();
+console.log('Skill plane list result: skills=' + list.skills.length + ' invalid=' + list.invalid_skills.length);
+if (list.invalid_skills.length > 0) {
+  console.error('Invalid skills remain:', list.invalid_skills);
+  process.exit(1);
+}
+const loaded = await plane.load({ name: 'deadbyte-adaptive-reverse-engineering' });
+console.log('Skill loaded OK: name=' + loaded.name + ' verified=' + loaded.verified);

package/src/capability-resolver.mjs

@@ -0,0 +1,303 @@
+export const CAPABILITY_STATES = Object.freeze({
+  AVAILABLE: 'AVAILABLE',
+  DEGRADED: 'DEGRADED',
+  DISABLED: 'DISABLED',
+  DENIED: 'DENIED',
+  UNAVAILABLE: 'UNAVAILABLE'
+});
+
+const CAPABILITY_OPERATIONS = Object.freeze({
+  'skill.catalog': ['list', 'load', 'resource'],
+  'machine.list': ['machine_list'],
+  'machine.status': ['machine_status'],
+  'machine.ping': ['machine_ping'],
+  'machine.revoke': ['machine_revoke'],
+  'process.start': ['start'],
+  'process.read': ['read'],
+  'process.write': ['write'],
+  'process.status': ['status'],
+  'process.list': ['list'],
+  'process.action': ['action'],
+  'process.terminate': ['terminate'],
+  'coding.session_status': ['coding_session_status'],
+  'coding.tree': ['coding_tree'],
+  'coding.stat': ['stat'],
+  'coding.search': ['search'],
+  'coding.files_read': ['files_read'],
+  'coding.file_read': ['coding_file_read'],
+  'coding.file_write': ['coding_file_write'],
+  'coding.text_replace': ['coding_text_replace'],
+  'coding.command_run': ['coding_command_run'],
+  'coding.benchmark_run': ['coding_benchmark_run'],
+  'coding.receipt_verify': ['coding_receipt_verify'],
+  'coding.task_submit': ['coding_task_submit'],
+  'coding.task_run': ['coding_task_run'],
+  'coding.task_status': ['coding_task_status'],
+  'coding.task_events': ['coding_task_events'],
+  'coding.task_cancel': ['coding_task_cancel'],
+  'coding.task_approve': ['coding_task_approve'],
+  'coding.task_verify': ['coding_task_verify'],
+  'semantic.outline': ['symbol_outline'],
+  'semantic.definition': ['symbol_definition'],
+  'semantic.references': ['symbol_references'],
+  'semantic.diagnostics': ['symbol_diagnostics'],
+  'semantic.implementations': ['symbol_implementations'],
+  'semantic.rename_preview': ['symbol_rename_preview'],
+  'semantic.replace': ['coding_symbol_replace'],
+  'machine_fs.stat': ['stat'],
+  'machine_fs.list': ['list'],
+  'machine_fs.read': ['read'],
+  'machine_fs.write': ['write'],
+  'machine_fs.edit_exact': ['edit_exact'],
+  'machine_fs.mkdir': ['mkdir'],
+  'machine_fs.move': ['move'],
+  'machine_fs.delete': ['delete'],
+  'observation.search_start': ['search_start'],
+  'observation.search_page': ['search_page'],
+  'observation.search_status': ['search_status'],
+  'observation.search_cancel': ['search_cancel'],
+  'observation.process_list': ['process_list'],
+  'observation.system_status': ['system_status'],
+  'observation.hardware_query': ['hardware_query'],
+  'desktop.status': ['status'],
+  'desktop.observe': ['observe'],
+  'desktop.target': ['target'],
+  'desktop.action': ['action'],
+  'autonomous.session_status': ['autonomous_session_status'],
+  'native_diff.preview': ['native_diff_preview'],
+  'native_diff.apply': ['native_diff_apply'],
+  'native_diff.verify': ['native_diff_verify'],
+  'autonomous.goal_submit': ['autonomous_goal_submit'],
+  'autonomous.goal_run': ['autonomous_goal_run'],
+  'autonomous.goal_status': ['autonomous_goal_status'],
+  'autonomous.goal_events': ['autonomous_goal_events'],
+  'autonomous.goal_cancel': ['autonomous_goal_cancel'],
+  'autonomous.goal_approve': ['autonomous_goal_approve'],
