deadbyte-mcp 0.15.2 → 0.15.3

package/src/coding-output-contracts.mjs

@@ -8,9 +8,19 @@ const hex64 = z.string().regex(HEX64_RE);
 const receiptId = z.string().regex(HEX24_RE);
 const taskId = z.string().regex(TASK_ID_RE);
 const stepId = z.string().regex(STEP_ID_RE);
+const streamCoverage = z.strictObject({
+  logical_first_seq:z.number().int().min(1), logical_last_seq:z.number().int().min(0),
+  retained_first_seq:z.number().int().min(1), retained_last_seq:z.number().int().min(0),
+  complete:z.boolean(), truncated:z.boolean(),
+  missing_ranges:z.array(z.strictObject({from:z.number().int().min(1),to:z.number().int().min(0)})).max(100000),
+  logical_item_count:z.number().int().min(0), retained_item_count:z.number().int().min(0),
+  logical_bytes:z.number().int().min(0), retained_bytes:z.number().int().min(0),
+  dropped_items:z.number().int().min(0), dropped_bytes:z.number().int().min(0), status:z.enum(['open','closed'])
+});
 const jsonObject = z.record(z.string(), z.json());
 const taskState = z.enum(['pending', 'running', 'paused', 'failed', 'cancelled', 'succeeded']);
 const codingKind = z.enum(['checkpoint', 'write', 'replace', 'command', 'benchmark']);
+const deadline = z.strictObject({ schema:z.literal('deadbyte.deadline.v1'), id:z.string().nullable(), created_at_ms:z.number(), timeout_ms:z.number().int().min(1).nullable(), deadline_ms:z.number().nullable() });
 
 function requireFields(value, ctx, fields) {
   for (const field of fields) if (value[field] === undefined) ctx.addIssue({ code: 'custom', path: [field], message: `${field} is required` });
@@ -87,7 +97,9 @@ export const codingSearchOutputSchema = statusContract({
     binary_files_skipped: z.number().int().min(0).optional(), truncated: z.boolean().optional(),
     truncation_reason: z.enum(['tree_limit','scan_byte_limit','max_results']).nullable().optional(),
     query_sha256: hex64.optional(), snapshot_sha256: hex64.optional(), page_sha256: hex64.optional(),
-    next_cursor: z.string().max(8192).nullable().optional() },
+    next_cursor: z.string().max(8192).nullable().optional(),
+    stream_id: hex64.optional(), stream_generation: z.number().int().min(1).optional(), stream_next_seq: z.number().int().min(1).optional(),
+    stream_coverage: streamCoverage.optional() },
   successStatuses: ['ok'], successRequired: ['root_id','path','pattern','target','mode','case_sensitive','matches','files_scanned','bytes_scanned','binary_files_skipped','truncated','truncation_reason','query_sha256','snapshot_sha256','page_sha256','next_cursor']
 });
 const semanticLocationSchema = z.strictObject({
@@ -222,7 +234,7 @@ export const codingTaskSubmitOutputSchema = statusContract({
   successStatuses: ['accepted', 'existing'], successRequired: ['task_id', 'plan_sha256', 'state']
 });
 export const codingTaskRunOutputSchema = z.strictObject({
-  status: z.enum(['terminal', 'paused', 'completed', 'cancelled', 'failed', 'yielded', 'succeeded']), error: z.string().optional(), task_id: taskId.optional(),
+  status: z.enum(['terminal', 'paused', 'completed', 'cancelled', 'failed', 'yielded', 'succeeded']), error: z.string().optional(), task_id: taskId.optional(), deadline: deadline.optional(),
   ...Object.fromEntries(Object.entries(derivedShape).map(([key, schema]) => [key, schema.optional()]))
 }).superRefine((value, ctx) => {
   if (value.error !== undefined) { if (value.status !== 'failed') ctx.addIssue({ code: 'custom', path: ['error'], message: 'error wrapper requires status=failed' }); return; }
@@ -231,13 +243,15 @@ export const codingTaskRunOutputSchema = z.strictObject({
 export const codingTaskStatusOutputSchema = statusContract({
   statuses: ['ok', 'failed'],
   shape: { task_id: taskId.optional(), plan_sha256: hex64.optional(),
-    ...Object.fromEntries(Object.entries(derivedShape).map(([key, schema]) => [key, schema.optional()])), journal_verified: z.literal(true).optional() },
+    ...Object.fromEntries(Object.entries(derivedShape).map(([key, schema]) => [key, schema.optional()])), journal_verified: z.literal(true).optional(),
+    stream_id: taskId.optional(), stream_generation: z.number().int().min(1).optional(), stream_next_seq: z.number().int().min(1).optional(), stream_coverage: streamCoverage.optional() },
   successStatuses: ['ok'], successRequired: ['task_id', 'plan_sha256', ...Object.keys(derivedShape), 'journal_verified']
 });
 export const codingTaskEventsOutputSchema = statusContract({
   statuses: ['ok', 'failed'],
   shape: { task_id: taskId.optional(), plan_sha256: hex64.optional(), journal_verified: z.literal(true).optional(),
-    journal_head_sha256: hex64.optional(), events: z.array(eventSchema).max(200).optional() },
+    journal_head_sha256: hex64.optional(), events: z.array(eventSchema).max(200).optional(),
+    stream_id: taskId.optional(), stream_generation: z.number().int().min(1).optional(), stream_next_seq: z.number().int().min(1).optional(), stream_coverage: streamCoverage.optional() },
   successStatuses: ['ok'], successRequired: ['task_id', 'plan_sha256', 'journal_verified', 'journal_head_sha256', 'events']
 });
 export const codingTaskCancelOutputSchema = statusContract({

