deadbyte-mcp 0.15.21 → 0.15.22

package/package.json

@@ -1,93 +1,94 @@
-{
-    "name": "deadbyte-mcp",
-    "version": "0.15.21",
-    "private": false,
-    "type": "module",
-    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
-    "engines": {
-        "node": ">=22"
-    },
-    "scripts": {
-        "test": "node --test test/*.test.mjs",
-        "manifest:write": "node scripts/release-manifest.mjs write",
-        "manifest:verify": "node scripts/release-manifest.mjs verify",
-        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
-        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
-        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
-        "r42:eval": "node scripts/agent-eval-r42.mjs",
-        "self-update:runtime": "node scripts/runtime-self-update.mjs",
-        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
-        "release:parity": "node scripts/release-parity-r46.mjs",
-        "release:final:write": "node scripts/final-closure-r46.mjs",
-        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
-        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
-        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
-        "trust:init": "node src/trust-init.mjs",
-        "mcp": "node src/mcp-server.mjs",
-        "mcp:smoke": "node src/mcp-smoke-client.mjs",
-        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
-        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
-        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
-        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
-        "mcp:process:smoke": "node src/process-smoke-client.mjs",
-        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
-        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
-        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
-        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
-        "containment:bootstrap": "node src/containment-bootstrap.mjs",
-        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
-        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
-        "containment:construction": "node src/containment-construction.mjs",
-        "containment:child-control": "node src/containment-child-control.mjs",
-        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
-        "contained:smoke": "node src/contained-smoke.mjs",
-        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-        "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1",
-        "authority:smoke": "node src/authority-smoke.mjs",
-        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
-        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
-        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
-        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
-        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
-        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
-        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
-        "audit:status": "node src/deadbyte-cli.mjs audit status",
-        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
-        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
-        "r43:full:test": "node scripts/full-regression-r43.mjs",
-        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
-        "r44:full:test": "node scripts/full-regression-r44.mjs",
-        "finalize:r44": "node scripts/finalize-r44.mjs",
-        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-        "doctor": "node src/deadbyte-cli.mjs doctor",
-        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
-        "r45:full:test": "node scripts/full-regression-r45.mjs",
-        "finalize:r45": "node scripts/finalize-r45.mjs",
-        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
-        "r46:full:test": "node scripts/full-regression-r46.mjs",
-        "r47:full:test": "node scripts/full-regression-r47.mjs",
-        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
-        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
-        "r48:full:test": "node scripts/full-regression-r48.mjs",
-        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs"
-    },
-    "bundleDependencies": [
-        "@modelcontextprotocol/server",
-        "@modelcontextprotocol/client",
-        "typescript",
-        "zod"
-    ],
-    "dependencies": {
-        "@modelcontextprotocol/client": "2.1.0",
-        "@modelcontextprotocol/server": "2.1.0",
-        "typescript": "5.9.3",
-        "zod": "4.4.3"
-    },
-    "bin": {
-        "deadbyte-mcp": "src/deadbyte-cli.mjs"
-    },
-    "publishConfig": {
-        "access": "public"
-    }
-}
+{
+    "name": "deadbyte-mcp",
+    "version": "0.15.22",
+    "private": false,
+    "type": "module",
+    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
+    "engines": {
+        "node": ">=22"
+    },
+    "scripts": {
+        "test": "node --test test/*.test.mjs",
+        "manifest:write": "node scripts/release-manifest.mjs write",
+        "manifest:verify": "node scripts/release-manifest.mjs verify",
+        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
+        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
+        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
+        "r42:eval": "node scripts/agent-eval-r42.mjs",
+        "self-update:runtime": "node scripts/runtime-self-update.mjs",
+        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
+        "release:parity": "node scripts/release-parity-r46.mjs",
+        "release:final:write": "node scripts/final-closure-r46.mjs",
+        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
+        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
+        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
+        "trust:init": "node src/trust-init.mjs",
+        "mcp": "node src/mcp-server.mjs",
+        "mcp:smoke": "node src/mcp-smoke-client.mjs",
+        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
+        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
+        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
+        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
+        "mcp:process:smoke": "node src/process-smoke-client.mjs",
+        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
+        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
+        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
+        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
+        "containment:bootstrap": "node src/containment-bootstrap.mjs",
+        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
+        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
+        "containment:construction": "node src/containment-construction.mjs",
+        "containment:child-control": "node src/containment-child-control.mjs",
+        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
+        "contained:smoke": "node src/contained-smoke.mjs",
+        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
+        "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1",
+        "authority:smoke": "node src/authority-smoke.mjs",
+        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
+        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
+        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
+        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
+        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
+        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
+        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
+        "audit:status": "node src/deadbyte-cli.mjs audit status",
+        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
+        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+        "r43:full:test": "node scripts/full-regression-r43.mjs",
+        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+        "r44:full:test": "node scripts/full-regression-r44.mjs",
+        "finalize:r44": "node scripts/finalize-r44.mjs",
+        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+        "doctor": "node src/deadbyte-cli.mjs doctor",
+        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+        "r45:full:test": "node scripts/full-regression-r45.mjs",
+        "finalize:r45": "node scripts/finalize-r45.mjs",
+        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
+        "r46:full:test": "node scripts/full-regression-r46.mjs",
+        "r47:full:test": "node scripts/full-regression-r47.mjs",
+        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
+        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
+        "r48:full:test": "node scripts/full-regression-r48.mjs",
+        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs",
+        "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs"
+    },
+    "bundleDependencies": [
+        "@modelcontextprotocol/server",
+        "@modelcontextprotocol/client",
+        "typescript",
+        "zod"
+    ],
+    "dependencies": {
+        "@modelcontextprotocol/client": "2.1.0",
+        "@modelcontextprotocol/server": "2.1.0",
+        "typescript": "5.9.3",
+        "zod": "4.4.3"
+    },
+    "bin": {
+        "deadbyte-mcp": "src/deadbyte-cli.mjs"
+    },
+    "publishConfig": {
+        "access": "public"
+    }
+}

