deadbyte-mcp 0.15.20 → 0.15.21

package/MANIFEST.SHA256

@@ -1335,7 +1335,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-fcf75bf9bca9087083629d561793a62c48bccca5ce809815dfbf41b5ebd37e63  package.json
+8b341990ff54a32760233b5e1bee614a01c10634b4da03fb6678643bfec0e2b8  package.json
 872947dffd89755b03558b217129f009dc9f4fd1ce55e93c602fc6ea97ba8b48  proof/commander-closure-20260927/CONTINUATION.json
 2959980d295814aaa0df71fdb358d2cbfd01c1357ee36ef6b10c149875bdb262  proof/commander-closure-20260927/RESULT.json
 2c2866309ca3a6fc8de5b03d445f1dcf0778474fa25cefb822b2ab729bc91c62  proof/commander-closure-20260927/SEARCH-CONTINUATION.json
@@ -1399,7 +1399,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-24fd81da0f2bd1924b98166d5a3346250932bd1119a9510afa7fe2bb4b941069  PROVENANCE.json
+882599a4a5734296f96cef5235de97d3157b44950e525458a576051f139d2cbf  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1407,9 +1407,9 @@ bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.jso
 f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.json
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
-366e830adfb7d20f50af0c518414b84943df0768467b24ec3b7ba687da89e02a  README.txt
-8a3bc7b365d910a519305428dca02c54201506916e9d46c015f15f48896c537c  RELEASE.json
-1f729b4427610aeb5941060c5ece1dd2d080791d39b1f332c7bc6aef5ca80033  SBOM.cdx.json
+fec4fdf373b3a3a2a36b228722ad67cfee48ab3600840013f9ea1c255fa7b574  README.txt
+c5cc53320752501dde2c781c388cf5cee46dabb9d7527c20401de44ab8e96136  RELEASE.json
+1241bc4856d07ef3c3b92d52b81cd2b6c1f9e6e31136b9cfbc2527e943de0f53  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
 1d4e9dee6f0669bd825334a6a72e13ee85ee29ab430dcef21d893ffd744774b5  scripts/autonomous-benchmark.mjs
@@ -1598,7 +1598,7 @@ e5f944a310ed957e3b8f7b1cab54c082acf1b35f8fdd7d9b672ebe1a80dc37ac  src/canonical-
 da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability-benchmark-runner.mjs
 2b62295591f142ca4b3bc5b03e6434f7fc3c51d9502f9a40ef8a03d1f72a8899  src/capability-benchmark.mjs
 160199b25f45bd0490f6b21a9fa8194313e9673c4b2699afce68249d3d249a7b  src/capability-ledger.mjs
-ecccd8645297f2edd131b2e1a30016fb58ea9d18d8536aa784a21734c81cf209  src/capability-resolver.mjs
+163ff2615496c453c3a325c79f49b1520e2effad93acf976a12e5a192bd5268a  src/capability-resolver.mjs
 94e5aeff2453cdc0239aee4d547dbbefee183c71933cb84e5e8a418fa99bc1e8  src/codex-app-server-r44.mjs
 6d0a80daaa2711e67e2597bff3db5bd2802682f559107a492f3cd89b9c6785ed  src/coding-mcp-tools.mjs
 d6fc395575f49abbbf60bf6f6ef5ee9ad51034a7e770a381e6ec34f869788306  src/coding-output-contracts.mjs
@@ -1668,7 +1668,7 @@ ad4ca3635cb228b57b5b98e9518f379380ee1a03ad07ab4d12f8b7f324be2517  src/machine-mc
 e81b3ac2955e5dfafe308c82da24356a14da396230cb9fc47b231ab672d5be48  src/machine-output-contracts.mjs
 ed85d41c494a334117661ddec8191d34974fe28cb2a3378f3c04ee0e4c5d3ccc  src/mcp-contained-smoke-client.mjs
 b705345aa432b6a6ebbf62aabce1f78ba7e392bdfe998e79217eba8289ed0a7e  src/mcp-host-smoke-client.mjs
-15defd69705903fa637df403a0099e4ff060577db48fcb101c782a00967f51f8  src/mcp-server.mjs
+4f2ddba24aa0fb3d86b90ca8772ad96f5e51b715a94a3e8986038d266cd9e92c  src/mcp-server.mjs
 b490c4152b16adae658b3af20a4827847866cec352e1b0c9eb6b36094116b83b  src/mcp-smoke-client.mjs
 cde7c813f5a2e9a69f09849455d1504e766963845a1f4b201ecc84090fa260d5  src/memory-r41.mjs
