deadbyte-mcp 0.15.21 → 0.15.23

package/package.json

@@ -1,93 +1,95 @@
-{
-    "name": "deadbyte-mcp",
-    "version": "0.15.21",
-    "private": false,
-    "type": "module",
-    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
-    "engines": {
-        "node": ">=22"
-    },
-    "scripts": {
-        "test": "node --test test/*.test.mjs",
-        "manifest:write": "node scripts/release-manifest.mjs write",
-        "manifest:verify": "node scripts/release-manifest.mjs verify",
-        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
-        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
-        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
-        "r42:eval": "node scripts/agent-eval-r42.mjs",
-        "self-update:runtime": "node scripts/runtime-self-update.mjs",
-        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
-        "release:parity": "node scripts/release-parity-r46.mjs",
-        "release:final:write": "node scripts/final-closure-r46.mjs",
-        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
-        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
-        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
-        "trust:init": "node src/trust-init.mjs",
-        "mcp": "node src/mcp-server.mjs",
-        "mcp:smoke": "node src/mcp-smoke-client.mjs",
-        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
-        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
-        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
-        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
-        "mcp:process:smoke": "node src/process-smoke-client.mjs",
-        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
-        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
-        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
-        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
-        "containment:bootstrap": "node src/containment-bootstrap.mjs",
-        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
-        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
-        "containment:construction": "node src/containment-construction.mjs",
-        "containment:child-control": "node src/containment-child-control.mjs",
-        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
-        "contained:smoke": "node src/contained-smoke.mjs",
-        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-        "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1",
-        "authority:smoke": "node src/authority-smoke.mjs",
-        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
-        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
-        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
-        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
-        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
-        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
-        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
-        "audit:status": "node src/deadbyte-cli.mjs audit status",
-        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
-        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
-        "r43:full:test": "node scripts/full-regression-r43.mjs",
-        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
-        "r44:full:test": "node scripts/full-regression-r44.mjs",
-        "finalize:r44": "node scripts/finalize-r44.mjs",
-        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-        "doctor": "node src/deadbyte-cli.mjs doctor",
-        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
-        "r45:full:test": "node scripts/full-regression-r45.mjs",
-        "finalize:r45": "node scripts/finalize-r45.mjs",
-        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
-        "r46:full:test": "node scripts/full-regression-r46.mjs",
-        "r47:full:test": "node scripts/full-regression-r47.mjs",
-        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
-        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
-        "r48:full:test": "node scripts/full-regression-r48.mjs",
-        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs"
-    },
-    "bundleDependencies": [
-        "@modelcontextprotocol/server",
-        "@modelcontextprotocol/client",
-        "typescript",
-        "zod"
-    ],
-    "dependencies": {
-        "@modelcontextprotocol/client": "2.1.0",
-        "@modelcontextprotocol/server": "2.1.0",
-        "typescript": "5.9.3",
-        "zod": "4.4.3"
-    },
-    "bin": {
-        "deadbyte-mcp": "src/deadbyte-cli.mjs"
-    },
-    "publishConfig": {
-        "access": "public"
-    }
-}
+{
+    "name": "deadbyte-mcp",
+    "version": "0.15.23",
+    "private": false,
+    "type": "module",
+    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
+    "engines": {
+        "node": ">=22"
+    },
+    "scripts": {
+        "test": "node --test test/*.test.mjs",
+        "manifest:write": "node scripts/release-manifest.mjs write",
+        "manifest:verify": "node scripts/release-manifest.mjs verify",
+        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
+        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
+        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
+        "r42:eval": "node scripts/agent-eval-r42.mjs",
+        "self-update:runtime": "node scripts/runtime-self-update.mjs",
+        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
+        "release:parity": "node scripts/release-parity-r46.mjs",
+        "release:final:write": "node scripts/final-closure-r46.mjs",
+        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
+        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
+        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
+        "trust:init": "node src/trust-init.mjs",
+        "mcp": "node src/mcp-server.mjs",
+        "mcp:smoke": "node src/mcp-smoke-client.mjs",
+        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
+        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
+        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
+        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
+        "mcp:process:smoke": "node src/process-smoke-client.mjs",
+        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
+        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
+        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
+        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
+        "containment:bootstrap": "node src/containment-bootstrap.mjs",
+        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
+        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
+        "containment:construction": "node src/containment-construction.mjs",
+        "containment:child-control": "node src/containment-child-control.mjs",
+        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
+        "contained:smoke": "node src/contained-smoke.mjs",
+        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
+        "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1",
+        "authority:smoke": "node src/authority-smoke.mjs",
+        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
+        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
+        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
+        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
+        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
+        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
+        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
+        "audit:status": "node src/deadbyte-cli.mjs audit status",
+        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
+        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+        "r43:full:test": "node scripts/full-regression-r43.mjs",
+        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+        "r44:full:test": "node scripts/full-regression-r44.mjs",
+        "finalize:r44": "node scripts/finalize-r44.mjs",
+        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+        "doctor": "node src/deadbyte-cli.mjs doctor",
+        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+        "r45:full:test": "node scripts/full-regression-r45.mjs",
+        "finalize:r45": "node scripts/finalize-r45.mjs",
+        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
+        "r46:full:test": "node scripts/full-regression-r46.mjs",
+        "r47:full:test": "node scripts/full-regression-r47.mjs",
+        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
+        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
+        "r48:full:test": "node scripts/full-regression-r48.mjs",
+        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs",
+        "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
+        "release:npm": "node scripts/npm-release-r48.mjs"
+    },
+    "bundleDependencies": [
+        "@modelcontextprotocol/server",
+        "@modelcontextprotocol/client",
+        "typescript",
+        "zod"
+    ],
+    "dependencies": {
+        "@modelcontextprotocol/client": "2.1.0",
+        "@modelcontextprotocol/server": "2.1.0",
+        "typescript": "5.9.3",
+        "zod": "4.4.3"
+    },
+    "bin": {
+        "deadbyte-mcp": "src/deadbyte-cli.mjs"
+    },
+    "publishConfig": {
+        "access": "public"
+    }
+}