package/scripts/build-hardware-r45.ps1

@@ -53,6 +53,24 @@ foreach($query in @('cpu','gpu','memory','storage','network','pci')){
   $queries[$query]=Get-Sha256Hex -Path $Exe
 }
 
+$windowsQueries=[ordered]@{}
+foreach($query in @('services','drivers','sockets','volumes','usb','wsl')){
+  $raw=& $Exe $query 2>&1
+  $queryExit=$LASTEXITCODE
+  if($queryExit -ne 0){throw "Windows query $query failed exit=$queryExit output=$($raw -join ' ')"}
+  $text=($raw -join [Environment]::NewLine)
+  $parsed=$text | ConvertFrom-Json
+  if($parsed.schema -ne 'deadbyte.windows-query.v1' -or $parsed.query -ne $query){throw "Windows query $query contract mismatch"}
+  $windowsQueries[$query]=Get-Sha256Hex -Path $Exe
+}
+$registryRaw=& $Exe registry HKLM 'SOFTWARE\Microsoft\Windows NT\CurrentVersion' ProductName 2>&1
+$registryExit=$LASTEXITCODE
+if($registryExit -ne 0){throw "Windows registry query failed exit=$registryExit output=$($registryRaw -join ' ')"}
+$registryText=($registryRaw -join [Environment]::NewLine)
+$registryParsed=$registryText | ConvertFrom-Json
+if($registryParsed.schema -ne 'deadbyte.windows-query.v1' -or $registryParsed.query -ne 'registry'){throw 'Windows registry query contract mismatch'}
+$windowsQueries['registry']=Get-Sha256Hex -Path $Exe
+
 $depLine='call "{0}" -no_logo -arch=x64 -host_arch=x64 && dumpbin /nologo /dependents "{1}"' -f $dev,$Exe
 $deps=& $cmd /d /s /c $depLine 2>&1
 $depExit=$LASTEXITCODE
@@ -67,5 +85,6 @@ if($depExit -ne 0){throw "hardware observer dumpbin failed exit=$depExit"}
   obj_sha256=Get-Sha256Hex -Path $Obj
   selftest=@($self | ForEach-Object {[string]$_})
   queries=@($queries.Keys)
+  windows_queries=@($windowsQueries.Keys)
   dependencies=@($deps | ForEach-Object {[string]$_})
 }|ConvertTo-Json -Depth 5