 9525aee66944023603f6d1ebb0768b8e8ab8bb93582a10dd7f9cd4459ee07454  src/native-diff-v2.mjs
@@ -1743,11 +1743,11 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-5bed29049d7c8823986120d68d7477bf2224860e85e4e9b6c1fec7413f2ffd99  src/version.mjs
+2c3edb278ad7ac00768216d0e47b0a5c14e90abc983e18fca1c77d262e5f5096  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
-fe93303c735ffeca84c05340f171ecaec4c0b922ee506603f463ace86b3224c4  TEST-MATRIX.json
+dd71ec32ac61c686e441c8e2cf9821f3c6a722f5276de46ac08abff937c2bc9e  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -1784,7 +1784,7 @@ bad448d7bfd0c66b8d0dc0fa601fc22d69ccc3f447140ed0f77b68957984daea  test/capabilit
 c343906ca0878e13c576cd9f615802b1139c693bf6769a780dfb052637cf0d83  test/capability-benchmark.test.mjs
 b9a8faa4b86683ac5aea891fe6bc95f8e425fb31635176aa4603f9d582b52a79  test/capability-claims-r36.test.mjs
 a466a490759d438a8ac68919f79ddcb52253bdbecb5e4448a4fbf62af118184e  test/capability-ledger-r36.test.mjs
-5cdf20eace97fa87563c6b139390e6bd8ccbe80215f53aacd041579bfbad20d6  test/capability-resolver.test.mjs
+aec98dc7d09acf39916425d055d5e76f45713ef4d3d73f9aedb7ec1ea037bed4  test/capability-resolver.test.mjs
 84eefe1a43474927fdc6fb7ef269309c662cefb229d6af2c91d9e2f0b9ba5c23  test/cli-entrypoint.test.mjs
 bec565ffa8550d56a5bb21927177c37d9d05f8353e3bc2541fc156886fe23688  test/codex-app-server-r44.test.mjs
 c43105a78ee4c93417d720ee660cfebc75b17f142a6484568e3cbaa583457f8c  test/codex-autonomous-r44.test.mjs
@@ -1818,7 +1818,7 @@ d68167d1ab3040670262c4916c0230acf85b8a6dfb1c5e1b28738843e3adf280  test/commander
 14a7aa23e27da0a59025c71766fc8685d62abc07b3ea4f5fd3453aa00923fd47  test/compact-gateway-r36.test.mjs
 3b5133e8cc7a8c2c5e66a7c34ac5e4f9bf2cf14b5897a7e871fb41ba82b629e5  test/compact-max-catalog-r40.test.mjs
 22e3cc9a6f9e2da776e3c737b964e2a8889c1363c244474de552d8e17dac8ffc  test/compact-max-catalog-r44.test.mjs
-dfb788030ce448c4f18eed99fe7e8ee74d8f022a1d2fd36fc7e6d4a5bc4de7f6  test/compact-max-catalog-r45.test.mjs
+d05c22af0c714fd98ee7454668e8b2968e6349f006b5e7d8ead2b6669e68714c  test/compact-max-catalog-r45.test.mjs
 887df1e1627747444baf7e4e4179015e5b15c8e236c14674ddf36e3a83766bba  test/contained.test.mjs
 48a3b64ed40311fb017217cd85f3102c77a2cd72490b5edd41aac01247a1882c  test/containment.test.mjs
 599eba90e0e4e1222518f7c268e0d5598dcbc9121a13fe6ede909645e72ec24b  test/context-provenance.test.mjs
@@ -1984,7 +1984,7 @@ d8f544bbcdfff61f7abb7705ad7e5e1f17998f5fde3c114fb33915fc66d1408f  test/r41-final
 2c5f2093b945c267c8d09cd2da0875c7f45911a7c01aa02a50cd64c2c1a7ccdc  test/r45-autonomous-quick-test.test.mjs
 532075c86893caf68a2d0ea09171bee4c7d60892c1892011285376a2c186ed92  test/r45-finalization.test.mjs
 25a21ccffcf566b020b8f3c6c0a5a3b7ff06b243fff84e405207e458640ba487  test/r47-release-contract.test.mjs
-c050366979eb50810425593130b36c985ff5f74fddb3e1fd55fb9b0713ec5e89  test/r48-release-contract.test.mjs
+26c52445254369d60d669135fab1f61764bfec790c2f1097d14858e10be01416  test/r48-release-contract.test.mjs
 e45a6cd299d8d65bdeb9bc0117ce1eb2b47fdebad89a02413ee979c9d0ae3a5c  test/release-activation-gate.test.mjs
 85f6dc2059fd19d03452309ffe67bed5b87da8e6f0ce3a85cab58cba8b197ceb  test/release-generation.test.mjs
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs

package/PROVENANCE.json

@@ -1,17 +1,17 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.20",
-  "builder": "deadbyte-r48-durable-journal-hotfix",
-  "source_model": "development-root -> pinned Desktop Commander 0.2.51 wire reference -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed machine truth",
+  "version": "0.15.21",
+  "builder": "deadbyte-r48-capability-manifest-authority-truth",
+  "source_model": "development-root -> pinned Desktop Commander 0.2.51 wire reference -> authority-truth regression -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed machine truth",
   "signing": "ed25519",
-  "parent_release_id": "v0.15.19-4b5fcf7acdff11e9",
-  "parent_manifest_sha256": "4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29",
-  "parent_generation_manifest_sha256": "610f4fef7c5e37330f7b2b0fbad69efe0a00f9c7bd256ce8e08bc87e1891680b",
-  "source_predecessor_version": "0.15.19",
-  "source_predecessor_tarball_sha256": "e4224ec93588cbd6d68a147cc26097e8a29ddea870fa5f3a9020ab9ed1efbe8f",
-  "source_predecessor_manifest_file_sha256": "4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29",
+  "parent_release_id": "v0.15.20-bab990b08c9c1f07",
+  "parent_manifest_sha256": "bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d",
+  "parent_generation_manifest_sha256": "617ea6bfbfc7e1952d17e7fea1043fd70b32bb1edacbd3ed6002fec7235c7221",
+  "source_predecessor_version": "0.15.20",
+  "source_predecessor_tarball_sha256": "eb7cbe8465ae3834c9857fc2115c7ab4eb3d1a018aa1695b799912def5dc3cee",
+  "source_predecessor_manifest_file_sha256": "bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d",
   "commander_reference_version": "0.2.51",
   "commander_reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
   "commander_reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140",
-  "reproducibility": "manifest-bound package bytes; exact wire reference hashes; native payloads hash-bound; version/slot/generation coherence verified by signed machine ping"
+  "reproducibility": "manifest-bound package bytes; exact predecessor package digest; authority state resolver covered by unit and real compact stdio proof; version/slot/generation coherence verified by signed machine ping"
 }

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.20 / R48 DURABLE JOURNAL AUTHENTIC EVENT HOTFIX
+DEADBYTE MCP V0.15.21 / R48 CAPABILITY MANIFEST AUTHORITY TRUTH
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.20 mcp
-  npx -y deadbyte-mcp@0.15.20 remote
-  npx -y deadbyte-mcp@0.15.20 remote status
-  npx -y deadbyte-mcp@0.15.20 remote restart
-  npx -y deadbyte-mcp@0.15.20 audit status
-  npx -y deadbyte-mcp@0.15.20 audit verify
+  npx -y deadbyte-mcp@0.15.21 mcp
+  npx -y deadbyte-mcp@0.15.21 remote
+  npx -y deadbyte-mcp@0.15.21 remote status
+  npx -y deadbyte-mcp@0.15.21 remote restart
+  npx -y deadbyte-mcp@0.15.21 audit status
+  npx -y deadbyte-mcp@0.15.21 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,19 +1,19 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.20",
+  "version": "0.15.21",
   "train": "R48",
-  "label": "DURABLE JOURNAL AUTHENTIC EVENT HOTFIX",
+  "label": "CAPABILITY MANIFEST AUTHORITY TRUTH",
   "protocol_revision": "2026-07-28",
   "parent": {
-    "release_id": "v0.15.19-4b5fcf7acdff11e9",
-    "manifest_sha256": "4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29",
-    "generation_manifest_sha256": "610f4fef7c5e37330f7b2b0fbad69efe0a00f9c7bd256ce8e08bc87e1891680b"
+    "release_id": "v0.15.20-bab990b08c9c1f07",
+    "manifest_sha256": "bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d",
+    "generation_manifest_sha256": "617ea6bfbfc7e1952d17e7fea1043fd70b32bb1edacbd3ed6002fec7235c7221"
   },
   "source_predecessor": {
-    "version": "0.15.19",
-    "tarball_sha256": "e4224ec93588cbd6d68a147cc26097e8a29ddea870fa5f3a9020ab9ed1efbe8f",
-    "manifest_file_sha256": "4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29",
+    "version": "0.15.20",
+    "tarball_sha256": "eb7cbe8465ae3834c9857fc2115c7ab4eb3d1a018aa1695b799912def5dc3cee",
+    "manifest_file_sha256": "bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d",
     "reference_package": "@wonderwhy-er/desktop-commander@0.2.51",
     "reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
     "reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
@@ -44,6 +44,8 @@
     "pid_reuse_self_recovery": true,
     "bounded_controller_failure_evidence": true,
     "durable_task_events_preserve_signed_envelope": true,
+    "capability_manifest_authority_truth": true,
+    "capability_manifest_host_grant_truth": true,
     "process_profiles": ["ping_hold", "powershell", "powershell_repl"],
     "powershell_fileless": true,
     "powershell_source_max_arg_bytes": 8192,

