deadbyte-mcp 0.15.27 → 0.15.29

package/package.json

@@ -1,95 +1,97 @@
 {
-    "name": "deadbyte-mcp",
-    "version": "0.15.27",
-    "private": false,
-    "type": "module",
-    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
-    "engines": {
-        "node": ">=22"
-    },
-    "scripts": {
-        "test": "node --test test/*.test.mjs",
-        "manifest:write": "node scripts/release-manifest.mjs write",
-        "manifest:verify": "node scripts/release-manifest.mjs verify",
-        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
-        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
-        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
-        "r42:eval": "node scripts/agent-eval-r42.mjs",
-        "self-update:runtime": "node scripts/runtime-self-update.mjs",
-        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
-        "release:parity": "node scripts/release-parity-r46.mjs",
-        "release:final:write": "node scripts/final-closure-r46.mjs",
-        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
-        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
-        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
-        "trust:init": "node src/trust-init.mjs",
-        "mcp": "node src/mcp-server.mjs",
-        "mcp:smoke": "node src/mcp-smoke-client.mjs",
-        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
-        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
-        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
-        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
-        "mcp:process:smoke": "node src/process-smoke-client.mjs",
-        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
-        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
-        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
-        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
-        "containment:bootstrap": "node src/containment-bootstrap.mjs",
-        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
-        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
-        "containment:construction": "node src/containment-construction.mjs",
-        "containment:child-control": "node src/containment-child-control.mjs",
-        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
-        "contained:smoke": "node src/contained-smoke.mjs",
-        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r50.ps1",
-        "authority:smoke": "node src/authority-smoke.mjs",
-        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
-        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
-        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
-        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
-        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
-        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
-        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
-        "audit:status": "node src/deadbyte-cli.mjs audit status",
-        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
-        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
-        "r43:full:test": "node scripts/full-regression-r43.mjs",
-        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
-        "r44:full:test": "node scripts/full-regression-r44.mjs",
-        "finalize:r44": "node scripts/finalize-r44.mjs",
-        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-        "doctor": "node src/deadbyte-cli.mjs doctor",
-        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
-        "r45:full:test": "node scripts/full-regression-r45.mjs",
-        "finalize:r45": "node scripts/finalize-r45.mjs",
-        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
-        "r46:full:test": "node scripts/full-regression-r46.mjs",
-        "r47:full:test": "node scripts/full-regression-r47.mjs",
-        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
-        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
-        "r48:full:test": "node scripts/full-regression-r48.mjs",
-        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs test/commander-protocol-adversarial-r48.test.mjs",
-        "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
-        "release:npm": "node scripts/npm-release-r48.mjs"
-    },
-    "bundleDependencies": [
-        "@modelcontextprotocol/server",
-        "@modelcontextprotocol/client",
-        "typescript",
-        "zod"
-    ],
-    "dependencies": {
-        "@modelcontextprotocol/client": "2.1.0",
-        "@modelcontextprotocol/server": "2.1.0",
-        "typescript": "5.9.3",
-        "zod": "4.4.3"
-    },
-    "bin": {
-        "deadbyte-mcp": "src/deadbyte-cli.mjs"
-    },
-    "publishConfig": {
-        "access": "public"
-    }
+  "name": "deadbyte-mcp",
+  "version": "0.15.29",
+  "private": false,
+  "type": "module",
+  "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "manifest:write": "node scripts/release-manifest.mjs write",
+    "manifest:verify": "node scripts/release-manifest.mjs verify",
+    "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
+    "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
+    "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
+    "r42:eval": "node scripts/agent-eval-r42.mjs",
+    "self-update:runtime": "node scripts/runtime-self-update.mjs",
+    "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
+    "release:parity": "node scripts/release-parity-r46.mjs",
+    "release:final:write": "node scripts/final-closure-r46.mjs",
+    "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
+    "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
+    "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
+    "trust:init": "node src/trust-init.mjs",
+    "mcp": "node src/mcp-server.mjs",
+    "mcp:smoke": "node src/mcp-smoke-client.mjs",
+    "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
+    "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
+    "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
+    "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
+    "mcp:process:smoke": "node src/process-smoke-client.mjs",
+    "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
+    "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
+    "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
+    "containment:smoke": "node src/containment-smoke.mjs appcontainer",
+    "containment:bootstrap": "node src/containment-bootstrap.mjs",
+    "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
+    "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
+    "containment:construction": "node src/containment-construction.mjs",
+    "containment:child-control": "node src/containment-child-control.mjs",
+    "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
+    "contained:smoke": "node src/contained-smoke.mjs",
+    "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r52.ps1",
+    "authority:smoke": "node src/authority-smoke.mjs",
+    "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
+    "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
+    "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
+    "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
+    "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
+    "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
+    "audit:verify": "node src/deadbyte-cli.mjs audit verify",
+    "audit:status": "node src/deadbyte-cli.mjs audit status",
+    "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
+    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+    "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+    "r43:full:test": "node scripts/full-regression-r43.mjs",
+    "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+    "r44:full:test": "node scripts/full-regression-r44.mjs",
+    "finalize:r44": "node scripts/finalize-r44.mjs",
+    "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+    "doctor": "node src/deadbyte-cli.mjs doctor",
+    "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+    "r45:full:test": "node scripts/full-regression-r45.mjs",
+    "finalize:r45": "node scripts/finalize-r45.mjs",
+    "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
+    "r46:full:test": "node scripts/full-regression-r46.mjs",
+    "r47:full:test": "node scripts/full-regression-r47.mjs",
+    "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
+    "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
+    "r48:full:test": "node scripts/full-regression-r48.mjs",
+    "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs test/commander-protocol-adversarial-r48.test.mjs",
+    "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
+    "release:npm": "node scripts/npm-release-r48.mjs",
+    "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs",
+    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs"
+  },
+  "bundleDependencies": [
+    "@modelcontextprotocol/server",
+    "@modelcontextprotocol/client",
+    "typescript",
+    "zod"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.1.0",
+    "@modelcontextprotocol/server": "2.1.0",
+    "typescript": "5.9.3",
+    "zod": "4.4.3"
+  },
+  "bin": {
+    "deadbyte-mcp": "src/deadbyte-cli.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/scripts/deploy-r48.mjs