package/scripts/full-regression-r48-batch.mjs

@@ -0,0 +1,27 @@
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const excluded=new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']);
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs')&&!excluded.has(entry.name));
+const weighted=[];
+for(const entry of files) weighted.push({path:path.join('test',entry.name),size:(await stat(path.join(testDir,entry.name))).size});
+weighted.sort((a,b)=>b.size-a.size||a.path.localeCompare(b.path,'en'));
+const batchCount=8;
+const batches=Array.from({length:batchCount},()=>[]);
+weighted.forEach((entry,index)=>batches[index%batchCount].push(entry.path));
+const requested=Number(process.argv[2]);
+if(!Number.isInteger(requested)||requested<1||requested>batchCount) throw new Error('usage: node full-regression-r48-batch.mjs <1..8>');
+const batch=batches[requested-1].sort((a,b)=>a.localeCompare(b,'en'));
+console.log(`R48-BOUNDED-REGRESSION batch=${requested}/${batchCount} files=${batch.length}`);
+console.log(batch.join('\n'));
+const result=spawnSync(process.execPath,['--test','--test-concurrency=1',...batch],{cwd:root,stdio:'inherit',windowsHide:true,shell:false});
+if(result.error) throw result.error;
+if(result.signal) throw new Error(`regression batch ${requested} terminated by ${result.signal}`);
+if(result.status!==0) throw new Error(`regression batch ${requested} failed with exit code ${result.status}`);
+console.log(`R48-BOUNDED-REGRESSION BATCH PASS batch=${requested} files=${batch.length}`);

