deadbyte-mcp 0.15.25 → 0.15.26

package/scripts/gate-windows-r49.ps1

@@ -0,0 +1,54 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.26 / R49 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.26 / R49 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Invoke-GateStep 'desktop-policy-refresh' @('run','desktop:policy:refresh')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r49-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r49.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R49 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.26 / R49 WINDOWS GATE: PASS ===='

package/scripts/windows-gate-evidence-r49.mjs

@@ -0,0 +1,27 @@
+import {createHash} from 'node:crypto';
+import {mkdir,open,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {doctor} from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const active=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+insist(pkg.version==='0.15.26'&&release.version===pkg.version&&release.train==='R49','R49 candidate identity mismatch');
+insist(active.release_id===release.parent.release_id&&active.manifest_sha256===release.parent.manifest_sha256&&active.generation_manifest_sha256===release.parent.generation_manifest_sha256,'active runtime is not the exact sealed R49 parent');
+const health=await doctor();
+insist(health.status==='ok'&&health.package_version===pkg.version&&health.manifest?.verified===true,'R49 doctor evidence invalid');
+insist(health.policy?.host_v2_ready===true,'R49 Host policy v2 is not ready');
+const evidence={schema:'deadbyte.r49-windows-gate.v1',status:'passed',exit_code:0,version:pkg.version,train:'R49',completed_at_utc:new Date().toISOString(),manifest_sha256:manifestSha256,parent:release.parent,active_predecessor:{release_id:active.release_id,version:active.version,manifest_sha256:active.manifest_sha256,generation_manifest_sha256:active.generation_manifest_sha256},doctor:{verified_entries:health.manifest.verified_entries,host_v2_ready:true},gates:{full_regression:true,commander_hardening:true,donor_proof:true,desktop_wait:true,exact_catalog:true,stdio_smokes:true,manifest_final_verify:true}};
+const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`);
+const dir=path.join(stateRoot,'evidence','release'); await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r49-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{const handle=await open(target,'wx',0o600);try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}}
+catch(error){if(error?.code!=='EEXIST')throw error;const prior=JSON.parse(await readFile(target,'utf8'));insist(prior.schema===evidence.schema&&prior.status==='passed'&&prior.version===evidence.version&&prior.manifest_sha256===manifestSha256&&prior.parent?.release_id===release.parent.release_id,'conflicting R49 gate evidence identity');}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));

package/src/autonomous-planner-contracts.mjs

@@ -132,6 +132,7 @@ const r36TypedActionSchemas=[
   z.strictObject({kind:z.literal('observation_system_status')}),
   z.strictObject({kind:z.literal('desktop_status')}),
   z.strictObject({kind:z.literal('desktop_observe')}),
+  z.strictObject({kind:z.literal('desktop_wait'),baseline_frame_id:z.string().regex(HEX64),until:z.enum(['frame_changed','topology_changed','foreground_changed','uia_present','uia_absent']),uia_query:plannerDesktopQuery.nullable().default(null),timeout_ms:z.number().int().min(100).max(30000).default(5000),poll_ms:z.number().int().min(50).max(1000).default(100)}),
   z.strictObject({kind:z.literal('desktop_target'),frame_id:z.string().regex(HEX64),uia_query:plannerDesktopQuery}),
   z.strictObject({
     kind:z.literal('desktop_action'),action_kind:plannerDesktopActionKind,expected_frame_id:z.string().regex(HEX64),