@@ -8,7 +8,7 @@ import { loadPowerShellDataFile, runSlotUpdateCli } from '../src/runtime-update.
 import { parseActivePointer } from '../src/release-slot.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
-const state=path.join(os.homedir(),'.deadbyte-mcp');
+const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha=async f=>createHash('sha256').update(await readFile(f)).digest('hex');
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 

package/scripts/gate-windows-r51.ps1

@@ -0,0 +1,58 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.28 / R51 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.28 / R51 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r51-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-NodeTest 'r51-release-smoke-isolation' @('test/release-smoke-isolation.test.mjs')
+Invoke-GateStep 'r51-focused-contracts' @('run','r51:focused:test')
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Write-Host "==== desktop-policy-refresh ===="
+& (Join-Path $PSScriptRoot 'init-desktop-policy-r40.ps1')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r51-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r51.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R51 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.28 / R51 WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r52.ps1

@@ -0,0 +1,58 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.29 / R52 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.29 / R52 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r52-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-NodeTest 'r52-release-smoke-isolation' @('test/release-smoke-isolation.test.mjs')
+Invoke-GateStep 'r52-focused-contracts' @('run','r52:focused:test')
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Write-Host "==== desktop-policy-refresh ===="
+& (Join-Path $PSScriptRoot 'init-desktop-policy-r40.ps1')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r52-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r52.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R52 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.29 / R52 WINDOWS GATE: PASS ===='

