deadbyte-mcp 0.15.21 → 0.15.23

package/scripts/pcb-skill-src-pcb_constraint_gate.py.txt

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+import json, sys
+
+def load(path):
+    with open(path, "r", encoding="utf-8") as f:
+        return json.load(f)
+
+def main():
+    if len(sys.argv) != 3:
+        raise SystemExit("usage: pcb_constraint_gate.py board-probe.json board-contract.json")
+    probe = load(sys.argv[1])
+    contract = load(sys.argv[2])
+    if probe.get("schema") != "deadbyte.kicad-pcb-probe.v1":
+        raise SystemExit("unsupported probe schema")
+
+    checks = []
+    def add(rule, ok, observed, required):
+        checks.append({"rule": rule, "ok": bool(ok), "observed": observed, "required": required})
+
+    if "required_layers" in contract:
+        observed = set(x.get("name") for x in probe.get("layers", []))
+        req = list(contract["required_layers"])
+        add("required_layers", all(x in observed for x in req), sorted(observed), req)
+
+    if "min_copper_layers" in contract:
+        observed = probe.get("copper_layer_count")
+        req = int(contract["min_copper_layers"])
+        add("min_copper_layers", isinstance(observed, int) and observed >= req, observed, req)
+
+    for key, probe_key in [
+        ("min_track_width_mm", "track_width_mm"),
+        ("min_via_diameter_mm", "via_diameter_mm"),
+        ("min_via_drill_mm", "via_drill_mm"),
+    ]:
+        if key in contract:
+            observed = (probe.get(probe_key) or {}).get("min")
+            req = float(contract[key])
+            add(key, observed is not None and float(observed) >= req, observed, req)
+
+    if "required_nets" in contract:
+        observed = set(probe.get("nets", []))
+        req = list(contract["required_nets"])
+        add("required_nets", all(x in observed for x in req), sorted(observed), req)
+
+    for key, count_key in [
+        ("min_footprints", "footprints"),
+        ("min_segments", "segments"),
+        ("min_vias", "vias"),
+        ("min_zones", "zones"),
+    ]:
+        if key in contract:
+            observed = (probe.get("counts") or {}).get(count_key)
+            req = int(contract[key])
+            add(key, isinstance(observed, int) and observed >= req, observed, req)
+
+    allowed = {
+        "required_layers", "min_copper_layers", "min_track_width_mm",
+        "min_via_diameter_mm", "min_via_drill_mm", "required_nets",
+        "min_footprints", "min_segments", "min_vias", "min_zones"
+    }
+    unknown = sorted(set(contract) - allowed)
+    if unknown:
+        checks.append({"rule": "unknown_contract_keys", "ok": False, "observed": unknown, "required": "no unsupported keys"})
+
+    passed = all(x["ok"] for x in checks)
+    out = {
+        "schema": "deadbyte.pcb-constraint-gate.v1",
+        "status": "PASS" if passed else "FAIL",
+        "probe_sha256": probe.get("sha256"),
+        "checks": checks
+    }
+    print(json.dumps(out, indent=2, sort_keys=True))
+    raise SystemExit(0 if passed else 2)
+
+if __name__ == "__main__":
+    main()

package/scripts/pcb-skill-src-power-integrity.md.txt

@@ -0,0 +1,15 @@
+# Power Integrity and Thermal
+
+Power integrity begins with current loops, not capacitor count.
+
+For each regulator trace the input current path, keep the high di/dt input loop compact, bound switch-node copper, place bootstrap/gate-drive parts by topology, protect the feedback sense path, close the output-current loop, and provide a credible thermal path.
+
+For decoupling separate bulk-energy storage from local high-frequency charge. Account for capacitor mounting inductance, vias, planes, and package inductance. Printed capacitance alone does not prove useful impedance at frequency.
+
+For planes and pours verify neck-downs at pads, vias, connectors, and thermal spokes; identify slots caused by keepouts and antipads; preserve return continuity; and check both DC drop and transient current paths.
+
+For sensitive analog control where digital and switching currents return. Do not split ground reflexively. Placement, loop control, filtering, and current-path ownership matter more than labels.
+
+Thermal claims require dissipation, package thermal path, copper geometry, ambient, airflow, and enclosure assumptions. Missing inputs mean thermal margin UNKNOWN.
+
+Bench evidence should include rail voltage, ripple/noise with correct probing, startup sequencing, relevant load transient behavior, and regulator temperature under representative load.