package/src/autonomous-planner.mjs

@@ -134,11 +134,17 @@ function validateR36TypedAction(action) {
   if (typeof action.destination_path === 'string') pathFields.push(action.destination_path);
   for (const item of action.files ?? []) if (typeof item?.path === 'string') pathFields.push(item.path);
   for (const candidate of pathFields) validatePortableRelativePath(candidate);
-  if(action.kind==='desktop_target'){
+  if(action.kind==='desktop_target'||action.kind==='desktop_wait'){
     const q=action.uia_query;
-    if(q.kind==='root'&&q.value!=='') throw new Error('desktop root query value must be empty');
-    if(q.kind!=='root'&&q.value.length<1) throw new Error('desktop UIA query value required');
-    if(q.ordinal>=q.max_results) throw new Error('desktop UIA ordinal must be below max_results');
+    const needsQuery=action.kind==='desktop_target'||action.until==='uia_present'||action.until==='uia_absent';
+    if(needsQuery&&!q)throw new Error('desktop UIA query required');
+    if(!needsQuery&&q)throw new Error('desktop non-UIA wait cannot carry query');
+    if(q){
+      if(q.kind==='root'&&q.value!=='') throw new Error('desktop root query value must be empty');
+      if(q.kind!=='root'&&q.value.length<1) throw new Error('desktop UIA query value required');
+      if(q.ordinal>=q.max_results) throw new Error('desktop UIA ordinal must be below max_results');
+    }
+    if(action.kind==='desktop_wait'&&action.poll_ms>action.timeout_ms)throw new Error('desktop wait poll exceeds timeout');
   }
   if(action.kind==='desktop_action'){
     const pointer=['pointer_move','click_primary','click_secondary','double_click_primary','scroll'].includes(action.action_kind);
@@ -372,7 +378,7 @@ export function buildPlannerPrompt({ goal, policy, view }) {
     'patch: operations are DEADBYTE Native Diff operations (write, replace, delete) and MUST use exact SHA-256 preconditions from supplied context.',
     'run_profile: profile_id must be one of the policy profile ids in state.',
     'delegate: operation is one bounded existing-runtime action. Allowed kinds: machine_stat, machine_list, machine_read, observation_search_start, observation_search_status, observation_search_page, observation_search_cancel, observation_process_list, observation_system_status, process_start, process_read, process_status, process_list, process_action, process_terminate.',
-    'When Desktop capabilities are present, use typed desktop_status, desktop_observe, desktop_target with one bounded UIA query, and desktop_action. desktop_action requires separate Desktop authority; Autonomous authority never implies Desktop authority. After stale or unknown Desktop evidence, observe again and replan; never blindly repeat an action.',
+    'When Desktop capabilities are present, use typed desktop_status, desktop_observe, bounded desktop_wait, desktop_target with one bounded UIA query, and desktop_action. desktop_wait is read-only and replaces fixed sleeps; it never retries an action. desktop_action requires separate Desktop authority; Autonomous authority never implies Desktop authority. After stale or unknown Desktop evidence, observe again and replan; never blindly repeat an action.',
     'Delegate paths are relative to the goal root. Process start accepts only profile_id and cwd; process_action accepts only session_id and fixed action_id. Never emit raw stdin, executable, PID, environment, shell command, or process arguments.',
     'finish only when the goal is actually satisfied. Required release profiles are enforced by the engine and cannot be bypassed.',
     'clarify only when one bounded operator choice is genuinely required. Ask one concrete question and provide 2-5 short mutually exclusive choices.',

package/src/autonomous-runtime.mjs

@@ -726,7 +726,7 @@ const CAPABILITY_BY_ACTION=Object.freeze({
   machine_stat:'machine_fs.stat',machine_list:'machine_fs.list',machine_read:'machine_fs.read',
   observation_search_start:'observation.search_start',observation_search_status:'observation.search_status',observation_search_page:'observation.search_page',observation_search_cancel:'observation.search_cancel',
   observation_process_list:'observation.process_list',observation_system_status:'observation.system_status',
-  desktop_status:'desktop.status',desktop_observe:'desktop.observe',desktop_target:'desktop.target',desktop_action:'desktop.action'
+  desktop_status:'desktop.status',desktop_observe:'desktop.observe',desktop_wait:'desktop.wait',desktop_target:'desktop.target',desktop_action:'desktop.action'
 });
 function capabilityIdForOperation(operation){return CAPABILITY_BY_ACTION[operation?.kind]??null;}
 function assertDelegatedIdentity(events, operation) {
@@ -745,6 +745,12 @@ function assertDelegatedIdentity(events, operation) {
       event.payload?.operation?.kind==='desktop_observe'&&event.payload?.result?.frame?.frame_id===operation.frame_id);
     if(!owned) throw new Error(`desktop frame '${operation.frame_id}' was not freshly observed by this goal`);
   }
+  if(operation.kind==='desktop_wait'){
+    const owned=events.some(event=>event.type==='delegated_action_completed'&&
+      ['desktop_observe','desktop_wait','desktop_target'].includes(event.payload?.operation?.kind)&&
+      event.payload?.result?.frame?.frame_id===operation.baseline_frame_id);
+    if(!owned)throw new Error(`desktop wait baseline '${operation.baseline_frame_id}' was not freshly observed by this goal`);
+  }
   if(operation.kind==='desktop_action'){
     const frameOwned=events.some(event=>event.type==='delegated_action_completed'&&
       ['desktop_observe','desktop_target'].includes(event.payload?.operation?.kind)&&
@@ -856,6 +862,9 @@ async function invokeDelegatedOperation(goal, operation, runtimes, desktopContex
     case 'desktop_observe':
       if(!desktopRuntime) throw new Error('desktop runtime unavailable');
       return desktopRuntime.observe({preview:false});
+    case 'desktop_wait':
+      if(!desktopRuntime) throw new Error('desktop runtime unavailable');
+      return desktopRuntime.wait({baselineFrameId:operation.baseline_frame_id,until:operation.until,query:operation.uia_query,timeoutMs:operation.timeout_ms,pollMs:operation.poll_ms,preview:false});
     case 'desktop_target':
       if(!desktopRuntime) throw new Error('desktop runtime unavailable');
       return desktopRuntime.ground({frameId:operation.frame_id,query:operation.uia_query});
@@ -903,6 +912,7 @@ async function verifyDelegatedEvidence(operation, result, runtimes, verifyKeyPat
     if(!runtimes.desktopRuntime?.verifyReceipt) throw new Error('desktop receipt verifier unavailable');
     const refs=[];
     if(operation.kind==='desktop_observe'&&result?.receipt_id) refs.push([result.receipt_id,result.receipt_sha256,'desktop_observation']);
+    if(operation.kind==='desktop_wait'&&result?.receipt_id) refs.push([result.receipt_id,result.receipt_sha256,'desktop_wait_observation']);
     if(operation.kind==='desktop_target'&&result?.grounding?.receipt_id) refs.push([result.grounding.receipt_id,result.grounding.receipt_sha256,'desktop_grounding']);
     if(operation.kind==='desktop_action'){
       refs.push(

