deadbyte-mcp 0.15.26 → 0.15.27

package/DEADBYTE-MCP.cmd

@@ -0,0 +1,4 @@
+@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+call "%~dp0controller\DEADBYTE-MCP.cmd" %*
+exit /b %ERRORLEVEL%

package/MANIFEST.SHA256

@@ -56,6 +56,7 @@ d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/dea
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
 9aaf6d07e7511a1f0046ee8cc731d4b9660bbbf47dcea785a9c6b6cec95640bc  DEADBYTE-MCP-R27-FINAL/R27-SLOT-UPDATE-RECEIPT.json
+79d7cf101e6890acd4d36ec8e3773ec8434b67bfe01b8aab7e00b5c80e9a7f87  DEADBYTE-MCP.cmd
 7994082e4340b5f43272e8cb111ce54043af64dc3a04d5279e251f3dae16f654  docs/ADR-0001-PRODUCTION-BASELINE-SEAMS.md
 c945b519454c6cb4c89a2b432a3f7ad29a5e7d4bc1db638972104f0093639b18  docs/ARCHITECTURE.md
 3f455f407933d8e044682f3415bdb51e68d7c4b508411dda7d8ed65b6e1d7e79  docs/AUTHORITY.md
@@ -1338,7 +1339,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-d16f408d918a1c91063956e27c35b0b326fa38fa03a95fecfe9b8fbf3c04ad15  package.json
+1b90040b11d1b042656ff077ec2c037bfe0044f252c594cd9cbfb7d7c66d382f  package.json
 872947dffd89755b03558b217129f009dc9f4fd1ce55e93c602fc6ea97ba8b48  proof/commander-closure-20260927/CONTINUATION.json
 2959980d295814aaa0df71fdb358d2cbfd01c1357ee36ef6b10c149875bdb262  proof/commander-closure-20260927/RESULT.json
 2c2866309ca3a6fc8de5b03d445f1dcf0778474fa25cefb822b2ab729bc91c62  proof/commander-closure-20260927/SEARCH-CONTINUATION.json
@@ -1403,7 +1404,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-5ddf32cbdbd75da1d79b221673cfd9aaaac02b3b9b643d49bf85504e46cce127  PROVENANCE.json
+1002cd1721f3af6c5adef6c64c0e336454f58fa7ea68b6e619e0740e987dd4b7  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1412,9 +1413,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-69e9cccfdc0b5c24bca6a1390bc09abf663868772d954330591b73f37e53e143  README.txt
-a2663c5c15243f5b95daa78e9bbfca47b2d2650b8e57e53ca3e46372a2060cad  RELEASE.json
-80fc11669ca4aa10d51f9cf1afacf03aa558cd30fab4275d77d8a3285d7dfce5  SBOM.cdx.json
+335019064f8365f86411f2d4657e96c3f05b18a68d8d966fa928bdadd914be2c  README.txt
+6651133e13cfee8e24d1faca0fe7302288afb5bd98c0b76126c32af2e2713076  RELEASE.json
+4229644f54f475d7486132df06042145a505569370396c6c822da5660e00a021  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1506,6 +1507,7 @@ a0ad824eed1d8be051d5f731579f9bf4115b311f202b75ea0d03aa257b13a671  scripts/gate-w
 00a3fc5aa75763c40ff0e09173091168903eb7fcae0ce164e51876569a4e2ff1  scripts/gate-windows-r46.ps1
 e2d555bfcdc1464834cd6541753a7edc9845fc4a72761c2ec9f2d75991616b2d  scripts/gate-windows-r48.ps1
 a76505b4a2e7702e7d61a3ae799e5fa297ced7006dc1a1df8b65d5ed1cd7604b  scripts/gate-windows-r49.ps1
+a62d69eea0c9db8778cd1551185ff6721ee6390d91afcb6863aecb75f9f422d1  scripts/gate-windows-r50.ps1
 9a085b34b9e54023eb0efadcea1e74a1bef44b984105d064768d66910999173e  scripts/gate-windows.ps1
 9e625bdc701298c05eb2a63c208d023a487a1baf306c05940eb29c19fb1d6544  scripts/init-desktop-policy-r40.ps1
 01451045bff624a157e7eea79afd7edfa8cb8212ea0256c8ec744fe1e1b269ff  scripts/init-host-policy.ps1
@@ -1593,6 +1595,7 @@ d05fd67d62005aebf3cd2daf1e67f0550d124a2068baf9aa0550afb7de26f440  scripts/window
 536f36b6d4cd86b9f874f6b8c0599d752d9efa69a2691f8971ee4b0d317c9739  scripts/windows-gate-evidence-r46.mjs
