deadbyte-mcp 0.15.29 → 0.15.30

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.29",
-  "train": "R52",
+  "version": "0.15.30",
+  "train": "R53",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -11,14 +11,9 @@
   },
   "required": [
     {
-      "id": "r52-focused",
-      "command": "npm run r52:focused:test",
-      "expected": "PASS offline predecessor stale Host grant is revoked before capture; R51 coherence/single-flight/livelog and runtime-update contracts remain green"
-    },
-    {
-      "id": "r51-remote-session",
-      "command": "node --test test/remote-session-cli.test.mjs",
-      "expected": "PASS foreground lifecycle, Desktop/Host fail-closed cleanup, guardian and live timeline"
+      "id": "r53-focused",
+      "command": "npm run r53:focused:test",
+      "expected": "PASS stabilization contracts, runtime coherence, state-root propagation, guardian cleanup, SemVer and PowerShell environment behavior"
     },
     {
       "id": "package-boundary",
@@ -31,130 +26,80 @@
       "expected": "PASS"
     },
     {
-      "id": "capability-authority-truth",
-      "command": "node --test test/capability-resolver.test.mjs",
-      "expected": "PASS authority-state manifest truth"
-    },
-    {
-      "id": "compact-authority-truth",
-      "command": "node --test test/compact-max-catalog-r45.test.mjs",
-      "expected": "PASS real compact stdio authority-state manifest truth"
-    },
-    {
-      "id": "native-windows-observation",
-      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-      "expected": "PASS native Windows observation build/query gate"
-    },
-    {
-      "id": "r49-donor-proof",
-      "command": "node --test test/r49-remote-control-donors.test.mjs",
-      "expected": "PASS six pinned donor decisions"
-    },
-    {
-      "id": "r49-desktop-wait",
-      "command": "node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs",
-      "expected": "PASS bounded semantic wait and signed evidence"
-    },
-    {
-      "id": "r49-catalog",
-      "command": "npm run r48:catalog:test",
-      "expected": "PASS 117-tool full catalog; compact remains 43"
-    },
-    {
-      "id": "commander-hardening",
-      "command": "npm run r47:hardening:test",
+      "id": "full-regression",
+      "command": "npm run r48:full:test",
       "expected": "PASS"
     },
     {
-      "id": "commander-protocol-adversarial",
-      "command": "node --test test/commander-protocol-adversarial-r48.test.mjs",
-      "expected": "PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"
+      "id": "runtime-update",
+      "command": "node --test test/runtime-self-update.test.mjs",
+      "expected": "PASS"
     },
     {
-      "id": "r48-release",
-      "command": "npm run r48:release:test",
-      "expected": "PASS"
+      "id": "windows-gate",
+      "command": "npm run gate:windows",
+      "expected": "PASS R53 exact 0.15.29 predecessor binding and final 0.15.30 manifest"
     },
     {
-      "id": "full-regression",
-      "command": "npm run r48:full:test",
-      "expected": "PASS"
+      "id": "local-isolated-state-acceptance",
+      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File D:/Projects/deadbyte-mcp/testing/0.15.30/local-isolated-acceptance.ps1",
+      "expected": "PASS with production sentinel unchanged"
     },
     {
-      "id": "runtime-update",
-      "command": "node --test test/runtime-self-update.test.mjs",
-      "expected": "PASS"
+      "id": "four-hour-soak",
+      "command": "owner override",