package/src/coding-plane.mjs

@@ -10,6 +10,7 @@ import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { createCodingSearch } from './coding-search.mjs';
 import { createSearchCursorCodec } from './search-cursor.mjs';
+import { atomicMutation } from './atomic-mutation.mjs';
 
 export const CODING_POLICY_SCHEMA = 'deadbyte.coding-policy.v1';
 export const CODING_LEASE_SCHEMA = 'deadbyte.coding-lease.v1';
@@ -261,30 +262,8 @@ function decodeContent(content, encoding) {
   throw new Error('encoding must be utf8 or base64');
 }
 async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
-  const before = await targetState(target);
-  checkExpected(before, expectedSha256);
-  const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-coding-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
-  let handle;
-  try {
-    if (authorityCheck) await authorityCheck();
-    handle = await open(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
-    await handle.writeFile(bytes);
-    await handle.sync();
-    await handle.close();
-    handle = null;
-    const race = await targetState(target);
-    checkExpected(race, expectedSha256);
-    if (authorityCheck) await authorityCheck();
-    await rename(temp, target);
-  } catch (error) {
-    if (handle) await handle.close().catch(() => {});
-    await rm(temp, { force: true }).catch(() => {});
-    throw error;
-  }
-  const after = await targetState(target);
-  const expectedAfter = sha256Bytes(bytes);
-  if (!after.exists || after.sha256 !== expectedAfter) throw new Error('coding write post-commit hash mismatch');
-  return { before, after };
+  return atomicMutation({ target, bytes, expected: expectedSha256, readState: targetState,
+    assertExpected: checkExpected, authorityCheck, tempTag: 'deadbyte-coding' });
 }
 function codingEnvironment() {
   const allowed = new Set([

package/src/coding-search.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
+import { createSequenceStream } from './workload-substrate.mjs';
 
 const sha256Object=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
 const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -121,18 +122,26 @@ export function createCodingSearch({tree,fileRead,cursorCodec}){
 
     const snapshotSha=sha256Object({schema:'deadbyte.coding-search-snapshot.v2',query_sha256:querySha,entries:snapshotEntries});
     if(decodedCursor&&decodedCursor.snapshot_sha256!==snapshotSha) throw new Error('coding search cursor stale snapshot mismatch');
+    const stream=createSequenceStream({streamId:querySha,maxItems:Math.max(1,maxResults),maxBytes:Math.max(1024, maxResults*4096)});
+    for(const match of matches) stream.append(match,{producer:'coding-search',channel:'match'});
     const offset=decodedCursor?.offset??0;
     if(offset>matches.length) throw new Error('coding search cursor offset exceeds retained results');
-    const pageMatches=matches.slice(offset,offset+pageSize);
+    const page=stream.read(offset+1,pageSize);
+    if(page.missing) throw new Error('coding search cursor offset is outside retained stream coverage');
+    const pageMatches=page.items.map(item=>item.value);
     const nextOffset=offset+pageMatches.length;
     const hasMore=nextOffset<matches.length;
     const nextCursor=hasMore?await cursorCodec.encode({query_sha256:querySha,snapshot_sha256:snapshotSha,offset:nextOffset}):null;
     const pageSha=sha256Object({schema:'deadbyte.coding-search-page.v2',query_sha256:querySha,snapshot_sha256:snapshotSha,offset,matches:pageMatches});
+    const coverage=stream.coverage();
+    const streamSnapshot=stream.snapshot();
     return {
       status:'ok',root_id:rootId,path,pattern,target,mode,case_sensitive:caseSensitive,
       matches:pageMatches,files_scanned:filesScanned,bytes_scanned:bytesScanned,binary_files_skipped:binaryFilesSkipped,
       truncated:truncated||hasMore,truncation_reason:truncationReason,query_sha256:querySha,snapshot_sha256:snapshotSha,
-      page_sha256:pageSha,next_cursor:nextCursor
+      page_sha256:pageSha,next_cursor:nextCursor,
+      stream_id:stream.streamId,stream_generation:stream.generation,stream_next_seq:streamSnapshot.next_seq,
+      stream_coverage:coverage
     };
   };
 }