 f344639080f68b7da5cda765b518e0fb91bc8818229b6f460e82b173018ad30c  scripts/windows-gate-evidence-r48.mjs
 6fc6c98fe0ccb06891227703196743cd22135934603e600f9c6a0cb86400934b  scripts/windows-gate-evidence-r49.mjs
+31ddb34208af0ab0d65fbb4a59db43a2428a06720aeb38b040ac211c9e838ed4  scripts/windows-gate-evidence-r50.mjs
 2255b8eb78ca61267df54448560a671357f04893b6bb1df27b8b9fc8a944d255  scripts/windows-gate-evidence.mjs
 105a5c6dcd54e4fabb416df9eaac093654f3ea39c4233a56e0bc6d53371b2128  scripts/workload-contract-regression-r47.mjs
 c32cb9054a1b9641ae071c00622c0054272bdb0b519ea22c4ff926a1600a2b46  scripts/workload-stream-regression.mjs
@@ -1775,11 +1778,11 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-f2c7fed24616ee3986a400a9d6695eca62c5fad409cb263293c0c7ebc9cdd9dd  src/version.mjs
+cfbd76b3c1ff33e8686aa0f27beeca8ef84b3752084508eda2ffe81f62f383e7  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
-3562b159a7bad028d69252a72ee1e8ba33c8158b38e4330821486ae65367e88e  TEST-MATRIX.json
+588aef615e8e663c9550d1ed36d579bf96c887d2771f96b17bbbcc4e0666a339  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -1983,7 +1986,7 @@ a113ee9c06d38c5f674c369a950704ad00a84a45ee56b873143db3ac2154dd0f  test/observati
 ea60bf617122536ed10f546dc660491522e79c70a05d827efe5b50f09de5711f  test/operation-history.test.mjs
 874924c2d2e4073b1032e3e4a81af809efd2919044e19c0f862535a2d7442392  test/operation-lifecycle.test.mjs
 77ec02d6826e1006aa6dc2f09d46783c22f10ba0a8ee0cfe0238c2b66887ee0e  test/output-schema.test.mjs
-b25e37f3224fc63b020a84468b8955a5de68c7f2751c88de23832c23e343fea3  test/package-boundary.test.mjs
+3c73352548e7fe83d6c39ccd057fc36aae217f9e0a7808883326528466d7772d  test/package-boundary.test.mjs
 8f28e3990b79cc58bf52a646a88f374270396c9bc8738f5eceb156f721ae8a81  test/process-longrun-r36.test.mjs
 ddac61c12ab29be1736885c01c999ca0346ba44c712cc2c8a48a7eea1ed62a53  test/process-mcp-tools.test.mjs
 b84622d07d2ecfe27b55e45f7e89949f29a2d14184d8c6f6f82ed7f1e5fa59be  test/process-native.test.mjs
@@ -2021,9 +2024,9 @@ d8f544bbcdfff61f7abb7705ad7e5e1f17998f5fde3c114fb33915fc66d1408f  test/r41-final
 2c5f2093b945c267c8d09cd2da0875c7f45911a7c01aa02a50cd64c2c1a7ccdc  test/r45-autonomous-quick-test.test.mjs
 532075c86893caf68a2d0ea09171bee4c7d60892c1892011285376a2c186ed92  test/r45-finalization.test.mjs
 25a21ccffcf566b020b8f3c6c0a5a3b7ff06b243fff84e405207e458640ba487  test/r47-release-contract.test.mjs
-85e15fdc44b80149fe1947b66f4475150b24f1c5bfdb805e1f6341529197b831  test/r48-release-contract.test.mjs
+0f5c469d07748cb0b828b2fa4e80380ff780f95617ff18c9fd1bb8de5d747fbd  test/r48-release-contract.test.mjs
 ec6fc253774c318b048dc943c83b496f942d8dd034f6db9439a99a46ae3a6158  test/r49-remote-control-donors.test.mjs
-2a91b31ca8dae3041b112fb260924d528193914b457de186c3803df219d5b8ec  test/r49-windows-gate.test.mjs
+cbff58e466ea8d41c339202532eec341ece481eece2be97cc65f091a7f3c2ca8  test/r49-windows-gate.test.mjs
 e45a6cd299d8d65bdeb9bc0117ce1eb2b47fdebad89a02413ee979c9d0ae3a5c  test/release-activation-gate.test.mjs
 85f6dc2059fd19d03452309ffe67bed5b87da8e6f0ce3a85cab58cba8b197ceb  test/release-generation.test.mjs
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs

package/PROVENANCE.json

@@ -1,18 +1,18 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.26",
-  "builder": "deadbyte-r49-bounded-semantic-desktop-wait",
-  "source_model": "immutable published 0.15.25 parent -> six byte-pinned remote-control donor audits -> native bounded semantic Desktop wait -> RED/GREEN focused proof -> full R49 regression -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed machine truth",
+  "version": "0.15.27",
+  "builder": "deadbyte-r50-public-package-boundary-hotfix",
+  "source_model": "immutable published 0.15.26 parent -> registry-artifact RED proof -> canonical Windows launcher pack-boundary fix -> focused GREEN -> full R50 regression -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed machine truth",
   "signing": "ed25519",
-  "parent_release_id": "v0.15.25-7ed657b1aa038ee6",
-  "parent_manifest_sha256": "7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319",
-  "parent_generation_manifest_sha256": "c9763738e27ec39b1180473995f2af088d85293a94f5693abd6a843e09cecec9",
-  "source_predecessor_version": "0.15.25",
-  "source_predecessor_tarball_sha256": "0410b41b3c891210262a4db793ee3b339862472ef069f881c9e092c1083ba6d2",
-  "source_predecessor_manifest_file_sha256": "7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319",
+  "parent_release_id": "v0.15.26-669ea65d2307ee2c",
+  "parent_manifest_sha256": "669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8",
+  "parent_generation_manifest_sha256": "08364adaf1dab9730c314e29121632c6371ed76fc677e83cb7f6aa6b244eab94",
+  "source_predecessor_version": "0.15.26",
+  "source_predecessor_tarball_sha256": "3272679e3a18610d47e83dc8d3161e949d75a57da145a43c2ab50c865a83bb86",
+  "source_predecessor_manifest_file_sha256": "669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8",
   "commander_reference_version": "0.2.51",
   "commander_reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
   "commander_reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140",
   "predecessor_r48_full_regression_task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
-  "reproducibility": "candidate source bound to exact immutable published 0.15.25 predecessor and six donor commits; fresh R49 full-regression, manifest, package, activation, rollback and restore proof remain mandatory before release"
+  "reproducibility": "candidate source bound to exact immutable published 0.15.26 predecessor and registry round-trip bytes; fresh R50 full-regression, manifest, package, activation, rollback and restore proof remain mandatory before release"
 }