package/src/capability-ledger.mjs

@@ -147,6 +147,7 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
 
   gateway('desktop.status','desktop_status','desktop_control','status','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.observe','desktop_observe','desktop_control','observe','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
+  gateway('desktop.wait','desktop_wait','desktop_control','wait','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.target','desktop_target','desktop_control','target','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.action','desktop_action','desktop_control','action','DEADBYTE_DESKTOP_RUNTIME','desktop',{mutating:true,receipt_class:'desktop'}),
 

package/src/desktop-mcp-tools-r40.mjs

@@ -33,6 +33,19 @@ const explicitTargetFields={
   confidence:z.number().min(0).max(1),semantic_label_sha256:hex64.nullable().default(null)
 };
 const uiaTargetFields={frame_id:hex64,uia_query:uiaQuery};
+const waitFields={
+  baseline_frame_id:hex64,
+  until:z.enum(['frame_changed','topology_changed','foreground_changed','uia_present','uia_absent']),
+  uia_query:uiaQuery.nullable().default(null),timeout_ms:z.number().int().min(100).max(30000).default(5000),
+  poll_ms:z.number().int().min(50).max(1000).default(100),preview:z.boolean().default(false)
+};
+function validateWait(value,ctx){
+  const needsQuery=value.until==='uia_present'||value.until==='uia_absent';
+  if(needsQuery&&value.uia_query===null)ctx.addIssue({code:'custom',path:['uia_query'],message:'UIA wait requires uia_query'});
+  if(!needsQuery&&value.uia_query!==null)ctx.addIssue({code:'custom',path:['uia_query'],message:'non-UIA wait cannot carry uia_query'});
+  if(value.poll_ms>value.timeout_ms)ctx.addIssue({code:'custom',path:['poll_ms'],message:'poll_ms cannot exceed timeout_ms'});
+}
+export const desktopWaitInputSchema=z.strictObject(waitFields).superRefine(validateWait);
 export const desktopTargetInputSchema=z.union([
   z.strictObject(explicitTargetFields),z.strictObject(uiaTargetFields)
 ]);
@@ -61,12 +74,13 @@ export const desktopActionInputSchema=z.strictObject(actionFields).superRefine(v
 
 const statusOp=z.strictObject({op:z.literal('status')});
 const observeOp=z.strictObject({op:z.literal('observe'),preview:z.boolean().default(false)});
+const waitOp=z.strictObject({op:z.literal('wait'),...waitFields}).superRefine(validateWait);
 const targetOp=z.union([
   z.strictObject({op:z.literal('target'),...explicitTargetFields}),
   z.strictObject({op:z.literal('target'),...uiaTargetFields})
 ]);
 const actionOp=z.strictObject({op:z.literal('action'),...actionFields}).superRefine(validateAction);
-export const desktopControlInputSchema=z.union([statusOp,observeOp,targetOp,actionOp]);
+export const desktopControlInputSchema=z.union([statusOp,observeOp,waitOp,targetOp,actionOp]);
 
