deadbyte-mcp 0.15.28 → 0.15.30

package/docs/R51-RELEASE.json

@@ -0,0 +1,115 @@
+{
+  "schema": "deadbyte.release.v1",
+  "name": "deadbyte-mcp",
+  "version": "0.15.28",
+  "train": "R51",
+  "label": "RUNTIME COHERENCE + SINGLE-FLIGHT + LIVELOG HARDENING",
+  "protocol_revision": "2026-07-28",
+  "parent": {
+    "release_id": "v0.15.27-1b1dbe24b45ad06a",
+    "manifest_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+    "generation_manifest_sha256": "f87a1637b3c55ba050d079d8a5e0862a2244b306be7e985880708e0d8ded3db0"
+  },
+  "source_predecessor": {
+    "version": "0.15.27",
+    "tarball_sha256": "e728031d097d8678dfef80f8648cce65e72a96611052c31969c80f884506d1d7",
+    "manifest_file_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+    "reference_package": "@wonderwhy-er/desktop-commander@0.2.51",
+    "reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
+    "reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
+  },
+  "platform": {
+    "primary": "win32",
+    "architectures": [
+      "x64"
+    ]
+  },
+  "capabilities": {
+    "host_execution_modes": [
+      "script",
+      "inline",
+      "native"
+    ],
+    "hardware_queries": [
+      "cpu",
+      "gpu",
+      "memory",
+      "storage",
+      "network",
+      "pci"
+    ],
+    "compact_tool_count": 43,
+    "full_tool_count": 117,
+    "full_tool_catalog": {
+      "path": "docs/R49-FULL-TOOL-CATALOG.json",
+      "base_sha256": "259fdc97a24575aff3f094911b5e86e4f512b07be7c2cc1286b0fd200d03a8c9"
+    },
+    "historical_r46_full_tool_count": 84,
+    "commander_reference_public_tool_count": 26,
+    "commander_additive_tool_count": 14,
+    "commander_drop_in": true,
+    "commander_rich_pdf": true,
+    "commander_incremental_pdf_revisions": true,
+    "commander_docx": true,
+    "commander_docx_header_footer_search": true,
+    "commander_xlsx": true,
+    "commander_url_read": true,
+    "commander_external_process_identity": true,
+    "commander_directory_read_fallback": true,
+    "commander_binary_detection": true,
+    "commander_protocol_adversarial": true,
+    "atomic_mutation_unknown_effect": true,
+    "package_slot_version_coherence": true,
+    "pid_reuse_self_recovery": true,
+    "bounded_controller_failure_evidence": true,
+    "durable_task_events_preserve_signed_envelope": true,
+    "capability_manifest_authority_truth": true,
+    "capability_manifest_host_grant_truth": true,
+    "process_profiles": [
+      "ping_hold",
+      "powershell",
+      "powershell_repl"
+    ],
+    "powershell_fileless": true,
+    "powershell_source_max_arg_bytes": 8192,
+    "powershell_persistent_repl": true,
+    "process_raw_input_profile_opt_in": true,
+    "process_tail_reads": true,
+    "process_wait_reads": true,
+    "process_chunked_output_ring": true,
+    "remote_reachability_ttl": true,
+    "remote_probe_timeout_retry": true,
+    "remote_dispatch_timeout_no_retry": true,
+    "observation_search_session_ttl": true,
+    "observation_search_session_cap": 128,
+    "windows_queries": [
+      "registry",
+      "services",
+      "drivers",
+      "sockets",
+      "volumes",
+      "usb",
+      "wsl"
+    ],
+    "machine_fs_list_entry_fault_isolation": true,
+    "native_windows_observation": true,
+    "desktop_bounded_semantic_wait": true,
+    "desktop_wait_signed_final_observation": true,
+    "desktop_wait_autonomous_goal_binding": true,
+    "native_windows_observer_sha256": "c9b46fc497b55b8f0ad1564c8e15f9c1cdf2a07f206b3c8fa7966c892058e920",
+    "human_livelog_visual_opcode": true,
+    "human_livelog_absolute_root_paths": true,
+    "human_livelog_trace_span": true,
+    "human_livelog_presentation_filter": true,
+    "human_livelog_tty_in_place_rewrite": true,
+    "human_livelog_expanded_summary": true,
+    "runtime_package_auto_coherence": true,
