deadbyte-mcp 0.15.29 → 0.15.31

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.29",
-  "train": "R52",
+  "version": "0.15.31",
+  "train": "R54",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -11,150 +11,80 @@
   },
   "required": [
     {
-      "id": "r52-focused",
-      "command": "npm run r52:focused:test",
-      "expected": "PASS offline predecessor stale Host grant is revoked before capture; R51 coherence/single-flight/livelog and runtime-update contracts remain green"
+      "id": "r54-focused",
+      "command": "npm run r54:focused:test",
+      "expected": "PASS R54 release identity, activation ancestry exclusion, stale-runtime negative controls, runtime update/coherence"
     },
     {
-      "id": "r51-remote-session",
-      "command": "node --test test/remote-session-cli.test.mjs",
-      "expected": "PASS foreground lifecycle, Desktop/Host fail-closed cleanup, guardian and live timeline"
+      "id": "full-regression",
+      "command": "npm run r48:full:test",
+      "expected": "PASS current R54 successor"
     },
     {
       "id": "package-boundary",
       "command": "node --test test/package-boundary.test.mjs",
-      "expected": "PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"
-    },
-    {
-      "id": "release-smoke",
-      "command": "node --test test/release-smoke-isolation.test.mjs",
       "expected": "PASS"
     },
     {
-      "id": "capability-authority-truth",
-      "command": "node --test test/capability-resolver.test.mjs",
-      "expected": "PASS authority-state manifest truth"
-    },
-    {
-      "id": "compact-authority-truth",
-      "command": "node --test test/compact-max-catalog-r45.test.mjs",
-      "expected": "PASS real compact stdio authority-state manifest truth"
-    },
-    {
-      "id": "native-windows-observation",
-      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
-      "expected": "PASS native Windows observation build/query gate"
-    },
-    {
-      "id": "r49-donor-proof",
-      "command": "node --test test/r49-remote-control-donors.test.mjs",
-      "expected": "PASS six pinned donor decisions"
-    },
-    {
-      "id": "r49-desktop-wait",
-      "command": "node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs",
-      "expected": "PASS bounded semantic wait and signed evidence"
+      "id": "windows-gate",
+      "command": "npm run gate:windows",
+      "expected": "PASS R54 focused + full regression + manifest/doctor evidence"
     },
     {
-      "id": "r49-catalog",
-      "command": "npm run r48:catalog:test",
-      "expected": "PASS 117-tool full catalog; compact remains 43"
-    },
-    {
-      "id": "commander-hardening",
-      "command": "npm run r47:hardening:test",
-      "expected": "PASS"
-    },
-    {
-      "id": "commander-protocol-adversarial",
-      "command": "node --test test/commander-protocol-adversarial-r48.test.mjs",
-      "expected": "PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"
-    },
-    {
-      "id": "r48-release",
-      "command": "npm run r48:release:test",
-      "expected": "PASS"
-    },
-    {
-      "id": "full-regression",
-      "command": "npm run r48:full:test",
-      "expected": "PASS"
-    },
-    {
-      "id": "runtime-update",
-      "command": "node --test test/runtime-self-update.test.mjs",
-      "expected": "PASS"
-    },
-    {
-      "id": "audit",
-      "command": "npm audit --omit=dev",
-      "expected": "0 vulnerabilities"
+      "id": "package-verify",
+      "command": "node scripts/npm-release-r48.mjs --verify-only",
+      "expected": "PASS exact packaged surface and isolated doctor"
     },
     {
       "id": "activation",
-      "command": "npx -y deadbyte-mcp@0.15.29 remote",
-      "expected": "active runtime auto-synchronizes from exact 0.15.27 runtime rollback target to exact 0.15.29 package manifest; published lineage parent is exact 0.15.28; offline predecessor Host authority is revoked before capture"
+      "command": "npx --yes deadbyte-mcp@0.15.31 remote",
+      "expected": "clean OFFLINE recovery must not self-block and must activate exact R54 manifest"
     },
     {
       "id": "machine-truth",
       "command": "signed machine_ping",
-      "expected": "release_id and manifests bind activated 0.15.29 generation"
+      "expected": "active release/generation bind exact R54"
     },
     {
       "id": "rollback-restore",
       "command": "immutable slot rollback/restore",
-      "expected": "0.15.29 -> exact 0.15.27 -> exact 0.15.29"
+      "expected": "0.15.31 -> exact 0.15.29 -> same exact 0.15.31"
     }
   ],
-  "focused_proof": {
-    "raw_mcp_protocol": {
-      "tests": 3,
-      "pass": 3,
-      "fail": 0
-    },
-    "commander_hardening": {
-      "tests": 139,
-      "pass": 139,
-      "fail": 0,
-      "skip": 0
-    },
-    "npm_audit_production_vulnerabilities": 0,
-    "r51_behavioral": {
-      "tests": 56,
-      "pass": 56,
-      "fail": 0,
-      "components": [
-        "release-contract",
-        "runtime-coherence",
-        "live-log-polling",
-        "coding-runtime",
-        "remote-live-log",
-        "remote-session-cli"
-      ]
-    },
-    "r52_behavioral": {
-      "tests": 1,
-      "pass": 1,
-      "fail": 0,
-      "components": [
-        "offline-predecessor-host-revocation"
-      ]
+  "observed_pre_release_evidence": {
+    "red_parent_0_15_30": {
+      "status": "FAIL_EXPECTED",
+      "tests": 5,
+      "failed": 5,
+      "receipt_sha256": "116070d3bf860c0a13624e3d017f079655d3b4a4ccac2c7907369066c9833432"
+    },
+    "green_r54_candidate": {
+      "status": "PASS",
+      "tests": 5,
+      "failed": 0,
+      "receipt_sha256": "93889c4829e9b1690f4e8473a632b27b9be8d6a74c62ec54de05bec55524d934"
+    },
+    "full_regression": {
+      "status": "PASS",
+      "files": 229,
+      "batches": 8,
+      "elapsed_ms": 238406.738,
+      "receipt_id": "fafd5d1b2a543bb347ca6617",
+      "receipt_sha256": "ab8d0c1242570fc89cf8b87850ab168ad04147b3ca6535ea58178e6461059225",
+      "request_sha256": "24e963d6016e20d0527dd8825e0ba40b49009347d01faf6e45285f9c9412451a"
     }
   },
-  "predecessor_r48_full_regression_partition_proof": {
-    "files": 211,
-    "batches": 8,
-    "fail": 0,
-    "elapsed_ms": 196997.218,
-    "coding_task_id": "a1a10fff1520b37ac674f1861cd9e53e64e350d5a0766639036aefe5e096e235",
-    "task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
-    "action_receipt_sha256": "095c5eb4d959b9105a769649aa196a1d33f5097b899031dd16997e5ba1b352e6",
-    "not_valid_as_r50_proof": true
+  "inherited_parent_evidence": {
+    "version": "0.15.30",
+    "r53_full_regression": "PASS",
+    "local_isolated_state_acceptance": "PASS",
+    "four_hour_soak": "NOT_COMPLETED_OPERATOR_BYPASS"
+  },
+  "operator_override": {
+    "four_hour_soak": "NOT_COMPLETED",
+    "stable_final_claim": false
   },
   "performance": {
-    "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",
-    "reason": "A test-only copy of the byte-pinned 0.2.51 reference was installed with scripts, audit, and dev dependencies disabled; production has no reference dependency.",
-    "historical_sample_only": false,
     "r51": {
       "coding_command_singleflight": true,
       "completed_result_cache": {
@@ -170,6 +100,10 @@
       "offline_predecessor_host_revoke_before_capture": true,
       "status_reread_required": true,
       "fail_closed_if_host_remains_armed": true
+    },
+    "r54": {
+      "offline_recovery_activation_ancestry_exclusion": true,
+      "unrelated_stale_runtime_fail_closed": true
     }
   },
   "non_win32": {