package/scripts/prepare-skill-creator-1.1.1.mjs

@@ -0,0 +1,113 @@
+import { readFile, writeFile, mkdir, rm, cp } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+import { createHash, createPrivateKey, createPublicKey, sign } from "node:crypto";
+import { createSkillPlane } from "../src/skill-plane-r44.mjs";
+
+const ex = promisify(execFile);
+const home = os.homedir();
+const stateDir = path.join(home, ".deadbyte-mcp");
+const skillsRoot = path.join(stateDir, "skills");
+const active = path.join(skillsRoot, "skill-creator");
+const expectedOldManifest = "f34b3953db176c8ae9a5e08e7702b39f12b60b013edcd2f4d63a6268af9ba432";
+const oldEnv = JSON.parse(await readFile(path.join(active, "skill.json"), "utf8"));
+if (oldEnv.manifest_sha256 !== expectedOldManifest) {
+  throw new Error("unexpected active skill-creator manifest: " + oldEnv.manifest_sha256);
+}
+if (oldEnv.body.version !== "1.1.0") throw new Error("expected active skill-creator 1.1.0");
+
+const history = path.join(stateDir, "skill-history", "skill-creator", "1.1.0-" + expectedOldManifest);
+await mkdir(path.dirname(history), {recursive:true});
+try {
+  const prior = JSON.parse(await readFile(path.join(history, "skill.json"), "utf8"));
+  if (prior.manifest_sha256 !== expectedOldManifest) throw new Error("history path collision");
+} catch (e) {
+  if (e.code !== "ENOENT") throw e;
+  await cp(active, history, {recursive:true, errorOnExist:true});
+}
+const archived = JSON.parse(await readFile(path.join(history, "skill.json"), "utf8"));
+if (archived.manifest_sha256 !== expectedOldManifest) throw new Error("archive manifest mismatch");
+
+const stageParent = path.join(stateDir, "skill-staging", "skill-creator-1.1.1");
+const stage = path.join(stageParent, "skill-creator");
+await rm(stageParent, {recursive:true, force:true});
+await mkdir(stageParent, {recursive:true});
+await cp(active, stage, {recursive:true});
+await rm(path.join(stage, "references", "skills_cache.json"), {force:true});
+
+const createPath = path.join(stage, "scripts", "create-skill.mjs");
+const oldCreate = await readFile(createPath, "utf8");
+const oldRegex = "const VERSION=/^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/;";
+const newRegex = "const VERSION=/^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/;";
+if (!oldCreate.includes(oldRegex)) throw new Error("expected defective VERSION regex not found");
+if (oldCreate.split(oldRegex).length !== 2) throw new Error("VERSION regex occurrence count != 1");
+await writeFile(createPath, oldCreate.replace(oldRegex, newRegex), "utf8");
+
+const skillPath = path.join(stage, "SKILL.md");
+const oldSkill = await readFile(skillPath, "utf8");
+const versionLine = "version: 1.1.0";
+if (!oldSkill.includes(versionLine) || oldSkill.split(versionLine).length !== 2) {
+  throw new Error("SKILL.md version occurrence count != 1");
+}
+await writeFile(skillPath, oldSkill.replace(versionLine, "version: 1.1.1"), "utf8");
+
+const sha = b => createHash("sha256").update(b).digest("hex");
+const canonical = v => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object"
+  ? Object.fromEntries(Object.keys(v).sort((a,b)=>a.localeCompare(b,"en")).map(k=>[k,canonical(v[k])]))
+  : v;
+
+const body = structuredClone(oldEnv.body);
+body.version = "1.1.1";
+body.skill_md_sha256 = sha(await readFile(skillPath));
+body.provenance = {
+  ...body.provenance,
+  source_revision: "r47.1-semver-regex-repair-2026-09-27"
+};
+for (const resource of body.resources) {
+  resource.sha256 = sha(await readFile(path.join(stage, ...resource.path.split("/"))));
+}
+const bodyBytes = Buffer.from(JSON.stringify(canonical(body)), "utf8");
+const body_sha256 = sha(bodyBytes);
+const priv = createPrivateKey(await readFile(path.join(stateDir, "trust", "ed25519-private.pem")));
+const pub = createPublicKey(priv);
+const keyId = sha(pub.export({type:"spki", format:"der"}));
+const attestation = {
+  algorithm: "ed25519",
+  domain: "DEADBYTE-SKILL-MANIFEST-V1",
+  key_id: keyId,
+  signature_base64: sign(null, Buffer.concat([Buffer.from("DEADBYTE-SKILL-MANIFEST-V1\0", "utf8"), bodyBytes]), priv).toString("base64")
+};
+const unsigned = {body, body_sha256, attestation};