+  'autonomous.goal_verify': ['autonomous_goal_verify'],
+  'autonomous.release_gate': ['autonomous_release_gate'],
+  'host.file_read': ['host_file_read'],
+  'host.file_write': ['host_file_write'],
+  'host.exec': ['host_exec'],
+  'evidence.verify': ['evidence_verify']
+});
+
+export function deriveCapabilityRequirements(capability) {
+  const reqs = [];
+  if (capability.runtime_flag) reqs.push(capability.runtime_flag);
+  if (capability.id === 'skill.catalog') {
+    reqs.push('skill_plane.valid');
+    return reqs;
+  }
+  if (capability.authority === 'coding') {
+    if (capability.mutating) {
+      reqs.push('coding_session.armed', 'policy.write');
+    } else {
+      reqs.push('coding_runtime.ready');
+    }
+  } else if (capability.authority === 'process') {
+    if (capability.mutating) {
+      reqs.push('process_session.armed');
+    } else {
+      reqs.push('process_runtime.ready');
+    }
+  } else if (capability.authority === 'autonomous') {
+    if (capability.mutating) {
+      reqs.push('autonomous_session.armed');
+    } else {
+      reqs.push('autonomous_runtime.ready');
+    }
+  } else if (capability.authority === 'desktop') {
+    if (capability.mutating) {
+      reqs.push('desktop_control.armed', 'policy.desktop');
+    } else {
+      reqs.push('desktop_runtime.ready');
+    }
+  } else if (capability.authority === 'host' || capability.host_only) {
+    if (capability.mutating) {
+      reqs.push('host_policy.armed');
+    } else {
+      reqs.push('host_policy.configured');
+    }
+  }
+  return reqs;
+}
+
+export async function resolveCapabilityStates({
+  ledger,
+  toolCatalog = [],
+  profile = 'full',
+  env = process.env,
+  codingRuntime = null,
+  processRuntime = null,
+  processPolicy = null,
+  machineFsRuntime = null,
+  observationRuntime = null,
+  desktopRuntime = null,
+  desktopPolicy = null,
+  autonomousRuntime = null,
+  skillRuntime = null,
+  hostPolicy = null
+} = {}) {
+  const capabilities = ledger?.entries ?? [];
+  const resolved = [];
+  const catalogSet = new Set(toolCatalog);
+
+  // Probe session authorities asynchronously
+  let codingStatus = null;
+  if (codingRuntime?.sessionStatus) {
+    try { codingStatus = await codingRuntime.sessionStatus(); } catch {}
+  }
+
+  let autonomousStatus = null;
+  if (autonomousRuntime?.sessionStatus) {
+    try { autonomousStatus = await autonomousRuntime.sessionStatus(); } catch {}
+  }
+
+  let skillListResult = null;
+  if (skillRuntime?.list) {
+    try { skillListResult = await skillRuntime.list(); } catch (err) {
+      skillListResult = { invalid_skills: [{ name: '*', error: String(err) }] };
+    }
+  }
+
+  for (const cap of capabilities) {
+    const activeTool = profile === 'compact' ? (cap.compact_tool || cap.full_tool) : cap.full_tool;
+    const activeOp = profile === 'compact' ? (cap.compact_op || 'direct') : 'direct';
+    const ops = CAPABILITY_OPERATIONS[cap.id] ?? [activeOp];
+    const requires = deriveCapabilityRequirements(cap);
+
+    let state = CAPABILITY_STATES.AVAILABLE;
+    let ready = true;
+    let diagnostic = null;
+
+    // 1. Runtime Flag Disabled check
+    if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
+      state = CAPABILITY_STATES.DISABLED;
+      ready = false;
+      diagnostic = {
+        code: 'RUNTIME_FLAG_DISABLED',
+        reason: `Runtime flag ${cap.runtime_flag}=0 is disarmed`,
+        recoverable: false
+      };
+    }
+    // 2. Tool presence check
+    else if (!catalogSet.has(activeTool)) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'TOOL_NOT_REGISTERED',
+        reason: `Tool '${activeTool}' is not registered in the active tool catalog`,