package/controller/deadbyte-desktop-policy.json

@@ -1,19 +1,19 @@
 {
     "schema":  "deadbyte.desktop-policy.v1",
     "enabled":  true,
-    "grant_file":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\desktop-grant.json",
-    "evidence_dir":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\desktop-evidence",
+    "grant_file":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\desktop-grant.json",
+    "evidence_dir":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\controller\\runtime\\desktop-evidence",
     "observer":  {
-                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-observer-r40.exe",
+                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-observer-r40.exe",
                      "sha256":  "32671ef2b7decd68c25fcabfe064086e4b3f83a8e9d3558b9d6de3a2510c6dab",
                      "backend":  "gdi-bitblt-fallback"
                  },
     "input":  {
-                  "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-input-r40.exe",
+                  "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-input-r40.exe",
                   "sha256":  "0b967fd0ef599cbb9882b96ea16db7261f086dbcccae631b56f1bc2445a8ab5b"
               },
     "grounder":  {
-                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-desktop-uia-r40.exe",
+                     "executable":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.30-stabilization\\bin\\deadbyte-desktop-uia-r40.exe",
                      "sha256":  "19ff558218fe8437dc04f50a8848756a8a83a84f73f464057562d77c7e19fb75"
                  },
     "allowed_input_desktops":  [

