deadbyte-mcp 0.15.21 → 0.15.23

package/test/remote-live-log-r37.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { createLiveTimelineTracker, formatRemoteLifecycle, formatRuntimeDiagnosticLine, summarizeLiveToolArgs, truncateUtf8 } from '../src/remote-live-log.mjs';
+import * as live from '../src/remote-live-log.mjs';
+const {createLiveTimelineTracker,formatRemoteLifecycle,formatRuntimeDiagnosticLine,summarizeLiveToolArgs,truncateUtf8}=live;
 
 test('R40 human live timeline suppresses noisy read request and emits one categorized terminal line',()=>{
   let now=1000;
@@ -43,7 +44,7 @@ test('R40 heartbeat burst folds repeated status calls instead of printing every
     else assert.match(line,/^📡  .*#39  machine_ping ×5  avg 3ms  ✓$/);
     now+=10;
   }
-  assert.match(tracker.summary(),/5 calls \| 0 errors .*folded 4 heartbeat lines.*machine_ping×5/);
+  assert.match(tracker.summary(),/5 calls \| 5 ok \| 0 errors \| 0 unknown \| 0 mutations .*folded 4 heartbeat lines.*machine_ping×5/);
 });
 
 test('R40 transport IN/OUT echo is hidden by default and available only in verbose diagnostics',()=>{
@@ -64,14 +65,19 @@ test('R40 interrupted spans remain correlated and session summary is available',
     args:{root_id:'core',path:'x.txt',content:'x'}},{sequence:50});
   const lines=tracker.reconcileInterrupted('recovery');
   assert.deepEqual(lines,['⚠ [pending-] OUTCOME_UNKNOWN coding_file_write — recovery ended before terminal result; inspect state before retry']);
-  assert.match(tracker.summary(),/^📊 \[SUMMARY\] 0 calls \| 0 errors/);
+  assert.match(tracker.summary(),/^📊 \[SUMMARY\] 0 calls \| 0 ok \| 0 errors \| 0 unknown \| 0 mutations/);
 });
 
 test('R40 CLI exposes explicit verbose mode while keeping default live mode compact',async()=>{
   const {readFile}=await import('node:fs/promises');
   const src=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
-  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode\}\)/);
-  assert.match(src,/args\.includes\('--verbose'\)/);
+  assert.match(src,/readLiveRootPaths\(ctx\.root\)/);
+  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace\}\)/);
+  assert.match(src,/createLiveTimelineFilter\(filterExpression\)/);
+  assert.match(src,/createLiveTimelineWriter\(\{stream:process\.stdout,displayMode,rewrite:!verbose\}\)/);
+  assert.match(src,/arg==='--verbose'\|\|arg==='-v'/);
+  assert.match(src,/arg==='--trace'/);
+  assert.match(src,/arg==='--filter'/);
   assert.match(src,/Transport IN\/OUT hidden/);
   assert.doesNotMatch(src,/\[cursor \$\{recorded\.cursor\}\]/);
 });
@@ -88,13 +94,13 @@ test('R40 ASCII display fallback contains no non-ASCII bytes and preserves termi
   assert.equal(formatRemoteLifecycle('device_start',{displayMode:'ascii'}),'[DEVICE] Starting DEADBYTE MCP...');
 });
 
-test('R40 interrupted side effect is explicit OUTCOME_UNKNOWN instead of implying failure or replay safety',()=>{
+test('R40 interrupted side effect is explicit failed-after-unknown-effect instead of implying replay safety',()=>{
   const tracker=createLiveTimelineTracker({clock:()=>1000});
   tracker.observe({event_type:'tool.request',tool:'coding_file_write',request_id:'unknown-12345678',
     args:{root_id:'core',path:'x.txt',content:'x'}},{sequence:70});
   const line=tracker.observe({event_type:'tool.result',tool:'coding_file_write',request_id:'unknown-12345678',
     outcome:{status:'interrupted',is_error:true,duration_ms:0,side_effect_state:'unknown',recovery:{reason:'runtime_restart'}}},{sequence:71});
-  assert.match(line,/OUTCOME_UNKNOWN — runtime_restart$/);
+  assert.match(line,/FAILED_AFTER_UNKNOWN_EFFECT — runtime_restart$/);
   assert.doesNotMatch(line,/\s[✓✗]\s/);
 });
 