package/scripts/promote-local-c-generation.ps1

@@ -0,0 +1,217 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+function Fail([string]$Message) { throw "LOCAL_C_PROMOTION: $Message" }
+function Sha256-File([string]$Path) {
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+function Sha256-Text([string]$Text) {
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
+        return -join ($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
+    } finally { $sha.Dispose() }
+}
+function Write-Utf8NoBom([string]$Path,[string]$Text) {
+    [System.IO.File]::WriteAllText($Path,$Text,(New-Object System.Text.UTF8Encoding($false)))
+}
+function Read-Raw([string]$Path) {
+    return [System.IO.File]::ReadAllText($Path,[System.Text.Encoding]::UTF8)
+}
+
+$stateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointerPath = Join-Path $stateRoot 'active-release.json'
+$launcher = Join-Path $stateRoot 'bin\DEADBYTE-MCP.ps1'
+$runtimeRoot = Join-Path $stateRoot 'runtime'
+if (-not (Test-Path -LiteralPath $pointerPath -PathType Leaf)) { Fail 'active pointer missing' }
+if (-not (Test-Path -LiteralPath $launcher -PathType Leaf)) { Fail 'stable launcher missing' }
+
+$pointerText = Read-Raw $pointerPath
+$pointer = $pointerText | ConvertFrom-Json
+if ([string]$pointer.schema -ne 'deadbyte.active-release.v1') { Fail 'active pointer schema mismatch' }
+$oldGeneration = [System.IO.Path]::GetFullPath([string]$pointer.generation_root)
+$oldManifest = Join-Path $oldGeneration 'GENERATION.SHA256'
+if (-not (Test-Path -LiteralPath $oldManifest -PathType Leaf)) { Fail 'old generation manifest missing' }
+$oldManifestHash = Sha256-File $oldManifest
+if ($oldManifestHash -ne [string]$pointer.generation_manifest_sha256) { Fail 'old generation manifest hash mismatch' }
+
+$manifestLines = @(Get-Content -LiteralPath $oldManifest -Encoding UTF8)
+$entries = @()
+foreach ($line in $manifestLines) {
+    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }
+    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail "malformed old generation manifest line: $line" }
+    $expected = [string]$Matches[1]
+    $name = [string]$Matches[2]
+    $path = Join-Path $oldGeneration $name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "old generation file missing: $name" }
+    $actual = Sha256-File $path
+    if ($actual -ne $expected) { Fail "old generation hash mismatch: $name" }
+    $entries += [pscustomobject]@{ Name=$name; Expected=$expected }
+}
+$names = @($entries | ForEach-Object { $_.Name })
+foreach ($required in @('coding-policy.json','autonomous-policy.json','controller-config.psd1')) {
+    if ($required -notin $names) { Fail "required generation file not manifested: $required" }
+}
+
+$oldCodingPath = Join-Path $oldGeneration 'coding-policy.json'
+$oldAutonomousPath = Join-Path $oldGeneration 'autonomous-policy.json'
+$oldCodingHash = Sha256-File $oldCodingPath
+$oldAutonomousHash = Sha256-File $oldAutonomousPath
+
+$coding = (Read-Raw $oldCodingPath) | ConvertFrom-Json
+if ([string]$coding.schema -ne 'deadbyte.coding-policy.v1' -or $coding.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+if ($null -eq $coding.roots) { Fail 'coding roots missing' }
+
+$localRoot = [pscustomobject][ordered]@{
+    path = 'C:\'
+    read = $true
+    write = $true
+    exec = $true
+    deny_paths = @()
+}
+if ($coding.roots.PSObject.Properties.Name -contains 'local_c') {
+    $coding.roots.local_c = $localRoot
+} else {
+    $coding.roots | Add-Member -NotePropertyName 'local_c' -NotePropertyValue $localRoot
+}
+foreach ($commandProp in @($coding.commands.PSObject.Properties)) {
+    $command = $commandProp.Value
+    if ($command.PSObject.Properties.Name -contains 'root_ids') {
+        $ids = @($command.root_ids)
+        if ('local_c' -notin $ids) { $command.root_ids = @($ids + 'local_c') }
+    }
+}
+$codingText = ($coding | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newCodingHash = Sha256-Text $codingText
+
+$autonomous = (Read-Raw $oldAutonomousPath) | ConvertFrom-Json
+if ([string]$autonomous.schema -ne 'deadbyte.autonomous-policy.v1' -or $autonomous.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+$autonomous.coding_policy_sha256 = $newCodingHash
+$autonomousText = ($autonomous | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newAutonomousHash = Sha256-Text $autonomousText
+
+$seed = $oldManifestHash + [Environment]::NewLine + $newCodingHash + [Environment]::NewLine + $newAutonomousHash + [Environment]::NewLine + 'local_c=C:\'
+$generationSuffix = (Sha256-Text $seed).Substring(0,16)
+$newGenerationId = ([string]$pointer.release_id) + '-g' + $generationSuffix
+$generationStore = Join-Path $stateRoot 'generations'
+$newGeneration = Join-Path $generationStore $newGenerationId
+if (Test-Path -LiteralPath $newGeneration) { Fail "target generation already exists: $newGeneration" }
+New-Item -ItemType Directory -Path $newGeneration | Out-Null
+
+$pointerBackup = Join-Path $runtimeRoot 'active-release.before-local-c.json'
+$codingGrantPath = Join-Path $runtimeRoot 'coding-grant.json'
+$autonomousGrantPath = Join-Path $runtimeRoot 'autonomous-grant.json'
+$hadCodingGrant = Test-Path -LiteralPath $codingGrantPath -PathType Leaf
+$hadAutonomousGrant = Test-Path -LiteralPath $autonomousGrantPath -PathType Leaf
+$oldCodingGrantText = if ($hadCodingGrant) { Read-Raw $codingGrantPath } else { $null }
+$oldAutonomousGrantText = if ($hadAutonomousGrant) { Read-Raw $autonomousGrantPath } else { $null }
+$wasAutonomousArmed = $false
+if ($hadCodingGrant -and $hadAutonomousGrant) {
+    try {
+        $cg = $oldCodingGrantText | ConvertFrom-Json
+        $ag = $oldAutonomousGrantText | ConvertFrom-Json