+      "expected": "NOT_COMPLETED_OPERATOR_BYPASS"
     },
     {
       "id": "audit",
       "command": "npm audit --omit=dev",
       "expected": "0 vulnerabilities"
     },
+    {
+      "id": "package-verify",
+      "command": "node scripts/npm-release-r48.mjs --verify-only",
+      "expected": "PASS manifest, package surface, isolated unpack version and doctor"
+    },
     {
       "id": "activation",
-      "command": "npx -y deadbyte-mcp@0.15.29 remote",
-      "expected": "active runtime auto-synchronizes from exact 0.15.27 runtime rollback target to exact 0.15.29 package manifest; published lineage parent is exact 0.15.28; offline predecessor Host authority is revoked before capture"
+      "command": "npx --yes deadbyte-mcp@0.15.30 remote",
+      "expected": "active runtime synchronizes from exact sealed 0.15.29 to exact 0.15.30 package manifest"
     },
     {
       "id": "machine-truth",
       "command": "signed machine_ping",
-      "expected": "release_id and manifests bind activated 0.15.29 generation"
+      "expected": "release_id and manifests bind activated 0.15.30 generation"
     },
     {
       "id": "rollback-restore",
       "command": "immutable slot rollback/restore",
-      "expected": "0.15.29 -> exact 0.15.27 -> exact 0.15.29"
+      "expected": "0.15.30 -> exact 0.15.29 -> same exact 0.15.30"
     }
   ],
-  "focused_proof": {
-    "raw_mcp_protocol": {
-      "tests": 3,
-      "pass": 3,
-      "fail": 0
-    },
-    "commander_hardening": {
-      "tests": 139,
-      "pass": 139,
-      "fail": 0,
+  "observed_pre_release_evidence": {
+    "focused_before_version_finalize": {
+      "status": "PASS",
       "skip": 0
     },
-    "npm_audit_production_vulnerabilities": 0,
-    "r51_behavioral": {
-      "tests": 56,
-      "pass": 56,
-      "fail": 0,
-      "components": [
-        "release-contract",
-        "runtime-coherence",
-        "live-log-polling",
-        "coding-runtime",
-        "remote-live-log",
-        "remote-session-cli"
-      ]
-    },
-    "r52_behavioral": {
-      "tests": 1,
-      "pass": 1,
-      "fail": 0,
-      "components": [
-        "offline-predecessor-host-revocation"
-      ]
+    "full_regression_before_version_finalize": {
+      "status": "PASS",
+      "batches": 8,
+      "test_files": 226,
+      "source_unchanged": true
+    },
+    "local_isolated_state_acceptance": {
+      "status": "PASS",
+      "production_sentinel_changed": 0,
+      "isolated_final_state": "OFFLINE",
+      "durable_task_verified": true,
+      "action_receipts_verified": 2
     }
   },
-  "predecessor_r48_full_regression_partition_proof": {
-    "files": 211,
-    "batches": 8,
-    "fail": 0,
-    "elapsed_ms": 196997.218,
-    "coding_task_id": "a1a10fff1520b37ac674f1861cd9e53e64e350d5a0766639036aefe5e096e235",
-    "task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
-    "action_receipt_sha256": "095c5eb4d959b9105a769649aa196a1d33f5097b899031dd16997e5ba1b352e6",
-    "not_valid_as_r50_proof": true
+  "operator_override": {
+    "four_hour_soak": "NOT_COMPLETED",
+    "stable_final_claim": false
   },
   "performance": {
-    "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",
-    "reason": "A test-only copy of the byte-pinned 0.2.51 reference was installed with scripts, audit, and dev dependencies disabled; production has no reference dependency.",
-    "historical_sample_only": false,
     "r51": {
       "coding_command_singleflight": true,
       "completed_result_cache": {