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.26 / R49 BOUNDED SEMANTIC DESKTOP WAIT CANDIDATE
+DEADBYTE MCP V0.15.27 / R50 PUBLIC PACKAGE BOUNDARY HOTFIX CANDIDATE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.26 mcp
-  npx -y deadbyte-mcp@0.15.26 remote
-  npx -y deadbyte-mcp@0.15.26 remote status
-  npx -y deadbyte-mcp@0.15.26 remote restart
-  npx -y deadbyte-mcp@0.15.26 audit status
-  npx -y deadbyte-mcp@0.15.26 audit verify
+  npx -y deadbyte-mcp@0.15.27 mcp
+  npx -y deadbyte-mcp@0.15.27 remote
+  npx -y deadbyte-mcp@0.15.27 remote status
+  npx -y deadbyte-mcp@0.15.27 remote restart
+  npx -y deadbyte-mcp@0.15.27 audit status
+  npx -y deadbyte-mcp@0.15.27 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -29,6 +29,14 @@ and a random 256-bit session nonce, prevents concurrent foreground sessions, and
 recover only a dead, unguarded stale owner. Explicit subcommands such as `remote status` remain
 one-shot controller operations.
 
+R50 PUBLIC PACKAGE BOUNDARY HOTFIX
+----------------------------------
+0.15.26 is immutable and remains valid as a published historical release, but its npm tarball omitted the
+canonical top-level DEADBYTE-MCP.cmd compatibility launcher because the package-ignore boundary matched all
+top-level DEADBYTE-MCP*.cmd wrappers. R50 narrows that boundary: DEADBYTE-MCP.cmd is shipped, while local and
+shadow wrappers remain excluded. A pack-boundary regression now verifies this exact file surface before publish.
+No R49 runtime semantics are widened by this hotfix.
+
 R49 BOUNDED SEMANTIC DESKTOP WAIT
 ----------------------------------
 `desktop_wait` replaces blind fixed sleeps with a bounded, read-only observation loop. It can wait for

package/RELEASE.json

@@ -1,19 +1,19 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.26",
-  "train": "R49",
-  "label": "BOUNDED SEMANTIC DESKTOP WAIT + REMOTE CONTROL HARDENING",
+  "version": "0.15.27",
+  "train": "R50",
+  "label": "PUBLIC PACKAGE BOUNDARY HOTFIX",
   "protocol_revision": "2026-07-28",
   "parent": {
-    "release_id": "v0.15.25-7ed657b1aa038ee6",
-    "manifest_sha256": "7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319",
-    "generation_manifest_sha256": "c9763738e27ec39b1180473995f2af088d85293a94f5693abd6a843e09cecec9"
+    "release_id": "v0.15.26-669ea65d2307ee2c",
+    "manifest_sha256": "669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8",
+    "generation_manifest_sha256": "08364adaf1dab9730c314e29121632c6371ed76fc677e83cb7f6aa6b244eab94"
   },
   "source_predecessor": {
-    "version": "0.15.25",
-    "tarball_sha256": "0410b41b3c891210262a4db793ee3b339862472ef069f881c9e092c1083ba6d2",
-    "manifest_file_sha256": "7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319",
+    "version": "0.15.26",
+    "tarball_sha256": "3272679e3a18610d47e83dc8d3161e949d75a57da145a43c2ab50c865a83bb86",
+    "manifest_file_sha256": "669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8",
     "reference_package": "@wonderwhy-er/desktop-commander@0.2.51",
     "reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
     "reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r49:0.15.26",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r50:0.15.27",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.26"
+      "version": "0.15.27"
     }
   },
   "components": [
@@ -34,7 +34,7 @@
     {
       "type": "file",
       "name": "deadbyte-hardware-observer-r45.exe",
-      "version": "0.15.26",
+      "version": "0.15.27",
       "hashes": [
         {
           "alg": "SHA-256",