package/scripts/windows-gate-evidence-r51.mjs

@@ -0,0 +1,84 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const stateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(), '.deadbyte-mcp'));
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const insist = (ok, message) => { if (!ok) throw new Error(message); };
+const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+const release = JSON.parse(await readFile(path.join(root, 'RELEASE.json'), 'utf8'));
+const active = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
+const manifestSha256 = sha256(await readFile(path.join(root, 'MANIFEST.SHA256')));
+
+insist(pkg.version === '0.15.28' && release.version === pkg.version && release.train === 'R51', 'R51 candidate identity mismatch');
+insist(
+  active.release_id === release.parent.release_id &&
+  active.manifest_sha256 === release.parent.manifest_sha256 &&
+  active.generation_manifest_sha256 === release.parent.generation_manifest_sha256,
+  'active runtime is not the exact sealed R51 parent'
+);
+
+const health = await doctor();
+insist(health.status === 'ok' && health.package_version === pkg.version && health.manifest?.verified === true, 'R51 doctor evidence invalid');
+insist(health.policy?.host_v2_ready === true, 'R51 Host policy v2 is not ready');
+
+const evidence = {
+  schema: 'deadbyte.r51-windows-gate.v1',
+  status: 'passed',
+  exit_code: 0,
+  version: pkg.version,
+  train: 'R51',
+  completed_at_utc: new Date().toISOString(),
+  manifest_sha256: manifestSha256,
+  parent: release.parent,
+  active_predecessor: {
+    release_id: active.release_id,
+    version: active.version,
+    manifest_sha256: active.manifest_sha256,
+    generation_manifest_sha256: active.generation_manifest_sha256
+  },
+  doctor: { verified_entries: health.manifest.verified_entries, host_v2_ready: true },
+  gates: {
+    package_boundary: true,
+    release_smoke_isolation: true,
+    runtime_coherence: true,
+    coding_command_singleflight: true,
+    foreground_desktop_host_fail_closed: true,
+    livelog_optimizer: true,
+    full_regression: true,
+    commander_hardening: true,
+    donor_proof: true,
+    desktop_wait: true,
+    exact_catalog: true,
+    stdio_smokes: true,
+    manifest_final_verify: true
+  }
+};
+
+const bytes = Buffer.from(`${JSON.stringify(evidence, null, 2)}\n`);
+const dir = path.join(stateRoot, 'evidence', 'release');
+await mkdir(dir, { recursive: true });
+const target = path.join(dir, `r51-windows-gate-${manifestSha256.slice(0, 16)}.json`);
+
+try {
+  const handle = await open(target, 'wx', 0o600);
+  try { await handle.writeFile(bytes); await handle.sync(); }
+  finally { await handle.close(); }
+} catch (error) {
+  if (error?.code !== 'EEXIST') throw error;
+  const prior = JSON.parse(await readFile(target, 'utf8'));
+  insist(
+    prior.schema === evidence.schema &&
+    prior.status === 'passed' &&
+    prior.version === evidence.version &&
+    prior.manifest_sha256 === manifestSha256 &&
+    prior.parent?.release_id === release.parent.release_id,
+    'conflicting R51 gate evidence identity'
+  );
+}
+
+console.log(JSON.stringify({ status: 'passed', path: target, sha256: sha256(bytes), manifest_sha256: manifestSha256 }));

package/scripts/windows-gate-evidence-r52.mjs

@@ -0,0 +1,94 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const stateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(), '.deadbyte-mcp'));
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const insist = (ok, message) => { if (!ok) throw new Error(message); };
+const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+const release = JSON.parse(await readFile(path.join(root, 'RELEASE.json'), 'utf8'));
+const provenance = JSON.parse(await readFile(path.join(root, 'PROVENANCE.json'), 'utf8'));
+const active = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
+const manifestSha256 = sha256(await readFile(path.join(root, 'MANIFEST.SHA256')));
+
+insist(pkg.version === '0.15.29' && release.version === pkg.version && release.train === 'R52', 'R52 candidate identity mismatch');
+insist(
+  active.release_id === release.runtime_predecessor.release_id &&
+  active.manifest_sha256 === release.runtime_predecessor.manifest_sha256 &&
+  active.generation_manifest_sha256 === release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not the exact sealed R52 runtime rollback target'
+);
+insist(release.parent.version === '0.15.28' && release.parent.manifest_sha256 === release.source_predecessor.manifest_file_sha256 && release.parent.tarball_sha256 === release.source_predecessor.tarball_sha256, 'R52 published parent binding mismatch');
+insist(release.source_predecessor.version === '0.15.28', 'R52 source predecessor version mismatch');
+insist(release.source_predecessor.tarball_sha256 === '0a74332ba715d80a532dc871ece4826bdb917b8c7a442e71388a06d44698c411', 'R52 source predecessor tarball mismatch');
+insist(provenance.source_predecessor_activation_failure_receipt_sha256 === '090f165c96da0d5a8e9c0815fd389fe94e8fe36c23a6878ee825b8f46bfb0bc2', 'R52 failure receipt binding mismatch');
+
+const health = await doctor();
+insist(health.status === 'ok' && health.package_version === pkg.version && health.manifest?.verified === true, 'R52 doctor evidence invalid');
+insist(health.policy?.host_v2_ready === true, 'R52 Host policy v2 is not ready');
+
+const evidence = {
+  schema: 'deadbyte.r52-windows-gate.v1',
+  status: 'passed',
+  exit_code: 0,
+  version: pkg.version,
+  train: 'R52',
+  completed_at_utc: new Date().toISOString(),
+  manifest_sha256: manifestSha256,
+  parent: release.parent,
+  runtime_predecessor: release.runtime_predecessor,
+  source_predecessor: release.source_predecessor,
+  activation_failure_receipt_sha256: provenance.source_predecessor_activation_failure_receipt_sha256,
+  active_predecessor: {
+    release_id: active.release_id,
+    version: active.version,
+    manifest_sha256: active.manifest_sha256,
+    generation_manifest_sha256: active.generation_manifest_sha256
+  },
+  doctor: { verified_entries: health.manifest.verified_entries, host_v2_ready: true },
+  gates: {
+    offline_predecessor_host_revoke_before_capture: true,
+    package_boundary: true,
+    release_smoke_isolation: true,
+    runtime_coherence: true,
+    coding_command_singleflight: true,
+    foreground_desktop_host_fail_closed: true,
+    livelog_optimizer: true,
+    full_regression: true,
+    commander_hardening: true,
+    donor_proof: true,
+    desktop_wait: true,
+    exact_catalog: true,
+    stdio_smokes: true,
+    manifest_final_verify: true
+  }
+};
+
+const bytes = Buffer.from(`${JSON.stringify(evidence, null, 2)}\n`);
+const dir = path.join(stateRoot, 'evidence', 'release');
+await mkdir(dir, { recursive: true });
+const target = path.join(dir, `r52-windows-gate-${manifestSha256.slice(0, 16)}.json`);
+
+try {
+  const handle = await open(target, 'wx', 0o600);
+  try { await handle.writeFile(bytes); await handle.sync(); }
+  finally { await handle.close(); }
+} catch (error) {
+  if (error?.code !== 'EEXIST') throw error;
+  const prior = JSON.parse(await readFile(target, 'utf8'));
+  insist(
+    prior.schema === evidence.schema &&
+    prior.status === 'passed' &&
+    prior.version === evidence.version &&
+    prior.manifest_sha256 === manifestSha256 &&
+    prior.parent?.release_id === release.parent.release_id &&
+    prior.activation_failure_receipt_sha256 === evidence.activation_failure_receipt_sha256,
+    'conflicting R52 gate evidence identity'
+  );
+}
+
+console.log(JSON.stringify({ status: 'passed', path: target, sha256: sha256(bytes), manifest_sha256: manifestSha256 }));