@@ -105,3 +111,96 @@ test('R40 UTF-8 truncation never splits Thai or emoji into replacement character
   assert.equal(clipped.includes('\uFFFD'),false);
   assert.ok(clipped.endsWith('…'));
 });
+
+
+test('visual opcode projection resolves multiplexed machine_fs operation and exposes terminal evidence',()=>{
+  let now=1000;
+  const receipt='1'.repeat(64);
+  const tracker=createLiveTimelineTracker({clock:()=>now,rootPaths:{projects:'D:\\Projects'}});
+  const start=tracker.observe({event_type:'tool.request',tool:'machine_fs',request_id:'machinefs-12345678',
+    ts:'1970-01-01T00:00:01.000Z',args:{op:'write',root_id:'projects',path:'S3CORE01-R2/STATUS.txt',content:'x'}},{sequence:80});
+  assert.match(start,/^📝 .*machine_fs\.write /);
+  assert.ok(start.includes('D:\\Projects\\S3CORE01-R2\\STATUS.txt [root=projects]'));
+  now=1007;
+  const done=tracker.observe({event_type:'tool.result',tool:'machine_fs',request_id:'machinefs-12345678',
+    ts:'1970-01-01T00:00:01.007Z',outcome:{status:'committed',is_error:false,duration_ms:7,receipt_sha256s:[receipt]}},{sequence:81});
+  assert.match(done,/^📝 .*machine_fs\.write .*7ms  ✅ SUCCEEDED  🧾 receipt=11111111…$/);
+});
+
+test('visual opcode projection reserves warning semantics for explicitly unknown side effects',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000});
+  tracker.observe({event_type:'tool.request',tool:'host_exec',request_id:'unknown-host-1234',
+    args:{root_id:'core',command_id:'powershell_inline',mode:'inline'}},{sequence:90});
+  const done=tracker.observe({event_type:'tool.result',tool:'host_exec',request_id:'unknown-host-1234',
+    outcome:{status:'interrupted',is_error:true,duration_ms:4,side_effect_state:'unknown',recovery:{reason:'runtime_restart'}}},{sequence:91});
+  assert.match(done,/^⚠️ .*host_exec .*4ms  FAILED_AFTER_UNKNOWN_EFFECT — runtime_restart$/);
+  assert.doesNotMatch(done,/❌|🚫/);
+});
+
+
+test('absolute Windows root rendering shows the operator the real host path and root identity',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000,rootPaths:{local_c:'C:\\'}});
+  tracker.observe({event_type:'tool.request',tool:'machine_fs',request_id:'localc-123456789',
+    args:{op:'read',root_id:'local_c',path:'Users/DEADBYTE/.deadbyte-mcp/active-release.json'}},{sequence:100});
+  const line=tracker.observe({event_type:'tool.result',tool:'machine_fs',request_id:'localc-123456789',
+    outcome:{is_error:false,duration_ms:1}},{sequence:101});
+  assert.ok(line.includes('C:\\Users\\DEADBYTE\\.deadbyte-mcp\\active-release.json [root=local_c]'));
+  assert.match(line,/^📖 .*machine_fs\.read /);
+});
+
+
+test('trace mode exposes deterministic trace/span hierarchy without payload bytes',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000,trace:true});
+  const start=tracker.observe({event_type:'tool.request',tool:'coding_file_write',request_id:'span-1234567890abcdef',
+    context:{parent_span_id:'parent-abcdef123456',job_id:'job-112233445566'},args:{root_id:'core',path:'x.txt',content:'SECRET'}},{sequence:110});
+  assert.match(start,/trace=job-1122… span=span-123… parent=parent-a…/);
+  assert.doesNotMatch(start,/SECRET/);
+  const done=tracker.observe({event_type:'tool.result',tool:'coding_file_write',request_id:'span-1234567890abcdef',
+    outcome:{is_error:false,duration_ms:2}},{sequence:111});
+  assert.match(done,/trace=job-1122… span=span-123… parent=parent-a…/);
+});
+
+test('timeline filter keeps audit observation complete while selecting presentation by category status and trace',()=>{
+  const filter=live.createLiveTimelineFilter('category=write,status=error,trace=goal-1234');
+  const request={event_type:'tool.request',tool:'machine_fs',request_id:'filter-span-1',
+    args:{op:'write',root_id:'projects',path:'x.txt',goal_id:'goal-1234'}};
+  assert.equal(filter.accept(request),false,'status-constrained request start is deferred');
+  assert.equal(filter.accept({event_type:'tool.result',tool:'machine_fs',request_id:'filter-span-1',
+    outcome:{is_error:true,duration_ms:1}}),true);
+  const other={event_type:'tool.request',tool:'coding_file_read',request_id:'filter-span-2',
+    args:{root_id:'projects',path:'x.txt',goal_id:'goal-1234'}};
+  assert.equal(filter.accept(other),false);
+  assert.equal(filter.accept({event_type:'tool.result',tool:'coding_file_read',request_id:'filter-span-2',
+    outcome:{is_error:true,duration_ms:1}}),false);
+});
+
+test('TTY writer rewrites matching visible start in place and never rewrites unrelated output',()=>{
+  const writes=[];const stream={isTTY:true,write(value){writes.push(value);return true;}};
+  const writer=live.createLiveTimelineWriter({stream,displayMode:'unicode'});
+  writer.write('RUNNING',{event_type:'tool.call',request_id:'a'});
+  writer.write('DONE',{event_type:'tool.result',request_id:'a'});
+  assert.deepEqual(writes,['RUNNING','\r\x1b[2KDONE\n']);
+  writes.length=0;
+  writer.write('RUN-A',{event_type:'tool.call',request_id:'a'});
+  writer.write('OTHER',{event_type:'tool.result',request_id:'b'});
+  assert.deepEqual(writes,['RUN-A','\n','OTHER\n']);
+});
+
+test('expanded session summary reports outcome classes latency and slowest tool',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000});
+  const events=[
+    ['a','coding_file_read',10,false,false],
+    ['b','coding_file_write',50,false,false],
+    ['c','coding_command_run',100,true,false],
+    ['d','host_exec',200,true,true]
+  ];
+  for(const [id,tool,duration,isError,unknown] of events){
+    tracker.observe({event_type:'tool.request',tool,request_id:id,args:{root_id:'core',path:'x'}});
+    tracker.observe({event_type:'tool.result',tool,request_id:id,outcome:{is_error:isError,duration_ms:duration,
+      ...(unknown?{side_effect_state:'unknown'}:{})}});
+  }
+  const summary=tracker.summary();
+  assert.match(summary,/4 calls \| 2 ok \| 1 error \| 1 unknown \| 3 mutations/);
+  assert.match(summary,/p50 75ms \| p95 200ms/);
+  assert.match(summary,/slowest host_exec 200ms/);
+});