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r48:0.15.20",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r48:0.15.21",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.20"
+      "version": "0.15.21"
     }
   },
   "components": [
@@ -15,6 +15,6 @@
     {"type":"library","name":"@modelcontextprotocol/server","version":"2.1.0"},
     {"type":"library","name":"typescript","version":"5.9.3"},
     {"type":"library","name":"zod","version":"4.4.3"},
-    {"type":"file","name":"deadbyte-hardware-observer-r45.exe","version":"0.15.20","hashes":[{"alg":"SHA-256","content":"46bcd3768bb95f8c63fc3118e031efc2818a92929611cabf6c3b29c5162a6591"}]}
+    {"type":"file","name":"deadbyte-hardware-observer-r45.exe","version":"0.15.21","hashes":[{"alg":"SHA-256","content":"46bcd3768bb95f8c63fc3118e031efc2818a92929611cabf6c3b29c5162a6591"}]}
   ]
 }

package/TEST-MATRIX.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.20",
+  "version": "0.15.21",
   "train": "R48",
   "primary_platform": "win32-x64",
   "reference": {
@@ -10,7 +10,9 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
-    {"id":"coding-durable-event-envelope","command":"node test/coding-runtime.test.mjs","expected":"PASS with signed durable event envelope fields"},
+    {"id":"capability-authority-truth","command":"node --test test/capability-resolver.test.mjs","expected":"PASS across disarmed Coding/Process/Autonomous/Desktop/Host plus armed Host positive control"},
+    {"id":"compact-authority-truth","command":"node --test test/compact-max-catalog-r45.test.mjs","expected":"PASS real compact stdio authority-state manifest truth"},
+    {"id":"coding-durable-event-envelope","command":"node --test test/coding-runtime.test.mjs","expected":"PASS with signed durable event envelope fields"},
     {"id":"commander-hardening","command":"npm run r47:hardening:test","expected":"PASS"},
     {"id":"r48-release","command":"npm run r48:release:test","expected":"PASS"},
     {"id":"full-regression","command":"npm run r48:full:test","expected":"PASS"},
@@ -18,14 +20,15 @@
     {"id":"release-smoke","command":"node --test test/release-smoke-isolation.test.mjs","expected":"PASS"},
     {"id":"runtime-update","command":"node --test test/runtime-self-update.test.mjs","expected":"PASS"},
     {"id":"audit","command":"npm audit --omit=dev","expected":"0 vulnerabilities"},
-    {"id":"activation","command":"npx -y deadbyte-mcp@0.15.20 remote status","expected":"active runtime 0.15.20 with no VERSION SKEW"},
-    {"id":"machine-truth","command":"signed machine_ping","expected":"release_id and manifests bind activated 0.15.20 generation"}
+    {"id":"activation","command":"npx -y deadbyte-mcp@0.15.21 remote status","expected":"active runtime 0.15.21 with no VERSION SKEW"},
+    {"id":"machine-truth","command":"signed machine_ping","expected":"release_id and manifests bind activated 0.15.21 generation"},
+    {"id":"live-capability-truth","command":"capability_manifest after activation","expected":"DENIED mutating/bound reads follow disarmed authority; authority-independent reads remain AVAILABLE"}
   ],
   "full_regression_partition_proof": {
     "files": 204,
     "batches": 8,
-    "tests": 1013,
-    "pass": 1005,
+    "tests": 1015,
+    "pass": 1007,
     "skip": 8,
     "fail": 0
   },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "deadbyte-mcp",
-    "version": "0.15.20",
+    "version": "0.15.21",
     "private": false,
     "type": "module",
     "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/src/capability-resolver.mjs