package/scripts/activate-skill-creator-1.1.1.mjs

@@ -0,0 +1,46 @@
+import { readFile, rename, rm, mkdir } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { createSkillPlane } from "../src/skill-plane-r44.mjs";
+
+const stateDir=path.join(os.homedir(),".deadbyte-mcp");
+const skillsRoot=path.join(stateDir,"skills");
+const active=path.join(skillsRoot,"skill-creator");
+const stageParent=path.join(stateDir,"skill-staging","skill-creator-1.1.1");
+const candidate=path.join(stageParent,"skill-creator");
+const expectedOld="f34b3953db176c8ae9a5e08e7702b39f12b60b013edcd2f4d63a6268af9ba432";
+const expectedNew="e39960cab9eab44512fa38703fc8255b8be8e8b4f6565b4255b94604eded5359";
+
+const oldEnv=JSON.parse(await readFile(path.join(active,"skill.json"),"utf8"));
+const newEnv=JSON.parse(await readFile(path.join(candidate,"skill.json"),"utf8"));
+if(oldEnv.manifest_sha256!==expectedOld||oldEnv.body.version!=="1.1.0") throw new Error("active precondition failed");
+if(newEnv.manifest_sha256!==expectedNew||newEnv.body.version!=="1.1.1") throw new Error("candidate precondition failed");
+
+const stagePlane=await createSkillPlane({root:stageParent,verifyKeyPath:path.join(stateDir,"trust","ed25519-public.pem")});
+const staged=await stagePlane.load({name:"skill-creator"});
+if(!staged.verified||staged.version!=="1.1.1") throw new Error("candidate signature verification failed");
+
+const swapRoot=path.join(stateDir,"skill-staging","swap");
+await mkdir(swapRoot,{recursive:true});
+const oldSwap=path.join(swapRoot,"skill-creator-1.1.0-"+expectedOld);
+await rm(oldSwap,{recursive:true,force:true});
+
+let movedOld=false,movedNew=false;
+try{
+  await rename(active,oldSwap); movedOld=true;
+  await rename(candidate,active); movedNew=true;
+  const livePlane=await createSkillPlane({root:skillsRoot,verifyKeyPath:path.join(stateDir,"trust","ed25519-public.pem")});
+  const live=await livePlane.load({name:"skill-creator"});
+  if(!live.verified||live.version!=="1.1.1"||live.manifest_sha256!==expectedNew) throw new Error("live verification failed after swap");
+  await rm(oldSwap,{recursive:true,force:true});
+  await rm(stageParent,{recursive:true,force:true});
+  console.log(JSON.stringify({status:"ACTIVATED",version:live.version,manifest_sha256:live.manifest_sha256,verified:live.verified},null,2));
+}catch(e){
+  try{
+    if(movedNew) await rename(active,candidate);
+    if(movedOld) await rename(oldSwap,active);
+  }catch(rollbackError){
+    e.message += "; rollback_failed="+rollbackError.message;
+  }
+  throw e;
+}