+        recoverable: false
+      };
+    }
+    // 3. Subsystem runtime instantiation check
+    else if (cap.id.startsWith('machine_fs.') && !machineFsRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'MACHINE_FS_NOT_INSTANTIATED',
+        reason: 'Machine filesystem runtime is uninitialized',
+        recoverable: false
+      };
+    } else if (cap.id.startsWith('observation.') && !observationRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'OBSERVATION_NOT_INSTANTIATED',
+        reason: 'Observation runtime is uninitialized',
+        recoverable: false
+      };
+    } else if (cap.id.startsWith('desktop.') && !desktopRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'DESKTOP_NOT_INSTANTIATED',
+        reason: 'Desktop runtime is uninitialized',
+        recoverable: false
+      };
+    } else if ((cap.authority === 'host' || cap.host_only) && !hostPolicy) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'HOST_POLICY_DISARMED',
+        reason: 'Privileged host policy is not configured or disarmed',
+        recoverable: true
+      };
+    }
+    // 4. Session Authority Checks
+    else if (cap.authority === 'coding' && cap.mutating && codingStatus && !codingStatus.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'CODING_SESSION_DISARMED',
+        reason: codingStatus.reason || 'Coding session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (cap.authority === 'autonomous' && cap.mutating && autonomousStatus && !autonomousStatus.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'AUTONOMOUS_SESSION_DISARMED',
+        reason: autonomousStatus.reason || 'Autonomous session is not armed for mutation',
+        recoverable: true
+      };
+    }
+    // 5. Subsystem Health Probes (e.g. Skill Plane envelope verification)
+    else if (cap.id === 'skill.catalog') {
+      if (skillListResult?.invalid_skills && skillListResult.invalid_skills.length > 0) {
+        state = CAPABILITY_STATES.DEGRADED;
+        ready = false;
+        diagnostic = {
+          code: 'SKILL_ENVELOPE_MISMATCH',
+          reason: `Skill registry rejected envelope for: ${skillListResult.invalid_skills.map(s => s.name).join(', ')}`,
+          recoverable: true
+        };
+      }
+    }
+
+    resolved.push(Object.freeze({
+      id: cap.id,
+      tool: activeTool,
+      compact_tool: cap.compact_tool,
+      compact_op: cap.compact_op,
+      operations: ops,
+      authority: cap.authority,
+      mutating: cap.mutating,
+      production: cap.production,
+      runtime_flag: cap.runtime_flag,
+      requires,
+      state,
+      ready,
+      diagnostic
+    }));
+  }
+
+  const effectiveCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.AVAILABLE)
+    .map(c => c.id);
+
+  const unavailableCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.UNAVAILABLE || c.state === CAPABILITY_STATES.DISABLED || c.state === CAPABILITY_STATES.DENIED)
+    .map(c => ({
+      id: c.id,
+      state: c.state,
+      reason_code: c.diagnostic?.code ?? 'UNAVAILABLE',
+      reason: c.diagnostic?.reason ?? 'Capability not available'
+    }));
+
+  const degradedCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.DEGRADED)
+    .map(c => ({
+      id: c.id,
+      state: c.state,
+      reason_code: c.diagnostic?.code ?? 'DEGRADED',
+      reason: c.diagnostic?.reason ?? 'Capability operating in degraded mode'
+    }));
+
+  return Object.freeze({
+    capabilities: resolved,
+    effective_capabilities: effectiveCapabilities,
+    unavailable_capabilities: unavailableCapabilities,
+    degraded_capabilities: degradedCapabilities
+  });
+}