 const sha256=value=>createHash('sha256').update(value).digest('hex');
 function publicResult(value){
@@ -89,6 +103,10 @@ export async function invokeDesktopOperation(args,runtime){
     let value;
     if(op==='status') value=await runtime.status();
     else if(op==='observe') value=await runtime.observe({preview:args.preview??false});
+    else if(op==='wait') value=await runtime.wait({
+      baselineFrameId:args.baseline_frame_id,until:args.until,query:args.uia_query,
+      timeoutMs:args.timeout_ms,pollMs:args.poll_ms,preview:args.preview
+    });
     else if(op==='target'&&args.uia_query) value=await runtime.ground({frameId:args.frame_id,query:args.uia_query});
     else if(op==='target') value=await runtime.target({
       frameId:args.frame_id,rect:args.rect,source:args.source,confidence:args.confidence,
@@ -115,6 +133,10 @@ export function registerDesktopTools(server,{runtime}={}){
     description:'Capture one bounded Windows desktop frame and signed observation evidence. Observation does not require Desktop mutation authority.',
     inputSchema:desktopObserveInputSchema,outputSchema:compactGatewayOutputSchema
   },args=>invokeDesktopOperation({op:'observe',...args},runtime));
+  server.registerTool('desktop_wait',{
+    description:'Wait for one bounded desktop or local UIA condition using fresh observations. This is read-only, returns signed final evidence, and never dispatches or retries an action.',
+    inputSchema:desktopWaitInputSchema,outputSchema:compactGatewayOutputSchema
+  },args=>invokeDesktopOperation({op:'wait',...args},runtime));
   server.registerTool('desktop_target',{
     description:'Bind one explicit rectangle or one local Windows UIA query to fresh desktop evidence. UIA query text is matched locally and is not returned.',
     inputSchema:desktopTargetInputSchema,outputSchema:compactGatewayOutputSchema

package/src/desktop-runtime-r40.mjs

@@ -71,13 +71,14 @@ export function verifyDesktopReceiptObject(receipt,{policySha256,publicKey,keyId
 