@@ -1,3 +1,11 @@
+import { processSessionStatus } from './process-policy.mjs';
+import { assertHostArmed } from './host-plane.mjs';
+
+const CODING_ARMED_READ_CAPABILITIES = new Set([
+  'coding.tree','coding.stat','coding.search','coding.files_read','coding.file_read',
+  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview'
+]);
+
 export const CAPABILITY_STATES = Object.freeze({
   AVAILABLE: 'AVAILABLE',
   DEGRADED: 'DEGRADED',
@@ -88,12 +96,11 @@ export function deriveCapabilityRequirements(capability) {
     reqs.push('skill_plane.valid');
     return reqs;
   }
+  if (CODING_ARMED_READ_CAPABILITIES.has(capability.id) && capability.authority !== 'coding') reqs.push('coding_session.armed');
   if (capability.authority === 'coding') {
-    if (capability.mutating) {
-      reqs.push('coding_session.armed', 'policy.write');
-    } else {
-      reqs.push('coding_runtime.ready');
-    }
+    if (capability.mutating || CODING_ARMED_READ_CAPABILITIES.has(capability.id)) reqs.push('coding_session.armed');
+    else reqs.push('coding_runtime.ready');
+    if (capability.mutating) reqs.push('policy.write');
   } else if (capability.authority === 'process') {
     if (capability.mutating) {
       reqs.push('process_session.armed');
@@ -113,11 +120,7 @@ export function deriveCapabilityRequirements(capability) {
       reqs.push('desktop_runtime.ready');
     }
   } else if (capability.authority === 'host' || capability.host_only) {
-    if (capability.mutating) {
-      reqs.push('host_policy.armed');
-    } else {
-      reqs.push('host_policy.configured');
-    }
+    reqs.push('host_policy.armed');
   }
   return reqs;
 }
@@ -148,11 +151,33 @@ export async function resolveCapabilityStates({
     try { codingStatus = await codingRuntime.sessionStatus(); } catch {}
   }
 
+  let processStatus = null;
+  if (processRuntime?.sessionStatus) {
+    try { processStatus = await processRuntime.sessionStatus(); } catch {}
+  } else if (processRuntime?.policy) {
+    try { processStatus = await processSessionStatus(processRuntime.policy); } catch {}
+  }
+
   let autonomousStatus = null;
   if (autonomousRuntime?.sessionStatus) {
     try { autonomousStatus = await autonomousRuntime.sessionStatus(); } catch {}
   }
 
+  let desktopStatus = null;
+  if (desktopRuntime?.status) {
+    try { desktopStatus = await desktopRuntime.status(); } catch {}
+  }
+
+  let hostStatus = null;
+  if (hostPolicy) {
+    try {
+      const armed = await assertHostArmed(hostPolicy);
+      hostStatus = { configured:true, armed:true, reason:armed.standing ? 'standing-grant' : 'armed' };
+    } catch (error) {
+      hostStatus = { configured:true, armed:false, reason:String(error?.message ?? error) };
+    }
+  }
+
   let skillListResult = null;
   if (skillRuntime?.list) {
     try { skillListResult = await skillRuntime.list(); } catch (err) {
@@ -225,20 +250,44 @@ export async function resolveCapabilityStates({
       };
     }
     // 4. Session Authority Checks
-    else if (cap.authority === 'coding' && cap.mutating && codingStatus && !codingStatus.armed) {
+    else if (requires.includes('coding_session.armed') && !codingStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
       diagnostic = {
         code: 'CODING_SESSION_DISARMED',
-        reason: codingStatus.reason || 'Coding session is not armed for mutation',
+        reason: codingStatus?.reason || 'Coding session is not armed for this capability',
         recoverable: true
       };
-    } else if (cap.authority === 'autonomous' && cap.mutating && autonomousStatus && !autonomousStatus.armed) {
+    } else if (requires.includes('process_session.armed') && !processStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'PROCESS_SESSION_DISARMED',
+        reason: processStatus?.reason || 'Process session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('autonomous_session.armed') && !autonomousStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
       diagnostic = {
         code: 'AUTONOMOUS_SESSION_DISARMED',
-        reason: autonomousStatus.reason || 'Autonomous session is not armed for mutation',
+        reason: autonomousStatus?.reason || 'Autonomous session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('desktop_control.armed') && !desktopStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'DESKTOP_SESSION_DISARMED',
+        reason: desktopStatus?.reason || 'Desktop control is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('host_policy.armed') && !hostStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'HOST_POLICY_DISARMED',
+        reason: hostStatus?.reason || 'Privileged host policy is disarmed',
         recoverable: true
       };
     }