package/src/coding-task-runtime.mjs

@@ -4,6 +4,8 @@ import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
 import { validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
+import { createJournalStream } from './workload-substrate.mjs';
+import { createDeadline, deadlineState } from './deadline-cancellation.mjs';
 
 export const CODING_TASK_PLAN_SCHEMA = 'deadbyte.coding-task-plan.v1';
 export const CODING_TASK_EVENT_SCHEMA = 'deadbyte.coding-task-event.v1';
@@ -525,7 +527,11 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
     const ctx = taskContext(policy, taskId);
     const plan = await loadPlan(ctx, policy, verifyKeyPath);
     const events = await readEvents(ctx, verifyKeyPath);
-    return { status: 'ok', task_id: taskId, plan_sha256: plan.plan_sha256, ...deriveState(plan, events), journal_verified: true };
+    const stream = createJournalStream({streamId:taskId,events,maxItems:MAX_EVENTS,maxBytes:8*1024*1024,producer:'coding-task',channel:'event'});
+    const snapshot = stream.snapshot();
+    return { status: 'ok', task_id: taskId, plan_sha256: plan.plan_sha256, ...deriveState(plan, events), journal_verified: true,
+      stream_id:snapshot.stream_id, stream_generation:snapshot.generation, stream_next_seq:snapshot.next_seq,
+      stream_coverage:stream.coverage() };
   }
 
   async function events({ taskId, fromSeq = 1, limit = 100 }) {
@@ -534,10 +540,15 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
     const ctx = taskContext(policy, taskId);
     const plan = await loadPlan(ctx, policy, verifyKeyPath);
     const all = await readEvents(ctx, verifyKeyPath);
+    const stream = createJournalStream({streamId:taskId,events:all,maxItems:MAX_EVENTS,maxBytes:8*1024*1024,producer:'coding-task',channel:'event'});
+    const page = stream.read(fromSeq,limit);
+    const snapshot = stream.snapshot();
     return {
       status: 'ok', task_id: taskId, plan_sha256: plan.plan_sha256, journal_verified: true,
       journal_head_sha256: all.at(-1)?.event_sha256 ?? ZERO_HASH,
-      events: all.slice(fromSeq - 1, fromSeq - 1 + limit)
+      stream_id: snapshot.stream_id, stream_generation: snapshot.generation, stream_next_seq: snapshot.next_seq,
+      stream_coverage: stream.coverage(),
+      events: page.items.map(item=>item.value)
     };
   }
 