 export function createDesktopRuntime({
   policy,observerRuntime,inputProvider,grounderProvider=null,privateKey,publicKey=null,keyId,evidenceDir=policy?.evidence_dir,
-  now=()=>new Date().toISOString(),maxTargets=64
+  now=()=>new Date().toISOString(),clockMs=()=>Date.now(),sleeper=ms=>new Promise(resolve=>setTimeout(resolve,ms)),maxTargets=64
 }={}){
   insist(policy?.schema===DESKTOP_POLICY_SCHEMA,'desktop runtime policy invalid');
   insist(observerRuntime?.capture&&observerRuntime?.frameStatus,'desktop runtime observer invalid');
   insist(typeof inputProvider==='function','desktop runtime inputProvider required');
   insist(privateKey,'desktop runtime privateKey required');
   insist(typeof keyId==='string'&&keyId.length>=1,'desktop runtime keyId invalid');
+  insist(typeof clockMs==='function'&&typeof sleeper==='function','desktop wait clock invalid');
   insist(Number.isInteger(maxTargets)&&maxTargets>=1&&maxTargets<=1024,'maxTargets invalid');
   const receiptPublicKey=publicKey??createPublicKey(privateKey);
   const targets=new Map();
@@ -118,6 +119,49 @@ export function createDesktopRuntime({
     },observed.frame.observed_at_utc);
     return Object.freeze({...observed,...(previewValue?{preview:previewValue}:{}),receipt_id:evidence.receipt_id,receipt_sha256:evidence.receipt_sha256});
   }
+  async function wait({baselineFrameId,until,query=null,timeoutMs=5000,pollMs=100,preview=false}={}){
+    insist(HEX64.test(baselineFrameId??''),'desktop wait baseline frame invalid');
+    insist(['frame_changed','topology_changed','foreground_changed','uia_present','uia_absent'].includes(until),'desktop wait condition invalid');
+    insist(Number.isInteger(timeoutMs)&&timeoutMs>=100&&timeoutMs<=30000,'desktop wait timeout invalid');
+    insist(Number.isInteger(pollMs)&&pollMs>=50&&pollMs<=1000&&pollMs<=timeoutMs,'desktop wait poll invalid');
+    insist(typeof preview==='boolean','desktop wait preview invalid');
+    const needsQuery=until==='uia_present'||until==='uia_absent';
+    insist(needsQuery?query&&typeof grounderProvider==='function':query===null,'desktop wait query invalid');
+    const baseline=observerRuntime.frameStatus(baselineFrameId).frame;
+    const started=clockMs();
+    insist(Number.isFinite(started),'desktop wait clock result invalid');
+    let attempts=0,observed=null,match=null,satisfied=false;
+    while(true){
+      observed=await observerRuntime.capture();attempts++;
+      if(until==='frame_changed')satisfied=observed.frame.image_sha256!==baseline.image_sha256;
+      else if(until==='topology_changed')satisfied=observed.frame.topology_sha256!==baseline.topology_sha256;
+      else if(until==='foreground_changed')satisfied=!sameWindow(observed.frame.active_window,baseline.active_window);
+      else{
+        const grounded=await grounderProvider({frame:observed.frame,query});
+        insist(grounded&&grounded.status==='ok'&&HEX64.test(grounded.query_sha256??''),'desktop wait UIA result invalid');
+        const candidate=grounded.matches?.[grounded.ordinal??0]??null;
+        const actionable=Boolean(candidate?.enabled===true&&!candidate?.offscreen);
+        match=Object.freeze({query_sha256:grounded.query_sha256,query_kind:grounded.query_kind,
+          match_count:Array.isArray(grounded.matches)?grounded.matches.length:0,actionable,
+          visited:grounded.visited,truncated:grounded.truncated,provider_receipt_sha256:grounded.provider_receipt_sha256});
+        satisfied=until==='uia_present'?actionable:!actionable;
+      }
+      const elapsed=Math.max(0,clockMs()-started);
+      if(satisfied||elapsed>=timeoutMs)break;
+      await sleeper(Math.min(pollMs,timeoutMs-elapsed));
+    }
+    const elapsedMs=Math.max(0,clockMs()-started);
+    const previewValue=preview?observerRuntime.framePreview?.(observed.frame.frame_id,{maxBytes:policy.limits.max_preview_bytes}):null;
+    if(preview)insist(previewValue?.schema==='deadbyte.desktop-preview.v1','desktop preview unavailable');
+    const payload={condition:until,satisfied,attempts,elapsed_ms:elapsedMs,baseline_frame_id:baseline.frame_id,
+      frame_id:observed.frame.frame_id,desktop_epoch:observed.frame.desktop_epoch,topology_sha256:observed.frame.topology_sha256,
+      image_sha256:observed.frame.image_sha256,observed_at_utc:observed.frame.observed_at_utc,active_window:observed.frame.active_window,
+      match,preview:previewValue?{sha256:previewValue.sha256,byte_length:previewValue.byte_length,width:previewValue.width,height:previewValue.height,encoding:previewValue.encoding}:null};
+    const evidence=await receipt('desktop_wait_observation',payload,observed.frame.observed_at_utc);
+    return Object.freeze({status:'ok',condition:until,satisfied,timed_out:!satisfied,attempts,elapsed_ms:elapsedMs,
+      baseline_frame_id:baseline.frame_id,frame:observed.frame,match,...(previewValue?{preview:previewValue}:{}),
+      receipt_id:evidence.receipt_id,receipt_sha256:evidence.receipt_sha256});
+  }
   function targetFor(targetId){
     insist(HEX64.test(targetId??''),'targetId invalid');
     const found=targets.get(targetId);if(!found)throw new Error('desktop target expired or unknown');return found;
@@ -314,5 +358,5 @@ export function createDesktopRuntime({
       throw wrapped;
     }
   }
-  return Object.freeze({status,observe,target,ground,action,verifyReceipt});
+  return Object.freeze({status,observe,wait,target,ground,action,verifyReceipt});
 }

package/src/remote-mcp-smoke-client.mjs

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { verifyMachinePingPublic } from './machine-identity.mjs';
 
 const endpointText = process.argv[2];
 const mode = process.argv[3] ?? 'smoke';
@@ -151,6 +152,11 @@ try {
         ping.release_id !== machine.release_id || ping.release_manifest_sha256 !== machine.release_manifest_sha256) {
       throw new Error('compact machine ping binding mismatch');
     }
+    const pingSignatureValid = await verifyMachinePingPublic({
+      ping,
+      publicKeySpkiBase64: machine.public_key_spki_base64
+    });
+    if (!pingSignatureValid) throw new Error('machine ping public Ed25519 verification failed');
     compact = {
       profile: 'compact',
       ledger_sha256: manifest.ledger_sha256,
@@ -160,7 +166,7 @@ try {
       machine_id: machine.machine_id,
       release_id: machine.release_id,
       release_manifest_sha256: machine.release_manifest_sha256,
-      ping_signature_valid: ping.signature_valid === true
+      ping_signature_valid: true
     };
   } else {
     const opened = structured(await client.callTool({ name: 'workspace_open', arguments: { workspace_id: 'demo' } }), 'workspace_open');

package/src/runtime-catalog-expectation.mjs

@@ -1,15 +1,23 @@
 import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { R36_CAPABILITY_LEDGER } from './capability-ledger.mjs';
 