+const envelope = {
+  ...unsigned,
+  manifest_sha256: sha(Buffer.from(JSON.stringify(canonical(unsigned)), "utf8"))
+};
+await writeFile(path.join(stage, "skill.json"), JSON.stringify(envelope, null, 2), "utf8");
+
+const validator = await ex(process.execPath, [path.join(stage, "scripts", "validate-skill.mjs"), stage], {
+  timeout: 30000,
+  maxBuffer: 1024 * 1024
+});
+
+const plane = await createSkillPlane({
+  root: stageParent,
+  verifyKeyPath: path.join(stateDir, "trust", "ed25519-public.pem")
+});
+const loaded = await plane.load({name:"skill-creator"});
+if (!loaded.verified || loaded.version !== "1.1.1") throw new Error("staging Skill Plane verification failed");
+
+console.log(JSON.stringify({
+  status:"STAGED",
+  active_manifest:oldEnv.manifest_sha256,
+  archived_path:history,
+  archived_manifest:archived.manifest_sha256,
+  stage_parent:stageParent,
+  stage_skill:stage,
+  candidate_manifest:envelope.manifest_sha256,
+  candidate_body_sha256:body_sha256,
+  verify_key_id:keyId,
+  validator:validator.stdout.trim(),
+  skill_plane_verified:loaded.verified
+}, null, 2));

package/scripts/promote-local-c-generation.ps1

@@ -0,0 +1,217 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+function Fail([string]$Message) { throw "LOCAL_C_PROMOTION: $Message" }
+function Sha256-File([string]$Path) {
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+function Sha256-Text([string]$Text) {
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
+        return -join ($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
+    } finally { $sha.Dispose() }
+}
+function Write-Utf8NoBom([string]$Path,[string]$Text) {
+    [System.IO.File]::WriteAllText($Path,$Text,(New-Object System.Text.UTF8Encoding($false)))
+}
+function Read-Raw([string]$Path) {
+    return [System.IO.File]::ReadAllText($Path,[System.Text.Encoding]::UTF8)
+}
+
+$stateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointerPath = Join-Path $stateRoot 'active-release.json'
+$launcher = Join-Path $stateRoot 'bin\DEADBYTE-MCP.ps1'
+$runtimeRoot = Join-Path $stateRoot 'runtime'
+if (-not (Test-Path -LiteralPath $pointerPath -PathType Leaf)) { Fail 'active pointer missing' }
+if (-not (Test-Path -LiteralPath $launcher -PathType Leaf)) { Fail 'stable launcher missing' }
+
+$pointerText = Read-Raw $pointerPath
+$pointer = $pointerText | ConvertFrom-Json
+if ([string]$pointer.schema -ne 'deadbyte.active-release.v1') { Fail 'active pointer schema mismatch' }
+$oldGeneration = [System.IO.Path]::GetFullPath([string]$pointer.generation_root)
+$oldManifest = Join-Path $oldGeneration 'GENERATION.SHA256'
+if (-not (Test-Path -LiteralPath $oldManifest -PathType Leaf)) { Fail 'old generation manifest missing' }
+$oldManifestHash = Sha256-File $oldManifest
+if ($oldManifestHash -ne [string]$pointer.generation_manifest_sha256) { Fail 'old generation manifest hash mismatch' }
+
+$manifestLines = @(Get-Content -LiteralPath $oldManifest -Encoding UTF8)
+$entries = @()
+foreach ($line in $manifestLines) {
+    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }
+    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail "malformed old generation manifest line: $line" }
+    $expected = [string]$Matches[1]
+    $name = [string]$Matches[2]
+    $path = Join-Path $oldGeneration $name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "old generation file missing: $name" }
+    $actual = Sha256-File $path
+    if ($actual -ne $expected) { Fail "old generation hash mismatch: $name" }
+    $entries += [pscustomobject]@{ Name=$name; Expected=$expected }
+}
+$names = @($entries | ForEach-Object { $_.Name })
+foreach ($required in @('coding-policy.json','autonomous-policy.json','controller-config.psd1')) {
+    if ($required -notin $names) { Fail "required generation file not manifested: $required" }
+}
+
+$oldCodingPath = Join-Path $oldGeneration 'coding-policy.json'
+$oldAutonomousPath = Join-Path $oldGeneration 'autonomous-policy.json'
+$oldCodingHash = Sha256-File $oldCodingPath
+$oldAutonomousHash = Sha256-File $oldAutonomousPath
+
+$coding = (Read-Raw $oldCodingPath) | ConvertFrom-Json