@@ -590,8 +601,18 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
     const journal = await readEvents(ctx, verifyKeyPath);
     return verifyTaskReceipt(ctx, plan, journal, policy, verifyKeyPath, codingRuntime);
   }
-  async function run({ taskId, maxSteps = 8 }) {
+  async function run({ taskId, maxSteps = 8, timeoutMs = null }) {
     if (!Number.isInteger(maxSteps) || maxSteps < 1 || maxSteps > MAX_STEPS) throw new Error(`max_steps must be in [1, ${MAX_STEPS}]`);
+    if (timeoutMs !== null && (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 900000)) throw new Error('timeout_ms must be null or in [100,900000]');
+    const deadline = createDeadline({ timeoutMs });
+    const deadlineExpired = () => timeoutMs !== null && deadlineState(deadline).expired;
+    const failDeadline = async (ctx, journal, plan, stepId = null) => {
+      await appendEvent(ctx, journal, signingKeyPath, 'task_failed', {
+        stepId,
+        payload: { reason: 'deadline_exceeded', deadline }
+      });
+      return deriveState(plan, journal);
+    };
     const session = await codingRuntime.sessionStatus();
     if (!session.armed) throw new Error(`coding plane is disarmed: ${session.reason}`);
     const ctx = taskContext(policy, taskId);
@@ -610,10 +631,14 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
       if (await consumeCancel(ctx, journal, signingKeyPath, verifyKeyPath)) {
         derived = deriveState(plan, journal); return { status: 'cancelled', task_id: taskId, ...derived };
       }
-      await appendEvent(ctx, journal, signingKeyPath, 'run_started', { payload: { max_steps: maxSteps } });
+      await appendEvent(ctx, journal, signingKeyPath, 'run_started', { payload: { max_steps: maxSteps, deadline } });
       derived = deriveState(plan, journal);
       let consumed = 0;
       while (consumed < maxSteps) {
+        if (deadlineExpired()) {
+          derived = await failDeadline(ctx, journal, plan);
+          return { status: 'failed', task_id: taskId, ...derived, deadline };
+        }
         if (await consumeCancel(ctx, journal, signingKeyPath, verifyKeyPath)) {
           derived = deriveState(plan, journal); return { status: 'cancelled', task_id: taskId, ...derived };
         }
@@ -638,7 +663,9 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
         derived = deriveState(plan, journal);
         consumed += 1;
         try {
-          const executed = await executeStep(codingRuntime, plan, next, attempt);
+          const remainingMs = timeoutMs === null ? null : Math.max(100, Math.floor(deadlineState(deadline).remaining_ms));
+          const boundedStep = remainingMs === null ? next : { ...next, timeout_ms: next.timeout_ms === null || next.timeout_ms === undefined ? remainingMs : Math.min(next.timeout_ms, remainingMs) };
+          const executed = await executeStep(codingRuntime, plan, boundedStep, attempt);
           if (!executed.outcome.valid) {
             await appendEvent(ctx, journal, signingKeyPath, 'task_paused', {
               stepId: next.step_id, payload: { reason: 'post_execute_receipt_mismatch', detail: executed.outcome.reason }
@@ -646,6 +673,10 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
             derived = deriveState(plan, journal);
             return { status: 'paused', task_id: taskId, ...derived };
           }
+          if (deadlineExpired()) {
+            derived = await failDeadline(ctx, journal, plan, next.step_id);
+            return { status: 'failed', task_id: taskId, ...derived, deadline };
+          }
           if (executed.outcome.success) {
             await appendEvent(ctx, journal, signingKeyPath, 'step_succeeded', {
               stepId: next.step_id, payload: { ...executed.outcome.payload, attempt, recovered: false }
@@ -664,6 +695,10 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
           }
           derived = deriveState(plan, journal);
         } catch (error) {
+          if (deadlineExpired()) {
+            derived = await failDeadline(ctx, journal, plan, next.step_id);
+            return { status: 'failed', task_id: taskId, ...derived, deadline };
+          }
           const checked = await codingRuntime.verifyReceiptDetailed(receiptId);
           if (checked.ok) {
             const outcome = receiptOutcome(next, checked, requestSha256);
@@ -717,7 +752,7 @@ export function createCodingTaskRuntime({ codingRuntime, signingKeyPath, verifyK
           }
         }
       }
-      return { status: 'yielded', task_id: taskId, ...derived };
+      return { status: 'yielded', task_id: taskId, ...derived, deadline };
     } finally { await releaseLock(ctx); }
   }
 