package/test/remote-session-cli.test.mjs

@@ -466,3 +466,43 @@ winTest('bare remote surfaces bounded controller-start-failure evidence instead
     assert.match(output.stderr,/controller-start-failure/i);
   }finally{await rm(fx.dir,{recursive:true,force:true});}
 });
+
+
+winTest('remote --trace --filter selects presentation without dropping journaled events',async()=>{
+  const fx=await fixture();
+  let child=null;
+  try{
+    child=spawn(process.execPath,[cliPath,'remote','--trace','--filter','category=write,status=error,trace=goal-1234'],{
+      env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true
+    });
+    const output=await collect(child);
+    await waitFor(fx.trace,commands=>commands.includes('hoststatus'));
+    const marker=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-session.json'),'utf8'));
+    const auditDir=path.join(fx.state,'audit');await mkdir(auditDir,{recursive:true});
+    const audit=[
+      {event_type:'tool.request',tool:'machine_fs',request_id:'filter-write-1234',created_at_utc:'2026-09-19T01:00:00.000Z',
+        args:{op:'write',root_id:'projects',path:'x.txt',goal_id:'goal-1234',content:'SECRET'}},
+      {event_type:'tool.result',tool:'machine_fs',request_id:'filter-write-1234',created_at_utc:'2026-09-19T01:00:00.010Z',
+        outcome:{is_error:true,duration_ms:10,reason:'denied'}},
+      {event_type:'tool.request',tool:'coding_file_read',request_id:'filter-read-12345',created_at_utc:'2026-09-19T01:00:00.020Z',
+        args:{root_id:'projects',path:'x.txt',goal_id:'goal-1234'}},
+      {event_type:'tool.result',tool:'coding_file_read',request_id:'filter-read-12345',created_at_utc:'2026-09-19T01:00:00.030Z',
+        outcome:{is_error:true,duration_ms:10,reason:'missing'}}
+    ];
+    await writeFile(path.join(auditDir,'segment-00000001.jsonl'),audit.map(JSON.stringify).join('\n')+'\n','utf8');
+    const deadline=Date.now()+4000;
+    while(Date.now()<deadline&&!/machine_fs\.write.*trace=goal-1234/.test(output.stdout)) await sleep(50);
+    assert.match(output.stdout,/machine_fs\.write.*trace=goal-123\.\.\. span=filter-w\.\.\..*10ms.*ERR - denied/);
+    assert.doesNotMatch(output.stdout,/coding_file_read.*missing/);
+    assert.doesNotMatch(output.stdout,/SECRET/);
+    const journal=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-results',marker.result_session_id+'.json'),'utf8'));
+    assert.equal(journal.events.length,4,'presentation filter must not remove journal evidence');
+    child.stdin.end();
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined);
+    assert.equal(ended.code,0,output.stderr);
+  }finally{
+    if(child?.exitCode===null) child.kill('SIGKILL');
+    await rm(fx.dir,{recursive:true,force:true});
+  }
+});