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.26",
-  "train": "R49",
+  "version": "0.15.27",
+  "train": "R50",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,8 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {"id":"package-boundary","command":"node --test test/package-boundary.test.mjs","expected":"PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"},
+    {"id":"release-smoke","command":"node --test test/release-smoke-isolation.test.mjs","expected":"PASS"},
     {"id":"capability-authority-truth","command":"node --test test/capability-resolver.test.mjs","expected":"PASS authority-state manifest truth"},
     {"id":"compact-authority-truth","command":"node --test test/compact-max-catalog-r45.test.mjs","expected":"PASS real compact stdio authority-state manifest truth"},
     {"id":"native-windows-observation","command":"powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1","expected":"PASS native Windows observation build/query gate"},
@@ -20,13 +22,11 @@
     {"id":"commander-protocol-adversarial","command":"node --test test/commander-protocol-adversarial-r48.test.mjs","expected":"PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"},
     {"id":"r48-release","command":"npm run r48:release:test","expected":"PASS"},
     {"id":"full-regression","command":"npm run r48:full:test","expected":"PASS"},
-    {"id":"package-boundary","command":"node --test test/package-boundary.test.mjs","expected":"PASS"},
-    {"id":"release-smoke","command":"node --test test/release-smoke-isolation.test.mjs","expected":"PASS"},
     {"id":"runtime-update","command":"node --test test/runtime-self-update.test.mjs","expected":"PASS"},
     {"id":"audit","command":"npm audit --omit=dev","expected":"0 vulnerabilities"},
-    {"id":"activation","command":"npx -y deadbyte-mcp@0.15.26 remote status","expected":"active runtime 0.15.26 with no VERSION SKEW"},
-    {"id":"machine-truth","command":"signed machine_ping","expected":"release_id and manifests bind activated 0.15.26 generation"},
-    {"id":"rollback-restore","command":"immutable slot rollback/restore","expected":"0.15.26 -> exact 0.15.25 -> exact 0.15.26"}
+    {"id":"activation","command":"npx -y deadbyte-mcp@0.15.27 remote status","expected":"active runtime 0.15.27 with no VERSION SKEW"},
+    {"id":"machine-truth","command":"signed machine_ping","expected":"release_id and manifests bind activated 0.15.27 generation"},
+    {"id":"rollback-restore","command":"immutable slot rollback/restore","expected":"0.15.27 -> exact 0.15.26 -> exact 0.15.27"}
   ],
   "focused_proof": {
     "raw_mcp_protocol": {"tests":3,"pass":3,"fail":0},
@@ -41,7 +41,7 @@
     "coding_task_id": "a1a10fff1520b37ac674f1861cd9e53e64e350d5a0766639036aefe5e096e235",
     "task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
     "action_receipt_sha256": "095c5eb4d959b9105a769649aa196a1d33f5097b899031dd16997e5ba1b352e6",
-    "not_valid_as_r49_proof": true
+    "not_valid_as_r50_proof": true
   },
   "performance": {
     "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "deadbyte-mcp",
-    "version": "0.15.26",
+    "version": "0.15.27",
     "private": false,
     "type": "module",
     "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
         "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
         "contained:smoke": "node src/contained-smoke.mjs",
         "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r49.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r50.ps1",
         "authority:smoke": "node src/authority-smoke.mjs",
         "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
         "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",

package/scripts/gate-windows-r50.ps1

@@ -0,0 +1,56 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.27 / R50 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.27 / R50 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r50-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-NodeTest 'r50-release-smoke-isolation' @('test/release-smoke-isolation.test.mjs')
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Invoke-GateStep 'desktop-policy-refresh' @('run','desktop:policy:refresh')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r50-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r50.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R50 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.27 / R50 WINDOWS GATE: PASS ===='