package/scripts/build-advanced-pcb-skill.mjs

@@ -0,0 +1,208 @@
+import { readFile, writeFile, mkdir, rm, mkdtemp } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+import { createHash, createPrivateKey, createPublicKey, sign } from "node:crypto";
+import { createSkillPlane } from "../src/skill-plane-r44.mjs";
+
+const ex = promisify(execFile);
+const here = path.dirname(fileURLToPath(import.meta.url));
+const home = os.homedir();
+const stateDir = path.join(home, ".deadbyte-mcp");
+const skillsRoot = path.join(stateDir, "skills");
+const creatorDir = path.join(skillsRoot, "skill-creator");
+const name = "deadbyte-advanced-pcb-engineering";
+const version = "1.0.0";
+const out = path.join(skillsRoot, name);
+const description = "Evidence-driven advanced PCB engineering workflow for schematic review, constraint capture, stackup-aware placement and routing, power and signal integrity, EMC, DFM/DFT, KiCad verification, manufacturing release, and hardware bring-up.";
+const creatorManifest = "e39960cab9eab44512fa38703fc8255b8be8e8b4f6565b4255b94604eded5359";
+
+const sha = b => createHash("sha256").update(b).digest("hex");
+const canonical = v => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object"
+  ? Object.fromEntries(Object.keys(v).sort((a,b)=>a.localeCompare(b,"en")).map(k=>[k,canonical(v[k])]))
+  : v;
+
+const sources = [
+  ["SKILL.md", "pcb-skill-src-SKILL.md.txt", "skill"],
+  ["references/bringup-evidence.md", "pcb-skill-src-bringup-evidence.md.txt", "reference"],
+  ["references/constraint-model.md", "pcb-skill-src-constraint-model.md.txt", "reference"],
+  ["references/emc-mechanical-dfm.md", "pcb-skill-src-emc-mechanical-dfm.md.txt", "reference"],
+  ["references/high-speed-layout.md", "pcb-skill-src-high-speed-layout.md.txt", "reference"],
+  ["references/kicad-native.md", "pcb-skill-src-kicad-native.md.txt", "reference"],
+  ["references/power-integrity.md", "pcb-skill-src-power-integrity.md.txt", "reference"],
+  ["scripts/kicad_pcb_probe.py", "pcb-skill-src-kicad_pcb_probe.py.txt", "script"],
+  ["scripts/pcb_constraint_gate.py", "pcb-skill-src-pcb_constraint_gate.py.txt", "script"]
+];
+
+await rm(out, { recursive: true, force: true });
+const scaffold = await ex(process.execPath, [path.join(creatorDir, "scripts", "create-skill.mjs"), skillsRoot, name, version], { maxBuffer: 1024 * 1024 });
+
+for (const [target, src] of sources) {
+  const data = await readFile(path.join(here, src));
+  const dst = path.join(out, ...target.split("/"));
+  await mkdir(path.dirname(dst), { recursive: true });
+  await writeFile(dst, data);
+}
+
+const resources = [];
+for (const [target,, kind] of sources) {
+  if (target === "SKILL.md") continue;
+  const bytes = await readFile(path.join(out, ...target.split("/")));
+  resources.push({ path: target, sha256: sha(bytes), kind });
+}
+resources.sort((a,b)=>a.path.localeCompare(b.path,"en"));