+if ([string]$coding.schema -ne 'deadbyte.coding-policy.v1' -or $coding.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+if ($null -eq $coding.roots) { Fail 'coding roots missing' }
+
+$localRoot = [pscustomobject][ordered]@{
+    path = 'C:\'
+    read = $true
+    write = $true
+    exec = $true
+    deny_paths = @()
+}
+if ($coding.roots.PSObject.Properties.Name -contains 'local_c') {
+    $coding.roots.local_c = $localRoot
+} else {
+    $coding.roots | Add-Member -NotePropertyName 'local_c' -NotePropertyValue $localRoot
+}
+foreach ($commandProp in @($coding.commands.PSObject.Properties)) {
+    $command = $commandProp.Value
+    if ($command.PSObject.Properties.Name -contains 'root_ids') {
+        $ids = @($command.root_ids)
+        if ('local_c' -notin $ids) { $command.root_ids = @($ids + 'local_c') }
+    }
+}
+$codingText = ($coding | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newCodingHash = Sha256-Text $codingText
+
+$autonomous = (Read-Raw $oldAutonomousPath) | ConvertFrom-Json
+if ([string]$autonomous.schema -ne 'deadbyte.autonomous-policy.v1' -or $autonomous.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+$autonomous.coding_policy_sha256 = $newCodingHash
+$autonomousText = ($autonomous | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newAutonomousHash = Sha256-Text $autonomousText
+
+$seed = $oldManifestHash + [Environment]::NewLine + $newCodingHash + [Environment]::NewLine + $newAutonomousHash + [Environment]::NewLine + 'local_c=C:\'
+$generationSuffix = (Sha256-Text $seed).Substring(0,16)
+$newGenerationId = ([string]$pointer.release_id) + '-g' + $generationSuffix
+$generationStore = Join-Path $stateRoot 'generations'
+$newGeneration = Join-Path $generationStore $newGenerationId
+if (Test-Path -LiteralPath $newGeneration) { Fail "target generation already exists: $newGeneration" }
+New-Item -ItemType Directory -Path $newGeneration | Out-Null
+
+$pointerBackup = Join-Path $runtimeRoot 'active-release.before-local-c.json'
+$codingGrantPath = Join-Path $runtimeRoot 'coding-grant.json'
+$autonomousGrantPath = Join-Path $runtimeRoot 'autonomous-grant.json'
+$hadCodingGrant = Test-Path -LiteralPath $codingGrantPath -PathType Leaf
+$hadAutonomousGrant = Test-Path -LiteralPath $autonomousGrantPath -PathType Leaf
+$oldCodingGrantText = if ($hadCodingGrant) { Read-Raw $codingGrantPath } else { $null }
+$oldAutonomousGrantText = if ($hadAutonomousGrant) { Read-Raw $autonomousGrantPath } else { $null }
+$wasAutonomousArmed = $false
+if ($hadCodingGrant -and $hadAutonomousGrant) {
+    try {
+        $cg = $oldCodingGrantText | ConvertFrom-Json
+        $ag = $oldAutonomousGrantText | ConvertFrom-Json
+        $wasAutonomousArmed =
+            ([string]$cg.policy_sha256 -eq $oldCodingHash) -and
+            ([string]$ag.policy_sha256 -eq $oldAutonomousHash) -and
+            ([string]$ag.coding_policy_sha256 -eq $oldCodingHash)
+    } catch { $wasAutonomousArmed = $false }
+}
+
+$switched = $false
+try {
+    foreach ($entry in $entries) {
+        $src = Join-Path $oldGeneration $entry.Name
+        $dst = Join-Path $newGeneration $entry.Name
+        Copy-Item -LiteralPath $src -Destination $dst
+    }
+
+    Write-Utf8NoBom (Join-Path $newGeneration 'coding-policy.json') $codingText
+    Write-Utf8NoBom (Join-Path $newGeneration 'autonomous-policy.json') $autonomousText
+
+    $configPath = Join-Path $newGeneration 'controller-config.psd1'
+    $configText = Read-Raw $configPath
+    if ($configText.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -lt 0) { Fail 'controller config is not bound to old generation root' }
+    $configText = $configText.Replace($oldGeneration,$newGeneration)
+    Write-Utf8NoBom $configPath $configText
+    $cfg = Import-PowerShellDataFile -LiteralPath $configPath
+    if ([System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'coding-policy.json'))) { Fail 'new controller CodingPolicyFile binding mismatch' }
+    if ([System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'autonomous-policy.json'))) { Fail 'new controller AutonomousPolicyFile binding mismatch' }
+
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $text = $null
+        try { $text = Read-Raw $p } catch { $text = $null }