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.31-r54\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.31-r54\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.31-r54\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.31-r54",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.29",
+  "version": "0.15.31",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r52.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r54.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -74,7 +74,9 @@
     "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
     "release:npm": "node scripts/npm-release-r48.mjs",
     "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs",
-    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs"
+    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs",
+    "r53:focused:test": "node --test --test-concurrency=1 test/r53-release-contract.test.mjs test/stabilization-update-child-root.test.mjs test/stabilization-state-root.test.mjs test/stabilization-guardian.test.mjs test/stabilization-semver.test.mjs test/stabilization-powershell.test.mjs test/release-slot.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs",
+    "r54:focused:test": "node --test --test-concurrency=1 test/r54-release-contract.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/proof/CONTAINMENT-BUILD.txt

@@ -39,7 +39,7 @@ deadbyte-process-host.cpp
 exit_code=0
 ==== probe-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\containment-probe.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\containment-probe.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -59,7 +59,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-launcher-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-exec.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-exec.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -83,7 +83,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\contained-transform-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-transform-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -104,7 +104,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-reverse-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\contained-reverse-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-reverse-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -125,7 +125,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== named-tunnel-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-tunnel-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-tunnel-host.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -144,7 +144,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== process-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-r42-agentic-dev\bin\deadbyte-process-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-process-host.exe
 
 File Type: EXECUTABLE IMAGE
 

package/scripts/gate-windows-r53.ps1

@@ -0,0 +1,58 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.30 / R53 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.30 / R53 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r53-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-NodeTest 'r53-release-smoke-isolation' @('test/release-smoke-isolation.test.mjs')
+Invoke-GateStep 'r53-focused-contracts' @('run','r53:focused:test')
+Invoke-GateStep 'containment-build' @('run','containment:build')
+Invoke-GateStep 'process-policy-refresh' @('run','process:policy:refresh')
+Write-Host "==== desktop-policy-refresh ===="
+& (Join-Path $PSScriptRoot 'init-desktop-policy-r40.ps1')
+Invoke-GateStep 'hardware-build' @('run','hardware:build')
+
+$hostPolicy = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\controller\deadbyte-host-policy.json'))
+Remove-Item -LiteralPath $hostPolicy -Force -ErrorAction SilentlyContinue
+if (Test-Path -LiteralPath $hostPolicy) { throw 'could not establish hermetic Host policy absence' }
+
+Invoke-GateStep 'r53-release-focused' @('run','r48:release:test')
+Invoke-NodeTest 'r49-donor-proof' @('test/r49-remote-control-donors.test.mjs')
+Invoke-NodeTest 'r49-desktop-wait' @('test/desktop-runtime-r40.test.mjs','test/desktop-mcp-tools-r40.test.mjs','test/autonomous-desktop-r40.test.mjs')
+Invoke-GateStep 'r49-catalog' @('run','r48:catalog:test')
+Invoke-GateStep 'commander-hardening' @('run','r47:hardening:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'mcp-smoke' @('run','mcp:smoke')
+Invoke-GateStep 'mcp-agent-smoke' @('run','mcp:agent:smoke')
+Invoke-GateStep 'mcp-coding-smoke' @('run','mcp:coding:smoke')
+Invoke-GateStep 'mcp-machine-fs-smoke' @('run','mcp:machine-fs:smoke')
+Invoke-GateStep 'mcp-observation-smoke' @('run','mcp:observation:smoke')
+Invoke-GateStep 'mcp-process-smoke' @('run','mcp:process:smoke')
+Invoke-GateStep 'mcp-autonomous-smoke' @('run','mcp:autonomous:smoke')
+Invoke-GateStep 'tunnel-stdio-compat-smoke' @('run','mcp:tunnel-compat:smoke')
+Invoke-GateStep 'containment-smoke' @('run','containment:smoke')
+Invoke-GateStep 'contained-smoke' @('run','contained:smoke')
+Invoke-GateStep 'mcp-contained-smoke' @('run','mcp:contained:smoke')
+Invoke-GateStep 'host-policy-refresh' @('run','host:policy:init')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+Invoke-GateStep 'mcp-host-smoke' @('run','mcp:host:smoke')
+Invoke-GateStep 'authority-smoke' @('run','authority:smoke')
+Invoke-GateStep 'manifest-final-verify' @('run','manifest:verify')
+
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r53.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R53 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.30 / R53 WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r54.ps1