+
+const body = {
+  schema: "deadbyte.skill-manifest.v1",
+  name,
+  version,
+  description,
+  audience: "agent",
+  skill_md_sha256: sha(await readFile(path.join(out, "SKILL.md"))),
+  resources,
+  required_capabilities: [],
+  authority_planes: ["coding"],
+  provenance: {
+    source: "skill-creator",
+    origin_url: null,
+    source_revision: "local-draft-2026-09-27-pcb-v1"
+  }
+};
+
+const bodyBytes = Buffer.from(JSON.stringify(canonical(body)), "utf8");
+const body_sha256 = sha(bodyBytes);
+const priv = createPrivateKey(await readFile(path.join(stateDir, "trust", "ed25519-private.pem")));
+const pub = createPublicKey(priv);
+const keyId = sha(pub.export({ type: "spki", format: "der" }));
+const attestation = {
+  algorithm: "ed25519",
+  domain: "DEADBYTE-SKILL-MANIFEST-V1",
+  key_id: keyId,
+  signature_base64: sign(null, Buffer.concat([Buffer.from("DEADBYTE-SKILL-MANIFEST-V1\0", "utf8"), bodyBytes]), priv).toString("base64")
+};
+const unsigned = { body, body_sha256, attestation };
+const envelope = {
+  ...unsigned,
+  manifest_sha256: sha(Buffer.from(JSON.stringify(canonical(unsigned)), "utf8"))
+};
+await writeFile(path.join(out, "skill.json"), JSON.stringify(envelope, null, 2), "utf8");
+
+const validator = await ex(process.execPath, [path.join(creatorDir, "scripts", "validate-skill.mjs"), out], { maxBuffer: 1024 * 1024 });
+
+const plane = await createSkillPlane({
+  root: skillsRoot,
+  verifyKeyPath: path.join(stateDir, "trust", "ed25519-public.pem")
+});
+const loaded = await plane.load({ name });
+if (!loaded.verified) throw new Error("skill plane returned verified=false");
+
+let python = null;
+for (const candidate of ["python", "py"]) {
+  try {
+    await ex(candidate, ["--version"], { timeout: 10000, maxBuffer: 1024 * 1024 });
+    python = candidate;
+    break;
+  } catch {}
+}
+
+let selfTest = { status: "SKIPPED", reason: "python_not_found" };
+if (python) {
+  const tmp = await mkdtemp(path.join(os.tmpdir(), "deadbyte-pcb-skill-"));
+  try {
+    const fixture = [
+      "(kicad_pcb",
+      "  (version 20240108)",
+      "  (generator pcbnew)",
+      "  (layers",
+      "    (0 \"F.Cu\" signal)",
+      "    (31 \"B.Cu\" signal)",
+      "  )",
+      "  (net 0 \"\")",
+      "  (net 1 \"GND\")",
+      "  (footprint \"TEST\" (layer \"F.Cu\"))",
+      "  (segment (start 0 0) (end 1 0) (width 0.2) (layer \"F.Cu\") (net 1))",
+      "  (via (at 1 0) (size 0.6) (drill 0.3) (layers \"F.Cu\" \"B.Cu\") (net 1))",
+      "  (zone (net 1) (net_name \"GND\") (layer \"B.Cu\"))",
+      ")",
+      ""
+    ].join("\n");
+    const fixturePath = path.join(tmp, "fixture.kicad_pcb");
+    const probePath = path.join(tmp, "probe.json");
+    const contractPath = path.join(tmp, "contract.json");
+    await writeFile(fixturePath, fixture, "utf8");
+
+    const probeScript = path.join(out, "scripts", "kicad_pcb_probe.py");