+        if ($null -ne $text -and $entry.Name -ne 'controller-config.psd1' -and $text.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            Fail "unexpected old generation binding remains in $($entry.Name)"
+        }
+    }
+
+    $newManifestLines = @()
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $newManifestLines += ((Sha256-File $p) + '  ' + $entry.Name)
+    }
+    $newManifestText = ($newManifestLines -join [Environment]::NewLine) + [Environment]::NewLine
+    $newManifestPath = Join-Path $newGeneration 'GENERATION.SHA256'
+    Write-Utf8NoBom $newManifestPath $newManifestText
+    $newManifestHash = Sha256-File $newManifestPath
+
+    foreach ($line in $newManifestLines) {
+        if ($line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'new manifest internal format error' }
+        $actual = Sha256-File (Join-Path $newGeneration ([string]$Matches[2]))
+        if ($actual -ne [string]$Matches[1]) { Fail "new generation verification failed: $($Matches[2])" }
+    }
+    if ((Sha256-File (Join-Path $newGeneration 'coding-policy.json')) -ne $newCodingHash) { Fail 'new coding hash self-check failed' }
+    if ((Sha256-File (Join-Path $newGeneration 'autonomous-policy.json')) -ne $newAutonomousHash) { Fail 'new autonomous hash self-check failed' }
+
+    Write-Utf8NoBom $pointerBackup $pointerText
+    $pointer.generation_root = $newGeneration
+    $pointer.config_path = Join-Path $newGeneration 'controller-config.psd1'
+    $pointer.generation_manifest_sha256 = $newManifestHash
+    if ($pointer.PSObject.Properties.Name -contains 'generation_id') { $pointer.generation_id = $newGenerationId }
+    if ($pointer.PSObject.Properties.Name -contains 'generation_manifest_path') { $pointer.generation_manifest_path = $newManifestPath }
+    if ($pointer.PSObject.Properties.Name -contains 'updated_at_utc') { $pointer.updated_at_utc = [DateTime]::UtcNow.ToString('o') }
+    $newPointerText = ($pointer | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+    $pointerTmp = $pointerPath + '.local-c.tmp'
+    Write-Utf8NoBom $pointerTmp $newPointerText
+    Move-Item -LiteralPath $pointerTmp -Destination $pointerPath -Force
+    $switched = $true
+
+    $statusText = (& $launcher status 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "launcher status failed after pointer switch: $statusText" }
+
+    $armCodingText = (& $launcher armcoding 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "armcoding failed after pointer switch: $armCodingText" }
+
+    $armAutonomousText = ''
+    if ($wasAutonomousArmed) {
+        $armAutonomousText = (& $launcher armautonomous 2>&1 | Out-String)
+        if ($LASTEXITCODE -ne 0) { Fail "armautonomous failed after pointer switch: $armAutonomousText" }
+    }
+
+    Write-Output 'LOCAL_C_PROMOTION=PASS'
+    Write-Output ('OLD_GENERATION=' + $oldGeneration)
+    Write-Output ('NEW_GENERATION=' + $newGeneration)
+    Write-Output ('OLD_GENERATION_MANIFEST_SHA256=' + $oldManifestHash)
+    Write-Output ('NEW_GENERATION_MANIFEST_SHA256=' + $newManifestHash)
+    Write-Output ('OLD_CODING_POLICY_SHA256=' + $oldCodingHash)
+    Write-Output ('NEW_CODING_POLICY_SHA256=' + $newCodingHash)
+    Write-Output ('NEW_AUTONOMOUS_POLICY_SHA256=' + $newAutonomousHash)
+    Write-Output ('AUTONOMOUS_REARMED=' + $wasAutonomousArmed)
+    Write-Output ('ROLLBACK_POINTER=' + $pointerBackup)
+    Write-Output 'RESTART_REQUIRED=YES'
+} catch {
+    $message = $_.Exception.Message
+    if ($switched) {
+        try { Write-Utf8NoBom $pointerPath $pointerText } catch {}
+        if ($hadCodingGrant) { try { Write-Utf8NoBom $codingGrantPath $oldCodingGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $codingGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+        if ($hadAutonomousGrant) { try { Write-Utf8NoBom $autonomousGrantPath $oldAutonomousGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $autonomousGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+    }
+    try { if (Test-Path -LiteralPath $newGeneration) { Remove-Item -LiteralPath $newGeneration -Recurse -Force } } catch {}
+    Fail $message
+}

package/scripts/promote-local-d-generation.ps1