package/controller/deadbyte-desktop-policy.json

@@ -1,19 +1,19 @@
 {
     "schema":  "deadbyte.desktop-policy.v1",
     "enabled":  true,
-    "grant_file":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\desktop-grant.json",
-    "evidence_dir":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\desktop-evidence",
+    "grant_file":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\desktop-grant.json",
+    "evidence_dir":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\desktop-evidence",
     "observer":  {
-                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-observer-r40.exe",
+                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-observer-r40.exe",
                      "sha256":  "32671ef2b7decd68c25fcabfe064086e4b3f83a8e9d3558b9d6de3a2510c6dab",
                      "backend":  "gdi-bitblt-fallback"
                  },
     "input":  {
-                  "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-input-r40.exe",
+                  "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-input-r40.exe",
                   "sha256":  "0b967fd0ef599cbb9882b96ea16db7261f086dbcccae631b56f1bc2445a8ab5b"
               },
     "grounder":  {
-                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-uia-r40.exe",
+                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-uia-r40.exe",
                      "sha256":  "19ff558218fe8437dc04f50a8848756a8a83a84f73f464057562d77c7e19fb75"
                  },
     "allowed_input_desktops":  [

package/controller/deadbyte-host-policy.json

@@ -0,0 +1,170 @@
+{
+    "schema":  "deadbyte.host-policy.v2",
+    "enabled":  true,
+    "arm_file":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\host-arm.json",
+    "max_read_bytes":  262144,
+    "max_write_bytes":  1048576,
+    "roots":  {
+                  "core":  {
+                               "path":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization",
+                               "read":  true,
+                               "write":  true,
+                               "exec":  true
+                           },
+                  "bridge":  {
+                                 "path":  "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-chatgpt-bridge",
+                                 "read":  true,
+                                 "write":  true,
+                                 "exec":  true
+                             },
+                  "downloads":  {
+                                    "path":  "C:\\Users\\DEADBYTE\\Downloads",
+                                    "read":  true,
+                                    "write":  true,
+                                    "exec":  true
+                                },
+                  "projects":  {
+                                   "path":  "D:\\Projects",
+                                   "read":  true,
+                                   "write":  true,
+                                   "exec":  true
+                               }
+              },
+    "commands":  {
+                     "powershell_script":  {
+                                               "kind":  "script",
+                                               "executable":  "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+                                               "executable_sha256":  "8bb6fa8c283b4d92120b1ef249a9b311b0f804d4cabbe9981159976c8be76a5e",
+                                               "root_ids":  [
+                                                                "core",
+                                                                "bridge",
+                                                                "downloads",
+                                                                "projects"
+                                                            ],
+                                               "prefix_args":  [
+                                                                   "-NoLogo",
+                                                                   "-NoProfile",
+                                                                   "-ExecutionPolicy",
+                                                                   "Bypass",
+                                                                   "-File"
+                                                               ],
+                                               "extensions":  [
+                                                                  ".ps1"
+                                                              ],
+                                               "timeout_ms":  120000,
+                                               "max_output_bytes":  1048576
+                                           },
+                     "cmd_script":  {
+                                        "kind":  "script",
+                                        "executable":  "C:\\WINDOWS\\system32\\cmd.exe",
+                                        "executable_sha256":  "97ac98b1a92c286054cce55239cfccdfc23a5517bd07fe693072c9ca96c7dabb",
+                                        "root_ids":  [
+                                                         "core",
+                                                         "bridge",
+                                                         "downloads",
+                                                         "projects"
+                                                     ],
+                                        "prefix_args":  [
+                                                            "/D",
+                                                            "/S",
+                                                            "/C"
+                                                        ],
+                                        "extensions":  [
+                                                           ".cmd",
+                                                           ".bat"
+                                                       ],
+                                        "timeout_ms":  120000,
+                                        "max_output_bytes":  1048576
+                                    },
+                     "node_script":  {
+                                         "kind":  "script",
+                                         "executable":  "C:\\Program Files\\nodejs\\node.exe",
+                                         "executable_sha256":  "9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de",
+                                         "root_ids":  [
+                                                          "core",
+                                                          "bridge",
+                                                          "downloads",
+                                                          "projects"
+                                                      ],
+                                         "prefix_args":  [
+
+                                                         ],
+                                         "extensions":  [
+                                                            ".mjs",
+                                                            ".js"
+                                                        ],
+                                         "timeout_ms":  120000,
+                                         "max_output_bytes":  1048576
+                                     },
+                     "powershell_inline":  {
+                                               "kind":  "inline",
+                                               "executable":  "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+                                               "executable_sha256":  "8bb6fa8c283b4d92120b1ef249a9b311b0f804d4cabbe9981159976c8be76a5e",
+                                               "root_ids":  [
+                                                                "core",
+                                                                "bridge",
+                                                                "downloads",
+                                                                "projects"
+                                                            ],
+                                               "prefix_args":  [
+                                                                   "-NoLogo",
+                                                                   "-NoProfile",
+                                                                   "-ExecutionPolicy",
+                                                                   "Bypass",
+                                                                   "-Command"
+                                                               ],
+                                               "timeout_ms":  120000,
+                                               "max_output_bytes":  1048576,
+                                               "max_command_chars":  32768
+                                           },
+                     "cmd_inline":  {
+                                        "kind":  "inline",
+                                        "executable":  "C:\\WINDOWS\\system32\\cmd.exe",
+                                        "executable_sha256":  "97ac98b1a92c286054cce55239cfccdfc23a5517bd07fe693072c9ca96c7dabb",
+                                        "root_ids":  [
+                                                         "core",
+                                                         "bridge",
+                                                         "downloads",
+                                                         "projects"
+                                                     ],
+                                        "prefix_args":  [
+                                                            "/D",
+                                                            "/S",
+                                                            "/C"
+                                                        ],
+                                        "timeout_ms":  120000,
+                                        "max_output_bytes":  1048576,
+                                        "max_command_chars":  32768
+                                    },
+                     "node_inline":  {
+                                         "kind":  "inline",
+                                         "executable":  "C:\\Program Files\\nodejs\\node.exe",
+                                         "executable_sha256":  "9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de",
+                                         "root_ids":  [
+                                                          "core",
+                                                          "bridge",
+                                                          "downloads",
+                                                          "projects"
+                                                      ],
+                                         "prefix_args":  [
+                                                             "-e"
+                                                         ],
+                                         "timeout_ms":  120000,
+                                         "max_output_bytes":  1048576,
+                                         "max_command_chars":  32768
+                                     }
+                 },
+    "native_exec":  {
+                        "enabled":  true,
+                        "root_ids":  [
+                                         "core",
+                                         "bridge",
+                                         "downloads",
+                                         "projects"
+                                     ],
+                        "timeout_ms":  120000,
+                        "max_output_bytes":  1048576,
+                        "max_args":  64,
+                        "max_arg_chars":  8192
+                    }
+}

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.29",
+  "version": "0.15.30",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r52.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r53.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -74,7 +74,8 @@
     "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
     "release:npm": "node scripts/npm-release-r48.mjs",
     "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs",
-    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs"
+    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs",
+    "r53:focused:test": "node --test --test-concurrency=1 test/r53-release-contract.test.mjs test/stabilization-update-child-root.test.mjs test/stabilization-state-root.test.mjs test/stabilization-guardian.test.mjs test/stabilization-semver.test.mjs test/stabilization-powershell.test.mjs test/release-slot.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/proof/CONTAINMENT-BUILD.txt

@@ -39,7 +39,7 @@ deadbyte-process-host.cpp
 exit_code=0
 ==== probe-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\containment-probe.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\containment-probe.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -59,7 +59,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-launcher-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-exec.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-exec.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -83,7 +83,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\contained-transform-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-transform-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -104,7 +104,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-reverse-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\contained-reverse-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-reverse-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -125,7 +125,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== named-tunnel-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-tunnel-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-tunnel-host.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -144,7 +144,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== process-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-process-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-process-host.exe
 
 File Type: EXECUTABLE IMAGE
 

package/scripts/gate-windows-r53.ps1

@@ -0,0 +1,58 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.30 / R53 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.30 / R53 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r53-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-NodeTest 'r53-release-smoke-isolation' @('test/release-smoke-isolation.test.mjs')
+Invoke-GateStep 'r53-focused-contracts' @('run','r53:focused:test')
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Write-Host "==== desktop-policy-refresh ===="
+& (Join-Path $PSScriptRoot 'init-desktop-policy-r40.ps1')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r53-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r53.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R53 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.30 / R53 WINDOWS GATE: PASS ===='

package/scripts/verify-r42-parent.mjs

@@ -82,7 +82,7 @@ export async function verifyR42Parent(file=path.join(root,'R42-PARENT.json')){
   const closureBytes=await readFile(path.resolve(record.parent_final_closure_path));
   insist(sha256(closureBytes)===record.parent_final_closure_sha256,'R41 parent final closure raw hash mismatch');
   const closure=JSON.parse(closureBytes.toString('utf8').replace(/^\uFEFF/,''));
-  const pointer=verifySignedClosure(closure,record,await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  const pointer=verifySignedClosure(closure,record,await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(stateRoot,'trust','ed25519-public.pem'))));
   const generationFiles=await verifyTree(path.resolve(pointer.generation_root),'GENERATION.SHA256',record.parent_generation_manifest_sha256,{exact:true});
 
   const tarball=await readFile(path.resolve(record.parent_public_tarball_path));

package/scripts/verify-r43-parent.mjs

@@ -107,7 +107,7 @@ export async function verifyR43Parent(file=path.join(root,'R43-PARENT.json')){
   const activationBytes=await readFile(path.resolve(record.parent_activation_receipt_path));
   insist(sha256(activationBytes)===record.parent_activation_receipt_file_sha256,'R42 activation raw file hash mismatch');
   const activation=JSON.parse(activationBytes.toString('utf8').replace(/^\uFEFF/,''));
-  const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  const keyInfo=publicKeyInfo(await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(stateRoot,'trust','ed25519-public.pem'))));
   verifyActivationEnvelope(activation,keyInfo,record);
 
   return {

package/scripts/verify-r44-parent.mjs

@@ -76,7 +76,7 @@ export async function verifyR44Parent(parentFile,{stateRoot=path.join(os.homedir
   insist(envelope.body.version===parent.parent_version,'R44 parent closure version mismatch');
   insist(envelope.body.release_label==='R43 AUTHORITY HARDENING PATCH','R44 parent closure label mismatch');
 
-  const publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+  const publicKey=createPublicKey(await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(path.resolve(stateRoot),'trust','ed25519-public.pem'))));
   insist(publicKey.asymmetricKeyType==='ed25519','R44 parent trust key must be Ed25519');
   const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
   insist(keyId===parent.parent_final_closure_signer_key_id,'R44 parent trust key id mismatch');