+    const gateScript = path.join(out, "scripts", "pcb_constraint_gate.py");
+    const probeRun = await ex(python, [probeScript, fixturePath, "--pretty"], { timeout: 30000, maxBuffer: 1024 * 1024 });
+    const probe = JSON.parse(probeRun.stdout);
+    if (probe.copper_layer_count !== 2 || probe.counts.footprints !== 1 || probe.counts.segments !== 1 || probe.counts.vias !== 1 || probe.track_width_mm.min !== 0.2 || probe.via_drill_mm.min !== 0.3) {
+      throw new Error("probe self-test observation mismatch");
+    }
+    await writeFile(probePath, probeRun.stdout, "utf8");
+
+    const passContract = {
+      required_layers: ["F.Cu", "B.Cu"],
+      min_copper_layers: 2,
+      min_track_width_mm: 0.15,
+      min_via_diameter_mm: 0.45,
+      min_via_drill_mm: 0.20,
+      required_nets: ["GND"],
+      min_footprints: 1,
+      min_segments: 1,
+      min_vias: 1,
+      min_zones: 1
+    };
+    await writeFile(contractPath, JSON.stringify(passContract, null, 2), "utf8");
+    const passRun = await ex(python, [gateScript, probePath, contractPath], { timeout: 30000, maxBuffer: 1024 * 1024 });
+    const passResult = JSON.parse(passRun.stdout);
+    if (passResult.status !== "PASS") throw new Error("positive gate self-test did not pass");
+
+    const failContract = { min_track_width_mm: 0.25 };
+    await writeFile(contractPath, JSON.stringify(failContract, null, 2), "utf8");
+    let negativeCaught = false;
+    try {
+      await ex(python, [gateScript, probePath, contractPath], { timeout: 30000, maxBuffer: 1024 * 1024 });
+    } catch (e) {
+      const parsed = e.stdout ? JSON.parse(e.stdout) : null;
+      if (e.code === 2 && parsed && parsed.status === "FAIL") negativeCaught = true;
+    }
+    if (!negativeCaught) throw new Error("negative gate self-test did not fail closed");
+
+    selfTest = {
+      status: "PASS",
+      python,
+      fixture_probe: {
+        copper_layers: probe.copper_layer_count,
+        footprints: probe.counts.footprints,
+        segments: probe.counts.segments,
+        vias: probe.counts.vias,
+        zones: probe.counts.zones,
+        min_track_width_mm: probe.track_width_mm.min,
+        min_via_diameter_mm: probe.via_diameter_mm.min,
+        min_via_drill_mm: probe.via_drill_mm.min
+      },
+      positive_gate: "PASS",
+      negative_gate: "FAIL_EXIT_2"
+    };
+  } finally {
+    await rm(tmp, { recursive: true, force: true });
+  }
+}
+
+console.log(JSON.stringify({
+  status: "built",
+  name,
+  version,
+  out,
+  creator_manifest: creatorManifest,
+  scaffold_stdout: scaffold.stdout.trim(),
+  manifest_sha256: envelope.manifest_sha256,
+  body_sha256,
+  resource_count: resources.length,
+  verify_key_id: keyId,
+  validator_stdout: validator.stdout.trim(),
+  skill_plane_verified: loaded.verified,
+  self_test: selfTest
+}, null, 2));