@@ -0,0 +1,217 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+function Fail([string]$Message) { throw "LOCAL_D_PROMOTION: $Message" }
+function Sha256-File([string]$Path) {
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+function Sha256-Text([string]$Text) {
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
+        return -join ($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
+    } finally { $sha.Dispose() }
+}
+function Write-Utf8NoBom([string]$Path,[string]$Text) {
+    [System.IO.File]::WriteAllText($Path,$Text,(New-Object System.Text.UTF8Encoding($false)))
+}
+function Read-Raw([string]$Path) {
+    return [System.IO.File]::ReadAllText($Path,[System.Text.Encoding]::UTF8)
+}
+
+$stateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointerPath = Join-Path $stateRoot 'active-release.json'
+$launcher = Join-Path $stateRoot 'bin\DEADBYTE-MCP.ps1'
+$runtimeRoot = Join-Path $stateRoot 'runtime'
+if (-not (Test-Path -LiteralPath $pointerPath -PathType Leaf)) { Fail 'active pointer missing' }
+if (-not (Test-Path -LiteralPath $launcher -PathType Leaf)) { Fail 'stable launcher missing' }
+
+$pointerText = Read-Raw $pointerPath
+$pointer = $pointerText | ConvertFrom-Json
+if ([string]$pointer.schema -ne 'deadbyte.active-release.v1') { Fail 'active pointer schema mismatch' }
+$oldGeneration = [System.IO.Path]::GetFullPath([string]$pointer.generation_root)
+$oldManifest = Join-Path $oldGeneration 'GENERATION.SHA256'
+if (-not (Test-Path -LiteralPath $oldManifest -PathType Leaf)) { Fail 'old generation manifest missing' }
+$oldManifestHash = Sha256-File $oldManifest
+if ($oldManifestHash -ne [string]$pointer.generation_manifest_sha256) { Fail 'old generation manifest hash mismatch' }
+
+$manifestLines = @(Get-Content -LiteralPath $oldManifest -Encoding UTF8)
+$entries = @()
+foreach ($line in $manifestLines) {
+    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }
+    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail "malformed old generation manifest line: $line" }
+    $expected = [string]$Matches[1]
+    $name = [string]$Matches[2]
+    $path = Join-Path $oldGeneration $name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "old generation file missing: $name" }
+    $actual = Sha256-File $path
+    if ($actual -ne $expected) { Fail "old generation hash mismatch: $name" }
+    $entries += [pscustomobject]@{ Name=$name; Expected=$expected }
+}
+$names = @($entries | ForEach-Object { $_.Name })
+foreach ($required in @('coding-policy.json','autonomous-policy.json','controller-config.psd1')) {
+    if ($required -notin $names) { Fail "required generation file not manifested: $required" }
+}
+
+$oldCodingPath = Join-Path $oldGeneration 'coding-policy.json'
+$oldAutonomousPath = Join-Path $oldGeneration 'autonomous-policy.json'
+$oldCodingHash = Sha256-File $oldCodingPath
+$oldAutonomousHash = Sha256-File $oldAutonomousPath
+
+$coding = (Read-Raw $oldCodingPath) | ConvertFrom-Json
+if ([string]$coding.schema -ne 'deadbyte.coding-policy.v1' -or $coding.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+if ($null -eq $coding.roots) { Fail 'coding roots missing' }
+
+$localRoot = [pscustomobject][ordered]@{
+    path = 'D:\'
+    read = $true
+    write = $true
+    exec = $true
+    deny_paths = @()
+}
+if ($coding.roots.PSObject.Properties.Name -contains 'local_d') {
+    $coding.roots.local_d = $localRoot
+} else {
+    $coding.roots | Add-Member -NotePropertyName 'local_d' -NotePropertyValue $localRoot
+}
+foreach ($commandProp in @($coding.commands.PSObject.Properties)) {
+    $command = $commandProp.Value
+    if ($command.PSObject.Properties.Name -contains 'root_ids') {
+        $ids = @($command.root_ids)
+        if ('local_d' -notin $ids) { $command.root_ids = @($ids + 'local_d') }
+    }
+}
+$codingText = ($coding | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newCodingHash = Sha256-Text $codingText
+
+$autonomous = (Read-Raw $oldAutonomousPath) | ConvertFrom-Json
+if ([string]$autonomous.schema -ne 'deadbyte.autonomous-policy.v1' -or $autonomous.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+$autonomous.coding_policy_sha256 = $newCodingHash