package/src/mcp-server.mjs

@@ -479,7 +479,8 @@ serveStdio(() => {
 
   registerCompactGatewayTools(toolServer,{
     profile:surfaceProfile,ledger:R36_CAPABILITY_LEDGER,codingRuntime,semanticRuntime,machineFsRuntime,
-    processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider:()=>[...registeredToolNames]
+    processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,
+    catalogProvider:()=>[...registeredToolNames]
   });
 
   if (hostPolicy) {

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.20';
+export const DEADBYTE_VERSION = '0.15.21';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/capability-resolver.test.mjs

@@ -1,5 +1,8 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import {
   CAPABILITY_STATES,
   deriveCapabilityRequirements,
@@ -22,7 +25,7 @@ test('deriveCapabilityRequirements maps dependencies accurately', () => {
     mutating: false,
     runtime_flag: 'DEADBYTE_CODING_RUNTIME'
   });
-  assert.deepEqual(reqCodingRead, ['DEADBYTE_CODING_RUNTIME', 'coding_runtime.ready']);
+  assert.deepEqual(reqCodingRead, ['DEADBYTE_CODING_RUNTIME', 'coding_session.armed']);
 
   const reqCodingWrite = deriveCapabilityRequirements({
     id: 'coding.file_write',
@@ -131,3 +134,67 @@ test('resolveCapabilityStates resolves all 5 states correctly', async () => {
   assert.equal(skillCap.diagnostic.code, 'SKILL_ENVELOPE_MISMATCH');
   assert.ok(degradedRes.degraded_capabilities.some(d => d.id === 'skill.catalog'));
 });
+
+test('capability resolver reports actual disarmed authority across coding process autonomous desktop and host', async () => {
+  const ledger={entries:[
+    {id:'coding.search',compact_tool:'coding_inspect',full_tool:'coding_search',compact_op:'search',authority:'coding',mutating:false,production:true,runtime_flag:'DEADBYTE_CODING_RUNTIME'},
+    {id:'process.start',compact_tool:'process_session',full_tool:'process_session_start',compact_op:'start',authority:'process',mutating:true,production:true,runtime_flag:'DEADBYTE_PROCESS_RUNTIME'},
+    {id:'autonomous.goal_submit',compact_tool:'autonomous_goal_submit',full_tool:'autonomous_goal_submit',compact_op:'direct',authority:'autonomous',mutating:true,production:true,runtime_flag:'DEADBYTE_AUTONOMOUS_RUNTIME'},
+    {id:'desktop.action',compact_tool:'desktop_control',full_tool:'desktop_action',compact_op:'action',authority:'desktop',mutating:true,production:true,runtime_flag:'DEADBYTE_DESKTOP_RUNTIME'},
+    {id:'host.file_read',compact_tool:'host_file_read',full_tool:'host_file_read',compact_op:'direct',authority:'host',mutating:false,production:false,runtime_flag:'DEADBYTE_PRIVILEGED_POLICY'}
+  ]};
+  const result=await resolveCapabilityStates({
+    ledger,
+    toolCatalog:['coding_inspect','process_session','autonomous_goal_submit','desktop_control','host_file_read'],
+    profile:'compact',
+    env:{},
+    codingRuntime:{sessionStatus:async()=>({armed:false,reason:'coding-disarmed'})},
+    processRuntime:{sessionStatus:async()=>({armed:false,reason:'process-disarmed'})},
+    autonomousRuntime:{sessionStatus:async()=>({armed:false,reason:'autonomous-disarmed'})},
+    desktopRuntime:{status:async()=>({armed:false,reason:'desktop-disarmed'})},
+    hostPolicy:{arm_file:path.join(os.tmpdir(),'deadbyte-capability-resolver-never-armed.json'),policy_sha256:'a'.repeat(64)}
+  });
+  const byId=id=>result.capabilities.find(item=>item.id===id);
+  assert.equal(byId('coding.search').state,CAPABILITY_STATES.DENIED);
+  assert.equal(byId('coding.search').diagnostic.code,'CODING_SESSION_DISARMED');
+  assert.equal(byId('process.start').state,CAPABILITY_STATES.DENIED);
+  assert.equal(byId('process.start').diagnostic.code,'PROCESS_SESSION_DISARMED');
+  assert.equal(byId('autonomous.goal_submit').state,CAPABILITY_STATES.DENIED);