package/scripts/windows-gate-evidence-r50.mjs

@@ -0,0 +1,80 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const stateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(), '.deadbyte-mcp'));
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const insist = (ok, message) => { if (!ok) throw new Error(message); };
+const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+const release = JSON.parse(await readFile(path.join(root, 'RELEASE.json'), 'utf8'));
+const active = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
+const manifestSha256 = sha256(await readFile(path.join(root, 'MANIFEST.SHA256')));
+
+insist(pkg.version === '0.15.27' && release.version === pkg.version && release.train === 'R50', 'R50 candidate identity mismatch');
+insist(
+  active.release_id === release.parent.release_id &&
+  active.manifest_sha256 === release.parent.manifest_sha256 &&
+  active.generation_manifest_sha256 === release.parent.generation_manifest_sha256,
+  'active runtime is not the exact sealed R50 parent'
+);
+
+const health = await doctor();
+insist(health.status === 'ok' && health.package_version === pkg.version && health.manifest?.verified === true, 'R50 doctor evidence invalid');
+insist(health.policy?.host_v2_ready === true, 'R50 Host policy v2 is not ready');
+
+const evidence = {
+  schema: 'deadbyte.r50-windows-gate.v1',
+  status: 'passed',
+  exit_code: 0,
+  version: pkg.version,
+  train: 'R50',
+  completed_at_utc: new Date().toISOString(),
+  manifest_sha256: manifestSha256,
+  parent: release.parent,
+  active_predecessor: {
+    release_id: active.release_id,
+    version: active.version,
+    manifest_sha256: active.manifest_sha256,
+    generation_manifest_sha256: active.generation_manifest_sha256
+  },
+  doctor: { verified_entries: health.manifest.verified_entries, host_v2_ready: true },
+  gates: {
+    package_boundary: true,
+    release_smoke_isolation: true,
+    full_regression: true,
+    commander_hardening: true,
+    donor_proof: true,
+    desktop_wait: true,
+    exact_catalog: true,
+    stdio_smokes: true,
+    manifest_final_verify: true
+  }
+};
+
+const bytes = Buffer.from(`${JSON.stringify(evidence, null, 2)}\n`);
+const dir = path.join(stateRoot, 'evidence', 'release');
+await mkdir(dir, { recursive: true });
+const target = path.join(dir, `r50-windows-gate-${manifestSha256.slice(0, 16)}.json`);
+
+try {
+  const handle = await open(target, 'wx', 0o600);
+  try { await handle.writeFile(bytes); await handle.sync(); }
+  finally { await handle.close(); }
+} catch (error) {
+  if (error?.code !== 'EEXIST') throw error;
+  const prior = JSON.parse(await readFile(target, 'utf8'));
+  insist(
+    prior.schema === evidence.schema &&
+    prior.status === 'passed' &&
+    prior.version === evidence.version &&
+    prior.manifest_sha256 === manifestSha256 &&
+    prior.parent?.release_id === release.parent.release_id,
+    'conflicting R50 gate evidence identity'
+  );
+}
+
+console.log(JSON.stringify({ status: 'passed', path: target, sha256: sha256(bytes), manifest_sha256: manifestSha256 }));

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.26';
+export const DEADBYTE_VERSION = '0.15.27';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/package-boundary.test.mjs

@@ -42,3 +42,9 @@ test('publish boundary excludes live state, private keys, grants and non-example
   const forbidden=files.filter(rel=>rel.startsWith('tmp/')||rel.startsWith('.deadbyte-machine-fs-recovery/')||/(^|\/)(active-release\.json|runtime\/|audit\/|evidence\/)|\.pem$|(^|\/)deadbyte-controller\.config\.psd1$|(^|\/)deadbyte-host-policy\.json$|(^|\/)[^/]*(?:grant|arm)\.json$/i.test(rel));
   assert.deepEqual(forbidden,[]);
 });
+
+test('publish boundary includes only the canonical top-level Windows launcher',()=>{
+  const files=packFiles();
+  const launchers=files.filter(rel=>/^DEADBYTE-MCP.*\.cmd$/i.test(rel));
+  assert.deepEqual(launchers,['DEADBYTE-MCP.cmd']);
+});

package/test/r48-release-contract.test.mjs

@@ -3,40 +3,55 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { DEADBYTE_VERSION } from '../src/version.mjs';
 