package/src/compact-gateway-mcp-tools.mjs

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import * as z from 'zod/v4';
 import { compactGatewayOutputSchema, compactGatewayResult } from './compact-gateway-output-contracts.mjs';
 import { desktopControlInputSchema,invokeDesktopOperation } from './desktop-mcp-tools-r40.mjs';
+import { resolveCapabilityStates } from './capability-resolver.mjs';
 
 const id=z.string().regex(/^[A-Za-z0-9._-]{1,64}$/);
 const rel=z.string().min(1).max(2048);
@@ -123,17 +124,26 @@ async function machineObserve(args,machineRuntime,observationRuntime){
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }
 
-export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider}){
+export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider}){
   if(!server) throw new Error('compact gateway registration requires server');
   if(profile!=='compact') return;
   if(typeof catalogProvider!=='function') throw new Error('compact gateway requires catalogProvider');
-  server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
+  server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog with runtime-aware resolution.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
     const toolCatalog=[...catalogProvider()].map(String).sort();
     if(toolCatalog.length<1||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('compact catalog provider returned invalid catalog');
     const catalogSha256=createHash('sha256').update(JSON.stringify(toolCatalog),'utf8').digest('hex');
+    const dynamicResolution = await resolveCapabilityStates({
+      ledger, toolCatalog, profile, env,
+      codingRuntime, processRuntime, machineFsRuntime, observationRuntime, desktopRuntime,
+      autonomousRuntime, skillRuntime, hostPolicy
+    });
     return compactGatewayResult({status:'ok',op:'manifest',result:{
       schema:'deadbyte.capability-manifest.v2',profile,ledger_sha256:ledger?.ledger_sha256??null,
-      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,capabilities:ledger?.entries??[]
+      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,
+      capabilities:dynamicResolution.capabilities,
+      effective_capabilities:dynamicResolution.effective_capabilities,
+      unavailable_capabilities:dynamicResolution.unavailable_capabilities,
+      degraded_capabilities:dynamicResolution.degraded_capabilities
     }},false);
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));

package/src/mcp-server.mjs

@@ -459,7 +459,8 @@ serveStdio(() => {
 
   registerCompactGatewayTools(toolServer,{
     profile:surfaceProfile,ledger:R36_CAPABILITY_LEDGER,codingRuntime,semanticRuntime,machineFsRuntime,
-    processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider:()=>[...registeredToolNames]
+    processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,
+    catalogProvider:()=>[...registeredToolNames]
   });
 
   if (hostPolicy) {

package/src/process-runtime.mjs

@@ -20,12 +20,27 @@ const TERMINAL_RECOVERY_SCHEMA = 'deadbyte.process-terminal.v1';
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 const nowUtc = () => new Date().toISOString();
 
+const STANDARD_PATHEXT = '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC';
+
+export function getRepairedPathExt() {
+  const current = process.env.PATHEXT;
+  if (!current) return STANDARD_PATHEXT;
+  const exts = current.split(';').map(e => e.trim().toUpperCase()).filter(Boolean);
+  if (!exts.includes('.EXE')) {
+    return [...new Set([...STANDARD_PATHEXT.split(';'), ...exts])].join(';');
+  }
+  return current;
+}
+
 function processEnvironment(profile) {
   const allow = new Set(profile.env_allow.map(name => name.toLowerCase()));
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (allow.has(key.toLowerCase()) && typeof value === 'string') env[key] = value;
   }
+  if (process.platform === 'win32') {
+    env.PATHEXT = getRepairedPathExt();
+  }
   return env;
 }
 async function resolveCwd(policy, grant, profile, rootId, cwd) {

package/src/runtime-update.mjs

@@ -1157,15 +1157,15 @@ async function resumeSlotUpdate({handoffPath}){
   const stableMcpUrl=body.stable_mcp_url?{...body.stable_mcp_url}:releaseState.stable_mcp_url?{...releaseState.stable_mcp_url}:null;
   const mcpUrlSnapshot=body.mcp_url_snapshot?decodeSnapshot(body.mcp_url_snapshot,'MCP URL'):{exists:false,bytes:null,sha256:null};
   const cleanup=await acquireSupervisorLease(absoluteHandoff);
+  const journal=releaseState;
+  let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
+  let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
   try{
-    const journal=releaseState;
     if(phaseRank(phase)<phaseRank('supervisor_spawned')){
       await writeState(statePath,journal,'supervisor_spawned',{supervisor_pid:process.pid,supervisor_script:body.supervisor_script,supervisor_script_sha256:body.supervisor_script_sha256});
       phase='supervisor_spawned';
     }
     let revoked=phaseRank(phase)>=phaseRank('authority_revoked')||journal.revoked_before_switch===true;
-    let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
-    let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
     let newRuntime=null,stabilization=null;
 
     if(phaseRank(phase)<phaseRank('authority_revoked')){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.10';
+export const DEADBYTE_VERSION = '0.15.11';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/capability-resolver.test.mjs