+  assert.equal(byId('autonomous.goal_submit').diagnostic.code,'AUTONOMOUS_SESSION_DISARMED');
+  assert.equal(byId('desktop.action').state,CAPABILITY_STATES.DENIED);
+  assert.equal(byId('desktop.action').diagnostic.code,'DESKTOP_SESSION_DISARMED');
+  assert.equal(byId('host.file_read').state,CAPABILITY_STATES.DENIED);
+  assert.equal(byId('host.file_read').diagnostic.code,'HOST_POLICY_DISARMED');
+});
+
+
+test('capability resolver reports armed Host capability when the standing grant is valid', async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-capability-host-'));
+  try{
+    const armFile=path.join(root,'host-grant.json');
+    const policySha='b'.repeat(64);
+    await writeFile(armFile,JSON.stringify({
+      schema:'deadbyte.host-grant.v2',
+      policy_sha256:policySha,
+      instance_nonce:'c'.repeat(64),
+      armed_at_utc:new Date().toISOString()
+    }));
+    const result=await resolveCapabilityStates({
+      ledger:{entries:[{
+        id:'host.file_read',compact_tool:'host_file_read',full_tool:'host_file_read',compact_op:'direct',
+        authority:'host',mutating:false,production:false,runtime_flag:'DEADBYTE_PRIVILEGED_POLICY'
+      }]},
+      toolCatalog:['host_file_read'],
+      profile:'compact',
+      env:{},
+      hostPolicy:{arm_file:armFile,policy_sha256:policySha}
+    });
+    const hostRead=result.capabilities[0];
+    assert.equal(hostRead.state,CAPABILITY_STATES.AVAILABLE);
+    assert.equal(hostRead.ready,true);
+    assert.equal(hostRead.diagnostic,null);
+    assert.deepEqual(hostRead.requires,['DEADBYTE_PRIVILEGED_POLICY','host_policy.armed']);
+  }finally{
+    await rm(root,{recursive:true,force:true});
+  }
+});

package/test/compact-max-catalog-r45.test.mjs

@@ -90,7 +90,31 @@ test('R45 real max-runtime compact stdio catalog is exactly 43 with verified ski
     assert.ok(hardware);assert.equal(hardware.authority,'none');assert.equal(hardware.compact_tool,'machine_observe');assert.equal(hardware.compact_op,'hardware_query');
     const skill=m.capabilities.find(item=>item.id==='skill.catalog');
     assert.ok(skill);assert.equal(skill.authority,'none');assert.equal(skill.mutating,false);
-    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,hardware_query:true,skill:true,authority:'DISARMED'}));
+
+    const byId=id=>m.capabilities.find(item=>item.id===id);
+    for(const [id,reasonCode] of [
+      ['coding.search','CODING_SESSION_DISARMED'],
+      ['process.start','PROCESS_SESSION_DISARMED'],
+      ['autonomous.goal_submit','AUTONOMOUS_SESSION_DISARMED'],
+      ['desktop.action','DESKTOP_SESSION_DISARMED'],
+      ['host.file_read','HOST_POLICY_DISARMED']
+    ]){
+      const item=byId(id);
+      assert.ok(item,'missing capability '+id);
+      assert.equal(item.state,'DENIED',id+' must reflect disarmed authority');
+      assert.equal(item.ready,false,id+' must not be ready while disarmed');
+      assert.equal(item.diagnostic?.code,reasonCode,id+' diagnostic mismatch');
+      assert.ok(m.unavailable_capabilities.some(entry=>entry.id===id&&entry.state==='DENIED'&&entry.reason_code===reasonCode),
+        id+' must be listed as unavailable');
+    }
+    for(const id of ['coding.task_events','coding.task_status','coding.task_verify','process.list','desktop.observe']){
+      const item=byId(id);
+      assert.ok(item,'missing read-only capability '+id);
+      assert.equal(item.state,'AVAILABLE',id+' should remain available without mutation authority');
+      assert.equal(item.ready,true,id+' should remain ready without mutation authority');
+    }
+
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,hardware_query:true,skill:true,authority:'DISARMED',authority_truth:true}));
   } finally {
     await client.close().catch(()=>{});
     for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);