package/src/deadline-cancellation.mjs

@@ -0,0 +1,83 @@
+const ID=/^[A-Za-z0-9._:-]{1,128}$/;
+
+export function createDeadline({timeoutMs=null, nowMs=Date.now(), id=null}={}) {
+  if(timeoutMs!==null && (!Number.isInteger(timeoutMs)||timeoutMs<1)) throw new Error('deadline timeout_ms invalid');
+  if(!Number.isFinite(nowMs)) throw new Error('deadline now_ms invalid');
+  const deadlineMs=timeoutMs===null?null:nowMs+timeoutMs;
+  return Object.freeze({
+    schema:'deadbyte.deadline.v1',
+    id:id===null?null:validateId(id),
+    created_at_ms:nowMs,
+    timeout_ms:timeoutMs,
+    deadline_ms:deadlineMs
+  });
+}
+
+export function deadlineState(deadline,{nowMs=Date.now()}={}) {
+  if(!deadline||deadline.schema!=='deadbyte.deadline.v1') throw new Error('deadline invalid');
+  if(!Number.isFinite(nowMs)) throw new Error('deadline now_ms invalid');
+  if(deadline.deadline_ms===null) return Object.freeze({expired:false,remaining_ms:null});
+  const remainingMs=deadline.deadline_ms-nowMs;
+  return Object.freeze({expired:remainingMs<=0,remaining_ms:Math.max(0,remainingMs)});
+}
+
+export function createCancellationToken({id=null}={}) {
+  const controller=new AbortController();
+  let requestedAtMs=null;
+  let reason=null;
+  const request=(value='cancelled')=>{
+    if(controller.signal.aborted)return false;
+    requestedAtMs=Date.now();
+    reason=String(value);
+    controller.abort(reason);
+    return true;
+  };
+  return Object.freeze({
+    schema:'deadbyte.cancellation.v1',
+    id:id===null?null:validateId(id),
+    signal:controller.signal,
+    request,
+    snapshot:()=>Object.freeze({
+      requested:controller.signal.aborted,
+      requested_at_ms:requestedAtMs,
+      reason
+    })
+  });
+}
+
+export function composeAbortSignal({deadline=null,cancellation=null}={}) {
+  const controller=new AbortController();
+  let timeout=null;
+  const abort=(reason)=>{
+    if(!controller.signal.aborted)controller.abort(reason);
+  };
+  if(cancellation?.signal){
+    if(cancellation.signal.aborted)abort(cancellation.signal.reason??'cancelled');
+    else cancellation.signal.addEventListener('abort',()=>abort(cancellation.signal.reason??'cancelled'),{once:true});
+  }
+  if(deadline?.deadline_ms!==null&&deadline?.deadline_ms!==undefined){
+    const remaining=Math.max(0,deadline.deadline_ms-Date.now());
+    if(remaining===0)abort('deadline_exceeded');
+    else timeout=setTimeout(()=>abort('deadline_exceeded'),remaining);
+    timeout?.unref?.();
+  }
+  const close=()=>{if(timeout)clearTimeout(timeout);};
+  return Object.freeze({signal:controller.signal,close});
+}
+
+export function classifyTermination({deadlineExceeded=false,cancellationRequested=false,physicallyTerminated=false,verified=false}={}) {
+  return Object.freeze({
+    deadline_exceeded:deadlineExceeded===true,
+    cancellation_requested:cancellationRequested===true,
+    physical_termination:physicallyTerminated===true,
+    verified:verified===true,
+    terminal_semantics:
+      verified ? (physicallyTerminated ? 'verified_termination' : 'verified_stop')
+      : physicallyTerminated ? 'termination_unverified'
+      : cancellationRequested ? 'cancellation_requested'
+      : deadlineExceeded ? 'deadline_exceeded'
+      : 'running'
+  });
+}
+
+function validateId(id){if(typeof id!=='string'||!ID.test(id))throw new Error('deadline/cancellation id invalid');return id;}

package/src/machine-fs-smoke-client.mjs

@@ -56,7 +56,7 @@ const transport = new StdioClientTransport({
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const baseTools = ['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const codingTools = [
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat',

package/src/machine-fs.mjs

@@ -9,6 +9,7 @@ import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
+import { atomicMutation } from './atomic-mutation.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -271,29 +272,8 @@ function requestSha(operation, args) {
 }
 
 async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
-  const before = await regularState(target);
-  checkExpectedFile(before, expectedSha256);
-  const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-machine-fs-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
-  let handle;
-  try {
-    if (authorityCheck) await authorityCheck();
-    handle = await open(temp, 'wx', 0o600);
-    await handle.writeFile(bytes);
-    await handle.sync();
-    await handle.close();
-    handle = null;
-    checkExpectedFile(await regularState(target), expectedSha256);
-    if (authorityCheck) await authorityCheck();
-    await rename(temp, target);
-  } catch (error) {
-    if (handle) await handle.close().catch(() => {});
-    await rm(temp, { force: true }).catch(() => {});
-    throw error;
-  }
-  const after = await regularState(target);
-  const expectedAfter = sha256Bytes(bytes);
-  if (!after.exists || after.sha256 !== expectedAfter) throw new Error('machine fs post-commit hash mismatch');
-  return { before, after };
+  return atomicMutation({ target, bytes, expected: expectedSha256, readState: regularState,
+    assertExpected: checkExpectedFile, authorityCheck, tempTag: 'deadbyte-machine-fs' });
 }
 
 export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {

package/src/mcp-server.mjs

@@ -15,6 +15,7 @@ import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
 import { installStdioConsoleGuard } from './stdio-console-guard.mjs';
+import { recoverInterruptedSlotUpdates } from './runtime-update.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
@@ -74,6 +75,11 @@ const verifyKeyPath = process.env.DEADBYTE_VERIFY_KEY ?? defaultPublicKeyPath();
 const auditRuntimeMode = process.env.DEADBYTE_AUDIT_RUNTIME ?? '0';
 if (!['0','1'].includes(auditRuntimeMode)) throw new Error('DEADBYTE_AUDIT_RUNTIME must be 0 or 1');
 const runtimeStateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(),'.deadbyte-mcp'));
+const interruptedUpdateRecovery = await recoverInterruptedSlotUpdates({ stateRoot: runtimeStateRoot });
+if (interruptedUpdateRecovery.launched > 0) {
+  console.error(`[runtime-update-recovery] launched ${interruptedUpdateRecovery.launched} detached supervisor(s)`);
+}
+
 const surfaceProfile = capabilityProfileFromEnv(process.env);
 const localPrivilegedPolicyPath = path.join(packageRoot, 'controller', 'deadbyte-host-policy.json');
 const privilegedPolicyExplicit = Object.hasOwn(process.env, 'DEADBYTE_PRIVILEGED_POLICY');