@@ -0,0 +1,133 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CAPABILITY_STATES,
+  deriveCapabilityRequirements,
+  resolveCapabilityStates
+} from '../src/capability-resolver.mjs';
+import { R36_CAPABILITY_LEDGER } from '../src/capability-ledger.mjs';
+
+test('capability resolver enforces 5 canonical states', () => {
+  assert.equal(CAPABILITY_STATES.AVAILABLE, 'AVAILABLE');
+  assert.equal(CAPABILITY_STATES.DEGRADED, 'DEGRADED');
+  assert.equal(CAPABILITY_STATES.DISABLED, 'DISABLED');
+  assert.equal(CAPABILITY_STATES.DENIED, 'DENIED');
+  assert.equal(CAPABILITY_STATES.UNAVAILABLE, 'UNAVAILABLE');
+});
+
+test('deriveCapabilityRequirements maps dependencies accurately', () => {
+  const reqCodingRead = deriveCapabilityRequirements({
+    id: 'coding.search',
+    authority: 'coding',
+    mutating: false,
+    runtime_flag: 'DEADBYTE_CODING_RUNTIME'
+  });
+  assert.deepEqual(reqCodingRead, ['DEADBYTE_CODING_RUNTIME', 'coding_runtime.ready']);
+
+  const reqCodingWrite = deriveCapabilityRequirements({
+    id: 'coding.file_write',
+    authority: 'coding',
+    mutating: true,
+    runtime_flag: 'DEADBYTE_CODING_RUNTIME'
+  });
+  assert.deepEqual(reqCodingWrite, ['DEADBYTE_CODING_RUNTIME', 'coding_session.armed', 'policy.write']);
+
+  const reqSkill = deriveCapabilityRequirements({
+    id: 'skill.catalog',
+    authority: 'operator',
+    mutating: false
+  });
+  assert.deepEqual(reqSkill, ['skill_plane.valid']);
+});
+
+test('resolveCapabilityStates resolves all 5 states correctly', async () => {
+  const allCompactTools = [
+    'capability_manifest',
+    'coding_inspect',
+    'machine_fs',
+    'process_session',
+    'machine_observe',
+    'desktop_control',
+    'skill_catalog'
+  ];
+
+  // 1. Fully available & armed state
+  const armedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    processRuntime: {},
+    machineFsRuntime: {},
+    observationRuntime: {},
+    desktopRuntime: {},
+    autonomousRuntime: { sessionStatus: async () => ({ armed: true }) },
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) },
+    hostPolicy: {}
+  });
+
+  assert.ok(armedRes.capabilities.length > 0);
+  assert.ok(armedRes.effective_capabilities.includes('coding.search'));
+  assert.ok(armedRes.effective_capabilities.includes('skill.catalog'));
+
+  // 2. Disabled by runtime flag
+  const disabledRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: { DEADBYTE_CODING_RUNTIME: '0' },
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    processRuntime: {},
+    machineFsRuntime: {},
+    observationRuntime: {},
+    desktopRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) }
+  });
+
+  const codingSearch = disabledRes.capabilities.find(c => c.id === 'coding.search');
+  assert.equal(codingSearch.state, CAPABILITY_STATES.DISABLED);
+  assert.equal(codingSearch.diagnostic.code, 'RUNTIME_FLAG_DISABLED');
+  assert.ok(disabledRes.unavailable_capabilities.some(u => u.id === 'coding.search' && u.state === CAPABILITY_STATES.DISABLED));
+
+  // 3. Unavailable due to uninstantiated subsystem
+  const uninstantiatedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    machineFsRuntime: null
+  });
+  const fsStat = uninstantiatedRes.capabilities.find(c => c.id === 'machine_fs.stat');
+  assert.equal(fsStat.state, CAPABILITY_STATES.UNAVAILABLE);
+  assert.equal(fsStat.diagnostic.code, 'MACHINE_FS_NOT_INSTANTIATED');
+
+  // 4. Denied when coding session is disarmed for mutating operations in full profile
+  const disarmedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: ['coding_file_write', 'coding_search'],
+    profile: 'full',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: false, reason: 'policy grant not confirmed' }) },
+    machineFsRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) }
+  });
+  const fileWrite = disarmedRes.capabilities.find(c => c.id === 'coding.file_write');
+  assert.equal(fileWrite.state, CAPABILITY_STATES.DENIED);
+  assert.equal(fileWrite.diagnostic.code, 'CODING_SESSION_DISARMED');
+
+  // 5. Degraded when skill plane reports envelope mismatch
+  const degradedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    machineFsRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [{ name: 'test-broken', error: 'envelope mismatch' }] }) }
+  });
+  const skillCap = degradedRes.capabilities.find(c => c.id === 'skill.catalog');
+  assert.equal(skillCap.state, CAPABILITY_STATES.DEGRADED);
+  assert.equal(skillCap.diagnostic.code, 'SKILL_ENVELOPE_MISMATCH');
+  assert.ok(degradedRes.degraded_capabilities.some(d => d.id === 'skill.catalog'));
+});