-const root=new URL('../',import.meta.url);
-const read=rel=>readFile(new URL(rel,root),'utf8');
+const root = new URL('../', import.meta.url);
+const read = rel => readFile(new URL(rel, root), 'utf8');
 
-test('R49 0.15.26 successor binds exact published immutable 0.15.25 parent',async()=>{
-  const [pkg,lock,release,provenance,matrix]=await Promise.all([
+test('R50 0.15.27 successor binds exact published immutable 0.15.26 parent', async () => {
+  const [pkg, lock, release, provenance, matrix] = await Promise.all([
     read('package.json').then(JSON.parse),
     read('package-lock.json').then(JSON.parse),
     read('RELEASE.json').then(JSON.parse),
     read('PROVENANCE.json').then(JSON.parse),
     read('TEST-MATRIX.json').then(JSON.parse)
   ]);
-  for(const value of [pkg.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION,release.version,provenance.version,matrix.version])assert.equal(value,'0.15.26');
-  assert.equal(release.train,'R49');
-  assert.equal(release.label,'BOUNDED SEMANTIC DESKTOP WAIT + REMOTE CONTROL HARDENING');
-  assert.equal(release.parent.release_id,'v0.15.25-7ed657b1aa038ee6');
-  assert.equal(release.parent.manifest_sha256,'7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319');
-  assert.equal(release.parent.generation_manifest_sha256,'c9763738e27ec39b1180473995f2af088d85293a94f5693abd6a843e09cecec9');
-  assert.equal(release.source_predecessor.version,'0.15.25');
-  assert.equal(release.source_predecessor.tarball_sha256,'0410b41b3c891210262a4db793ee3b339862472ef069f881c9e092c1083ba6d2');
-  assert.equal(release.source_predecessor.manifest_file_sha256,'7ed657b1aa038ee679ff081f1a83c421a5eeb5fc7ea6b746e0f661079b69b319');
-  assert.equal(release.source_predecessor.reference_server_sha256,'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
-  assert.equal(release.source_predecessor.reference_schemas_sha256,'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
-  assert.equal(release.capabilities.full_tool_count,117);
-  assert.equal(release.capabilities.desktop_bounded_semantic_wait,true);
-  assert.equal(release.capabilities.commander_incremental_pdf_revisions,true);
-  assert.equal(release.capabilities.commander_docx_header_footer_search,true);
-  assert.equal(release.capabilities.commander_directory_read_fallback,true);
-  assert.equal(release.capabilities.commander_binary_detection,true);
-  assert.equal(release.capabilities.commander_protocol_adversarial,true);
-  assert.equal(release.capabilities.atomic_mutation_unknown_effect,true);
-  assert.equal(provenance.parent_release_id,release.parent.release_id);
-  assert.equal(provenance.parent_manifest_sha256,release.parent.manifest_sha256);
-  assert.equal(provenance.parent_generation_manifest_sha256,release.parent.generation_manifest_sha256);
-  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.files,211);
-  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.not_valid_as_r49_proof,true);
+
+  for (const value of [
+    pkg.version,
+    lock.version,
+    lock.packages[''].version,
+    DEADBYTE_VERSION,
+    release.version,
+    provenance.version,
+    matrix.version
+  ]) assert.equal(value, '0.15.27');
+
+  assert.equal(release.train, 'R50');
+  assert.equal(release.label, 'PUBLIC PACKAGE BOUNDARY HOTFIX');
+  assert.equal(release.parent.release_id, 'v0.15.26-669ea65d2307ee2c');
+  assert.equal(release.parent.manifest_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
+  assert.equal(release.parent.generation_manifest_sha256, '08364adaf1dab9730c314e29121632c6371ed76fc677e83cb7f6aa6b244eab94');
+
+  assert.equal(release.source_predecessor.version, '0.15.26');
+  assert.equal(release.source_predecessor.tarball_sha256, '3272679e3a18610d47e83dc8d3161e949d75a57da145a43c2ab50c865a83bb86');
+  assert.equal(release.source_predecessor.manifest_file_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
+  assert.equal(release.source_predecessor.reference_server_sha256, 'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
+  assert.equal(release.source_predecessor.reference_schemas_sha256, 'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
+
+  assert.equal(release.capabilities.full_tool_count, 117);
+  assert.equal(release.capabilities.desktop_bounded_semantic_wait, true);
+  assert.equal(release.capabilities.commander_incremental_pdf_revisions, true);
+  assert.equal(release.capabilities.commander_docx_header_footer_search, true);
+  assert.equal(release.capabilities.commander_directory_read_fallback, true);
+  assert.equal(release.capabilities.commander_binary_detection, true);
+  assert.equal(release.capabilities.commander_protocol_adversarial, true);
+  assert.equal(release.capabilities.atomic_mutation_unknown_effect, true);
+
+  assert.equal(provenance.parent_release_id, release.parent.release_id);
+  assert.equal(provenance.parent_manifest_sha256, release.parent.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256, release.parent.generation_manifest_sha256);
+  assert.equal(provenance.source_predecessor_tarball_sha256, release.source_predecessor.tarball_sha256);
+
+  assert.equal(matrix.train, 'R50');
+  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.files, 211);
+  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.not_valid_as_r50_proof, true);
 });