package/src/observation-smoke-client.mjs

@@ -51,7 +51,7 @@ const transport=new StdioClientTransport({command:process.execPath,args:[serverP
   env:{...getDefaultEnvironment(),DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
     DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_STATE_ROOT:state,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath},stderr:'pipe'});
 const stderr=[]; transport.stderr?.on('data',chunk=>stderr.push(Buffer.from(chunk)));
-const base=['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const base=['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const machine=['machine_list','machine_ping','machine_revoke','machine_status'];
 const coding=['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read','coding_receipt_verify','coding_search',
   'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',

package/src/process-mcp-tools.mjs

@@ -22,10 +22,10 @@ export function registerProcessTools(server, { runtime }) {
     description: 'Start one locally registered process profile inside an approved root. Executable identity comes only from local policy.',
     inputSchema: z.strictObject({
       profile_id: id, root_id: id, cwd: z.string().min(1).max(1024).default('.'),
-      args: z.array(z.string().max(8192)).max(64).default([])
+      args: z.array(z.string().max(8192)).max(64).default([]), timeout_ms: z.number().int().min(100).max(900000).nullable().default(null)
     }), outputSchema: processStartOutputSchema
-  }, async ({ profile_id, root_id, cwd, args }) => {
-    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args }) }); }
+  }, async ({ profile_id, root_id, cwd, args, timeout_ms }) => {
+    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args, timeoutMs: timeout_ms }) }); }
     catch (error) { return fail(processStartOutputSchema, 'denied', error); }
   });
   server.registerTool('process_session_read', {
@@ -66,6 +66,14 @@ export function registerProcessTools(server, { runtime }) {
     try { return ok(processListOutputSchema, { status: 'ok', ...(await runtime.list()) }); }
     catch (error) { return fail(processListOutputSchema, 'failed', error); }
   });
+  server.registerTool('process_session_cancel', {
+    description: 'Request cooperative cancellation of one DEADBYTE-owned process session. Cancellation is recorded separately from physical termination.',
+    inputSchema: z.strictObject({ session_id: hex64, reason: z.string().min(1).max(256).default('operator_request') }), outputSchema: processTerminateOutputSchema
+  }, async ({ session_id, reason }) => {
+    try { return ok(processTerminateOutputSchema, { status: 'ok', session: await runtime.cancel({ sessionId: session_id, reason }) }); }
+    catch (error) { return fail(processTerminateOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_terminate', {
     description: 'Terminate one DEADBYTE-owned process session through its owned host boundary. Numeric PID is never an input.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processTerminateOutputSchema

package/src/process-output-contracts.mjs

@@ -4,6 +4,23 @@ import { structuredToolResult } from './output-contracts.mjs';
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
 const digits = z.string().regex(/^[0-9]+$/);
 const processState = z.enum(['running','exited','terminated']);
+const termination = z.strictObject({
+  deadline_exceeded:z.boolean(), cancellation_requested:z.boolean(), physical_termination:z.boolean(), verified:z.boolean(),
+  terminal_semantics:z.string().min(1).max(64)
+});
+const deadline = z.strictObject({
+  schema:z.literal('deadbyte.deadline.v1'), id:hex64.nullable(), created_at_ms:z.number(), timeout_ms:z.number().int().positive().nullable(), deadline_ms:z.number().nullable()
+});
+const streamCoverage = z.strictObject({
+  logical_first_seq:z.number().int().min(1), logical_last_seq:z.number().int().min(0),
+  retained_first_seq:z.number().int().min(1), retained_last_seq:z.number().int().min(0),
+  complete:z.boolean(), truncated:z.boolean(),
+  missing_ranges:z.array(z.strictObject({from:z.number().int().min(1),to:z.number().int().min(0)})).max(100000),
+  logical_item_count:z.number().int().min(0), retained_item_count:z.number().int().min(0),
+  logical_bytes:z.number().int().min(0), retained_bytes:z.number().int().min(0),
+  dropped_items:z.number().int().min(0), dropped_bytes:z.number().int().min(0),
+  status:z.enum(['open','closed'])
+});
 