@@ -0,0 +1,26 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.31 / R54 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.31 / R54 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r54-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-GateStep 'r54-focused-contracts' @('run','r54:focused:test')
+Invoke-GateStep 'full-regression' @('run','r48:full:test')
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r54.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R54 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.31 / R54 WINDOWS GATE: PASS ===='

package/scripts/verify-r42-parent.mjs

@@ -82,7 +82,7 @@ export async function verifyR42Parent(file=path.join(root,'R42-PARENT.json')){
   const closureBytes=await readFile(path.resolve(record.parent_final_closure_path));
   insist(sha256(closureBytes)===record.parent_final_closure_sha256,'R41 parent final closure raw hash mismatch');
   const closure=JSON.parse(closureBytes.toString('utf8').replace(/^\uFEFF/,''));
-  const pointer=verifySignedClosure(closure,record,await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  const pointer=verifySignedClosure(closure,record,await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(stateRoot,'trust','ed25519-public.pem'))));
   const generationFiles=await verifyTree(path.resolve(pointer.generation_root),'GENERATION.SHA256',record.parent_generation_manifest_sha256,{exact:true});
 
   const tarball=await readFile(path.resolve(record.parent_public_tarball_path));

package/scripts/verify-r43-parent.mjs

@@ -107,7 +107,7 @@ export async function verifyR43Parent(file=path.join(root,'R43-PARENT.json')){
   const activationBytes=await readFile(path.resolve(record.parent_activation_receipt_path));
   insist(sha256(activationBytes)===record.parent_activation_receipt_file_sha256,'R42 activation raw file hash mismatch');
   const activation=JSON.parse(activationBytes.toString('utf8').replace(/^\uFEFF/,''));
-  const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  const keyInfo=publicKeyInfo(await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(stateRoot,'trust','ed25519-public.pem'))));
   verifyActivationEnvelope(activation,keyInfo,record);
 
   return {

package/scripts/verify-r44-parent.mjs

@@ -76,7 +76,7 @@ export async function verifyR44Parent(parentFile,{stateRoot=path.join(os.homedir
   insist(envelope.body.version===parent.parent_version,'R44 parent closure version mismatch');
   insist(envelope.body.release_label==='R43 AUTHORITY HARDENING PATCH','R44 parent closure label mismatch');
 
-  const publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+  const publicKey=createPublicKey(await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(path.resolve(stateRoot),'trust','ed25519-public.pem'))));
   insist(publicKey.asymmetricKeyType==='ed25519','R44 parent trust key must be Ed25519');
   const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
   insist(keyId===parent.parent_final_closure_signer_key_id,'R44 parent trust key id mismatch');

package/scripts/verify-r45-parent.mjs

@@ -76,7 +76,7 @@ export async function verifyR45Parent(parentFile,{stateRoot=path.join(os.homedir
   insist(envelope.body.version===parent.parent_version,'R45 parent closure version mismatch');
   insist(envelope.body.release_label==='R44 REMOTE AGENT SKILL BASELINE','R45 parent closure label mismatch');
 
-  const publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+  const publicKey=createPublicKey(await readFile(path.resolve(process.env.DEADBYTE_PARENT_VERIFY_KEY||path.join(path.resolve(stateRoot),'trust','ed25519-public.pem'))));
   insist(publicKey.asymmetricKeyType==='ed25519','R45 parent trust key must be Ed25519');
   const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
   insist(keyId===parent.parent_final_closure_signer_key_id,'R45 parent trust key id mismatch');