+    "coding_command_singleflight": true,
+    "coding_command_result_dedup_cache": true,
+    "foreground_desktop_host_fail_closed": true,
+    "human_livelog_slow_call_marker": true,
+    "human_livelog_peak_inflight": true,
+    "human_livelog_bounded_discovery": true,
+    "human_livelog_single_parse": true
+  }
+}

package/docs/R51-TEST-MATRIX.json

@@ -0,0 +1,166 @@
+{
+  "schema": "deadbyte.test-matrix.v1",
+  "version": "0.15.28",
+  "train": "R51",
+  "primary_platform": "win32-x64",
+  "reference": {
+    "package": "@wonderwhy-er/desktop-commander",
+    "version": "0.2.51",
+    "server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
+    "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
+  },
+  "required": [
+    {
+      "id": "r51-focused",
+      "command": "npm run r51:focused:test",
+      "expected": "PASS runtime coherence, command single-flight/result reuse, authority cleanup and live-log optimizer contracts"
+    },
+    {
+      "id": "r51-remote-session",
+      "command": "node --test test/remote-session-cli.test.mjs",
+      "expected": "PASS foreground lifecycle, Desktop/Host fail-closed cleanup, guardian and live timeline"
+    },
+    {
+      "id": "package-boundary",
+      "command": "node --test test/package-boundary.test.mjs",
+      "expected": "PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"
+    },
+    {
+      "id": "release-smoke",
+      "command": "node --test test/release-smoke-isolation.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "capability-authority-truth",
+      "command": "node --test test/capability-resolver.test.mjs",
+      "expected": "PASS authority-state manifest truth"
+    },
+    {
+      "id": "compact-authority-truth",
+      "command": "node --test test/compact-max-catalog-r45.test.mjs",
+      "expected": "PASS real compact stdio authority-state manifest truth"
+    },
+    {
+      "id": "native-windows-observation",
+      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+      "expected": "PASS native Windows observation build/query gate"
+    },
+    {
+      "id": "r49-donor-proof",
+      "command": "node --test test/r49-remote-control-donors.test.mjs",
+      "expected": "PASS six pinned donor decisions"
+    },
+    {
+      "id": "r49-desktop-wait",
+      "command": "node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs",
+      "expected": "PASS bounded semantic wait and signed evidence"
+    },
+    {
+      "id": "r49-catalog",
+      "command": "npm run r48:catalog:test",
+      "expected": "PASS 117-tool full catalog; compact remains 43"
+    },
+    {
+      "id": "commander-hardening",
+      "command": "npm run r47:hardening:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "commander-protocol-adversarial",
+      "command": "node --test test/commander-protocol-adversarial-r48.test.mjs",
+      "expected": "PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"
+    },
+    {
+      "id": "r48-release",
+      "command": "npm run r48:release:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "full-regression",
+      "command": "npm run r48:full:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "runtime-update",
+      "command": "node --test test/runtime-self-update.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "audit",
+      "command": "npm audit --omit=dev",
+      "expected": "0 vulnerabilities"
+    },
+    {
+      "id": "activation",
+      "command": "npx -y deadbyte-mcp@0.15.28 remote",
+      "expected": "active runtime auto-synchronizes to exact 0.15.28 package manifest before foreground readiness; no VERSION SKEW reuse"
+    },
+    {
+      "id": "machine-truth",
+      "command": "signed machine_ping",
+      "expected": "release_id and manifests bind activated 0.15.28 generation"
+    },
+    {
+      "id": "rollback-restore",