 export const processSessionRecordSchema = z.strictObject({
   session_id: hex64,
@@ -17,6 +34,12 @@ export const processSessionRecordSchema = z.strictObject({
   earliest_offset: z.number().int().nonnegative(),
   stream_head: z.number().int().nonnegative(),
   stream_sha256: hex64,
+  stream_id: hex64.nullable(),
+  stream_generation: z.number().int().min(1).nullable(),
+  stream_next_seq: z.number().int().min(1).nullable(),
+  stream_coverage: streamCoverage.nullable(),
+  termination: termination.nullable(),
+  deadline: deadline.nullable(),
   journal_head_sha256: hex64
 });
 

package/src/process-runtime.mjs

@@ -6,6 +6,8 @@ import { canonicalJson } from './canonical-json.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { assertProcessArmed, recheckProcessAuthority } from './process-policy.mjs';
+import { createSequenceStream } from './workload-substrate.mjs';
+import { classifyTermination, composeAbortSignal, createCancellationToken, createDeadline } from './deadline-cancellation.mjs';
 
 const EVENT_SCHEMA = 'deadbyte.process-event.v1';
 const EVENT_DOMAIN = Buffer.from('DEADBYTE-PROCESS-EVENT-V1\0', 'utf8');
@@ -52,11 +54,18 @@ async function resolveCwd(policy, grant, profile, rootId, cwd) {
 }
 
 function publicSession(session) {
+  const stream = session.recovered_terminal ? null : session.output_stream;
   return {
     session_id: session.session_id, profile_id: session.profile_id, root_id: session.root_id,
     cwd: session.cwd_relative, child_pid: session.child_pid, creation_filetime: session.creation_filetime,
     state: session.state, exit_code: session.exit_code, earliest_offset: session.earliest_offset,
     stream_head: session.stream_head, stream_sha256: session.stream_sha256,
+    stream_id: stream?.streamId ?? null,
+    stream_generation: stream?.generation ?? null,
+    stream_next_seq: stream?.snapshot().next_seq ?? null,
+    stream_coverage: stream?.coverage() ?? null,
+    termination: session.termination ?? null,
+    deadline: session.deadline ?? null,
     journal_head_sha256: session.journal_head_sha256
   };
 }
@@ -93,6 +102,7 @@ function retainedIndexOf(session, needle, begin = 0) {
 function appendOutput(session, chunk) {
   if (!chunk?.length) return;
   const bytes = Buffer.from(chunk);
+  session.output_stream?.append(null, { producer: 'process-host', channel: 'merged-output', sizeBytes: bytes.length });
   session.stream_sha256 = sha256Bytes(Buffer.concat([
     Buffer.from(session.stream_sha256, 'hex'), bytes
   ]));
@@ -207,7 +217,8 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
           earliest_offset:terminal.detail.earliest_offset, stream_head:terminal.detail.stream_head,
           stream_sha256:terminal.detail.stream_sha256, output_chunks:[output], retained_output_bytes:output.length, control_buffer:Buffer.alloc(0),
           journal_head_sha256:checked.head_sha256, journal_path:path.join(policy.state_dir,name), event_count:checked.event_count,
-          max_retained_output_bytes:profile.max_retained_output_bytes, stderr:'', terminate_requested:terminal.type==='terminated',
+          max_retained_output_bytes:profile.max_retained_output_bytes, output_stream:createSequenceStream({streamId:sessionId,maxItems:1000000,maxBytes:profile.max_retained_output_bytes}), stderr:'', terminate_requested:terminal.type==='terminated',
+          termination:terminal.detail?.termination ?? null, deadline:terminal.detail?.deadline ?? null, cancellation:null,
           protocol_error:null, transport:profile.transport, win32_input_mode:false, host:null, close_promise:Promise.resolve(),
           recovered_terminal:true
         });
@@ -281,7 +292,8 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     }
   }
 