+$autonomousText = ($autonomous | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newAutonomousHash = Sha256-Text $autonomousText
+
+$seed = $oldManifestHash + [Environment]::NewLine + $newCodingHash + [Environment]::NewLine + $newAutonomousHash + [Environment]::NewLine + 'local_d=D:\'
+$generationSuffix = (Sha256-Text $seed).Substring(0,16)
+$newGenerationId = ([string]$pointer.release_id) + '-g' + $generationSuffix
+$generationStore = Join-Path $stateRoot 'generations'
+$newGeneration = Join-Path $generationStore $newGenerationId
+if (Test-Path -LiteralPath $newGeneration) { Fail "target generation already exists: $newGeneration" }
+New-Item -ItemType Directory -Path $newGeneration | Out-Null
+
+$pointerBackup = Join-Path $runtimeRoot 'active-release.before-local-d.json'
+$codingGrantPath = Join-Path $runtimeRoot 'coding-grant.json'
+$autonomousGrantPath = Join-Path $runtimeRoot 'autonomous-grant.json'
+$hadCodingGrant = Test-Path -LiteralPath $codingGrantPath -PathType Leaf
+$hadAutonomousGrant = Test-Path -LiteralPath $autonomousGrantPath -PathType Leaf
+$oldCodingGrantText = if ($hadCodingGrant) { Read-Raw $codingGrantPath } else { $null }
+$oldAutonomousGrantText = if ($hadAutonomousGrant) { Read-Raw $autonomousGrantPath } else { $null }
+$wasAutonomousArmed = $false
+if ($hadCodingGrant -and $hadAutonomousGrant) {
+    try {
+        $cg = $oldCodingGrantText | ConvertFrom-Json
+        $ag = $oldAutonomousGrantText | ConvertFrom-Json
+        $wasAutonomousArmed =
+            ([string]$cg.policy_sha256 -eq $oldCodingHash) -and
+            ([string]$ag.policy_sha256 -eq $oldAutonomousHash) -and
+            ([string]$ag.coding_policy_sha256 -eq $oldCodingHash)
+    } catch { $wasAutonomousArmed = $false }
+}
+
+$switched = $false
+try {
+    foreach ($entry in $entries) {
+        $src = Join-Path $oldGeneration $entry.Name
+        $dst = Join-Path $newGeneration $entry.Name
+        Copy-Item -LiteralPath $src -Destination $dst
+    }
+
+    Write-Utf8NoBom (Join-Path $newGeneration 'coding-policy.json') $codingText
+    Write-Utf8NoBom (Join-Path $newGeneration 'autonomous-policy.json') $autonomousText
+
+    $configPath = Join-Path $newGeneration 'controller-config.psd1'
+    $configText = Read-Raw $configPath
+    if ($configText.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -lt 0) { Fail 'controller config is not bound to old generation root' }
+    $configText = $configText.Replace($oldGeneration,$newGeneration)
+    Write-Utf8NoBom $configPath $configText
+    $cfg = Import-PowerShellDataFile -LiteralPath $configPath
+    if ([System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'coding-policy.json'))) { Fail 'new controller CodingPolicyFile binding mismatch' }
+    if ([System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'autonomous-policy.json'))) { Fail 'new controller AutonomousPolicyFile binding mismatch' }
+
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $text = $null
+        try { $text = Read-Raw $p } catch { $text = $null }
+        if ($null -ne $text -and $entry.Name -ne 'controller-config.psd1' -and $text.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            Fail "unexpected old generation binding remains in $($entry.Name)"
+        }
+    }
+
+    $newManifestLines = @()
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $newManifestLines += ((Sha256-File $p) + '  ' + $entry.Name)
+    }
+    $newManifestText = ($newManifestLines -join [Environment]::NewLine) + [Environment]::NewLine
+    $newManifestPath = Join-Path $newGeneration 'GENERATION.SHA256'
+    Write-Utf8NoBom $newManifestPath $newManifestText
+    $newManifestHash = Sha256-File $newManifestPath
+
+    foreach ($line in $newManifestLines) {
+        if ($line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'new manifest internal format error' }
+        $actual = Sha256-File (Join-Path $newGeneration ([string]$Matches[2]))
+        if ($actual -ne [string]$Matches[1]) { Fail "new generation verification failed: $($Matches[2])" }
+    }
+    if ((Sha256-File (Join-Path $newGeneration 'coding-policy.json')) -ne $newCodingHash) { Fail 'new coding hash self-check failed' }