 const packageRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const catalogPath=path.join(packageRoot,'docs','R48-FULL-TOOL-CATALOG.json');
+const overlayPath=path.join(packageRoot,'docs','R49-FULL-TOOL-CATALOG.json');
 const AGENT_TOOLS=new Set(['agent_task_approve','agent_task_cancel','agent_task_events','agent_task_run','agent_task_status','agent_task_submit','agent_task_verify']);
 
 export async function expectedFullCatalogForEnv(env){
   const canonical=JSON.parse(await readFile(catalogPath,'utf8'));
   if(canonical.schema!=='deadbyte.r48-full-catalog.v1'||canonical.tool_count!==canonical.tools?.length) throw new Error('canonical R48 full catalog is invalid');
+  const overlay=JSON.parse(await readFile(overlayPath,'utf8'));
+  const baseSha=createHash('sha256').update(await readFile(catalogPath)).digest('hex');
+  if(overlay.schema!=='deadbyte.r49-full-catalog-overlay.v1'||overlay.base?.sha256!==baseSha||overlay.base?.tool_count!==canonical.tool_count||
+    overlay.tool_count!==canonical.tool_count+overlay.additions.length-overlay.removals.length) throw new Error('canonical R49 full catalog overlay is invalid');
+  const full=[...new Set([...canonical.tools.filter(name=>!overlay.removals.includes(name)),...overlay.additions])].sort((a,b)=>a.localeCompare(b,'en'));
+  if(full.length!==overlay.tool_count) throw new Error('canonical R49 full catalog count mismatch');
   const disabled=new Set();
   for(const capability of R36_CAPABILITY_LEDGER.entries){
     const flag=capability.runtime_flag;
@@ -21,7 +29,7 @@ export async function expectedFullCatalogForEnv(env){
   if(env.DEADBYTE_CODING_RUNTIME==='1') disabled.delete('coding_symbol_rename_preview');
   if(env.DEADBYTE_AGENT_RUNTIME!=='1') for(const name of AGENT_TOOLS) disabled.add(name);
   if(env.DEADBYTE_PROCESS_RUNTIME!=='1') disabled.add('process_session_cancel');
-  return canonical.tools.filter(name=>!disabled.has(name));
+  return full.filter(name=>!disabled.has(name));
 }
 
 export function assertExactCatalog(actual,expected,label='MCP'){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.25';
+export const DEADBYTE_VERSION = '0.15.26';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/autonomous-desktop-r40.test.mjs

@@ -11,7 +11,7 @@ const POLICY=H('desktop-policy');
 const WIN={hwnd:'0x1234',pid:77,process_image_sha256:H('desktop-app'),title_sha256:H('desktop-title')};
 
 function fakeDesktopRuntime({armed=false,unknown=false}={}){
-  const calls={status:0,observe:0,ground:0,action:0,verify:0};
+  const calls={status:0,observe:0,wait:0,ground:0,action:0,verify:0};
   const receipts=new Map();
   let seq=0;
   const issue=kind=>{
@@ -28,6 +28,9 @@ function fakeDesktopRuntime({armed=false,unknown=false}={}){
     async status(){calls.status++;return {status:'ok',configured:true,armed,reason:armed?'standing-grant':'disarmed',
       action_kinds:armed?['click_primary']:[],policy_sha256:POLICY,observer_backend:'fake'};},
     async observe(){calls.observe++;const r=issue('desktop_observation');return {status:'ok',frame:frame(FRAME),backend:'fake',byte_length:4,...r};},
+    async wait({baselineFrameId,until}){calls.wait++;assert.equal(baselineFrameId,FRAME);assert.equal(until,'frame_changed');
+      const r=issue('desktop_wait_observation');return {status:'ok',condition:until,satisfied:true,timed_out:false,attempts:2,elapsed_ms:100,
+        baseline_frame_id:FRAME,frame:frame(GROUNDED_FRAME),match:null,...r};},
     async ground({frameId,query}){calls.ground++;assert.equal(frameId,FRAME);assert.equal(query.kind,'root');
       const r=issue('desktop_grounding');return {status:'ok',frame:frame(GROUNDED_FRAME),
         target:{target_id:TARGET,frame_id:GROUNDED_FRAME,rect:{left:100,top:100,width:200,height:80},source:'uia'},
@@ -99,6 +102,29 @@ test('T7 read-only Desktop observe works while Desktop mutation authority is DIS
   }finally{await f.cleanup();}
 });
 