-  async function start({ profileId, rootId, cwd = '.', args = [] }) {
+  async function start({ profileId, rootId, cwd = '.', args = [], timeoutMs = null }) {
+    if (timeoutMs !== null && (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 900000)) throw new Error('process timeout_ms must be in [100, 900000] or null');
     await hydrateTerminalSessions();
     const grant = await assertProcessArmed(policy, profileId, rootId);
     const profile = policy.profiles[profileId];
@@ -303,16 +315,35 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
       cwd_relative: cwdInfo.relative, child_pid: null, creation_filetime: null, state: 'starting', exit_code: null,
       earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output_chunks: [], retained_output_bytes: 0, control_buffer: Buffer.alloc(0),
       journal_head_sha256: ZERO_SHA256, journal_path: path.join(policy.state_dir, `${sessionId}.jsonl`), event_count: 0,
-      max_retained_output_bytes: profile.max_retained_output_bytes, stderr: '', terminate_requested: false, protocol_error: null,
+      max_retained_output_bytes: profile.max_retained_output_bytes, output_stream: createSequenceStream({streamId: sessionId, maxItems: 1000000, maxBytes: profile.max_retained_output_bytes}), stderr: '', terminate_requested: false, protocol_error: null,
+      deadline: createDeadline({ timeoutMs, id: sessionId }),
+      cancellation: createCancellationToken({ id: sessionId }),
+      termination: classifyTermination(),
       transport: profile.transport,
       win32_input_mode: false
     };
     await recheckProcessAuthority(policy, grant, profileId, rootId);
+    const composed = composeAbortSignal({ deadline: session.deadline, cancellation: session.cancellation });
+    session.abort_signal = composed;
     const host = spawn(policy.native_host.path,
       [profile.executable, cwdInfo.resolved, session.job_id, `--deadbyte-transport=${profile.transport}`, ...profile.prefix_args, ...args],
       { cwd: cwdInfo.resolved, env: processEnvironment(profile), windowsHide: true, shell: false, stdio: ['pipe','pipe','pipe'] });
     session.host = host;
     sessions.set(sessionId, session);
+    const abortProcess = () => {
+      const reason = String(composed.signal.reason ?? 'cancelled');
+      const snapshot = session.cancellation.snapshot();
+      session.termination = classifyTermination({
+        deadlineExceeded: reason === 'deadline_exceeded',
+        cancellationRequested: snapshot.requested,
+        physicallyTerminated: false,
+        verified: false
+      });
+      session.terminate_requested = true;
+      if (!host.killed) host.kill();
+    };
+    composed.signal.addEventListener('abort', abortProcess, { once: true });
+    if (composed.signal.aborted) abortProcess();
     const ready = new Promise((resolve, reject) => { session.ready_resolve = resolve; session.ready_reject = reject; });
     host.stdout.on('data', chunk => parseHostOutput(session, chunk));
     host.stderr.on('data', chunk => { session.stderr = (session.stderr + chunk.toString('utf8')).slice(-16384); });
@@ -322,6 +353,13 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
         parseHostOutput(session, null, true);
         if (session.state === 'starting') session.ready_reject?.(new Error(`process host exited before READY: ${session.stderr}`));
         session.exit_code ??= Number.isInteger(code) ? code : null;
+        const snapshot = session.cancellation.snapshot();
+        session.termination = classifyTermination({
+          deadlineExceeded: session.deadline.deadline_ms !== null && Date.now() >= session.deadline.deadline_ms && session.terminate_requested,
+          cancellationRequested: snapshot.requested,
+          physicallyTerminated: session.terminate_requested,
+          verified: true
+        });
         const terminalState = session.terminate_requested ? 'terminated' : 'exited';
         try {
           const outputFile = `${session.session_id}.stream.bin`;
@@ -336,10 +374,13 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
             stream_sha256:session.stream_sha256,
             retained_output_bytes:session.retained_output_bytes,
             retained_output_sha256:retainedOutputSha256,
+            termination:session.termination,
+            deadline:session.deadline,
             output_file:outputFile
           });
           session.state = terminalState;
         } catch {}
+        composed.close();
         resolve();
       });
     });
@@ -428,11 +469,19 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     await appendEvent(runtime, session, 'action', { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256 });
     return { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, session: publicSession(session) };
   }
+  async function cancel({ sessionId, reason = 'operator_request' }) {
+    const session = await sessionFor(sessionId);
+    if (typeof reason !== 'string' || reason.length < 1 || reason.length > 256) throw new Error('process cancellation reason invalid');
+    if (['exited','terminated'].includes(session.state)) return publicSession(session);
+    session.cancellation.request(reason);
+    await session.close_promise;
+    return publicSession(session);
+  }
   async function terminate({ sessionId }) {
     const session = await sessionFor(sessionId);
     if (['exited','terminated'].includes(session.state)) return publicSession(session);
     session.terminate_requested = true;
-    session.host.kill();
+    if (!session.host.killed) session.host.kill();
     await session.close_promise;
     return publicSession(session);
   }
@@ -463,5 +512,5 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return { ok: true, event_count: sequence, head_sha256: previous };
   }
 
-  return { policy, start, read, write, status, list, action, terminate, verifyEventJournal };
+  return { policy, start, read, write, status, list, action, cancel, terminate, verifyEventJournal };
 }