package/test/tool-audit.test.mjs

@@ -132,3 +132,20 @@ test('controller enables audit only for Bridge child and restores parent audit e
   assert.match(source,/if \(\$hadAuditRuntimeEnv\) \{ \$env:DEADBYTE_AUDIT_RUNTIME = \$previousAuditRuntimeEnv \}/);
   assert.match(source,/else \{ Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue \}/);
 });
+
+
+test('audit outcome reason preserves ordinary letters and Windows paths while folding actual whitespace',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);
+    const audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context()});
+    const server=fakeServer();installToolAudit(server,audit);
+    server.registerTool('broken_read',{},async()=>({
+      isError:true,
+      structuredContent:{status:'error',error:"Error:\tENOENT: no such file or directory,\nrealpath 'D:\\\\Projects\\\\runtime'"}
+    }));
+    await server.handlers.get('broken_read')({path:'x'});
+    const all=await events(root);
+    assert.equal(all.at(-1).outcome.reason,"Error: ENOENT: no such file or directory, realpath 'D:\\\\Projects\\\\runtime'");
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/windows-observation-r48.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createObservationRuntime, verifyObservationReceiptFile } from '../src/observation-runtime.mjs';
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-windows-query-r48-'));
+  const project=path.join(root,'project');await mkdir(project);
+  const policyPath=path.join(root,'coding-policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:path.join(root,'coding-grant.json'),evidence_dir:path.join(root,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{},
+    max_read_bytes:65536,max_write_bytes:65536}));
+  const policy=await loadCodingPolicy(policyPath);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+  const calls=[];
+  const windowsSnapshotProvider=async args=>{
+    calls.push(args);
+    return {schema:'deadbyte.windows-query.v1',query:args.query,data:{query:args.query,fixture:true},observer_sha256:'e'.repeat(64)};
+  };
+  const runtime=createObservationRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath,
+    stateRoot:root,processSnapshotProvider:async()=>[],systemSnapshotProvider:async()=>({hostname:'x',platform:'win32',architecture:'x64',
+      uptime_seconds:1,total_memory_bytes:1,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0]}),
+    ownedRuntimePidProvider:async()=>new Set(),hardwareSnapshotProvider:async query=>({schema:'deadbyte.hardware-query.v1',query,data:{fixture:true}}),
+    windowsSnapshotProvider});
+  return {root,policy,keys,runtime,calls};
+}
+
+test('R48 typed Windows queries are read-only signed native observations',async()=>{
+  const f=await fixture();
+  assert.equal(typeof f.runtime.windowsQuery,'function','windowsQuery runtime method missing');
+  const requests=[
+    {query:'registry',hive:'HKLM',key:'SYSTEM\\CurrentControlSet\\Control',value:null},
+    {query:'services'},{query:'drivers'},{query:'sockets'},{query:'volumes'},{query:'usb'},{query:'wsl'}
+  ];
+  for(const request of requests){
+    const out=await f.runtime.windowsQuery(request);
+    assert.equal(out.status,'ok');
+    assert.equal(out.query,request.query);
+    assert.equal(out.data.query,request.query);
+    assert.match(out.observer_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.request_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.result_head_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.receipt_id,/^[0-9a-f]{24}$/);
+    const verified=await verifyObservationReceiptFile({policy:f.policy,verifyKeyPath:f.keys.publicKeyPath,receiptId:out.receipt_id});
+    assert.equal(verified.ok,true);
+    assert.equal(verified.kind,'machine_windows_query');
+  }
+  assert.deepEqual(f.calls,requests);
+});
+
+test('R48 Windows query validation rejects arbitrary commands and malformed registry selectors before dispatch',async()=>{
+  const f=await fixture();
+  assert.equal(typeof f.runtime.windowsQuery,'function','windowsQuery runtime method missing');
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'powershell',command:'Get-Service'}),/windows query/i);
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'registry',hive:'HKCR',key:'x'}),/registry hive/i);
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'registry',hive:'HKLM',key:''}),/registry key/i);
+  assert.deepEqual(f.calls,[]);
+});