+        $wasAutonomousArmed =
+            ([string]$cg.policy_sha256 -eq $oldCodingHash) -and
+            ([string]$ag.policy_sha256 -eq $oldAutonomousHash) -and
+            ([string]$ag.coding_policy_sha256 -eq $oldCodingHash)
+    } catch { $wasAutonomousArmed = $false }
+}
+
+$switched = $false
+try {
+    foreach ($entry in $entries) {
+        $src = Join-Path $oldGeneration $entry.Name
+        $dst = Join-Path $newGeneration $entry.Name
+        Copy-Item -LiteralPath $src -Destination $dst
+    }
+
+    Write-Utf8NoBom (Join-Path $newGeneration 'coding-policy.json') $codingText
+    Write-Utf8NoBom (Join-Path $newGeneration 'autonomous-policy.json') $autonomousText
+
+    $configPath = Join-Path $newGeneration 'controller-config.psd1'
+    $configText = Read-Raw $configPath
+    if ($configText.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -lt 0) { Fail 'controller config is not bound to old generation root' }
+    $configText = $configText.Replace($oldGeneration,$newGeneration)
+    Write-Utf8NoBom $configPath $configText
+    $cfg = Import-PowerShellDataFile -LiteralPath $configPath
+    if ([System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'coding-policy.json'))) { Fail 'new controller CodingPolicyFile binding mismatch' }
+    if ([System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'autonomous-policy.json'))) { Fail 'new controller AutonomousPolicyFile binding mismatch' }
+
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $text = $null
+        try { $text = Read-Raw $p } catch { $text = $null }
+        if ($null -ne $text -and $entry.Name -ne 'controller-config.psd1' -and $text.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            Fail "unexpected old generation binding remains in $($entry.Name)"
+        }
+    }
+
+    $newManifestLines = @()
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $newManifestLines += ((Sha256-File $p) + '  ' + $entry.Name)
+    }
+    $newManifestText = ($newManifestLines -join [Environment]::NewLine) + [Environment]::NewLine
+    $newManifestPath = Join-Path $newGeneration 'GENERATION.SHA256'
+    Write-Utf8NoBom $newManifestPath $newManifestText
+    $newManifestHash = Sha256-File $newManifestPath
+
+    foreach ($line in $newManifestLines) {
+        if ($line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'new manifest internal format error' }
+        $actual = Sha256-File (Join-Path $newGeneration ([string]$Matches[2]))
+        if ($actual -ne [string]$Matches[1]) { Fail "new generation verification failed: $($Matches[2])" }
+    }
+    if ((Sha256-File (Join-Path $newGeneration 'coding-policy.json')) -ne $newCodingHash) { Fail 'new coding hash self-check failed' }
+    if ((Sha256-File (Join-Path $newGeneration 'autonomous-policy.json')) -ne $newAutonomousHash) { Fail 'new autonomous hash self-check failed' }
+
+    Write-Utf8NoBom $pointerBackup $pointerText
+    $pointer.generation_root = $newGeneration
+    $pointer.config_path = Join-Path $newGeneration 'controller-config.psd1'
+    $pointer.generation_manifest_sha256 = $newManifestHash
+    if ($pointer.PSObject.Properties.Name -contains 'generation_id') { $pointer.generation_id = $newGenerationId }
+    if ($pointer.PSObject.Properties.Name -contains 'generation_manifest_path') { $pointer.generation_manifest_path = $newManifestPath }
+    if ($pointer.PSObject.Properties.Name -contains 'updated_at_utc') { $pointer.updated_at_utc = [DateTime]::UtcNow.ToString('o') }
+    $newPointerText = ($pointer | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+    $pointerTmp = $pointerPath + '.local-c.tmp'
+    Write-Utf8NoBom $pointerTmp $newPointerText
+    Move-Item -LiteralPath $pointerTmp -Destination $pointerPath -Force
+    $switched = $true
+
+    $statusText = (& $launcher status 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "launcher status failed after pointer switch: $statusText" }
+
+    $armCodingText = (& $launcher armcoding 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "armcoding failed after pointer switch: $armCodingText" }
+
+    $armAutonomousText = ''
+    if ($wasAutonomousArmed) {
+        $armAutonomousText = (& $launcher armautonomous 2>&1 | Out-String)
+        if ($LASTEXITCODE -ne 0) { Fail "armautonomous failed after pointer switch: $armAutonomousText" }
+    }
+
+    Write-Output 'LOCAL_C_PROMOTION=PASS'
+    Write-Output ('OLD_GENERATION=' + $oldGeneration)
+    Write-Output ('NEW_GENERATION=' + $newGeneration)
+    Write-Output ('OLD_GENERATION_MANIFEST_SHA256=' + $oldManifestHash)
+    Write-Output ('NEW_GENERATION_MANIFEST_SHA256=' + $newManifestHash)
+    Write-Output ('OLD_CODING_POLICY_SHA256=' + $oldCodingHash)
+    Write-Output ('NEW_CODING_POLICY_SHA256=' + $newCodingHash)
+    Write-Output ('NEW_AUTONOMOUS_POLICY_SHA256=' + $newAutonomousHash)
+    Write-Output ('AUTONOMOUS_REARMED=' + $wasAutonomousArmed)
+    Write-Output ('ROLLBACK_POINTER=' + $pointerBackup)
+    Write-Output 'RESTART_REQUIRED=YES'
+} catch {
+    $message = $_.Exception.Message
+    if ($switched) {
+        try { Write-Utf8NoBom $pointerPath $pointerText } catch {}
+        if ($hadCodingGrant) { try { Write-Utf8NoBom $codingGrantPath $oldCodingGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $codingGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+        if ($hadAutonomousGrant) { try { Write-Utf8NoBom $autonomousGrantPath $oldAutonomousGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $autonomousGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+    }
+    try { if (Test-Path -LiteralPath $newGeneration) { Remove-Item -LiteralPath $newGeneration -Recurse -Force } } catch {}
+    Fail $message
+}