package/scripts/build-hardware-r45.ps1

@@ -53,6 +53,24 @@ foreach($query in @('cpu','gpu','memory','storage','network','pci')){
   $queries[$query]=Get-Sha256Hex -Path $Exe
 }
 
+$windowsQueries=[ordered]@{}
+foreach($query in @('services','drivers','sockets','volumes','usb','wsl')){
+  $raw=& $Exe $query 2>&1
+  $queryExit=$LASTEXITCODE
+  if($queryExit -ne 0){throw "Windows query $query failed exit=$queryExit output=$($raw -join ' ')"}
+  $text=($raw -join [Environment]::NewLine)
+  $parsed=$text | ConvertFrom-Json
+  if($parsed.schema -ne 'deadbyte.windows-query.v1' -or $parsed.query -ne $query){throw "Windows query $query contract mismatch"}
+  $windowsQueries[$query]=Get-Sha256Hex -Path $Exe
+}
+$registryRaw=& $Exe registry HKLM 'SOFTWARE\Microsoft\Windows NT\CurrentVersion' ProductName 2>&1
+$registryExit=$LASTEXITCODE
+if($registryExit -ne 0){throw "Windows registry query failed exit=$registryExit output=$($registryRaw -join ' ')"}
+$registryText=($registryRaw -join [Environment]::NewLine)
+$registryParsed=$registryText | ConvertFrom-Json
+if($registryParsed.schema -ne 'deadbyte.windows-query.v1' -or $registryParsed.query -ne 'registry'){throw 'Windows registry query contract mismatch'}
+$windowsQueries['registry']=Get-Sha256Hex -Path $Exe
+
 $depLine='call "{0}" -no_logo -arch=x64 -host_arch=x64 && dumpbin /nologo /dependents "{1}"' -f $dev,$Exe
 $deps=& $cmd /d /s /c $depLine 2>&1
 $depExit=$LASTEXITCODE
@@ -67,5 +85,6 @@ if($depExit -ne 0){throw "hardware observer dumpbin failed exit=$depExit"}
   obj_sha256=Get-Sha256Hex -Path $Obj
   selftest=@($self | ForEach-Object {[string]$_})
   queries=@($queries.Keys)
+  windows_queries=@($windowsQueries.Keys)
   dependencies=@($deps | ForEach-Object {[string]$_})
 }|ConvertTo-Json -Depth 5

package/scripts/diagnose-skill-tree.mjs

@@ -0,0 +1,8 @@
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+const root=process.argv[2];
+async function walk(d,r=""){let out=[];for(const e of (await readdir(d,{withFileTypes:true})).sort((a,b)=>a.name.localeCompare(b.name,"en"))){const p=path.join(d,e.name),q=r?r+"/"+e.name:e.name;if(e.isDirectory())out.push(...await walk(p,q));else if(e.isFile())out.push(q)}return out}
+const env=JSON.parse(await readFile(path.join(root,"skill.json"),"utf8"));
+const actual=(await walk(root)).sort((a,b)=>a.localeCompare(b,"en"));
+const expected=["SKILL.md","skill.json",...env.body.resources.map(x=>x.path)].sort((a,b)=>a.localeCompare(b,"en"));
+console.log(JSON.stringify({actual,expected,extra:actual.filter(x=>!expected.includes(x)),missing:expected.filter(x=>!actual.includes(x))},null,2));

package/scripts/full-regression-r48-batch.mjs

@@ -0,0 +1,27 @@
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const excluded=new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']);
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs')&&!excluded.has(entry.name));
+const weighted=[];
+for(const entry of files) weighted.push({path:path.join('test',entry.name),size:(await stat(path.join(testDir,entry.name))).size});
+weighted.sort((a,b)=>b.size-a.size||a.path.localeCompare(b.path,'en'));
+const batchCount=8;
+const batches=Array.from({length:batchCount},()=>[]);
+weighted.forEach((entry,index)=>batches[index%batchCount].push(entry.path));
+const requested=Number(process.argv[2]);
+if(!Number.isInteger(requested)||requested<1||requested>batchCount) throw new Error('usage: node full-regression-r48-batch.mjs <1..8>');
+const batch=batches[requested-1].sort((a,b)=>a.localeCompare(b,'en'));
+console.log(`R48-BOUNDED-REGRESSION batch=${requested}/${batchCount} files=${batch.length}`);
+console.log(batch.join('\n'));
+const result=spawnSync(process.execPath,['--test','--test-concurrency=1',...batch],{cwd:root,stdio:'inherit',windowsHide:true,shell:false});
+if(result.error) throw result.error;
+if(result.signal) throw new Error(`regression batch ${requested} terminated by ${result.signal}`);
+if(result.status!==0) throw new Error(`regression batch ${requested} failed with exit code ${result.status}`);
+console.log(`R48-BOUNDED-REGRESSION BATCH PASS batch=${requested} files=${batch.length}`);