package/test/windows-observation-surface-r48.test.mjs

@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { machineObserveInputSchema, registerCompactGatewayTools } from '../src/compact-gateway-mcp-tools.mjs';
+import { registerObservationTools } from '../src/observation-mcp-tools.mjs';
+import { R36_CAPABILITY_LEDGER } from '../src/capability-ledger.mjs';
+
+const fakeServer=()=>{
+  const tools=new Map();
+  return {tools,registerTool(name,spec,handler){if(tools.has(name))throw new Error('duplicate '+name);tools.set(name,{spec,handler});}};
+};
+const ledger={schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)};
+const evidence=query=>({status:'ok',observed_at_utc:new Date(0).toISOString(),query,data:{query},observer_sha256:'e'.repeat(64),
+  request_sha256:'b'.repeat(64),result_head_sha256:'c'.repeat(64),receipt_id:'a'.repeat(24),receipt_sha256:'d'.repeat(64)});
+
+test('R48 compact machine_observe exposes seven strict Windows native operations without generic command dispatch',()=>{
+  const valid=[
+    {op:'registry_query',hive:'HKLM',key:'SYSTEM\\CurrentControlSet\\Control',value:null},
+    {op:'service_list'},{op:'driver_list'},{op:'socket_list'},{op:'volume_list'},{op:'usb_list'},{op:'wsl_list'}
+  ];
+  for(const input of valid) assert.equal(machineObserveInputSchema.safeParse(input).success,true,JSON.stringify(input));
+  assert.equal(machineObserveInputSchema.safeParse({op:'registry_query',hive:'HKCR',key:'x',value:null}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'service_list',command:'sc.exe query'}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'socket_list',powershell:'Get-NetTCPConnection'}).success,false);
+});
+
+test('R48 compact machine_observe routes all Windows operations to one typed runtime method',async()=>{
+  const calls=[];
+  const observationRuntime={windowsQuery:async args=>{calls.push(args);return evidence(args.query);}};
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{profile:'compact',ledger,codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,
+    observationRuntime,machineRuntime:null,desktopRuntime:null,skillRuntime:null,autonomousRuntime:null,hostPolicy:null,
+    catalogProvider:()=>[...server.tools.keys()]});
+  const tool=server.tools.get('machine_observe');
+  const inputs=[
+    {op:'registry_query',hive:'HKCU',key:'Software\\Microsoft',value:'Test'},
+    {op:'service_list'},{op:'driver_list'},{op:'socket_list'},{op:'volume_list'},{op:'usb_list'},{op:'wsl_list'}
+  ];
+  for(const input of inputs){
+    const out=await tool.handler(input);
+    assert.equal(out.isError,false);
+  }
+  assert.deepEqual(calls,[
+    {query:'registry',hive:'HKCU',key:'Software\\Microsoft',value:'Test'},
+    {query:'services'},{query:'drivers'},{query:'sockets'},{query:'volumes'},{query:'usb'},{query:'wsl'}
+  ]);
+});
+
+test('R48 full observation surface exposes one typed machine_windows_query tool',()=>{
+  const server=fakeServer();
+  registerObservationTools(server,{runtime:{windowsQuery:async args=>evidence(args.query),
+    searchStart:async()=>{},searchPage:async()=>{},searchStatus:async()=>{},searchCancel:async()=>{},processList:async()=>{},systemStatus:async()=>{},hardwareQuery:async()=>{}}});
+  assert.equal(server.tools.has('machine_windows_query'),true);
+  const schema=server.tools.get('machine_windows_query').spec.inputSchema;
+  assert.equal(schema.safeParse({query:'registry',hive:'HKLM',key:'SOFTWARE',value:null}).success,true);
+  assert.equal(schema.safeParse({query:'services'}).success,true);
+  assert.equal(schema.safeParse({query:'services',command:'sc query'}).success,false);
+});
+
+test('R48 capability ledger declares every Windows observation through compact machine_observe',()=>{
+  const expected=['registry_query','service_list','driver_list','socket_list','volume_list','usb_list','wsl_list'];
+  for(const op of expected){
+    const cap=R36_CAPABILITY_LEDGER.entries.find(x=>x.id===`observation.${op}`);
+    assert.ok(cap,`missing observation.${op}`);
+    assert.equal(cap.full_tool,'machine_windows_query');
+    assert.equal(cap.compact_tool,'machine_observe');
+    assert.equal(cap.compact_op,op);
+    assert.equal(cap.authority,'none');
+    assert.equal(cap.mutating,false);
+  }
+});