+    if ((Sha256-File (Join-Path $newGeneration 'autonomous-policy.json')) -ne $newAutonomousHash) { Fail 'new autonomous hash self-check failed' }
+
+    Write-Utf8NoBom $pointerBackup $pointerText
+    $pointer.generation_root = $newGeneration
+    $pointer.config_path = Join-Path $newGeneration 'controller-config.psd1'
+    $pointer.generation_manifest_sha256 = $newManifestHash
+    if ($pointer.PSObject.Properties.Name -contains 'generation_id') { $pointer.generation_id = $newGenerationId }
+    if ($pointer.PSObject.Properties.Name -contains 'generation_manifest_path') { $pointer.generation_manifest_path = $newManifestPath }
+    if ($pointer.PSObject.Properties.Name -contains 'updated_at_utc') { $pointer.updated_at_utc = [DateTime]::UtcNow.ToString('o') }
+    $newPointerText = ($pointer | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+    $pointerTmp = $pointerPath + '.local-d.tmp'
+    Write-Utf8NoBom $pointerTmp $newPointerText
+    Move-Item -LiteralPath $pointerTmp -Destination $pointerPath -Force
+    $switched = $true
+
+    $statusText = (& $launcher status 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "launcher status failed after pointer switch: $statusText" }
+
+    $armCodingText = (& $launcher armcoding 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "armcoding failed after pointer switch: $armCodingText" }
+
+    $armAutonomousText = ''
+    if ($wasAutonomousArmed) {
+        $armAutonomousText = (& $launcher armautonomous 2>&1 | Out-String)
+        if ($LASTEXITCODE -ne 0) { Fail "armautonomous failed after pointer switch: $armAutonomousText" }
+    }
+
+    Write-Output 'LOCAL_D_PROMOTION=PASS'
+    Write-Output ('OLD_GENERATION=' + $oldGeneration)
+    Write-Output ('NEW_GENERATION=' + $newGeneration)
+    Write-Output ('OLD_GENERATION_MANIFEST_SHA256=' + $oldManifestHash)
+    Write-Output ('NEW_GENERATION_MANIFEST_SHA256=' + $newManifestHash)
+    Write-Output ('OLD_CODING_POLICY_SHA256=' + $oldCodingHash)
+    Write-Output ('NEW_CODING_POLICY_SHA256=' + $newCodingHash)
+    Write-Output ('NEW_AUTONOMOUS_POLICY_SHA256=' + $newAutonomousHash)
+    Write-Output ('AUTONOMOUS_REARMED=' + $wasAutonomousArmed)
+    Write-Output ('ROLLBACK_POINTER=' + $pointerBackup)
+    Write-Output 'RESTART_REQUIRED=YES'
+} catch {
+    $message = $_.Exception.Message
+    if ($switched) {
+        try { Write-Utf8NoBom $pointerPath $pointerText } catch {}
+        if ($hadCodingGrant) { try { Write-Utf8NoBom $codingGrantPath $oldCodingGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $codingGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+        if ($hadAutonomousGrant) { try { Write-Utf8NoBom $autonomousGrantPath $oldAutonomousGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $autonomousGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+    }
+    try { if (Test-Path -LiteralPath $newGeneration) { Remove-Item -LiteralPath $newGeneration -Recurse -Force } } catch {}
+    Fail $message
+}

package/scripts/test-r48-post-bump.ps1

@@ -0,0 +1,8 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$Root=Split-Path -Parent $PSScriptRoot
+Push-Location $Root
+try {
+  & node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/release-version.test.mjs test/cli-entrypoint.test.mjs test/package-boundary.test.mjs test/release-smoke-isolation.test.mjs test/full-max-catalog-r48.test.mjs
+  if($LASTEXITCODE -ne 0){throw "R48 post-bump release checks failed exit=$LASTEXITCODE"}
+} finally { Pop-Location }

package/scripts/test-r48-windows-observation.ps1

@@ -0,0 +1,8 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$Root=Split-Path -Parent $PSScriptRoot
+Push-Location $Root
+try {
+  & node --test test/machine-fs-runtime.test.mjs test/windows-observation-r48.test.mjs test/windows-observation-surface-r48.test.mjs test/hardware-observation-r45.test.mjs test/observation-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-resolver.test.mjs test/compact-catalog-r36.test.mjs test/compact-max-catalog-r45.test.mjs test/full-max-catalog-r45.test.mjs test/full-max-catalog-r46.test.mjs test/full-max-catalog-r47.test.mjs test/full-max-catalog-r48.test.mjs
+  if($LASTEXITCODE -ne 0){throw "R48 focused regression failed exit=$LASTEXITCODE"}
+} finally { Pop-Location }