+      "command": "immutable slot rollback/restore",
+      "expected": "0.15.28 -> exact 0.15.27 -> exact 0.15.28"
+    }
+  ],
+  "focused_proof": {
+    "raw_mcp_protocol": {
+      "tests": 3,
+      "pass": 3,
+      "fail": 0
+    },
+    "commander_hardening": {
+      "tests": 139,
+      "pass": 139,
+      "fail": 0,
+      "skip": 0
+    },
+    "npm_audit_production_vulnerabilities": 0,
+    "r51_behavioral": {
+      "tests": 56,
+      "pass": 56,
+      "fail": 0,
+      "components": [
+        "release-contract",
+        "runtime-coherence",
+        "live-log-polling",
+        "coding-runtime",
+        "remote-live-log",
+        "remote-session-cli"
+      ]
+    }
+  },
+  "predecessor_r48_full_regression_partition_proof": {
+    "files": 211,
+    "batches": 8,
+    "fail": 0,
+    "elapsed_ms": 196997.218,
+    "coding_task_id": "a1a10fff1520b37ac674f1861cd9e53e64e350d5a0766639036aefe5e096e235",
+    "task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
+    "action_receipt_sha256": "095c5eb4d959b9105a769649aa196a1d33f5097b899031dd16997e5ba1b352e6",
+    "not_valid_as_r50_proof": true
+  },
+  "performance": {
+    "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",
+    "reason": "A test-only copy of the byte-pinned 0.2.51 reference was installed with scripts, audit, and dev dependencies disabled; production has no reference dependency.",
+    "historical_sample_only": false,
+    "r51": {
+      "coding_command_singleflight": true,
+      "completed_result_cache": {
+        "ttl_ms": 300000,
+        "max_entries": 16
+      },
+      "live_log_poll_ms": 250,
+      "live_log_discovery_interval_ms": 1000,
+      "max_audit_segments_polled": 2,
+      "audit_json_parse_per_line": 1
+    }
+  },
+  "non_win32": {
+    "portable_tests": "supported where platform-independent",
+    "windows_native_tests": "SKIP/unsupported"
+  }
+}

package/docs/R52-ACTIVATION-FORENSICS.md

@@ -0,0 +1,85 @@
+# R52 activation investigation
+
+Observed 2026-09-30. This record distinguishes reproduced defects from
+historical facts that the retained evidence cannot establish.
+
+## Failed 0.15.28 transition
+
+Transaction `r27-b879bdff63478f28-muo5kmwo-33426318` started at
+13:40:29.304Z from registry/npx package 0.15.28. Its prior pointer was exact
+0.15.27 (`1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47`).
+It prepared immutable candidate 0.15.28 and its generation, then failed
+at `candidate_prepared`, at 13:40:34.362Z, with
+`offline predecessor recovery requires host plane DISARMED`.
+No predecessor capture, supervisor handoff, pointer commit, or rollback was
+recorded. A prepared `new_pointer` is not evidence of activation.
+
+The receipt's canonical envelope identity is
+`090f165c96da0d5a8e9c0815fd389fe94e8fe36c23a6878ee825b8f46bfb0bc2`.
+The formatted receipt file's SHA-256 is separately
+`e5de685f96b325388b27af3570175aa5fa7ebcc7f15b4bf27754eb96b20a81f5`.
+These hashes have different subjects and must not be conflated.
+
+The source path is CLI remote -> coherence -> privileged revocation ->
+deploy -> candidate preparation -> capturePredecessor -> offline Host check.
+The CLI checked revocation exit codes, not a post-revocation authority snapshot.
+The controller's former Disarm-Host suppressed removal errors and printed
+DISARMED regardless of whether the grant remained. Get-HostArmStatus treats
+a policy-matching standing grant as ARMED even when the runtime is OFFLINE.
+Thus runtime liveness and persisted authority are distinct.
+
+The retained failure does not contain the grant bytes, revocation result,
+actor identity, or an intervening authority-event trace. It cannot distinguish
+failed removal, concurrent rearming, or another state change. The historical
+actor/root cause is **not proven**. Do not call the grant merely stale or
+claim a specific rearming actor.