+test('successor autonomous Desktop wait replaces fixed sleep and verifies signed observation evidence',async()=>{
+  const d=fakeDesktopRuntime({armed:false});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'desktop-bounded-wait',rootId:'project',title:'desktop wait',goal:'wait for visual change',acceptance:'signed bounded wait'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe','wait']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('observe','wait-observe-proof'));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_wait',baseline_frame_id:FRAME,until:'frame_changed',uia_query:null,timeout_ms:1000,poll_ms:100
+    }});
+    assert.equal(result.loop.phase,'VERIFYING');
+    assert.equal(d.calls.wait,1);assert.equal(d.calls.action,0);assert.equal(d.calls.verify,2);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const completed=journal.events.find(e=>e.type==='delegated_action_completed'&&e.payload?.operation?.kind==='desktop_wait');
+    assert.equal(completed.payload.capability_id,'desktop.wait');
+    assert.equal(completed.payload.evidence.receipts[0].kind,'desktop_wait_observation');
+  }finally{await f.cleanup();}
+});
+
 test('T7 Autonomous authority cannot substitute for missing Desktop mutation grant',async()=>{
   const d=fakeDesktopRuntime({armed:false});
   const f=await createR34Fixture({desktopRuntime:d});

package/test/desktop-mcp-tools-r40.test.mjs

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
-  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,registerDesktopTools
+  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,desktopWaitInputSchema,registerDesktopTools
 } from '../src/desktop-mcp-tools-r40.mjs';
 
 const H=c=>c.repeat(64);
@@ -30,11 +30,26 @@ test('R40 T5 target schema supports local UIA query without arbitrary dispatch',
   assert.equal(desktopControlInputSchema.safeParse({op:'target',frame_id:frame,uia_query:{kind:'control_type',value:'button',max_results:4,ordinal:0}}).success,true);
 });
 
-test('R40 full desktop surface registers four narrow typed tools',()=>{
+test('successor desktop wait schema is bounded, semantic, and rejects action-shaped fields',()=>{
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',uia_query:{kind:'name_exact',value:'Ready',max_results:8,ordinal:0},timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({
+    op:'wait',baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false,point:{x:1,y:2}
+  }).success,false);
+});
+
+test('successor full desktop surface registers bounded semantic wait without mutation authority',()=>{
   const server=fakeServer();
-  const runtime={status(){},observe(){},target(){},action(){}};
+  const runtime={status(){},observe(){},wait(){},target(){},action(){}};
   registerDesktopTools(server,{runtime});
-  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target']);
+  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target','desktop_wait']);
 });
 
 test('R40 public desktop action output removes raw text while preserving content and action hashes',async()=>{

package/test/desktop-runtime-r40.test.mjs

@@ -19,7 +19,7 @@ function F(at,image=H('same'),window=WIN){
     bounds:{left:0,top:0,width:1000,height:800},activeWindow:window,imageSha256:image
   });
 }
-async function fixture({grantActions=['click_primary','text_input'],captureFrames=null,times=null,inputProvider=null,grounderProvider=null}={}){
+async function fixture({grantActions=['click_primary','text_input'],captureFrames=null,times=null,inputProvider=null,grounderProvider=null,clockMs=null,sleeper=null}={}){
   const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-runtime-'));
   const grant=path.join(root,'grant.json'),evidence=path.join(root,'evidence');
   const policy={
@@ -59,7 +59,7 @@ async function fixture({grantActions=['click_primary','text_input'],captureFrame
     '2026-09-19T02:00:01.000Z'
   ])];
   const now=()=>clock.length?clock.shift():'2026-09-19T02:00:01.000Z';
-  const runtime=createDesktopRuntime({policy,observerRuntime,inputProvider:provider,grounderProvider,privateKey,keyId:'test-key',evidenceDir:evidence,now});
+  const runtime=createDesktopRuntime({policy,observerRuntime,inputProvider:provider,grounderProvider,privateKey,keyId:'test-key',evidenceDir:evidence,now,clockMs:clockMs??undefined,sleeper:sleeper??undefined});
   return {root,grant,evidence,policy,expected,runtime,calls,publicKey};
 }
 
@@ -242,6 +242,47 @@ test('read-only observe works independently of desktop mutation grant',async()=>
   assert.match(observed.receipt_sha256,/^[0-9a-f]{64}$/);
 });
 