package/test/r48-release-contract.test.mjs

@@ -6,29 +6,31 @@ import { DEADBYTE_VERSION } from '../src/version.mjs';
 const root=new URL('../',import.meta.url);
 const read=rel=>readFile(new URL(rel,root),'utf8');
 
-test('R48 successor identity is coherent and binds active 0.15.19 parent plus sealed 0.15.19 source predecessor',async()=>{
+test('R48 successor identity is coherent and binds active 0.15.20 parent plus sealed 0.15.20 source predecessor',async()=>{
   const [pkg,lock,release,provenance]=await Promise.all([
     read('package.json').then(JSON.parse),
     read('package-lock.json').then(JSON.parse),
     read('RELEASE.json').then(JSON.parse),
     read('PROVENANCE.json').then(JSON.parse)
   ]);
-  assert.equal(pkg.version,'0.15.20');
-  assert.equal(lock.version,'0.15.20');
-  assert.equal(lock.packages[''].version,'0.15.20');
-  assert.equal(DEADBYTE_VERSION,'0.15.20');
-  assert.equal(release.version,'0.15.20');
-  assert.equal(provenance.version,'0.15.20');
+  assert.equal(pkg.version,'0.15.21');
+  assert.equal(lock.version,'0.15.21');
+  assert.equal(lock.packages[''].version,'0.15.21');
+  assert.equal(DEADBYTE_VERSION,'0.15.21');
+  assert.equal(release.version,'0.15.21');
+  assert.equal(provenance.version,'0.15.21');
   assert.equal(release.train,'R48');
-  assert.equal(release.label,'DURABLE JOURNAL AUTHENTIC EVENT HOTFIX');
-  assert.equal(release.parent.release_id,'v0.15.19-4b5fcf7acdff11e9');
-  assert.equal(release.parent.manifest_sha256,'4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29');
-  assert.equal(release.parent.generation_manifest_sha256,'610f4fef7c5e37330f7b2b0fbad69efe0a00f9c7bd256ce8e08bc87e1891680b');
-  assert.equal(release.source_predecessor.version,'0.15.19');
-  assert.equal(release.source_predecessor.tarball_sha256,'e4224ec93588cbd6d68a147cc26097e8a29ddea870fa5f3a9020ab9ed1efbe8f');
-  assert.equal(release.source_predecessor.manifest_file_sha256,'4b5fcf7acdff11e935e8f34b5659d92d1f0c51437795432f7715d6a98a55bc29');
+  assert.equal(release.label,'CAPABILITY MANIFEST AUTHORITY TRUTH');
+  assert.equal(release.parent.release_id,'v0.15.20-bab990b08c9c1f07');
+  assert.equal(release.parent.manifest_sha256,'bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d');
+  assert.equal(release.parent.generation_manifest_sha256,'617ea6bfbfc7e1952d17e7fea1043fd70b32bb1edacbd3ed6002fec7235c7221');
+  assert.equal(release.source_predecessor.version,'0.15.20');
+  assert.equal(release.source_predecessor.tarball_sha256,'eb7cbe8465ae3834c9857fc2115c7ab4eb3d1a018aa1695b799912def5dc3cee');
+  assert.equal(release.source_predecessor.manifest_file_sha256,'bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d');
   assert.equal(release.source_predecessor.reference_server_sha256,'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
   assert.equal(release.source_predecessor.reference_schemas_sha256,'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
+  assert.equal(release.capabilities.capability_manifest_authority_truth,true);
+  assert.equal(release.capabilities.capability_manifest_host_grant_truth,true);
   assert.equal(provenance.parent_release_id,release.parent.release_id);
   assert.equal(provenance.parent_manifest_sha256,release.parent.manifest_sha256);
   assert.equal(provenance.parent_generation_manifest_sha256,release.parent.generation_manifest_sha256);