package/test/r49-windows-gate.test.mjs

@@ -1,27 +1,30 @@
 import assert from 'node:assert/strict';
-import {readFile} from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import test from 'node:test';
 
 const read = path => readFile(new URL(`../${path}`, import.meta.url), 'utf8');
 
-test('R49 canonical Windows gate is successor-bound and preserves the R48 historical gate', async () => {
-  const [pkgText, gate, evidence, historical, deferred] = await Promise.all([
+test('R50 canonical Windows gate is successor-bound and preserves R49/R48 historical gates', async () => {
+  const [pkgText, gate, evidence, historicalR49, historicalR48, deferred] = await Promise.all([
     read('package.json'),
+    read('scripts/gate-windows-r50.ps1'),
+    read('scripts/windows-gate-evidence-r50.mjs'),
     read('scripts/gate-windows-r49.ps1'),
-    read('scripts/windows-gate-evidence-r49.mjs'),
     read('scripts/gate-windows-r48.ps1'),
     read('scripts/deferred-slot-operation-r46.mjs')
   ]);
   const pkg = JSON.parse(pkgText);
-  assert.match(pkg.scripts['gate:windows'], /gate-windows-r49\.ps1$/);
-  assert.match(gate, /DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
+  assert.match(pkg.scripts['gate:windows'], /gate-windows-r50\.ps1$/);
+  assert.match(gate, /DEADBYTE 0\.15\.27 \/ R50 WINDOWS GATE: PASS/);
+  assert.match(gate, /r50-package-boundary/);
   assert.match(gate, /r49-remote-control-donors\.test\.mjs/);
   assert.match(gate, /desktop-runtime-r40\.test\.mjs/);
   assert.match(gate, /manifest-final-verify/);
-  assert.match(evidence, /deadbyte\.r49-windows-gate\.v1/);
-  assert.match(evidence, /pkg\.version==='0\.15\.26'/);
-  assert.match(evidence, /release\.train==='R49'/);
-  assert.match(historical, /DEADBYTE 0\.15\.25 \/ R48 WINDOWS GATE: PASS/);
+  assert.match(evidence, /deadbyte\.r50-windows-gate\.v1/);
+  assert.match(evidence, /pkg\.version === '0\.15\.27'/);
+  assert.match(evidence, /release\.train === 'R50'/);
+  assert.match(historicalR49, /DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
+  assert.match(historicalR48, /DEADBYTE 0\.15\.25 \/ R48 WINDOWS GATE: PASS/);
   assert.match(deferred, /const expectedVersion=packageIdentity\.version/);
   assert.match(deferred, /'--expected-version',expectedVersion/);
   assert.match(deferred, /async function awaitHandoffCompletion/);