+
+## Separate observed state drift
+
+Earlier transaction `r27-b879bdff63478f28-muo5hf8w-bcc78637` captured an
+offline predecessor, spawned its supervisor, and then failed because
+`cloud.instance.json` was present at the next offline check. This is a
+different failure boundary. It proves capture is not a lifetime guarantee;
+it does not identify the writer or justify deleting ownership evidence.
+
+## Reproduced fixes and remaining acceptance
+
+The R52 offline recovery test exercises explicit Host revocation followed
+by fresh status, retaining the Host DISARMED invariant. It rejects failed
+revocation, successful-return-with-grant-remaining, and missing recovery opt-in.
+
+A new maintained-controller behavioral test was observed RED: failed grant
+removal returned success and printed DISARMED. The minimal fix uses terminating
+removal errors and verifies absence before reporting success. GREEN additionally
+covers absent grants, actual successful deletion, and nominal success with a
+remaining grant. No authority is armed by this fix.
+
+Release lineage parent is published 0.15.28; known-good 0.15.27 remains a
+separate runtime rollback target. A failed 0.15.28 generation is not a proven
+live parent generation.
+
+Focused GREEN does not establish durable caller-disconnect survival, owned-tree
+cancellation, the full Windows gate, registry round-trip, rollback/recovery, or
+actual latest remote activation. Those remain mandatory independent outcomes.
+
+## Subsequent long-run proof
+
+The added cancellation test was observed RED: a signed cancellation request
+waited for the running command to finish, and its descendant could perform a
+later write. Cancellation had only been consumed between task steps.
+
+Windows coding command execution now uses the existing package-pinned native
+process host's kill-on-close Job Object in pipe-quiet mode. Quiet mode suppresses
+only the host's control records, preserving raw stdout/stderr; no caller chooses
+the host, PID, input channel, or executable outside the existing coding policy.
+Signed cancellation is polled while a step runs, and terminal cancellation is
+reported after the owned host closes. The native host was rebuilt canonically
+and its process-policy digest refreshed. This is an internal implementation
+repair of the requested ownership contract, not a new public execution tool.
+
+Observed GREEN covers a real running parent and descendant, prompt cancellation,
+descendant absence and no delayed descendant write. A separate independent
+runtime process survived loss of its caller IPC transport, completed exactly one
+execution, retained attempts=1, and exposed a verifiable terminal task receipt
+to a fresh runtime instance. This does not claim survival of the execution owner
+itself being killed or prove public HTTP parity; those are different scopes.

package/native/deadbyte-process-host.cpp

@@ -170,9 +170,11 @@ int wmain(int argc, wchar_t** argv) {
     const wchar_t* cwd = argv[2];
     const wchar_t* job_id = argv[3];
     bool pipeTransport = false;
+    bool quietTransport = false;
     int firstChildArg = 4;
     if (argc > 4 && wcsncmp(argv[4], L"--deadbyte-transport=", 21) == 0) {
         if (wcscmp(argv[4], L"--deadbyte-transport=pipe") == 0) pipeTransport = true;
+        else if (wcscmp(argv[4], L"--deadbyte-transport=pipe-quiet") == 0) { pipeTransport = true; quietTransport = true; }
         else if (wcscmp(argv[4], L"--deadbyte-transport=conpty") != 0) {
             fwprintf(stderr, L"DEADBYTE process host: invalid transport\n");
             return 65;
@@ -306,8 +308,8 @@ int wmain(int argc, wchar_t** argv) {
     const int readyLength = snprintf(ready, sizeof(ready),
         "DEADBYTE_PROCESS_HOST_READY {\"child_pid\":%lu,\"creation_filetime\":\"%llu\",\"job_id\":\"%ls\"}\n",
         pi.dwProcessId, filetime_value(creation), job_id);
-    if (readyLength <= 0 || readyLength >= static_cast<int>(sizeof(ready)) ||
-        !write_all(GetStdHandle(STD_OUTPUT_HANDLE), ready, static_cast<DWORD>(readyLength))) {
+    if (!quietTransport && (readyLength <= 0 || readyLength >= static_cast<int>(sizeof(ready)) ||
+        !write_all(GetStdHandle(STD_OUTPUT_HANDLE), ready, static_cast<DWORD>(readyLength)))) {
         TerminateProcess(process.value, 113);
         if (hpc) ClosePseudoConsole(hpc);
         return fail_win32(L"WriteFile(ready)");
@@ -333,7 +335,7 @@ int wmain(int argc, wchar_t** argv) {
     const int doneLength = snprintf(done, sizeof(done),
         "\nDEADBYTE_PROCESS_HOST_EXIT {\"child_pid\":%lu,\"exit_code\":%lu}\n",
         pi.dwProcessId, exitCode);
-    if (doneLength > 0 && doneLength < static_cast<int>(sizeof(done))) {
+    if (!quietTransport && doneLength > 0 && doneLength < static_cast<int>(sizeof(done))) {
         write_all(GetStdHandle(STD_OUTPUT_HANDLE), done, static_cast<DWORD>(doneLength));
     }
     return wait == WAIT_OBJECT_0 ? static_cast<int>(exitCode) : 114;