package/scripts/windows-gate-evidence-r53.mjs

@@ -0,0 +1,102 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const stateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(), '.deadbyte-mcp'));
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const insist = (ok, message) => { if (!ok) throw new Error(message); };
+const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+const release = JSON.parse(await readFile(path.join(root, 'RELEASE.json'), 'utf8'));
+const provenance = JSON.parse(await readFile(path.join(root, 'PROVENANCE.json'), 'utf8'));
+const matrix = JSON.parse(await readFile(path.join(root, 'TEST-MATRIX.json'), 'utf8'));
+const active = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
+const manifestSha256 = sha256(await readFile(path.join(root, 'MANIFEST.SHA256')));
+
+insist(pkg.version === '0.15.30' && release.version === pkg.version && release.train === 'R53', 'R53 candidate identity mismatch');
+insist(
+  active.release_id === release.runtime_predecessor.release_id &&
+  active.manifest_sha256 === release.runtime_predecessor.manifest_sha256 &&
+  active.generation_manifest_sha256 === release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.29 predecessor'
+);
+insist(release.parent.version === '0.15.29', 'R53 parent version mismatch');
+insist(release.parent.release_id === 'v0.15.29-f74eaa1b3d00e6fb', 'R53 parent release id mismatch');
+insist(release.parent.manifest_sha256 === 'f74eaa1b3d00e6fb5a36b2358efb815e3686c9fe9dbd3b84d25a713ef957748c', 'R53 parent manifest mismatch');
+insist(release.parent.generation_manifest_sha256 === '289b4fc065de0681da6864cc1bbe09aab198ca804945ffc27c786438dad13f5a', 'R53 parent generation mismatch');
+insist(release.parent.tarball_sha256 === 'f535d7121a384bed106d34bc7525afa9d4048c7e290f270699e25136d1e82eeb', 'R53 parent tarball mismatch');
+insist(provenance.parent_release_id === release.parent.release_id, 'R53 provenance parent release mismatch');
+insist(provenance.parent_manifest_sha256 === release.parent.manifest_sha256, 'R53 provenance parent manifest mismatch');
+insist(provenance.parent_generation_manifest_sha256 === release.parent.generation_manifest_sha256, 'R53 provenance parent generation mismatch');
+insist(provenance.operator_override?.four_hour_soak === 'NOT_COMPLETED', 'R53 soak bypass missing');
+insist(provenance.operator_override?.stable_final_claim === false, 'R53 must not claim stable/final');
+insist(matrix.operator_override?.four_hour_soak === 'NOT_COMPLETED', 'R53 matrix soak bypass missing');
+
+const health = await doctor();
+insist(health.status === 'ok' && health.package_version === pkg.version && health.manifest?.verified === true, 'R53 doctor evidence invalid');
+insist(health.policy?.host_v2_ready === true, 'R53 Host policy v2 is not ready');
+
+const evidence = {
+  schema: 'deadbyte.r53-windows-gate.v1',
+  status: 'passed',
+  exit_code: 0,
+  version: pkg.version,
+  train: 'R53',
+  completed_at_utc: new Date().toISOString(),
+  manifest_sha256: manifestSha256,
+  parent: release.parent,
+  runtime_predecessor: release.runtime_predecessor,
+  stabilization: release.stabilization,
+  operator_override: provenance.operator_override,
+  active_predecessor: {
+    release_id: active.release_id,
+    version: active.version,
+    manifest_sha256: active.manifest_sha256,
+    generation_manifest_sha256: active.generation_manifest_sha256
+  },
+  doctor: { verified_entries: health.manifest.verified_entries, host_v2_ready: true },
+  gates: {
+    r53_focused: true,
+    package_boundary: true,
+    release_smoke_isolation: true,
+    runtime_coherence: true,
+    coding_command_singleflight: true,
+    foreground_desktop_host_fail_closed: true,
+    full_regression: true,
+    commander_hardening: true,
+    donor_proof: true,
+    desktop_wait: true,
+    exact_catalog: true,
+    stdio_smokes: true,
+    manifest_final_verify: true,
+    four_hour_soak_completed: false
+  }
+};
+
+const bytes = Buffer.from(`${JSON.stringify(evidence, null, 2)}\n`);
+const dir = path.join(stateRoot, 'evidence', 'release');
+await mkdir(dir, { recursive: true });
+const target = path.join(dir, `r53-windows-gate-${manifestSha256.slice(0, 16)}.json`);
+
+try {
+  const handle = await open(target, 'wx', 0o600);
+  try { await handle.writeFile(bytes); await handle.sync(); }
+  finally { await handle.close(); }
+} catch (error) {
+  if (error?.code !== 'EEXIST') throw error;
+  const prior = JSON.parse(await readFile(target, 'utf8'));
+  insist(
+    prior.schema === evidence.schema &&
+    prior.status === 'passed' &&
+    prior.version === evidence.version &&
+    prior.manifest_sha256 === manifestSha256 &&
+    prior.parent?.release_id === release.parent.release_id &&
+    prior.operator_override?.four_hour_soak === 'NOT_COMPLETED',
+    'conflicting R53 gate evidence identity'
+  );
+}
+
+console.log(JSON.stringify({ status: 'passed', path: target, sha256: sha256(bytes), manifest_sha256: manifestSha256 }));