+test('successor desktop wait observes until a frame changes and publishes signed final evidence',async()=>{
+  let tick=0;
+  const same={frame:F('2026-09-19T02:00:00.600Z'),backend:'fake',byte_length:4};
+  const changed={frame:F('2026-09-19T02:00:00.900Z',H('changed')),backend:'fake',byte_length:4};
+  const fx=await fixture({
+    captureFrames:[same,changed],clockMs:()=>tick,sleeper:async ms=>{tick+=ms;},
+    times:['2026-09-19T02:00:01.000Z']
+  });
+  await writeFile(fx.grant,'{}');
+  const result=await fx.runtime.wait({baselineFrameId:fx.expected.frame_id,until:'frame_changed',timeoutMs:1000,pollMs:100});
+  assert.equal(result.satisfied,true);
+  assert.equal(result.timed_out,false);
+  assert.equal(result.attempts,2);
+  assert.equal(result.frame.frame_id,changed.frame.frame_id);
+  assert.match(result.receipt_sha256,/^[0-9a-f]{64}$/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${result.receipt_id}.json`),'utf8'));
+  assert.equal(receipt.kind,'desktop_wait_observation');
+  assert.equal(receipt.payload.condition,'frame_changed');
+  assert.equal(receipt.payload.satisfied,true);
+  assert.equal(fx.calls.length,0);
+});
+
+test('successor desktop wait uses local UIA matching without leaking query text or dispatching input',async()=>{
+  let tick=0,queries=0;
+  const first={frame:F('2026-09-19T02:00:00.600Z'),backend:'fake',byte_length:4};
+  const second={frame:F('2026-09-19T02:00:00.900Z'),backend:'fake',byte_length:4};
+  const grounderProvider=async({query})=>{
+    queries++;
+    return {status:'ok',query_sha256:H('wait-query'),query_kind:query.kind,ordinal:0,visited:4,truncated:false,
+      matches:queries===1?[]:[{rect:{left:1,top:2,width:3,height:4},control_type:50000,enabled:true,offscreen:false}],
+      provider_receipt_sha256:H('wait-provider')};
+  };
+  const fx=await fixture({captureFrames:[first,second],grounderProvider,clockMs:()=>tick,sleeper:async ms=>{tick+=ms;},times:['2026-09-19T02:00:01.000Z']});
+  const result=await fx.runtime.wait({baselineFrameId:fx.expected.frame_id,until:'uia_present',query:{kind:'name_exact',value:'SECRET READY',max_results:8,ordinal:0},timeoutMs:1000,pollMs:100});
+  assert.equal(result.satisfied,true);
+  assert.equal(result.match.actionable,true);
+  assert.equal(result.match.query_sha256,H('wait-query'));
+  assert.equal(JSON.stringify(result).includes('SECRET READY'),false);
+  assert.equal(fx.calls.length,0);
+});
+
 
 test('desktop runtime enforces policy max_text_bytes before observation or input effect',async()=>{
   const fx=await fixture({grantActions:['text_input']});

package/test/full-max-catalog-r48.test.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
 import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+import { expectedFullCatalogForEnv } from '../src/runtime-catalog-expectation.mjs';
 
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
@@ -15,7 +16,7 @@ const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy
 const catalogPath=path.join(repoRoot,'docs','R48-FULL-TOOL-CATALOG.json');
 const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
 
-test('R48 runtime full stdio catalog exactly matches canonical registration surface',async()=>{
+test('R49 runtime full stdio catalog exactly matches sealed R48 base plus reviewed overlay',async()=>{
   const canonical=JSON.parse(await readFile(catalogPath,'utf8'));
   assert.equal(canonical.schema,'deadbyte.r48-full-catalog.v1');
   assert.equal(canonical.train,'R48');
@@ -61,15 +62,16 @@ test('R48 runtime full stdio catalog exactly matches canonical registration surf
     DEADBYTE_AUTONOMOUS_RUNTIME:'1',DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
     DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
   };
+  const expected=await expectedFullCatalogForEnv(env);
   const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
   try{
     await client.connect(transport);
     const listed=await client.listTools();
     const names=listed.tools.map(t=>t.name).sort();
-    assert.deepEqual(names,canonical.tools);
+    assert.deepEqual(names,expected);
     assert.equal(new Set(names).size,names.length,'runtime duplicate tool names');
     for(const tool of listed.tools) if(tool.outputSchema!==undefined) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
-    for(const name of ['agent_task_submit','autonomous_goal_submit','coding_task_submit','process_session_start','machine_fs_write','machine_search_start','desktop_action','host_exec','native_diff_apply','skill_catalog']) assert.ok(names.includes(name),'missing R48 surface '+name);
+    for(const name of ['agent_task_submit','autonomous_goal_submit','coding_task_submit','process_session_start','machine_fs_write','machine_search_start','desktop_wait','desktop_action','host_exec','native_diff_apply','skill_catalog']) assert.ok(names.includes(name),'missing R49 surface '+name);
   } finally {
     await client.close().catch(()=>{});
     for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);