package/package.json

@@ -1,96 +1,98 @@
 {
-    "name": "deadbyte-mcp",
-    "version": "0.15.28",
-    "private": false,
-    "type": "module",
-    "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
-    "engines": {
-        "node": ">=22"
-    },
-    "scripts": {
-        "test": "node --test test/*.test.mjs",
-        "manifest:write": "node scripts/release-manifest.mjs write",
-        "manifest:verify": "node scripts/release-manifest.mjs verify",
-        "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
-        "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
-        "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
-        "r42:eval": "node scripts/agent-eval-r42.mjs",
-        "self-update:runtime": "node scripts/runtime-self-update.mjs",
-        "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
-        "release:parity": "node scripts/release-parity-r46.mjs",
-        "release:final:write": "node scripts/final-closure-r46.mjs",
-        "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
-        "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
-        "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
-        "trust:init": "node src/trust-init.mjs",
-        "mcp": "node src/mcp-server.mjs",
-        "mcp:smoke": "node src/mcp-smoke-client.mjs",
-        "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
-        "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
-        "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
-        "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
-        "mcp:process:smoke": "node src/process-smoke-client.mjs",
-        "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
-        "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
-        "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
-        "containment:smoke": "node src/containment-smoke.mjs appcontainer",
-        "containment:bootstrap": "node src/containment-bootstrap.mjs",
-        "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
-        "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
-        "containment:construction": "node src/containment-construction.mjs",
-        "containment:child-control": "node src/containment-child-control.mjs",
-        "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
-        "contained:smoke": "node src/contained-smoke.mjs",
-        "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-        "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r51.ps1",
-        "authority:smoke": "node src/authority-smoke.mjs",
-        "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
-        "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
-        "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
-        "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
-        "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
-        "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
-        "audit:verify": "node src/deadbyte-cli.mjs audit verify",
-        "audit:status": "node src/deadbyte-cli.mjs audit status",
-        "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
-        "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
-        "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
-        "r43:full:test": "node scripts/full-regression-r43.mjs",
-        "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
-        "r44:full:test": "node scripts/full-regression-r44.mjs",
-        "finalize:r44": "node scripts/finalize-r44.mjs",
-        "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-        "doctor": "node src/deadbyte-cli.mjs doctor",
-        "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
-        "r45:full:test": "node scripts/full-regression-r45.mjs",
-        "finalize:r45": "node scripts/finalize-r45.mjs",
-        "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
-        "r46:full:test": "node scripts/full-regression-r46.mjs",
-        "r47:full:test": "node scripts/full-regression-r47.mjs",
-        "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
-        "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
-        "r48:full:test": "node scripts/full-regression-r48.mjs",
-        "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs test/commander-protocol-adversarial-r48.test.mjs",
-        "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
-        "release:npm": "node scripts/npm-release-r48.mjs",
-        "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs"
-    },
-    "bundleDependencies": [
-        "@modelcontextprotocol/server",
-        "@modelcontextprotocol/client",
-        "typescript",
-        "zod"
-    ],
-    "dependencies": {
-        "@modelcontextprotocol/client": "2.1.0",
-        "@modelcontextprotocol/server": "2.1.0",
-        "typescript": "5.9.3",
-        "zod": "4.4.3"
-    },
-    "bin": {
-        "deadbyte-mcp": "src/deadbyte-cli.mjs"
-    },
-    "publishConfig": {
-        "access": "public"
-    }
+  "name": "deadbyte-mcp",
+  "version": "0.15.30",
+  "private": false,
+  "type": "module",
+  "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "manifest:write": "node scripts/release-manifest.mjs write",
+    "manifest:verify": "node scripts/release-manifest.mjs verify",
+    "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
+    "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
+    "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
+    "r42:eval": "node scripts/agent-eval-r42.mjs",
+    "self-update:runtime": "node scripts/runtime-self-update.mjs",
+    "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
+    "release:parity": "node scripts/release-parity-r46.mjs",
+    "release:final:write": "node scripts/final-closure-r46.mjs",
+    "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
+    "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
+    "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
+    "trust:init": "node src/trust-init.mjs",
+    "mcp": "node src/mcp-server.mjs",
+    "mcp:smoke": "node src/mcp-smoke-client.mjs",
+    "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
+    "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
+    "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
+    "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
+    "mcp:process:smoke": "node src/process-smoke-client.mjs",
+    "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
+    "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
+    "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
+    "containment:smoke": "node src/containment-smoke.mjs appcontainer",
+    "containment:bootstrap": "node src/containment-bootstrap.mjs",
+    "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
+    "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
+    "containment:construction": "node src/containment-construction.mjs",
+    "containment:child-control": "node src/containment-child-control.mjs",
+    "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
+    "contained:smoke": "node src/contained-smoke.mjs",
+    "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r53.ps1",
+    "authority:smoke": "node src/authority-smoke.mjs",
+    "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
+    "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
+    "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
+    "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
+    "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
+    "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
+    "audit:verify": "node src/deadbyte-cli.mjs audit verify",
+    "audit:status": "node src/deadbyte-cli.mjs audit status",
+    "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
+    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+    "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+    "r43:full:test": "node scripts/full-regression-r43.mjs",
+    "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+    "r44:full:test": "node scripts/full-regression-r44.mjs",
+    "finalize:r44": "node scripts/finalize-r44.mjs",
+    "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+    "doctor": "node src/deadbyte-cli.mjs doctor",
+    "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+    "r45:full:test": "node scripts/full-regression-r45.mjs",
+    "finalize:r45": "node scripts/finalize-r45.mjs",
+    "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
+    "r46:full:test": "node scripts/full-regression-r46.mjs",
+    "r47:full:test": "node scripts/full-regression-r47.mjs",
+    "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
+    "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
+    "r48:full:test": "node scripts/full-regression-r48.mjs",
+    "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs test/commander-protocol-adversarial-r48.test.mjs",
+    "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
+    "release:npm": "node scripts/npm-release-r48.mjs",
+    "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs",
+    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs",
+    "r53:focused:test": "node --test --test-concurrency=1 test/r53-release-contract.test.mjs test/stabilization-update-child-root.test.mjs test/stabilization-state-root.test.mjs test/stabilization-guardian.test.mjs test/stabilization-semver.test.mjs test/stabilization-powershell.test.mjs test/release-slot.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs"
+  },
+  "bundleDependencies": [
+    "@modelcontextprotocol/server",
+    "@modelcontextprotocol/client",
+    "typescript",
+    "zod"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.1.0",
+    "@modelcontextprotocol/server": "2.1.0",
+    "typescript": "5.9.3",
+    "zod": "4.4.3"
+  },
+  "bin": {
+    "deadbyte-mcp": "src/deadbyte-cli.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }