deadbyte-mcp 0.15.34 → 0.15.36

package/proof/r59-full-regression-current.stdout.log

@@ -0,0 +1,1268 @@
+R48-BOUNDED-REGRESSION batch=1/8 files=34
+✔ compaction preserves proof identity while dropping stale payload bytes (2.9187ms)
+✔ same input always produces byte-identical compacted context (2.5925ms)
+✔ secret-like fields are redacted without exposing raw values or a hash oracle (1.3784ms)
+✔ project memory derives stable acceptance, failures and unresolved blockers from journal events (0.7137ms)
+✔ buildLoopContext produces the three named layers and respects the policy budget (1.6131ms)
+✔ R35 buildLoopContext attaches provenance and deduplicates identical retained context by newest observation (0.3917ms)
+✔ R35 deterministic compaction elides payload but preserves provenance envelope (1.125ms)
+✔ planner prompt serializes the R34 three-layer context instead of the legacy flat state (0.5065ms)
+✔ R24 live autonomous fixture is restored to release state (2.7885ms)
+✔ restart replay derives byte-equivalent logical loop state (2.3003ms)
+✔ action started without completion remains pending after replay (0.2799ms)
+✔ verified action completion clears pending action and phase may advance to verifying (0.8199ms)
+✔ replan and waiting state are durable and expose approval reason (0.3967ms)
+✔ release completion is terminal and cannot regress to a mutable phase (0.4348ms)
+✔ phase transition from a stale source phase fails closed (0.2522ms)
+✔ R24 autonomous goal diagnoses a failing test, replans with native diff, benchmarks, and releases (1654.8842ms)
+✔ historical autonomous release verification survives source drift and disarmed mutation authority (1570.1389ms)
+✔ autonomous profile execution is capped by the absolute autonomous lease without changing coding request identity (1501.3609ms)
+✔ autonomous profile nonce rotation immediately before spawn fails closed without a coding receipt (361.6066ms)
+✔ provider planner repairs an invalid structured decision inside the same run (1561.7417ms)
+✔ provider circuit survives runtime restart and permits exactly one probe at the HALF_OPEN boundary (369.4273ms)
+✔ provider supervisor adopts an OPEN circuit after restart and resumes only at HALF_OPEN boundary (1865.479ms)
+✔ provider supervisor completes a submitted goal without client run calls (1689.5063ms)
+✔ R59 bridge governor removes cancelled queued work and drains without replay (1.5018ms)
+✔ R59 bridge health requires fresh child negotiation catalog and v3 capability attestation (1.2783ms)
+✔ capability resolver enforces 5 canonical states (0.5056ms)
+✔ R59 live plane state can only reduce signed capability availability (0.8728ms)
+✔ deriveCapabilityRequirements maps dependencies accurately (0.1938ms)
+✔ resolveCapabilityStates resolves all 5 states correctly (1.0281ms)
+✔ capability resolver reports actual disarmed authority across coding process autonomous desktop and host (3.3515ms)
+✔ capability resolver reports armed Host capability when the standing grant is valid (3.4362ms)
+✔ new coding runtime generation adopts a signed write after process death without repeating mutation (457.7964ms)
+✔ coding mutation uncertainty survives the public structured error boundary (6.8117ms)
+✔ pinned reference rejects a real BIFF8 workbook and writes OOXML bytes under .xls (341.434ms)
+{"tool_count":43,"catalog_sha256":"dde7d10e85c52beb285e3adf41b69dece11162ab0bc8233f056e471f653776d6","ledger_sha256":"6acf1de7b66f1173eba1c33fe76e5053fb9e3cd15f0244da3bc06d3275c43021","desktop":true,"skill":true,"authority":"DISARMED"}
+✔ R44 real max-runtime compact stdio catalog is exactly 43 with verified skill_catalog while all authority remains disarmed (1930.0627ms)
+✔ contained launcher treats anonymous-pipe ERROR_BROKEN_PIPE as normal stdin EOF (5.2542ms)
+✔ contained executor rejects a launcher-reported truncated stdin import (0.5662ms)
+✔ contained invocation request digest binds challenge input operation manifest and worker identity (0.7582ms)
+✔ contained result rejects stale invocation challenge or request digest (0.639ms)
+✔ native launcher independently recomputes invocation digest before worker launch and workers echo it (3.1109ms)
+✔ contained executor cross-checks native manifest and selected-worker hashes before signing receipt (0.54ms)
+✔ trusted contained host launcher inherits Windows host environment instead of a lossy hand-picked subset (0.5637ms)
+✔ AppContainer worker receives only the fixed bootstrap allowlist plus drive current-directory state (1.2918ms)
+✔ contained launcher reports the exact bootstrap environment policy in runtime evidence (0.5685ms)
+✔ contained execution validator rejects a missing LOCALAPPDATA bootstrap marker (0.3142ms)
+✔ contained execution validator rejects a non-exact worker environment allowlist (0.1525ms)
+✔ contained execution validator rejects a missing drive-current-directory environment entry (0.096ms)
+✔ contained execution validator accepts the complete fixed-transform invariant set (0.1166ms)
+✔ contained execution validator rejects any granted capability (0.067ms)
+✔ contained execution validator rejects host workspace mounting (0.0544ms)
+✔ contained execution validator rejects non-atomic Job assignment (0.0666ms)
+✔ contained execution validator rejects normal child payload execution (0.0614ms)
+✔ contained execution validator rejects explicit breakaway payload execution (0.1014ms)
+✔ contained execution validator rejects a non-AppContainer worker (0.09ms)
+✔ contained execution source has a compile-time worker registry and no user executable parameter (3.0417ms)
+✔ contained launcher imports by stdin/profile copy and never mounts a host workspace (1.291ms)
+✔ contained workers recheck AppContainer, zero capabilities, canaries, Job and child denial (0.6763ms)
+✔ native build produces the contained launcher and worker with static runtime (0.5478ms)
+✔ native build emits a deterministic worker registry manifest and launcher verifies it before execution (0.5631ms)
+✔ V0.7 contained execution has compile-time budgets and a pre-export semantic gate (0.5153ms)
+✔ receipt and verifier bind contained worker, launcher and independent transform semantics (0.5151ms)
+✔ MCP protocol smoke derives the exact full catalog and explicitly disables Host (0.3715ms)
+✔ contained receipt verifies fixed runtime hashes and independently recomputed transform semantics (28.5692ms)
+✔ independent verifier rejects invocation digest tamper and partial invocation evidence (21.5325ms)
+✔ independent verifier preserves pre-V0.4.7 contained receipt compatibility but rejects partial manifest evidence (17.3286ms)
+✔ contained operation registry accepts lowercase_ascii and rejects unknown operations (0.2496ms)
+✔ native launcher uses a compile-time operation-to-executable registry (1.1755ms)
+✔ contained execution validator binds operation to fixed worker identity and executable (0.2425ms)
+✔ build-generated worker registry manifest binds launcher and both worker hashes and rejects tamper (4.8851ms)
+✔ contained execution validator rejects missing or altered worker manifest evidence (0.1969ms)
+✔ MCP contained_transform schema is a compile-time operation enum with no executable or invocation-control surface (0.6298ms)
+✔ R27 Windows batch gate builds native payload before freezing and verifying the candidate (0.4629ms)
+✔ contained receipt verifies lowercase_ascii semantics and rejects semantic tamper (16.26ms)
+✔ contained receipt verifies reverse_bytes through the fixed reverse worker and rejects tamper (18.6756ms)
+✔ active network proof uses a host-positive-control loopback listener and requires AppContainer denial (1.0545ms)
+✔ contained execution validator fails closed on active network evidence (0.2156ms)
+✔ execution authority is strict at MCP and native argv boundaries (1.0514ms)
+✔ R40 controller exposes Desktop runtime config but never auto-arms it (4.3843ms)
+✔ R40 Desktop standing grant is policy-digest and action-scope bound (1.698ms)
+✔ R40 Desktop environment reaches Bridge only and is restored after spawn (0.7593ms)
+✔ R40 lifecycle revokes Desktop before park stop restart and supervisor recovery (0.9309ms)
+✔ R40 policy initializer pins current native observer and input and starts DISARMED (0.5224ms)
+✔ R40 status exposes Desktop runtime and authority independently (0.5782ms)
+✔ R59 controller refuses to arm process or coding policy with a missing root (312.7531ms)
+✔ R21.1 binds controller execution to CoreRoot controller directory (3.0481ms)
+✔ R21.1 validates controller root before creating command runtime directories (1.0718ms)
+✔ R27 controller binds Bridge downstream core to configured CoreRoot (3.8852ms)
+✔ R27 controller can externalize mutable controller runtime state (1.5479ms)
+✔ R27 controller supports a trusted stable WorkspaceRoot independent of release CoreRoot (0.8623ms)
+✔ R27 controller pins external Bridge script bytes into owned runtime identity (0.8017ms)
+✔ R27 controller pins Bridge and Cloud executable bytes before launch (0.6272ms)
+✔ R28 controller hash-pins the stable MCP URL file for named tunnel v2 (0.7661ms)
+✔ R33 deferred worker survives scheduler exit and stays bound to explicit state root (4397.6425ms)
+✔ desktop native input protocol serializes one fixed click with frame-derived environment binding (1.9271ms)
+✔ desktop native input text protocol is byte-counted and preserves raw UTF-8 after bounded header (0.3719ms)
+✔ desktop native input protocol rejects out-of-bounds point before process launch (0.4027ms)
+✔ desktop native input response is bound to exact action desktop and foreground identity (0.4823ms)
+✔ R40 desktop action schema rejects ambiguous or authority-bypassing shapes (5.4836ms)
+✔ R40 T5 target schema supports local UIA query without arbitrary dispatch (0.7455ms)
+✔ successor desktop wait schema is bounded, semantic, and rejects action-shaped fields (0.6433ms)
+✔ successor full desktop surface registers bounded semantic wait without mutation authority (0.6406ms)
+✔ R40 public desktop action output removes raw text while preserving content and action hashes (1.3665ms)
+✔ privileged host plane requires a live policy-bound arm lease (335.4099ms)
+✔ host authority recheck rejects arm generation or expiry drift before side effects (171.0095ms)
+✔ host_file_write is root-scoped hash-precondition and host_file_read returns a verified digest (186.4215ms)
+✔ host file plane denies path traversal and symlink escape (170.0651ms)
+✔ host_exec runs only a hash-pinned script through a hash-pinned executable with no shell string (305.7355ms)
+✔ JEV allows typed autonomous mutation without granting execution (1.6258ms)
+✔ JEV rejects host authority escape from delegated planner action (0.2665ms)
+✔ JEV rejects desktop mutation when Desktop authority is absent (0.2512ms)
+✔ hash-chain preserves operation continuity (1.7273ms)
+✔ payload mutation after append cannot alter recorded digest (0.2172ms)
+✔ event cap creates explicit bounded-retention overflow (0.6269ms)
+✔ byte cap creates explicit overflow boundary (1.2747ms)
+✔ same operation cursor resumes after acknowledged boundary without duplicates (0.3123ms)
+✔ receipt exposes evidence head without becoming authority (0.2576ms)
+✔ R43 parity requires exact R42 predecessor and immutable R43 slot (1.3773ms)
+✔ R43 release machinery binds 0.14.1 exact R42 predecessor and no fresh model credential dependency (5.2297ms)
+✔ R54 exposes behavior-testable offline recovery blocker selection (0.7309ms)
+✔ R54 excludes only the current activation ancestry across non-Node wrapper processes (0.6681ms)
+✔ R54 does not exempt a sibling stale DEADBYTE runtime (0.1176ms)
+✔ R54 still blocks unrelated stale guardian, tunnel, and cloud DEADBYTE processes (0.2437ms)
+✔ R54 ignores unrelated Node processes without DEADBYTE runtime identity (0.1088ms)
+﹣ R54 release identity is coherent across package lock source metadata SBOM and gate (0.4837ms) # SKIP
+﹣ R54 source predecessor is exact immutable published 0.15.30 while runtime predecessor remains exact 0.15.29 (0.0868ms) # SKIP
+﹣ R54 records surgical activation recovery fix and preserves explicit non-final claim (0.0681ms) # SKIP
+✔ R58 core observation is parent/generation bound, singular and never retries ambiguity (323.7522ms)
+✔ R58 actual isolated controller/bridge/core reaches ONLINE and stops without an orphan core (52569.4893ms)
+✔ R58 controller human state cannot claim ONLINE/local ready without its verified core (262.53ms)
+✔ R58 controller startup readiness retries only zero-child core visibility and rejects ambiguity immediately (231.9461ms)
+﹣ R58 identity is coherent and parent is exact production-accepted 0.15.34 (0.4981ms) # SKIP
+﹣ R58 consolidation evidence preserves fail-closed and non-final claims (0.0999ms) # SKIP
+✔ R27 release ids bind exact semver and manifest generation (0.8665ms)
+✔ R27 manifest parser rejects traversal duplicates and malformed lines (0.7111ms)
+✔ R27 copies and verifies exactly the manifest package tree (19.2306ms)
+✔ R27 release slot materialization copies only manifest-bound files and adopts exact generations (30.5581ms)
+✔ R27 active pointer is schema bound and atomically replaceable (7.1847ms)
+✔ R27 stable launcher resolves only the active pointer, not a release hardcode (0.4567ms)
+✔ R29 release smokes isolate mutable output from immutable package workspaces (2.9597ms)
+✔ R40 human live timeline suppresses noisy read request and emits one categorized terminal line (3.5699ms)
+✔ R40 long or mutating call gets start line and terminal error carries sanitized reason (0.7245ms)
+✔ R40 heartbeat burst folds repeated status calls instead of printing every round-trip (0.9748ms)
+✔ R40 transport IN/OUT echo is hidden by default and available only in verbose diagnostics (0.2877ms)
+✔ R40 argument summaries are human-sized and do not expose payload text (0.2802ms)
+✔ R40 interrupted spans remain correlated and session summary is available (0.5921ms)
+✔ R40 CLI exposes explicit verbose mode while keeping default live mode compact (5.2418ms)
+✔ R40 ASCII display fallback contains no non-ASCII bytes and preserves terminal meaning (0.5303ms)
+✔ R40 interrupted side effect is explicit failed-after-unknown-effect instead of implying replay safety (0.3685ms)
+✔ R40 UTF-8 truncation never splits Thai or emoji into replacement characters (0.226ms)
+✔ visual opcode projection resolves multiplexed machine_fs operation and exposes terminal evidence (0.2974ms)
+✔ visual opcode projection reserves warning semantics for explicitly unknown side effects (0.2187ms)
+✔ absolute Windows root rendering shows the operator the real host path and root identity (0.2066ms)
+✔ trace mode exposes deterministic trace/span hierarchy without payload bytes (0.2481ms)
+✔ timeline filter keeps audit observation complete while selecting presentation by category status and trace (0.2706ms)
+✔ TTY writer rewrites matching visible start in place and never rewrites unrelated output (0.154ms)
+✔ expanded session summary reports outcome classes latency and slowest tool (7.3736ms)
+✔ R51 live timeline marks slow calls and reports peak in-flight concurrency (0.2413ms)
+✔ semantic LSP config normalizes explicit pinned server identities (1.4663ms)
+✔ semantic LSP config rejects unpinned, relative, duplicate, or ambiguous server declarations (1.0717ms)
+✔ semantic LSP config bounds startup settle to five seconds (0.2535ms)
+✔ semantic LSP config bounds transient read retry policy and keeps empty-result retries opt-in (0.2858ms)
+✔ semantic LSP config load verifies executable and dependency bytes before producing backends (242.8423ms)
+✔ semantic LSP environment binding requires config path and SHA-256 together (0.3313ms)
+✔ child normalization preserves custom module paths and unrelated environment (0.9934ms)
+✔ normalized Windows PowerShell resolves native Get-FileHash for inherited, missing and custom paths (582.804ms)
+✔ R42 task contract is identity-bound and visible to every planner round (40.1664ms)
+✔ R42 task contract rejects authority widening fields and invalid risk (7.7625ms)
+ℹ tests 167
+ℹ suites 0
+ℹ pass 162
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 5
+ℹ todo 0
+ℹ duration_ms 76280.0599
+R48-BOUNDED-REGRESSION batch=2/8 files=33
+✔ R42 generator never receives judge-only oracle or hidden ground truth (1.4996ms)
+✔ R42 fresh critic context contains artifacts and evidence but no implementer assumptions (0.8587ms)
+✔ R42 judge remains advisory and controller triage owns repair decision (0.2713ms)
+✔ existing signed task receipt is verified and adopted after crash before task_completed event (120.1847ms)
+✔ task receipt tamper is rejected even when journal remains intact (85.1302ms)
+✔ post-rename observation failure is explicit unknown effect and committed bytes are not replayed (13.3124ms)
+✔ pre-effect authority denial remains failed-before-effect (6.1791ms)
+✔ postcondition verifier loss after exact commit is explicit unknown effect (8.729ms)
+✔ R36 planner parses first-class capability actions without delegate wrapper (9.8643ms)
+✔ R40 T7 planner rejects ambiguous Desktop actions before runtime (0.6417ms)
+✔ R36 legacy delegate is accepted only for a known operation and normalized into typed action (1.7703ms)
+✔ R36 planner prompt exposes configured capability manifest and never advertises Host (1.6823ms)
+✔ R40 T6 autonomous planner receives bounded Desktop memory projection as context only (34.8474ms)
+✔ R36 progress fingerprint ignores rationale but binds capability, evidence, session and cursor identity (0.5888ms)
+✔ R36 typed stat executes through the autonomous loop and records capability-bound evidence (99.9226ms)
+✔ R36 typed native_diff_apply binds expected operation count and advances mutation epoch only after verified apply (137.7563ms)
+✔ R36 typed machine_fs_mkdir is promoted to Native Diff V2 and advances mutation epoch (114.0855ms)
+✔ R34 compact planner state projects recent context, observations, and mutation epoch (1.4167ms)
+✔ legacy planner state remains compatible (0.1268ms)
+✔ R35 benchmark corpus exposes the exact required offline case set (1.2353ms)
+✔ fixture identity is deterministic and changes when any declared fixture byte changes (5.0749ms)
+✔ runner fails closed on a failed case and returns evidence-backed metrics for passing cases (115.2849ms)
+✔ R36 benchmark Python symbol navigation (259.547ms)
+✔ R36 benchmark Rust symbol navigation (261.3165ms)
+✔ R36 benchmark Cpp symbol navigation (264.2038ms)
+✔ R36 capability ledger rejects duplicate ids (0.897ms)
+✔ R36 capability ledger validates authority and canonicalizes identity (0.7096ms)
+✔ R36 surface profile defaults full and accepts only full or compact (0.2472ms)
+✔ R36 compact closure covers every production non-host capability (0.2639ms)
+✔ R36 closure fails when a production route is lost or advertised tool is absent (0.2675ms)
+✔ R44 compact surface hard-fails above the observed 43-tool ceiling (0.2225ms)
+✔ R52 caller disconnect retains one durable execution, status, attempts and terminal receipt (1286.6919ms)
+✔ R52 cancelling a running durable command stops its owned descendants before terminal state (408.2991ms)
+✔ coding plane edits files under lease and verifies signed action receipts (193.3672ms)
+✔ R36 coding stat exposes mutation-relevant observation identity (172.8674ms)
+✔ coding plane rejects mutation when lease is absent or precondition is stale (168.4199ms)
+✔ coding authority recheck rejects lease generation or expiry drift before commit (173.1883ms)
+✔ coding execution deadline bounds runtime without changing the signed request identity (3184.3544ms)
+✔ coding command and benchmark produce signed observations (706.0184ms)
+✔ durable coding task chains edit command benchmark and verifies task receipt (612.8734ms)
+✔ coding mutation and execution boundaries fail closed (185.6949ms)
+✔ benchmark emits a signed regression verdict without disguising it as transport failure (421.1509ms)
+✔ coding task is idempotent, checkpointed, cancellable, and journal-authenticated (202.8874ms)
+✔ coding task rejects recomputed journal content without the private signing key (170.3413ms)
+✔ R51 coding command retries reuse one in-flight execution and completed receipt (603.9313ms)
+✔ R51 coding command single-flight spans independent runtime instances sharing evidence state (913.3412ms)
+✔ Commander surface has a native DEADBYTE target for every observed core capability (1.1585ms)
+✔ mutations require state preconditions (0.3764ms)
+✔ adapter binds request, result and before/after state into a verification receipt (0.3055ms)
+✔ native source rejects a Commander package dependency (0.1556ms)
+✔ Commander observability exposes bounded usage stats with integrity evidence (9.0778ms)
+✔ Commander observability recent calls preserves bounded history semantics (0.6163ms)
+✔ Commander observability rejects forged history providers (0.1146ms)
+✔ R47 Commander parity gate: all observed core capabilities map to native DEADBYTE surfaces (1.4582ms)
+✔ R47 Commander parity gate: native source tree has no Commander package dependency (4.1035ms)
+✔ R47 Commander parity gate: mutation contracts require explicit state binding (0.3294ms)
+✔ R47 remote Commander bridge routes remote_device directly to remote-device-r44 plane (5.7274ms)
+✔ R47 remote_mcp is a thin dispatch surface and never shells out to Commander (1.1922ms)
+✔ R47 remote surfaces fail closed as unavailable when no remote-device-r44 plane is wired (1.0946ms)
+✔ T6 memory derives only authenticated compact Desktop facts and never carries raw payload or authority nonce (3.3121ms)
+✔ T6 memory keeps unknown effects unresolved until authenticated completion appears (7.8453ms)
+✔ T6 rejects receipt substitution before memory trust (0.4807ms)
+✔ T6 signed snapshot persists atomically and verifies independently (7.9409ms)
+✔ T6 evidence provider loads bounded signed receipts and emits compact planner projection (9.0012ms)
+✔ T6 evidence loader fails closed instead of silently truncating receipt history (2.6793ms)
+✔ T6 current-policy memory rebuild ignores authenticated historical receipts from superseded Desktop policy (6.2839ms)
+✔ native parser binds pixels, topology and foreground identity (1.875ms)
+✔ native parser rejects payload length substitution (0.5284ms)
+✔ native parser rejects stride and byte length lies (0.7957ms)
+✔ native parser rejects monitor topology outside virtual desktop (0.3747ms)
+✔ native parser requires exactly one primary monitor (0.2585ms)
+✔ observer runtime creates stable epoch family and distinct frame identities (0.8983ms)
+✔ observer runtime evicts old raw frames by bounded cache (1.0399ms)
+✔ observer runtime rejects secure or unexpected input desktop (0.2853ms)
+✔ raw title and process image do not escape parsed active-window identity (0.2037ms)
+✔ T5 preview is deterministic PPM and hard-bounded by max_preview_bytes (0.4447ms)
+✔ R44 controller/session jobs never masquerade as persistent after owner restart (24.8228ms)
+✔ R44 persistent job reattaches only through external supervisor with exact process identity (14.0303ms)
+✔ R44 persistent lifetime rejects controller-local provider and state corruption (6.4418ms)
+✔ R44 terminate binds exact supervisor handle and becomes durable terminal state (9.8944ms)
+{"tool_count":80,"catalog_sha256":"bf7e4dbd89f5b9e8bcaeda1f4cfe60930278266643acfbdd9b60a0fc36866f1b","desktop_tools":4,"authority":"DISARMED"}
+✔ R40 real max-runtime full stdio catalog is exactly 80 with four Desktop primitives while authority remains disarmed (1699.6682ms)
+✔ process policy loads pinned native host, profile and root while grant is absent (266.3679ms)
+✔ process standing grant binds exact policy, profile and root (258.0348ms)
+✔ process authority recheck rejects grant generation or scope drift before side effects (257.6793ms)
+✔ process grant with wrong policy digest is disarmed (251.2807ms)
+✔ process policy rejects changed pinned executable bytes (246.4123ms)
+✔ process policy rejects profile roots that are not registered (89.1287ms)
+✔ process policy pins named input actions into the policy (252.9353ms)
+✔ process policy accepts explicit pipe transport and rejects unknown transports (246.3187ms)
+✔ process policy rejects named actions larger than the profile input bound (83.7288ms)
+✔ R42 policy accepts bounded OpenAI Responses planner configuration (10.8104ms)
+✔ R42 Responses adapter sends JSON mode and extracts bounded output with provenance (20.2286ms)
+✔ R42 Responses adapter fails closed on refusal and incomplete response (1.2715ms)
+✔ R38 parity validator requires full-76, compact closure, exact public 0.11.1 predecessor and immutable-slot separation (1.1655ms)
+✔ R38 parity captures R38 bridge, exact public 0.11.1 predecessor, stage reseed and successor restore (3.9073ms)
+✔ R38 current final closure writer and independent verifier bind R38 domains and public 0.11.1 predecessor (1.9998ms)
+✔ R38 bounded public parity suite covers current release identity and agent fabric (4.0735ms)
+✔ R40 parity validator requires full-80 compact-42 six gateways Desktop proof exact 0.11.3 predecessor and immutable separation (1.194ms)
+✔ R40 parity binds exact sealed 0.11.3 predecessor and separate Desktop authority smoke (3.522ms)
+✔ R40 deferred activation binds pinned Desktop policy and enables runtime without an arm command (1.0791ms)
+✔ R40 final closure writer and independent verifier bind R40 domains Desktop disarm and exact predecessor (1.3827ms)
+✔ R40 Windows gate refreshes Desktop policy before manifest freeze and emits R40 evidence (3.3896ms)
+✔ R40 bounded release parity suite includes Desktop updater generation and autonomous integration proofs (0.6009ms)
+✔ R40 guarded Desktop smoke retries only bounded pre-dispatch foreground drift and never replays an unknown effect (0.7631ms)
+✔ R41 parity requires exact R40 predecessor and immutable R41 slot (1.8417ms)
+✔ R41 release machinery binds 0.13.0, R40 predecessor, memory gates and R41 domains (6.5071ms)
+✔ R41 derived memory storage is namespaced by exact release manifest (5.2536ms)
+✔ R47 historical release contract remains frozen at 0.15.18 and canonical 115-tool catalog (4.0456ms)
+✔ R51 live log discovery tails only current and previous audit segments plus runtime logs (1.102ms)
+✔ R51 live tail caches directory discovery instead of rescanning every 250ms poll (2.8499ms)
+✔ R51 live tail parses each audit line once and reuses the decoded event (0.6509ms)
+✔ R58 deployment activates the bridge bundled inside the candidate release, not predecessor mutable workspace (2.5774ms)
+﹣ R58 bundled bridge package is present and version-bound to 0.15.35 (0.1744ms) # SKIP
+✔ R58 simultaneous stale recovery cannot both revoke the shared authority (4391.9138ms)
+✔ R40 remote console keeps Unicode off Windows and forces deterministic ASCII when requested (1.4862ms)
+✔ R40 Windows pipe uses ASCII fallback instead of emitting mojibake (0.6249ms)
+✔ R40 Windows TTY switches shared console code page to 65001 before enabling Unicode (0.2566ms)
+✔ R40 Windows TTY falls back to ASCII when code-page setup fails (1.3376ms)
+✔ R32 updater loads controller data with Windows PowerShell modules isolated from parent runtime paths (224.4953ms)
+✔ R36 updater keeps detached start semantics and binds controller sidecar diagnostics (1.2032ms)
+✔ R27 slot-update CLI requires exact stage/development/version/manifest bindings (0.9663ms)
+✔ R43 slot authority restore plan carries prior Process grant without restoring Desktop or Host (0.4048ms)
+✔ R27 development root is outside immutable/runtime state stores (1.6087ms)
+✔ R27 controller start transport returns while its long-lived descendant is still alive (142.1601ms)
+✔ R36 controller start sidecar is schema-bound and hash-bound (4.1641ms)
+✔ R36 updater preserves exact controller-start failure evidence before rollback (7.3222ms)
+✔ R28 slot-update CLI binds direct cloudflared plus external token file as one pinned contract (0.6583ms)
+✔ R28 named tunnel bootstrap rebinds release host and verifies cloudflared plus token-file pins (3.7614ms)
+✔ R28 derives and pins one stable full MCP URL from persistent origin plus external path token (4.3164ms)
+✔ R28 updater requires a stabilization window and public MCP smoke before completion receipt (0.7374ms)
+✔ R47 runtime updater arms a detached supervisor before any destructive stop (0.6154ms)
+✔ R47 supervisor resume parser is exact and recovery scans only durable update state (0.393ms)
+✔ R47 interrupted transition has explicit durable recovery phases (0.8842ms)
+✔ R47 MCP core startup invokes durable interrupted-update recovery before serving (0.4524ms)
+✔ R47 Windows detached supervisor survives termination of its parent process (484.0101ms)
+✔ R29 slot-update CLI requires explicit hash-bound host repins and offline recovery opt-in (0.6584ms)
+✔ R29 host policy repin changes only drifted executable hashes under exact operator pins (3.8319ms)
+✔ R29 authority repin propagates one exact observed executable hash across host and coding policies (2.1379ms)
+✔ R29 slot-update CLI accepts bridge rebind only as an exact root plus script hash pair (0.4292ms)
+✔ R31 slot-update CLI binds process-policy bootstrap and machine-FS enable explicitly (0.2639ms)
+✔ R46 slot-update CLI binds coding policy bootstrap as one exact pair (0.1981ms)
+✔ R40 slot-update CLI binds Desktop policy as one exact pair and enables runtime only explicitly (0.2657ms)
+✔ R46 coding policy bootstrap accepts only exact pinned enabled policy bytes (3.4221ms)
+✔ R40 Desktop policy bootstrap accepts only exact pinned enabled policy bytes (2.338ms)
+✔ R40 updater threads Desktop policy into generation and never restores Desktop authority automatically (0.6738ms)
+✔ R35 slot-update CLI binds semantic LSP config as one exact path plus SHA-256 pair (0.2971ms)
+✔ R35 semantic LSP bootstrap accepts only exact pinned semantic config bytes (1.8113ms)
+✔ R35 updater threads pinned semantic LSP config into successor generation (0.5133ms)
+✔ R32 slot-update CLI enables observation only by explicit flag (0.2524ms)
+✔ R34 slot-update CLI enables the out-of-band supervisor only by explicit flag (0.1229ms)
+✔ R34 supervisor bootstrap derives exact release-bound script identity from trusted Bridge executable (151.8752ms)
+✔ R31 process-policy bootstrap accepts only an exact pinned enabled process policy (3.3583ms)
+✔ R29 bridge bootstrap rebinds only the pinned external bridge script (85.8745ms)
+✔ R44 downstream core selection accepts only one exact visible or one opaque child of the verified Bridge (0.5979ms)
+✔ R31 updater threads pinned process policy and machine-FS enable into successor generation (1.1528ms)
+✔ R31 rollback CLI requires one exact activation receipt without update arguments (0.231ms)
+✔ R31 explicit rollback restores the exact signed prior pointer instead of regenerating it (0.6747ms)
+✔ R29 signed activation receipt preserves observed prior host authority (0.597ms)
+✔ semantic tools provide outline, definition, references and receipt-backed edit by symbol (2347.0841ms)
+✔ semantic LSP backend normalizes outline definition references diagnostics and receipt-path replacement (1281.6308ms)
+✔ semantic LSP backend rejects targets outside lease/root policy before launching server (3.1507ms)
+✔ semantic LSP backend forwards dependency pins before launching server (75.1541ms)
+✔ semantic LSP backend separates engine id from LSP language id (140.158ms)
+✔ semantic LSP backend pre-opens bounded same-language project files for deterministic cross-file navigation (272.6934ms)
+﹣ R35 python semantic tracer proves outline definition references and receipt-backed replace (0.572ms) # SKIP
+﹣ R35 rust semantic tracer proves outline definition references and receipt-backed replace (0.0927ms) # SKIP
+﹣ R35 cpp semantic tracer proves outline definition references and receipt-backed replace (0.0752ms) # SKIP
+✔ schema hash is canonical across object key ordering and preserves array ordering (9.265ms)
+✔ tool surface snapshot is deterministic and rejects duplicate or non-JSON schema content (1.2495ms)
+✔ surface diff classifies removals additions and schema changes without ordering noise (0.3677ms)
+✔ MCP tools/list result snapshots the exact client-visible schemas and rejects malformed tools (0.3408ms)
+✔ R48 compact machine_observe exposes seven strict Windows native operations without generic command dispatch (2.3939ms)
+✔ R48 compact machine_observe routes all Windows operations to one typed runtime method (4.8064ms)
+✔ R48 full observation surface exposes one typed machine_windows_query tool (1.4557ms)
+✔ R48 capability ledger declares every Windows observation through compact machine_observe (0.1912ms)
+ℹ tests 175
+ℹ suites 0
+ℹ pass 171
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 4
+ℹ todo 0
+ℹ duration_ms 33406.387
+R48-BOUNDED-REGRESSION batch=3/8 files=33
+✔ new runtime generation reconciles signed side effect after process death (189.9106ms)
+✔ audit context binds verified active release, generation, machine and all authority planes (9.2914ms)
+✔ audit context fails closed when active machine binding disagrees with executing package manifest (3.7112ms)
+✔ action identity is deterministic and changes when plan version changes (2.1197ms)
+✔ verified mutation receipt classifies as executed without replay (0.338ms)
+✔ missing mutation evidence is not executed and may retry with the same identity (0.1707ms)
+✔ conflicting or unverifiable mutation evidence is ambiguous and never replayed (0.2282ms)
+✔ verified profile failure is recovered as executed_failed_verified (0.2633ms)
+✔ receipt substitution or stale request identity is ambiguous (0.7146ms)
+✔ R34 loop executes plan -> inspect -> act -> verify -> step complete -> finish (262.0646ms)
+✔ R34 missing authority waits durably and approval resumes the same phase after operator re-arm (126.694ms)
+✔ R34 finish is blocked while the active plan is incomplete (40.9617ms)
+✔ R34 failed verification enters REPLANNING with regressed progress evidence (392.7697ms)
+✔ R34 operator reject cancels a waiting goal without requiring authority re-arm (58.1005ms)
+✔ R34 stale SHA returns to REPLANNING without force overwrite (74.9546ms)
+✔ R34 forged profile receipt substitution enters WAITING without replay (400.8436ms)
+✔ R34 multi-step fail replan repair finish emits independently verifiable release evidence (868.412ms)
+✔ R34 v2 crash after durable mutation reconciles the same action without duplicate apply (130.5339ms)
+✔ R35 benchmark schema is exact and preserves separate measurable dimensions (1.1217ms)
+✔ benchmark rejects missing evidence and invalid measurements instead of manufacturing a score (0.465ms)
+✔ aggregate identity is deterministic across timing changes while fixture/correctness verdicts remain inspectable (8.0484ms)
+✔ aggregate fails closed on duplicate case ids or any incorrect case (0.2351ms)
+✔ R36 capability evidence distinguishes documented competitor claims from direct observation and avoids blanket superiority (3.2108ms)
+✔ R36 README points to reproducible capability evidence instead of a tool-count victory claim (1.2016ms)
+✔ package exposes npx-first deadbyte-mcp bin and is registry-publishable (3.3346ms)
+✔ npx CLI reports the canonical package version through --version, -v and version (175.0996ms)
+✔ npx CLI remote path invokes stable PS1 directly and never routes through CMD (1.6814ms)
+✔ npx CLI exposes local supervisor lifecycle without any supervisor arm command (0.6756ms)
+✔ README makes npx the primary operator UX (0.7056ms)
+✔ R44 Codex adapter initializes no-jsonrpc wire and starts safe persistent planner thread (42.8342ms)
+✔ R44 Codex planner routes final answer by turn id and declines provider approvals (73.5255ms)
+✔ R44 Codex steer and interrupt bind exact active turn identity (48.9544ms)
+✔ R44 Codex adapter resumes durable thread after backend process recreation (63.2845ms)
+✔ Commander hidden and file-pattern flags affect native search and cursor identity (21.4732ms)
+✔ native search abort prevents further reads after an in-flight file returns (1.1024ms)
+✔ Commander file search treats glob and exact filename as filenames, not content regex (4.9747ms)
+✔ Commander context lines are ordered, deduplicated and query-bound (3.2183ms)
+✔ Commander exact filename early termination returns the first deterministic match unless disabled (3.82ms)
+✔ R36 regex search returns multiple matches per file with deterministic signed paging (7.2473ms)
+✔ R36 path search does not decode file content and is deterministic (1.9395ms)
+✔ R36 search cursor is query-bound and stale snapshot fails closed (4.4156ms)
+✔ R36 invalid regex fails before repository file reads and binary is classified (2.513ms)
+✔ R36 scan-byte bound truncates deterministically (2.18ms)
+✔ R47 search cursor rejects canonical-envelope tampering and forged signatures (5.7896ms)
+✔ R48 pins Desktop Commander 0.2.51 advertised public wire separately from DEADBYTE additive tools (3.4422ms)
+✔ R48 URL reader classifies public vs local/reserved addresses conservatively (4.9028ms)
+✔ R48 URL reader rejects private DNS answers before network transport (0.5601ms)
+✔ R48 URL reader revalidates every redirect and returns bounded text (1.0252ms)
+✔ R48 URL reader rejects oversized body even when transport returns success (0.2184ms)
+✔ R48 URL reader returns bounded PDF bytes for the native document adapter (0.2701ms)
+✔ R24 controller feature-gates autonomous runtime into Bridge child environment (3.3251ms)
+✔ R24 controller owns separate autonomous standing grant and requires coding authority (1.2991ms)
+✔ R24 controller exposes autonomous lifecycle commands and menu entries 17-20 (0.8196ms)
+✔ controller derives runtime state from observed identities and readiness (4.5992ms)
+✔ controller ownership resists PID reuse and executable substitution (0.8313ms)
+✔ controller starts detached processes and exit does not imply stop (0.8162ms)
+✔ controller public smoke uses a real modern MCP client and fulltest adds canonical contained gate (0.7551ms)
+✔ package exposes one top-level CMD entry and controller supports explicit CoreRoot when deployed beside bridge (0.6826ms)
+✔ controller exposes an explicit standing grant and revoke for the optional privileged host plane (0.7583ms)
+✔ controller keeps privileged policy optional and propagates it only to the bridge process (0.5451ms)
+✔ Windows host policy bootstrap pins executables and creates only explicit local roots (0.5668ms)
+✔ controller hosttest requires an armed lease and uses the public remote host smoke client (1.2957ms)
+✔ controller feature-gates agent runtime only into the Bridge child environment (0.8434ms)
+✔ controller status exposes the trusted agent-runtime mode explicitly (0.5292ms)
+✔ controller feature-gates coding runtime and policy only into the Bridge child environment (0.5542ms)
+✔ R35 controller binds semantic LSP config path and SHA only into the Bridge child environment (0.6595ms)
+✔ R31 controller feature-gates machine filesystem only into the Bridge child and requires coding runtime (0.7097ms)
+✔ controller owns a separate coding standing-grant lifecycle and exposes it in status (0.6467ms)
+✔ R29 controller exposes a non-mutating public machine identity live gate (0.7847ms)
+✔ R34 controller owns a separate local autonomous supervisor lifecycle with pinned host identity (0.7785ms)
+✔ R34 controller assigns external supervisor ownership to Bridge when local supervisor is enabled (0.494ms)
+✔ R34 supervisor lifecycle never arms privileged planes (0.3917ms)
+✔ supervisor recovery never assigns PowerShell automatic variable $Host (0.5252ms)
+✔ desktop policy loads bounded observer/input authority metadata (7.1099ms)
+✔ desktop plane is fail-closed when no grant exists (2.9896ms)
+✔ desktop standing grant is policy-hash-bound and action-scoped (2.919ms)
+✔ desktop grant rejects policy substitution (2.3748ms)
+✔ desktop grant rejects unknown or duplicate action kinds (2.9928ms)
+✔ desktop policy rejects unsafe limits and malformed desktops (2.51ms)
+✔ R46 fuzzy core and worker agree under a hard timeout boundary (31.1963ms)
+✔ R46 coding search fuzzy mode preserves bounded paging and file identity (60.0508ms)
+✔ R41 provider retrieves verified prior-goal memory and excludes cross-release journals (74.515ms)
+✔ R41 provider fails closed on a poisoned same-release historical chain (5.7178ms)
+✔ R41 verifier accepts content-addressed indexes from earlier verified snapshot prefixes (44.0705ms)
+✔ R41 episodic memory contains only canonical journal references and rejects nonexistent events (13.1061ms)
+✔ R41 decision memory preserves supersession edges and rejects cycles (1.8024ms)
+✔ R41 incidents use deterministic structured fingerprints and reject spoofing (3.0945ms)
+✔ R48 registers exactly eight bounded observation tools including typed native Windows observation (2.3421ms)
+✔ R32 observation schemas expose only bounded read-only inputs (2.5379ms)
+﹣ R44 historical base-plus-agent catalog is frozen at 13; current R47 runtime supersedes it (0.4558ms) # SKIP
+✔ DEADBYTE validates structured output locally even on isError paths (1.5896ms)
+✔ host mutation contract preserves explicit post-effect uncertainty (0.6885ms)
+✔ R36 process runtime publishes terminal state only after durable terminal journal commit (3.0522ms)
+✔ R36 long process returns before exit and exposes monotonic cursor chunks (872.3325ms)
+✔ R36 terminal process session is recovered from signed journal after wrapper restart (890.3213ms)
+✔ R46 registers exactly seven bounded process supervision tools (2.0417ms)
+✔ R46 process tool inputs expose guarded raw input only through process_session_write (2.6968ms)
+✔ R32 process action handler returns only strict logical identity and updated session state (3.2305ms)
+✔ R46 process write handler returns only input identity and session state (1.2629ms)
+✔ R31 package exposes the bounded process smoke command (3.2843ms)
+✔ R36 process smoke isolates grant and recovery state outside the release source tree (0.8382ms)
+✔ R31 Windows gate refreshes the native-host policy pin before manifest freeze (1.3984ms)
+✔ R31 Windows gate runs process smoke before final manifest verification (0.6441ms)
+✔ R31 package exposes bounded machine filesystem smoke command (0.4267ms)
+✔ R31 Windows gate runs machine filesystem smoke before final manifest verification (0.4087ms)
+✔ release parity restores a drifted development stage from the immutable active release (15.7922ms)
+✔ audit restart reconciles an orphan request with an explicit interrupted result (13.6856ms)
+✔ Windows current R45 gate binds exact sealed R44 parent and machine-freedom evidence contract (1.1885ms)
+✔ sealed public 0.11.0 release scripts remain preserved as historical R37 authority (3.3876ms)
+✔ R39 parity validator requires full-76, compact closure, exact public 0.11.2 predecessor and immutable-slot separation (1.1065ms)
+✔ R39 parity captures R39 bridge, exact public 0.11.2 predecessor, stage reseed and successor restore (6.1196ms)
+✔ R39 current final closure writer and independent verifier bind R39 domains and public 0.11.2 predecessor (4.0194ms)
+✔ R39 bounded public parity suite covers current release identity and agent fabric (0.6094ms)
+✔ R47 release pipeline activates the published release and waits for handoff completion (3.3069ms)
+✔ R47 deployment gate verifies both activation receipt and active pointer against version and manifest (0.999ms)
+✔ R47 interrupted-update recovery never resurrects failed or receipted updates (1.4838ms)
+✔ compact live activity shows request context without payload or secret values (0.756ms)
+✔ compact live activity shows successful result duration (0.1223ms)
+✔ compact live activity shows failed result duration (0.0804ms)
+✔ compact live activity ignores unrelated audit events (0.0747ms)
+✔ trace reader tolerates a transient Windows sharing violation and returns complete commands (3.814ms)
+✔ bare remote reuses a fully verified ONLINE runtime without invoking blocking start (2630.1163ms)
+✔ bare remote PARKED startup does not wait for a long-lived child holding inherited pipe handles (4205.3091ms)
+✔ bare remote uses one unified live timeline, keeps authority semantics, then disarms and parks when the foreground session ends (13781.0351ms)
+✔ remote --resume replays sanitized tool-call and terminal result events after the cursor without duplicates or loss (8778.9383ms)
+✔ remote --verbose enables sanitized request detail while preserving foreground authority cleanup (4390.1289ms)
+✔ detached guardian revokes authority, parks, and removes the session marker after the owner is hard-killed (22063.1158ms)
+✔ bare remote rolls back authority and parks if one plane fails to arm (3005.6524ms)
+✔ bare remote recovers a stale crashed session before arming a new one (5165.2678ms)
+✔ remote warning lines use deterministic ASCII fallback on piped Windows output (3858.8182ms)
+✔ R58 concurrent cold remote claims have one winner and no loser cleanup (3568.9059ms)
+✔ R58 duplicate remote verifies the real live owner and leaves its authority untouched (4004.8014ms)
+✔ bare remote refuses unverified legacy ownership without touching authority (520.4194ms)
+✔ explicit remote status remains a one-shot controller command (294.6354ms)
+✔ explicit remote status reports CLI package and active runtime VERSION SKEW (284.5694ms)
+✔ bare remote surfaces bounded controller-start-failure evidence instead of only exit code (2346.5084ms)
+✔ remote --trace --filter selects presentation without dropping journaled events (8239.0834ms)
+✔ R45 slot-update CLI binds Host policy bootstrap as one exact path plus SHA-256 pair (1.5307ms)
+✔ R45 Host policy bootstrap accepts exact v2 bytes and rejects hash or native contract drift (7.9882ms)
+✔ R45 updater threads the bootstrapped Host v2 policy into successor generation (1.6924ms)
+✔ R59 optional plane failure is isolated and reported as DEGRADED (0.9158ms)
+✔ R59 dependent plane becomes unavailable without invoking its initializer (0.3733ms)
+✔ R59 mandatory plane failure remains fail closed (0.3782ms)
+✔ R59 unavailable runtime never performs a delegated operation (1.0129ms)
+✔ trust default follows explicit environment in a fresh child (46.3869ms)
+✔ updater recovery reads the isolated pointer, not production (59.8623ms)
+✔ root precedence, default and invalid explicit roots (0.5884ms)
+✔ PS launcher selects isolated missing pointer rather than decoy production pointer (389.3057ms)
+✔ CMD launcher transports explicit root with spaces to nested Node child (158.0725ms)
+✔ coding standing grant remains armed until explicit revocation (6.6872ms)
+✔ autonomous standing grant remains armed until explicit revocation (5.5135ms)
+✔ host standing grant remains armed until explicit revocation (2.664ms)
+✔ controller emits standing grants and hides expiry UX (1.6943ms)
+✔ R48 typed Windows queries are read-only signed native observations (31.0702ms)
+✔ R48 Windows query validation rejects arbitrary commands and malformed registry selectors before dispatch (3.4073ms)
+ℹ tests 155
+ℹ suites 0
+ℹ pass 154
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 1
+ℹ todo 0
+ℹ duration_ms 100089.4284
+R48-BOUNDED-REGRESSION batch=4/8 files=33
+✔ R44 agent backend persists thread identity and request lifecycle atomically (30.4727ms)
+✔ R44 agent backend denies server approval by default and never auto-approves (4.2647ms)
+✔ R44 backend restart classifies unresolved requests interrupted and preserves threads (18.6644ms)
+✔ R44 backend fails closed on truncated state and binds production executable hash (86.4657ms)
+✔ R44 agent backend supports Codex wire mode notifications without jsonrpc envelope (13.246ms)
+✔ R42 approval binds exact artifact, event head, scope and expiry (1.7787ms)
+✔ R42 canonical DAG propagates STALE only through affected descendants (1.0342ms)
+✔ R42 one canonical DAG is deterministically derived from the authoritative plan (0.9875ms)
+✔ R42 evidence ladder never lets weak evidence masquerade as runtime proof (0.3351ms)
+✔ R42 rigor is derived once and cannot downgrade below risk minimum (0.2278ms)
+✔ R42 decisions become stale deterministically without deleting history (0.3386ms)
+﹣ R44 historical hermetic autonomous catalog is frozen at 50; current R47 runtime supersedes it (0.4337ms) # SKIP
+✔ search adapter drains bounded native pages instead of silently losing later matches (1.7097ms)
+✔ bridge registers all aliases (0.1975ms)
+✔ search adapter provides Commander progressive session semantics (0.3092ms)
+✔ search adapter cancellation aborts native work and rejects late results (0.3125ms)
+✔ search adapter timeout aborts native work, completes cleanly, and rejects late results (49.379ms)
+✔ search adapter natively searches DOCX document and header parts when the reference file pattern enables it (15.5315ms)
+✔ real Commander-parity filesystem lifecycle is transactional and signed (51.7859ms)
+✔ real Commander adapter preserves PowerShell command bytes through the bounded REPL (305.5378ms)
+✔ real stale mutation is rejected before commit and leaves source intact (14.6719ms)
+✔ real deterministic paging and deny boundary survive adversarial paths (14.8798ms)
+✔ real owned process lifecycle yields terminal evidence, not PID authority (56.3938ms)
+✔ real process cancellation reaches one terminal state with verified evidence (25.9547ms)
+✔ RDC filesystem schemas expose legacy wire fields, not DEADBYTE-native fields (0.8182ms)
+✔ RDC process schemas use command and numeric pid wire vocabulary (0.1234ms)
+✔ R48 RDC write_pdf preserves wire shape and performs native page surgery atomically (2.4759ms)
+✔ RDC write mode maps append through a hash-pinned native mutation (0.378ms)
+✔ RDC PID compatibility is a lookup boundary, not native authority (0.9932ms)
+✔ R48 RDC read_file preserves image/text wire behavior and natively reads DOCX/XLSX (4.6325ms)
+✔ R48 read_file preserves the reference directory-listing fallback (0.5098ms)
+✔ R48 read_file identifies unknown binary content instead of lossy UTF-8 decoding (0.2944ms)
+✔ R48 read_multiple_files reuses rich read_file semantics per path (0.8672ms)
+✔ R48 start_process preserves shell command bytes and uses raw policy-bound REPL when available (0.39ms)
+✔ R48 list_processes uses external observation while list_sessions stays DEADBYTE-owned (0.2525ms)
+✔ R48 kill_process external path is identity-bound and never aliases unknown PID to managed terminate (0.2116ms)
+✔ R48 read_process_output translates RDC line offsets onto native byte stream without unit confusion (0.431ms)
+✔ R48 interact_with_process waits from pre-input stream head and returns only new response bytes (0.4829ms)
+✔ R48 read_file URL path returns the full bounded body regardless of offset/length (0.1406ms)
+✔ R48 read_file URL image bypasses text slicing and returns base64 image metadata (0.0871ms)
+✔ R48 read_file URL PDF routes bounded bytes through native PDF profile (0.4364ms)
+✔ R48 read_file tails a large text file from the end without reading the whole file (0.4021ms)
+✔ R48 edit_block range mutates XLSX through native ZIP/XML writer with hash precondition (10.8443ms)
+✔ R48 list_directory honors recursive depth and drains paged native directory listings (0.3656ms)
+✔ R48 write_file rewrites and appends XLSX through native OOXML instead of UTF-8 corruption (1.6875ms)
+✔ R48 write_file creates deterministic native DOCX paragraphs and headings with hash-pinned replacement (1.1413ms)
+✔ R48 write_file refuses binary package corruption when no native writer owns the format (0.1452ms)
+✔ R48 legacy BIFF xls fails closed consistently with pinned reference OOXML-only implementation (0.1961ms)
+✔ R48 edit_block mutates DOCX document.xml through native package round-trip (0.4265ms)
+✔ R48 write_pdf schema matches Desktop Commander preprocessing and excludes unsupported origin field (1.6748ms)
+✔ R44 real compact stdio catalog stays <=43 and exposes all gateways plus skill_catalog (1290.6054ms)
+✔ desktop frame identity is deterministic and self-verifying (1.7156ms)
+✔ virtual desktop supports negative monitor coordinates but rejects overflow (1.7947ms)
+✔ T9 coordinate overflow and far-negative coordinates are denied before guard/effect (0.3073ms)
+✔ stale frame is denied before effect (0.2595ms)
+✔ action is bound to exact frame identity (0.2271ms)
+✔ desktop epoch mismatch is denied (0.2497ms)
+✔ topology mismatch is denied (0.3335ms)
+✔ foreground window mismatch is denied (0.2389ms)
+✔ target is frame-bound, bounded, and deterministic (0.5195ms)
+✔ key chord is narrow and duplicate-free (0.5449ms)
+✔ text input is bounded and hash-bound (0.2589ms)
+✔ post-observation binds before/action/after without claiming success (0.3941ms)
+✔ T4 action chain binds before action after post receipt and effect identity (0.3519ms)
+✔ post-observation rejects substitution and time travel (0.3857ms)
+✔ action vocabulary is fixed for R40-T1 (0.108ms)
+✔ R42 evidence publication is atomic, no-clobber and idempotent for identical bytes (12.7562ms)
+✔ R42 conflicting concurrent evidence identity fails closed without overwrite (6.0825ms)
+✔ R42 execution receipt and outcome verification are distinct typed artifacts (0.6782ms)
+✔ R49 runtime full stdio catalog exactly matches sealed R48 base plus reviewed overlay (1984.2404ms)
+✔ LSP stdio parses split frames and correlates out-of-order responses (150.254ms)
+✔ LSP stdio times out one request without retrying it (440.7125ms)
+✔ LSP stdio rejects oversized inbound messages (124.7445ms)
+✔ LSP stdio rejects outstanding requests when server exits unexpectedly (128.5518ms)
+✔ LSP stdio verifies executable identity before spawn (74.083ms)
+✔ LSP stdio verifies pinned dependency identities before spawn (202.5631ms)
+✔ LSP stdio graceful shutdown is idempotent (126.9518ms)
+✔ R41 retrieval indexes rebuild byte-identically and support exact token symbol artifact and incident lookup (19.7675ms)
+✔ R41 poisoned or cross-release indexes fail closed (5.1297ms)
+✔ R41 working memory is bounded provenance-bearing disposable state and rejects staleness (18.2756ms)
+✔ R41 semantic retrieval is disabled by default and verifies candidate IDs against canonical memory (5.9992ms)
+✔ R41 content-addressed projections survive deletion and rebuild byte-identically (46.4064ms)
+✔ R36 Native Diff V2 commits mkdir write move and independently verifies mixed receipts (92.2986ms)
+✔ R36 Native Diff V2 rolls back mkdir/write when later topology operation fails (52.9657ms)
+✔ R36 Native Diff V2 rejects stale move identity and destination collision before mutation (9.495ms)
+✔ R36 Native Diff V2 rmdir accepts only exact empty directory identity (32.4556ms)
+✔ R36 Native Diff V2 denies topology through reparse points (6.3526ms)
+✔ lifecycle is monotonic and terminal exactly once (2.0168ms)
+✔ cancel and timeout terminal outcomes are mutually exclusive (1.1473ms)
+✔ invalid transition and duplicate start fail closed (0.2774ms)
+✔ producer failure terminal is distinct from cancellation (0.334ms)
+✔ history eviction remains evidence-only and terminal receipt binds the retained head (0.3762ms)
+✔ late producer event after terminal is rejected and cannot mutate terminal proof (0.2106ms)
+✔ R59 invalid optional coding root preserves catalog and returns typed unavailable (1242.0641ms)
+✔ R36 successor source root contains no nested npm tarball artifacts (1.1002ms)
+✔ R28 package boundary contains only immutable workspace seed files (4601.8031ms)
+✔ publish boundary excludes live state, private keys, grants and non-example controller secrets (4305.6363ms)
+✔ publish boundary includes only the canonical top-level Windows launcher (4244.8545ms)
+✔ R46 process supervision is policy-gated and exposes bounded action plus opt-in raw input (3.6667ms)
+✔ public autonomous smoke chunks resumable goal runs below the 120 second proxy ceiling (3.2834ms)
+✔ sealed R36 historical proof scripts preserve 0.10.0 / R36 and exact R35 predecessor (4.1559ms)
+✔ current R37 controller still binds production remote to compact profile and restores parent environment (2.0553ms)
+✔ R36 surface contract remains exact full 76 plus compact gateway closure for R37 (1.106ms)
+✔ R37 unified timeline renders one sanitized tool-call line with ISO timestamp, padded tool name, and JSON arguments (2.2217ms)
+✔ R40 default live tracker keeps legacy formatter separate and emits one compact result line (1.3954ms)
+✔ R37 remote result journal persists sanitized tool-call and result in one monotonic cursor stream (9.3738ms)
+✔ R37 journal remains backward-compatible with pre-tool-call result-only events (2.3805ms)
+✔ R44 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED (1.0764ms)
+✔ R44 detached finalizer accepts only exact signed-R43-parent feature gate evidence (0.2659ms)
+✔ R44 detached finalizer prioritizes native Windows modules and preserves custom paths (0.2328ms)
+✔ R44 parent is exact sealed R43 final baseline (416.4408ms)
+✔ R44 parent proof is historical and does not require current grants to remain absent (373.2823ms)
+✔ R52 offline predecessor recovery revokes stale Host authority before capture (461.3038ms)
+✔ R52 offline predecessor fails closed if Host revoke returns success but grant remains (446.9602ms)
+✔ R52 failed Host revoke leaves predecessor grant intact and denies capture (298.1123ms)
+✔ R52 disarmed offline predecessor is accepted without invoking a failing revoke (165.3907ms)
+✔ R52 offline recovery requires explicit opt-in before any Host revocation (166.3919ms)
+﹣ R52 current release identity is coherent across package lock source metadata SBOM and gate (0.5403ms) # R52 historical release contract is frozen at 0.15.29; current successor is 0.15.36
+﹣ R52 lineage binds published 0.15.28 parent separately from 0.15.27 runtime rollback target (0.1261ms) # R52 historical release contract is frozen at 0.15.29; current successor is 0.15.36
+﹣ R52 advertises updater-owned offline predecessor Host revocation only after implementation (0.0903ms) # R52 historical release contract is frozen at 0.15.29; current successor is 0.15.36
+﹣ R57 release identity is coherent across package lock source metadata SBOM and gate (0.5017ms) # SKIP
+﹣ R57 source and runtime predecessor are exact active published 0.15.33 (0.0801ms) # SKIP
+﹣ R57 records bounded zero-child retry RED to GREEN and preserves fail-closed controls (0.0936ms) # SKIP
+✔ R58 bridge bootstrap binds the complete recursive local static import closure (17.2978ms)
+✔ R58 bridge dependency discovery rejects relative dynamic imports (3.9434ms)
+✔ R58 bridge dependency discovery rejects path escape (3.9882ms)
+✔ R58 real controller JSON status is bounded read-only and cannot select mutation (2038.9723ms)
+✔ R58 startup lock excludes competitors and releases after owner hard death without stale lockfiles (509.9875ms)
+✔ R58 inconsistent owner PID binding cannot trigger stale-session authority cleanup (464.6148ms)
+✔ R58 live unrelated PID is not accepted as a remote foreground owner (231.6012ms)
+✔ R58 bound stale birth identity reconciles on the first invocation without killing a reused PID (3445.2708ms)
+﹣ R58 canonical Windows gate is final-candidate bound and leaves historical gates immutable (0.4442ms) # SKIP
+✔ R27 generation bundle rebinds authority and mutable state outside the release slot (111.0246ms)
+✔ historical parent verifier rejects a different explicit public key (464.9757ms)
+✔ strict SemVer grammar (1.0426ms)
+✔ ASCII, arbitrary precision and SemVer precedence laws (2.7349ms)
+✔ ASCII downgrade never dispatches authority or activation (0.3356ms)
+ℹ tests 137
+ℹ suites 0
+ℹ pass 129
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 8
+ℹ todo 0
+ℹ duration_ms 32379.404
+R48-BOUNDED-REGRESSION batch=5/8 files=33
+✔ R42 model eval keeps hidden oracle out of generator and binds passed evidence to manifest (11.5749ms)
+✔ R42 model eval rejects failed judge and publishes no PASS evidence (2.2683ms)
+✔ R42 eval evidence tampering fails independent verification (6.5229ms)
+✔ agent submit is idempotent and rejects submission-id plan collisions (1216.301ms)
+✔ checkpoint pauses until explicit approval and approval never auto-runs the next step (1268.8407ms)
+✔ cancel request is observed before the next step and transitions terminal (1226.9896ms)
+✔ tampered journal is rejected instead of trusted (1295.4395ms)
+✔ agent mode off preserves the non-agent catalog (1197.1477ms)
+✔ recomputed plan hash without private key is rejected (1289.5125ms)
+✔ recomputed event hash-chain without private key is rejected (1210.5058ms)
+✔ unsigned forged cancel file cannot drive an authenticated cancellation (1234.1273ms)
+✔ planner prompt compacts stale context payloads before failing the byte budget (6.0224ms)
+✔ planner accepts a strict authoritative plan snapshot without adding a new agent round (18.1366ms)
+✔ completed authoritative plan hard-blocks further work before native diff mutation (64.5257ms)
+✔ planner parser rejects malformed JSON and unknown top-level fields (6.5216ms)
+✔ R34 decision parser rejects prose-wrapped JSON and authority arming actions (9.353ms)
+✔ R34 replan carries only a bounded mutable suffix proposal (7.0104ms)
+✔ R34 act accepts one bounded existing patch action with exact SHA precondition (6.7395ms)
+✔ R34 provider adapter returns only normalized decision plus raw response hash (17.04ms)
+✔ R33 private delegate routes bounded machine reads and records signed evidence (60.8662ms)
+✔ R33 stale delegated identities fail closed into a signed pause (30.3639ms)
+✔ R33 delegated output over the planner context budget fails closed (25.4898ms)
+✔ R33 rechecks authority immediately before a delegated process mutation (29.193ms)
+✔ R33 process delegates retain owned-session identity and verified journal evidence (85.8312ms)
+✔ R33 rejects a delegated observation result whose signed receipt cannot be verified (29.3707ms)
+✔ client sampling response must bind the exact pending request id (15.0733ms)
+✔ invalid client planner contract yields a signed repair request (23.5064ms)
+✔ three invalid planner contracts pause instead of retrying forever (40.8571ms)
+✔ autonomous execution fails closed when coding authority is revoked (11.1183ms)
+✔ three identical planner decisions trigger no-progress pause (43.5971ms)
+✔ signed autonomous journal tamper is rejected before state is trusted (13.2222ms)
+✔ R34 event deletion/reorder/signature tamper fails before state trust (37.1072ms)
+✔ R34 restart reconciles a committed Native Diff after crash without invoking apply twice (76.5752ms)
+✔ R35 loop exposes the exact production phase enum (0.9091ms)
+✔ failed VERIFY enters CRITIC and records bounded failure classification (1.2453ms)
+✔ REPAIR must change plan/hypothesis fingerprint before another ACT (1.0901ms)
+✔ unchanged repair fingerprint fails closed before ACT (0.5432ms)
+✔ todo projection is restart-safe and byte-equivalent from journal replay (0.3364ms)
+✔ src/remote-mcp-coding-smoke-client.mjs uses the exact R36 25-tool coding catalog (3.558ms)
+✔ src/remote-mcp-smoke-client.mjs uses the exact R36 25-tool coding catalog (0.751ms)
+✔ src/machine-fs-smoke-client.mjs derives its exact R48 catalog from the canonical runtime catalog (0.6801ms)
+✔ src/observation-smoke-client.mjs derives its exact R48 catalog from the canonical runtime catalog (1.0196ms)
+✔ coding stat reports bounded metadata and file digest (10.8056ms)
+✔ coding search is deterministic, bounded and respects denied paths (14.5013ms)
+﹣ R44 historical hermetic coding catalog is frozen at 38; current R47 runtime supersedes it (0.4778ms) # SKIP
+✔ R23 public coding gate reports the negotiated SDK protocol revision (8.5177ms)
+✔ R48 external process list exhausts one signed observation snapshot through cursors (1.7721ms)
+✔ R48 external kill binds PID creation time and name then proves the same identity disappeared (0.6344ms)
+✔ R48 external kill fails closed on missing identity and on post-effect same identity (1.0299ms)
+✔ Commander R47 exact 40-name surface is registered over real MCP stdio (1870.9144ms)
+✔ R48 exhaustive public property and required/default semantics match the pinned reference (61.1047ms)
+✔ R48 all 26 advertised schemas accept, normalize defaults, and strip unknown keys like pinned reference (7.3971ms)
+✔ R48 material enum union refinement and constraint probes match pinned reference schemas (4.8974ms)
+✔ R36 compact gateway schemas reject generic arbitrary dispatch (5.0823ms)
+✔ R36 compact schemas preserve representative preconditions (0.87ms)
+✔ R40 registers exactly six compact gateway names including desktop_control (0.6962ms)
+✔ R36 coding_inspect gateway calls runtime directly and never MCP-recurses (1.2557ms)
+✔ R59 capability manifest v3 preserves exact compact catalog attestation (8.7563ms)
+✔ R59 capability manifest v3 preserves v2 catalog fields and adds live bindings (0.5214ms)
+✔ R40 desktop_control is stable when runtime is absent and routes typed read-only operations when present (0.4606ms)
+✔ R46 compact process_session routes guarded write and wait/tail read without adding a tool name (0.4556ms)
+✔ desktop runtime performs observe-target-fresh-guard-effect-post chain (16.2363ms)
+✔ desktop runtime refuses effect when expected frame is stale (2.0694ms)
+✔ desktop runtime re-observes and blocks pixels changed before effect (1.7742ms)
+✔ desktop runtime key_chord is window-scoped and tolerates unrelated pixel drift (7.7569ms)
+✔ desktop runtime text_input remains pixel-stable because keyboard focus is control-sensitive (1.7399ms)
+✔ desktop runtime re-observes and blocks foreground-window drift (1.1652ms)
+✔ T9 capture failure blocks input before any side effect dispatch (0.9335ms)
+✔ T9 Desktop receipt substitution is detected by runtime verifier (7.7566ms)
+✔ desktop runtime enforces standing-grant action scope (1.8071ms)
+✔ desktop runtime denies mutation when grant is revoked (1.5313ms)
+✔ provider failure after dispatch is signed OUTCOME_UNKNOWN and never blind-retried (4.4691ms)
+✔ definite pre-dispatch provider denial is signed as not_started (4.9762ms)
+✔ post-observation failure after confirmed injection is OUTCOME_UNKNOWN (5.3112ms)
+✔ read-only observe works independently of desktop mutation grant (2.8675ms)
+✔ successor desktop wait observes until a frame changes and publishes signed final evidence (4.8502ms)
+✔ successor desktop wait uses local UIA matching without leaking query text or dispatching input (2.8969ms)
+✔ desktop runtime enforces policy max_text_bytes before observation or input effect (1.648ms)
+✔ T5 UIA grounding re-observes and binds candidate to fresh frame without mutation authority (3.8163ms)
+✔ R45 host inline executes in argv memory with zero staging artifact and hashes command/output (303.3193ms)
+✔ R45 native argv execution accepts arbitrary absolute hash-pinned executable only while Host is armed (379.4223ms)
+✔ R45 inline execution observes authority revocation during a live child and fails closed (381.5386ms)
+✔ R41 snapshot plus verified suffix is byte-equivalent to full replay (15.768ms)
+✔ R41 snapshot tampering fails closed for schema sequence prefix state hash and signature (1.7235ms)
+✔ R41 missing or corrupt snapshot falls back explicitly to full verified replay (15.6237ms)
+✔ native diff commits exact preconditioned edits and independently verifies coding receipts (93.6031ms)
+✔ native diff rolls back earlier operations when a later operation fails (61.799ms)
+✔ native diff revocation between operations rolls back to preimage without autonomous rollback authority (66.6021ms)
+✔ autonomous application scope isolates repeated identical native diffs across goals (84.16ms)
+✔ R33 candidate process policy self-binds to the current repository root (4.419ms)
+✔ process policy refresh repins native host and Windows system executables (8.3903ms)
+✔ process policy refresh fails closed when native-host path is not the candidate bin path (3.3687ms)
+✔ process policy refresh fails closed when a system profile path is not target-bound (3.378ms)
+✔ process policy refresh refuses a malformed or disabled process policy (3.5075ms)
+✔ detects prompts without treating arbitrary output as ready (3.9491ms)
+✔ distinguishes terminal state from prompt state (0.4179ms)
+✔ handles CRLF/LF/CR and normalization (0.3057ms)
+✔ production README documents one-command stdio configs for major MCP clients (4.2994ms)
+✔ production README records tracer bullet, semantic scope, remote UX, safety and document extension (1.5212ms)
+✔ production README contains an evidence-based competitor comparison without pretending semantic breadth parity (1.6701ms)
+✔ MCP exposes compact workflow prompts and source-of-truth context resources (1334.8001ms)
+✔ R37 parity validator requires full-76, compact closure, exact public 0.11.0 predecessor and immutable-slot separation (1.0512ms)
+✔ R37 parity captures R37 bridge, exact public 0.11.0 predecessor, stage reseed and successor restore (11.5465ms)
+✔ R37 current final closure writer and independent verifier bind R37 domains and public 0.11.0 predecessor (1.061ms)
+✔ R37 bounded public parity suite covers current release identity and agent fabric (0.9309ms)
+✔ R51 runtime coherence upgrades older active slot exactly once and verifies final identity (1.3823ms)
+✔ R51 runtime coherence is non-mutating when version and manifest already match (0.1773ms)
+✔ R51 runtime coherence refuses downgrade and same-version manifest drift (0.8475ms)
+✔ R51 bare remote wires coherence before live generation binding and deploy honors state root override (4.366ms)
+✔ R51 foreground authority contract explicitly verifies and cleans desktop plus host (0.8656ms)
+✔ R52 controller never reports successful Host revoke while grant removal failed (159.7987ms)
+✔ R52 controller rejects a grant that remains after nominally successful removal (159.7876ms)
+✔ R52 controller revocation is idempotent when no grant exists (146.6461ms)
+✔ R52 controller reports disarmed only after observing successful removal (152.2548ms)
+﹣ R53 current release identity is coherent across package lock source metadata SBOM and gate (0.5651ms) # SKIP
+﹣ R53 lineage binds exact published 0.15.29 as parent and runtime predecessor (0.0883ms) # SKIP
+﹣ R53 records stabilization evidence and explicit soak bypass without STABLE/FINAL claim (0.1043ms) # SKIP
+✔ R58 controller read-only dispatch must not create runtime/log state (1643.9781ms)
+✔ R58 actual doctor CLI is read-only and reports nonzero for a failed installed-state check (365.1699ms)
+✔ R58 doctor foreground validates bindings and distinguishes stale observations without mutation (15.2373ms)
+✔ R58 doctor foreground malformed, oversized and unreadable markers fail closed (4.4765ms)
+✔ R58 doctor actual owner observation verifies the current process, not PID alone (537.0059ms)
+✔ R58 doctor validates canonical active pointer without repair or production fallback (11.8229ms)
+﹣ R46 historical release contract is frozen at 0.15.15 and V0.15.2 parent identity (0.5188ms) # SKIP
+✔ R46 leaves sealed R45 release artifacts historical and unchanged in identity (4.1426ms)
+✔ R46 keeps ONLINE reuse, explicit Desktop authority, and semantic config pin (2.0781ms)
+✔ R24 remote full gate accepts autonomous only as a coding-dependent exact catalog (4.3426ms)
+✔ R24 remote gate evidence never emits the public endpoint origin (0.6786ms)
+✔ R30 remote gate includes bounded coding observation tools (1.4239ms)
+✔ R29 remote gate accepts machine plane as an exact optional catalog dimension (0.5728ms)
+✔ R49 compact remote gate independently verifies signed machine ping (0.46ms)
+✔ R46 remote gate accepts seven-tool process supervision as one exact optional catalog dimension (0.4266ms)
+✔ R31 remote gate accepts machine filesystem as one exact optional eight-tool dimension (0.6461ms)
+✔ R32 remote gate accepts observation only with machine plus coding configuration (0.5924ms)
+✔ R40 remote smoke preserves exact R36 compact compatibility and accepts only exact attested R40 compact catalog (0.923ms)
+✔ R34 disarmed public gate requires the exact canonical 73-tool catalog (0.6766ms)
+✔ semantic LSP backend honors bounded startup settle before cross-file request (760.1795ms)
+✔ MCP smoke preserves caller state root across SDK stdio transport (728.2141ms)
+✔ release smoke child environments explicitly bind state root (2.8589ms)
+✔ explicit updater context root overrides inherited root for controller child (113.0183ms)
+✔ stdio snapshot negotiates the real MCP server and hashes its client-visible tool schemas (408.2447ms)
+ℹ tests 141
+ℹ suites 0
+ℹ pass 136
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 5
+ℹ todo 0
+ℹ duration_ms 23412.0566
+R48-BOUNDED-REGRESSION batch=6/8 files=33
+✔ provider-backed MCP server supervises submitted goal without client run calls (2144.7553ms)
+✔ external supervisor mode leaves provider goal durable until standalone host advances it (3542.3427ms)
+✔ R36 benchmark corpus exposes exactly the 30 approved production coding cases (4.6566ms)
+✔ R36 benchmark case requires reachability, evidence verification and typed release-gate result (0.6999ms)
+✔ R36 aggregate fails closed when correctness reachability or evidence proof is missing (0.779ms)
+✔ R36 verdict identity is independent of timing and byte-count noise while observation identity retains it (0.3434ms)
+✔ coding lease is mandatory and expiry fails closed (188.8136ms)
+✔ coding write replace command and benchmark produce verifiable receipts (822.0871ms)
+✔ durable coding task completes edit command benchmark and verifies all receipts (661.9858ms)
+✔ coding task adopts a signed command receipt after wrapper crash (347.617ms)
+✔ unreceipted command crash pauses instead of blindly rerunning (194.5799ms)
+✔ unreceipted write mutation pauses as ambiguous instead of retrying (194.9246ms)
+✔ R48 extended bridge exposes Desktop Commander 0.2.51 argument shapes (5.8773ms)
+✔ R48 set_config_value performs internal CAS while preserving reference wire (4.1249ms)
+✔ R48 prompts, history filters, and feedback accept reference calls (2.0452ms)
+✔ R48 extended schema matches reference promptId and ISO datetime semantics exactly (3.1704ms)
+{"tool_count":43,"catalog_sha256":"dde7d10e85c52beb285e3adf41b69dece11162ab0bc8233f056e471f653776d6","ledger_sha256":"6acf1de7b66f1173eba1c33fe76e5053fb9e3cd15f0244da3bc06d3275c43021","desktop":true,"hardware_query":true,"skill":true,"authority":"DISARMED","authority_truth":true}
+✔ R45 real max-runtime compact stdio catalog is exactly 43 with verified skill_catalog while all authority remains disarmed (2083.0231ms)
+✔ R21.2 observes higher-integrity images through limited process query (3.9688ms)
+✔ R21.2 tries limited image query before MainModule fallback (1.0044ms)
+✔ R21.2 distinguishes existing but unobservable processes and fails closed (1.5263ms)
+✔ PID-reuse recovery archives stale ownership evidence, removes only metadata, and never kills the reused process (1.077ms)
+✔ R24 public gates require bounded stable DNS readiness before side effects (3.6773ms)
+✔ path traversal is denied (10.929ms)
+✔ absolute path is denied (3.5079ms)
+✔ Windows ADS, device aliases and trailing-dot paths are denied portably (0.6292ms)
+✔ symlink escape is denied where symlinks are permitted (5.2121ms)
+✔ proof execution creates deterministic output and signed verifiable receipt (63.7118ms)
+✔ independent verifier process accepts valid signed evidence (112.4596ms)
+✔ input source may change later because receipt preserves exact input snapshot (60.2401ms)
+✔ tampered output fails independent verification (53.8041ms)
+✔ tampered input snapshot fails independent verification (55.302ms)
+✔ tampered receipt fails its canonical self hash (50.9336ms)
+✔ recomputed self hash cannot forge Ed25519 attestation (59.053ms)
+✔ wrong public key cannot verify receipt (52.3337ms)
+✔ signing key inside workspace is denied (4.4899ms)
+✔ proof execution refuses to run without a signing key (2.173ms)
+✔ trust key generation refuses to overwrite an existing keypair (5.1617ms)
+✔ pre-existing output is denied instead of overwritten (4.8813ms)
+✔ output parent symlink escape is denied (4.0174ms)
+✔ distinct output names allow repeated signed proofs without weakening no-overwrite (112.2776ms)
+✔ V0.7 creates request identity before worker process execution and authenticates before V2 interpretation (0.8939ms)
+✔ strict UTF-8 decoder rejects malformed byte sequences (0.1909ms)
+✔ proof execution enforces compile-time input and timeout budgets (4.9684ms)
+✔ request identity validator rejects digest, worker and invocation substitution (0.381ms)
+✔ V0.8.0 resolves workspace and optional host policy from package root when bridge does not forward environment (0.4609ms)
+✔ R34 deferred slot operation preserves supervisor bootstrap across rollback restore (3.8597ms)
+✔ document adapter registry is bounded, explicit and rejects ambiguous adapter contracts (2.4351ms)
+✔ document adapter registry enforces input and output byte budgets (0.3551ms)
+✔ R44 real external supervisor preserves persistent job identity across controller recreation (882.0925ms)
+✔ R42 planner can request typed human clarification and resume with signed answer context (158.0149ms)
+✔ R42 clarification contract rejects injected fields and oversized choices (40.9688ms)
+✔ R29 stdio catalog exposes strict machine identity tools and signed generation-bound ping (1143.6789ms)
+✔ R29 machine MCP catalog registers four strict tools and protects revoke with local host authority (4.309ms)
+✔ R29 machine revoke fails closed before runtime mutation when host authority denies (0.7041ms)
+✔ R28 named tunnel host directly launches the pinned cloudflared with an external token file (5.5273ms)
+✔ R32 search is deterministic, paged, signed and independent from coding mutation grant (36.7454ms)
+✔ R32 search cancellation is cooperative and receipted (27.887ms)
+✔ R32 process observation is snapshot-paged and separates owned from external OS processes (6.1895ms)
+✔ R32 system observation is timestamped and signed without mutation authority (6.1846ms)
+✔ R46 observation search sessions expire after bounded terminal TTL and free capacity (20.9162ms)
+✔ R46 observation search hard cap fails closed while all retained sessions are active (22.4405ms)
+✔ R46 search cursor rejects tampering, wrong search, rewind, and expired snapshot (31.9383ms)
+✔ R31 runtime starts one approved profile and exposes ordered bounded output (99.8224ms)
+✔ R46 runtime executes fileless PowerShell source without ps1 materialization (198.7492ms)
+✔ R46 process output retention evicts oldest bytes without losing tail identity under multi-megabyte output (177.2933ms)
+✔ R46 process raw input keeps persistent PowerShell state with bounded wait and tail reads (187.1653ms)
+✔ R46 raw process input is profile-opt-in, bounded, and rechecks standing authority (46.0636ms)
+✔ R31 runtime lists, reports and terminates only its owned session (24.0174ms)
+✔ R31 runtime verifies its signed process event journal (25.9462ms)
+✔ R32 runtime executes one policy-defined named action in the running pipe session (94.2078ms)
+✔ R32 named actions fail closed for ConPTY and revoked or drifted authority (64.0168ms)
+✔ R32 named actions reject sessions after child exit (68.451ms)
+✔ R47 operation history integrates with real process lifecycle and signed terminal receipt (27.9723ms)
+✔ R47 concurrent cancel/terminate has one terminal operation event (25.9293ms)
+✔ R47 timeout and producer failure map to distinct terminal evidence (433.2929ms)
+✔ R47 concurrent cancel and page keep terminal authority singular (62.3406ms)
+✔ R47 process terminalization is idempotent under concurrent terminate race (24.6992ms)
+✔ R47 process output flood preserves bounded tail identity and signed terminal evidence (187.9789ms)
+✔ R47 process timeout race yields exactly one terminal class and recoverable evidence (280.9338ms)
+✔ R34 public parity catalog is exact, unique, and includes production coding ergonomics (1.0477ms)
+✔ release parity and final verifier are package entry points (3.5685ms)
+✔ R40 final closure verifier is implementation-independent from production helpers (2.4168ms)
+✔ final closure verifier canonicalizes traversal order before exact-tree comparison (3.7773ms)
+✔ R44 autonomous live gate binds the current compact gateway contract instead of the historical 73-tool public catalog (0.547ms)
+✔ R34 parity proves coding package tests before package-visible scratch mutation (0.605ms)
+✔ R34 parity isolates scratch mutation and search from the core release tree (0.9843ms)
+✔ R36 parity validator requires full-76, compact closure, exact R35 predecessor and immutable-slot separation (1.1702ms)
+✔ R36 compact disarmed probe carries signed machine status/ping evidence into closure (9.2218ms)
+✔ R36 parity captures exact successor bridge before rollback and reuses it for restore (1.0337ms)
+✔ R36 compact parity uses bounded release-parity tests instead of the full npm suite (0.8352ms)
+✔ R36 compact parity treats stale machine-fs precondition denial as expected evidence (0.4559ms)
+✔ R36 final closure writer binds compact public evidence and R36 release evidence domains (0.6012ms)
+✔ R36 independent closure verifier binds full, compact, predecessor, restore, Windows gate and immutable slot (0.5719ms)
+✔ R43 parent contract binds exact immutable R42 release and signed activation evidence (412.6357ms)
+✔ R43 parent record explicitly refuses to invent missing R42 final closure evidence (0.7195ms)
+✔ R49 remote-control donor evidence pins all requested sources and records bounded native adoption (3.2973ms)
+✔ R58 canonical Windows gate is successor-bound while the R57/R56/R55/R54/R53/R52/R51/R50/R49 historical gates stay frozen (6.4566ms)
+✔ R56 exposes rollback launcher planning from the signed activation handoff (0.5085ms)
+✔ R56 accepts a prior launcher snapshot whose hash differs from the active launcher and binds both signed pointers (1.0718ms)
+✔ R56 rejects a predecessor launcher snapshot that does not match the signed prior pointer (0.6182ms)
+✔ R56 rejects handoff pointer drift instead of using unsigned rollback state (0.3068ms)
+✔ R56 rollback verifies stored predecessor bytes before stop, restores signed predecessor launcher before pointer commit, and reinstalls successor launcher before recovery pointer (3.4485ms)
+✔ R57 exports bounded downstream core discovery (0.4961ms)
+✔ R57 tolerates the observed ONLINE-to-core visibility race and returns the later exact child (0.3746ms)
+✔ R57 times out fail-closed when the core never appears (0.487ms)
+✔ R57 does not retry an ambiguous downstream core topology (0.2147ms)
+✔ R57 startAndVerify uses bounded core discovery after the ONLINE gate (3.6413ms)
+✔ R58 doctor independently verifies installed bytes and never repairs fixture files (32.7412ms)
+✔ R58 doctor stops before following drifted release, generation or config paths (2.8421ms)
+✔ R58 doctor does not accept a valid-schema pointer to an absent installed slot (2.3464ms)
+✔ R58 guardian rejects an IPC parent that does not match its declared owner before cleanup (431.5626ms)
+✔ R58 launcher dispatch uses native Windows PowerShell even when entered from pwsh (773.8593ms)
+{"baseline_release":"v0.15.35-1b5715b276facbc0","surface_sha256":"8e98978b720633acb0c7d4d65c36a945243c47f6dbccfa64ab877329f2956fe3","unchanged":43,"added":[],"removed":[],"schema_changed":[]}
+✔ R59 compact client-visible tool names and schemas match sealed 0.15.35 baseline (1841.8635ms)
+✔ Windows manifest replace normalizes only a read-only destination before atomic rename (119.4568ms)
+✔ Windows manifest replace retries a transient sharing lock and stays atomic (768.8818ms)
+✔ Windows manifest replace fails closed after a bounded persistent sharing lock (1750.8792ms)
+✔ R36 lifecycle formatter exposes device/connect/ready/cleanup states with bounded semantic emoji (0.7512ms)
+✔ R36 live activity tracker prints RUN before terminal result and reconciles interrupted requests (1.0313ms)
+✔ R36 live activity tracker tolerates terminal result whose request was before the tail baseline (0.1014ms)
+✔ semantic LSP backend retries transient empty read results only when explicitly enabled (169.5069ms)
+✔ R36 TypeScript diagnostics carry target/result identity (297.8216ms)
+✔ R36 TypeScript implementations normalize implementation locations (180.4803ms)
+✔ R36 cross-file rename preview creates Native Diff without mutation, then apply/verify succeeds (200.8109ms)
+✔ R36 rename preview rejects invalid identifiers before Native Diff creation (5.089ms)
+✔ production tracer bullet negotiates MCP then reads, surgically edits, runs and verifies a real test (1826.4227ms)
+ℹ tests 125
+ℹ suites 0
+ℹ pass 125
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 31397.7033
+R48-BOUNDED-REGRESSION batch=7/8 files=33
+﹣ R44 historical agent catalog contract is frozen; current R47 runtime supersedes its base surface (0.4213ms) # SKIP
+✔ real stdio MCP audits request/result with active machine binding (1079.3007ms)
+✔ T7 capability manifest exposes Desktop only when runtime exists and never Host (29.0488ms)
+✔ T7 read-only Desktop observe works while Desktop mutation authority is DISARMED (78.8038ms)
+✔ successor autonomous Desktop wait replaces fixed sleep and verifies signed observation evidence (143.8997ms)
+✔ T7 Autonomous authority cannot substitute for missing Desktop mutation grant (55.7582ms)
+✔ T7 armed flow binds observe to UIA target to one Desktop action and verifies every Desktop receipt (252.3166ms)
+✔ T7 UNKNOWN Desktop outcome pauses for critic/replan and is never replayed (151.7771ms)
+✔ autonomous_goal_verify structured contract preserves delegated action evidence count (1.8782ms)
+✔ R34 run/status output contracts accept only the sanitized public loop projection (3.3588ms)
+✔ bounded yielded autonomous run preserves its resumable cycle count (1.0785ms)
+✔ R34 public loop contract rejects internal progress/action payload fields (1.0628ms)
+✔ R59 capability snapshot v3 is a backward-compatible content-bound live overlay (9.3457ms)
+✔ R59 capability snapshot rejects routes outside the signed ledger (0.3252ms)
+✔ R44 policy binds Codex executable, model, root and circuit identity (100.5166ms)
+✔ R44 autonomous runtime consumes injected Codex planner and does not ask client sampling (112.1111ms)
+✔ R44 autonomous Codex policy fails closed without injected provider runtime (90.6739ms)
+✔ Commander exhaustive surface is internally consistent and natively implemented (3.9344ms)
+✔ Commander extended native source has no Commander dependency (1.6017ms)
+✔ Commander extended config is hash-preconditioned and bounded (6.0922ms)
+✔ Commander prompt runtime accepts reference-valid long IDs within bounded native storage (0.2283ms)
+✔ Commander extended feedback is bounded and durably recorded (3.5825ms)
+✔ Commander extended prompt/resource catalogs are deterministic and bounded (0.5922ms)
+✔ Commander extended preview is bounded and PDF output is self-contained (3.1029ms)
+✔ R48 native DOCX reader produces text-bearing outline and paged raw XML (10.2812ms)
+✔ R48 native DOCX search covers document headers and footers with literal bounded semantics (1.1634ms)
+✔ R48 native XLSX reader preserves types, sheet selection, A1 range, and row pagination (1.6882ms)
+✔ R48 office ZIP parser rejects traversal and CRC corruption (0.6545ms)
+✔ R48 native XLSX range editor rewrites existing cells and creates missing rows/cells without shared-string mutation (2.165ms)
+✔ R48 native XLSX range editor fails closed on shape mismatch and unsupported value type (0.3619ms)
+✔ R48 native XLSX creator emits deterministic multi-sheet OOXML readable by the same parser (1.8485ms)
+✔ R48 native XLSX append preserves existing package and appends rows to an existing sheet (1.1114ms)
+✔ R48 native XLSX creator rejects unsafe sheet names and non-rectangular data (0.2163ms)
+✔ R48 native DOCX editor performs exact pretty-XML replacement and repacks a valid document (0.7606ms)
+✔ R48 native DOCX editor refuses ambiguous replacement counts before repack (0.2221ms)
+✔ R48 valid incremental update selects the latest object revision and survives oracle reload (103.6322ms)
+✔ R48 ordinary PDF with compressed object streams preserves pages through independent oracle reload (7.5969ms)
+✔ R48 compressed object streams reject duplicate identity and malformed indexes before mutation (1.1297ms)
+✔ R48 native PDF profile round-trips exact page text and exposes stable page count (1.0874ms)
+✔ R48 PDF delete uses Desktop Commander negative-index semantics without page confusion (0.3055ms)
+✔ R48 PDF insert supports markdown and source PDF pages with exact ordered insertion (0.3437ms)
+✔ R48 ordinary classic PDF surgery preserves selected content graphs and supports inserts (0.67ms)
+✔ R48 generic PDF reader extracts bounded text from classic plain content streams (0.2128ms)
+✔ R48 generic PDF reader inflates Flate streams and extracts TJ plus hex strings (0.4766ms)
+✔ R48 generic PDF reader fails closed when page content uses an unsupported filter (0.2354ms)
+✔ R48 raw stdio returns JSON-RPC parse error and remains usable after malformed JSON (622.5849ms)
+✔ R48 raw stdio returns Invalid Request for valid JSON outside MCP message schema and remains usable (615.4239ms)
+✔ R48 raw stdio preserves method/tool errors and request correlation under duplicate/concurrent ids (589.8514ms)
+✔ R47 production server wires native remote device plane (2.844ms)
+✔ R47 relay is native MCP client and contains no Desktop Commander dependency (1.0447ms)
+{"tool_count":42,"catalog_sha256":"a747adcd4dc515e40050a9ed2fea5deabaa5845d0bb3094cc9a64525b23b77aa","ledger_sha256":"5773a90a024edf1530b726eaf2674ec53a272c9947f020e29b4fd8eeb4bbdc18","desktop":true,"authority":"DISARMED"}
+✔ R40 real max-runtime compact stdio catalog is exactly 42 while all authority remains disarmed (1726.6247ms)
+✔ containment result validator accepts the complete LPAC invariant set (1.0415ms)
+✔ containment result validator accepts the complete regular AppContainer invariant set (0.1176ms)
+✔ containment result validator refuses mode confusion (0.2907ms)
+✔ containment result validator rejects a readable host canary (0.1185ms)
+✔ containment result validator rejects any granted capability (0.1001ms)
+✔ containment result validator rejects child payload execution (0.0799ms)
+✔ containment result validator rejects a non-LPAC token when LPAC is expected (0.1006ms)
+✔ containment result validator accepts regular AppContainer when LPAC-specific query is unavailable but AAP behavior proves regular mode (0.0761ms)
+✔ containment result validator rejects LPAC when regular AppContainer is expected (0.1712ms)
+✔ containment result validator rejects regular AppContainer when AAP behavioral mode evidence fails (0.1703ms)
+✔ containment result validator requires LPAC-specific token query for LPAC mode (0.1083ms)
+✔ containment result validator rejects LPAC that can read the AAP canary (0.0746ms)
+✔ containment result validator rejects missing Job assignment (0.0771ms)
+✔ containment result validator rejects timeout (0.0491ms)
+✔ containment result validator rejects non-atomic Job assignment (0.1133ms)
+✔ containment result validator rejects enabled breakaway (0.1415ms)
+✔ containment result validator rejects the broken token child-policy mechanism (0.0961ms)
+✔ containment result validator rejects breakaway child payload execution (0.0809ms)
+✔ containment result validator rejects a filesystem result channel (0.0505ms)
+✔ native launcher uses atomic Job assignment and excludes the broken child-policy attribute (8.3806ms)
+✔ native build script targets Windows 10 and preserves MSVC diagnostics (0.9304ms)
+✔ native build is reproducible at both MSVC object and linker boundaries (0.9701ms)
+✔ native build command composition is Windows PowerShell 5.1 parser-safe (0.5446ms)
+✔ native launcher link contract includes Ole32 for CoTaskMemFree (0.5988ms)
+✔ native probe link contract includes Advapi32 for token inspection APIs (0.3868ms)
+✔ native launcher narrows SID text only through explicit ASCII validation (0.3755ms)
+✔ native result channel is an explicitly inherited one-way handle, not a result path grant (0.6673ms)
+✔ containment smoke preserves parseable failed measurements instead of discarding child exit evidence (0.4122ms)
+✔ containment validator reports the probe invariant before aggregate failed status (0.1412ms)
+✔ containment smoke includes the raw probe measurement on invariant failure (0.6811ms)
+✔ native LPAC probe uses the static MSVC runtime (0.5432ms)
+✔ native build audits the probe for dynamic MSVC and UCRT dependencies (0.6253ms)
+✔ native launcher preserves symbolic early-loader failure evidence (0.7617ms)
+✔ native bootstrap probes have custom no-CRT entrypoints (1.4811ms)
+✔ native build links bootstrap probes without default CRT libraries (1.2205ms)
+✔ native launcher applies ALL_APPLICATION_PACKAGES opt-out only in LPAC mode (0.6743ms)
+✔ full probe validates requested mode with LPAC API evidence plus AAP behavioral evidence (1.4351ms)
+✔ full probe records per-query Win32 evidence instead of collapsing LPAC query failure into a generic token failure (2.4518ms)
+✔ full containment uses an ALL_APPLICATION_PACKAGES canary as behavioral regular-vs-LPAC evidence (1.066ms)
+✔ bootstrap diagnostic compares regular AppContainer and LPAC with zero capabilities (0.9492ms)
+✔ package exposes separate LPAC and regular AppContainer smoke gates (0.6321ms)
+✔ construction ladder starts from Microsoft-style security-capabilities-only baseline (0.6937ms)
+✔ construction ladder adds containment mechanisms as isolated transitions (0.5588ms)
+✔ construction entrypoint probe is no-CRT and proves execution only through exit code 66 (0.8737ms)
+✔ construction diagnostic reports the first failing transition without fallback (0.5858ms)
+✔ construction launcher includes the SDDL declaration and retains Advapi32 linkage for ConvertSidToStringSidW (1.2334ms)
+✔ construction diagnostic refuses to run when native build artifacts are missing (0.7858ms)
+✔ child-control matrix isolates policy, suspended start, delayed Job, and atomic Job (0.6789ms)
+✔ Job child-control candidate sets active process limit one and never enables breakaway (0.5861ms)
+✔ child-control hostile probe tests normal creation and explicit Job breakaway execution (1.1568ms)
+✔ child-control diagnostic has no automatic fallback and prefers atomic Job only after observed denial (1.1665ms)
+✔ native build produces child-control launcher and hostile probe with MSVC (0.6988ms)
+✔ package exposes explicit child-control diagnostic gate (0.5128ms)
+✔ full containment probe verifies normal and explicit breakaway child payload denial (0.7003ms)
+✔ package default containment smoke targets the observed regular AppContainer baseline (0.5335ms)
+✔ R35 provenance identity is deterministic and observation time is not part of stable identity (1.7764ms)
+✔ R35 structured secret evidence never exposes a secret-derived digest oracle (0.5796ms)
+✔ R35 dedupeEvidence keeps the newest item for identical provenance while preserving stable identity order (0.3817ms)
+✔ R35 provenance validates bounded identity, trust and relevance inputs (0.4004ms)
+✔ R21 binds local readiness to the verified Bridge listener PID (3.8619ms)
+✔ R21 handles empty cloud logs and waits for tunnel origin metadata (1.0355ms)
+✔ R29 machine identity is stable across generations and signs generation-bound pings (41.2109ms)
+✔ R29 revoke increments generation and invalidates previous machine-runtime epoch (26.1566ms)
+✔ R29 concurrent identity initialization converges on one key without destructive cleanup (36.7481ms)
+✔ contained smoke uses an isolated temporary workspace and cleans it (2.7184ms)
+✔ R30 native process host supervises one fixed child and captures output (30.7705ms)
+✔ R31 native process host pipe transport preserves an interactive owned session (72.7233ms)
+✔ provider circuit state enum is exact and failure classifier is bounded (1.5414ms)
+✔ CLOSED opens exactly at threshold and OPEN suppresses provider invocation (1.114ms)
+✔ OPEN becomes HALF_OPEN only at boundary and permits one bounded probe (0.2466ms)
+✔ HALF_OPEN success closes circuit and failure reopens it from failure time (0.1522ms)
+✔ replay is deterministic and malformed authenticated evidence becomes unavailable (0.1967ms)
+✔ events for other providers never affect this provider circuit (0.1023ms)
+✔ R42 parity requires exact R41 predecessor and immutable R42 slot (1.5571ms)
+✔ R42 release machinery binds 0.14.0, R41 predecessor, memory gates and R42 domains (3.747ms)
+✔ R42 preserves release-namespaced deterministic memory storage (1.2135ms)
+✔ R43 detached finalizer requires explicit Process+Coding+Autonomous grants and keeps Desktop+Host disarmed (1.353ms)
+✔ R43 detached finalizer accepts only exact parent-bound hardening gate evidence (0.4136ms)
+✔ R51 historical release metadata remains byte-frozen at published 0.15.28 (3.7751ms)
+✔ R51 historical lineage binds exact 0.15.27 parent and 0.15.27 source predecessor (1.4672ms)
+✔ R51 historical capability claims remain frozen (0.6519ms)
+✔ R58 doctor runtime cannot inherit ONLINE when downstream topology contradicts it (1.3335ms)
+✔ R58 doctor separates healthy local topology from remote/cloud disconnect (0.1958ms)
+✔ R58 doctor strict snapshot rejects injection, wrong root and topology/schema drift (0.4211ms)
+✔ R58 doctor surfaces corrupt grants and authority dependency loss without silently disarming (0.8383ms)
+✔ R58 bounded transaction inventory flags residue without recovering or overwriting it (14.2605ms)
+✔ R58 owner identity rejects PID reuse and every material identity drift (0.9682ms)
+✔ R58 narrow identity query binds the current live process and rejects injection (546.136ms)
+✔ remote result journal is monotonic, restart-safe, and suppresses duplicate terminal results (9.6785ms)
+✔ bounded retention rejects stale cursor and never stores raw payload bytes (4.5506ms)
+✔ cursor parser rejects foreign sessions and malformed cursors (1.7626ms)
+✔ remote result journal preserves explicit unknown side-effect state across restart and replay (2.9647ms)
+✔ semantic backend registry resolves normalized extensions and exposes stable languages (8.6853ms)
+✔ semantic backend registry fails closed for unsupported languages (0.4425ms)
+✔ semantic backend registry rejects duplicate ids, extension ownership, and incomplete backends (0.2606ms)
+✔ semantic LSP backend retries only transient null read results within configured bound (186.4254ms)
+✔ MCP server loads pinned external semantic backends from explicit config without changing public tool names (2275.8652ms)
+✔ R44 compact surface exposes one read-only skill_catalog without authority (1138.9464ms)
+✔ R44 skill catalog is metadata-only and load is signature/content bound (29.5605ms)
+✔ R44 skill plane reports malformed registry entries without hiding valid skills (11.7405ms)
+✔ R44 skill plane fails closed on SKILL.md and resource tampering (10.3032ms)
+✔ R44 skill plane rejects undeclared payloads, unknown authority and signature drift (16.0244ms)
+✔ sanitizer keeps useful identifiers, redacts secrets, and hashes payload/oversized values (2.6682ms)
+✔ tool wrapper durably records request before handler and writes correlated result without raw output (15.9236ms)
+✔ audit failure before request commit prevents handler side effects (0.5011ms)
+✔ thrown handler writes a hashed error outcome without raw error text (7.3946ms)
+✔ record threshold seals immutable segment with signed checkpoint and preserves cross-segment chain (16.1034ms)
+✔ writer restart resumes an unsealed segment without resetting seq or chain head (9.4076ms)
+✔ controller enables audit only for Bridge child and restores parent audit environment (0.5816ms)
+✔ audit outcome reason preserves ordinary letters and Windows paths while folding actual whitespace (6.6038ms)
+ℹ tests 161
+ℹ suites 0
+ℹ pass 160
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 1
+ℹ todo 0
+ℹ duration_ms 13873.4562
+R48-BOUNDED-REGRESSION batch=8/8 files=33
+✔ independent verifier accepts a clean signed multi-segment audit chain (30.6117ms)
+✔ verifier detects an edited event line (15.2687ms)
+✔ verifier detects a deleted line (11.4331ms)
+✔ verifier detects reordered lines (13.3883ms)
+✔ verifier detects a forged checkpoint signature (12.6249ms)
+✔ verifier detects broken cross-segment continuity even if the edited event self-hash is recomputed (13.7594ms)
+✔ current Windows process identity binds pid creation time image path and image hash (284.8203ms)
+✔ local supervisor refuses takeover of live verified owner (861.5284ms)
+✔ stale PID reuse does not inherit ownership (1088.3803ms)
+✔ exclusive claim and verified release cannot delete another live owner marker (1385.5352ms)
+✔ recovery request allowlist permits status resume park and disarm only (1.1365ms)
+✔ local supervisor host owns marker, advances durable provider goal, and releases ownership on stop (1148.8122ms)
+✔ managed runtime recovery uses only resume, disarm planes, then exact ONLINE/DISARMED status proof (0.7186ms)
+✔ managed runtime recovery fails closed when final status is not all disarmed (0.3486ms)
+✔ pinned controller runner verifies script hash before fixed PowerShell invocation (161.1671ms)
+✔ R34 bridge loss is recovered by local supervisor to ONLINE and all-DISARMED (3135.3887ms)
+✔ client-sampling local supervisor owns recovery without fabricating planner work (1209.9736ms)
+✔ standalone supervisor host starts in client-sampling recovery-only mode (1004.4148ms)
+✔ continuous standalone supervisor remains alive after READY and hard-stop ownership is takeover-safe (2627.5954ms)
+✔ standalone supervisor host advances durable provider goal without MCP bridge process (1080.3292ms)
+✔ plan id is goal-stable and version starts at one (1.2183ms)
+✔ completed prefix is immutable across replan (0.6661ms)
+✔ replan changes only active and pending suffix and increments version (0.6874ms)
+✔ step completion requires evidence and activates exactly the next step (0.2795ms)
+✔ completing the final step leaves no active step and marks plan complete (0.8603ms)
+✔ verified Native Diff epoch advance counts as progress (1.486ms)
+✔ same read identity and equivalent decision stalls (0.1959ms)
+✔ planner rationale text never changes the machine progress fingerprint (0.1605ms)
+✔ resolved acceptance failure and completed plan step count as progress (0.2533ms)
+✔ stall policy forces replan then waiting (1.3138ms)
+✔ autonomous policy defaults R34 progress limits and rejects zero values (12.9317ms)
+✔ torture: concurrent stale writers permit exactly one winner per version (1459.0029ms)
+✔ torture: move/delete races cannot duplicate or silently lose an object (20.7172ms)
+✔ torture: pagination remains deterministic under concurrent directory churn (39.4291ms)
+✔ torture: process cancellation race converges to one verified terminal state (35.4409ms)
+✔ torture: process session identity cannot be replaced by a foreign session id (46.0302ms)
+✔ R29 controller defaults machine runtime on and forwards stable state-root identity (3.1072ms)
+✔ R29 stable launcher exports canonical state root and example config enables machine runtime (0.7802ms)
+✔ R30 controller feature-gates process runtime and policy into Bridge only (3.4356ms)
+✔ R30 controller owns a separate process standing-grant lifecycle (1.3149ms)
+✔ T9 observer helper substitution is detected before native process launch (6.072ms)
+✔ T9 input helper substitution is definite not_started before SendInput dispatch (3.6213ms)
+✔ T9 UIA helper substitution is detected before COM traversal process launch (2.3849ms)
+✔ T5 UIA request is fixed bounded and keeps semantic query in stdin only (1.0832ms)
+✔ T5 UIA response is foreground-bound and filters off-desktop rectangles (0.8117ms)
+✔ T5 UIA response rejects foreground substitution and oversized query (0.4376ms)
+﹣ R47 runtime full stdio catalog exactly matches canonical registration surface (0.479ms) # historical R47 catalog; R48 supersedes it
+✔ R45 hardware query is typed read-only observation with signed evidence and no host authority (13.7452ms)
+✔ R45 hardware query rejects untyped arbitrary query names before provider dispatch (3.2372ms)
+✔ R31 registers exactly eight bounded machine filesystem tools (3.4909ms)
+✔ R31 machine filesystem schemas expose root-relative IDs/preconditions only (3.4113ms)
+✔ post-effect mutation uncertainty survives the public structured error boundary (1.8453ms)
+✔ R31 machine fs supports exact mkdir/write/stat/list/range-read/edit/move/delete lifecycle (56.788ms)
+✔ R31 machine fs listing is deterministic and cursor-paged (12.1904ms)
+✔ R48 machine fs listing isolates one unreadable child instead of failing the page (3.0788ms)
+✔ R31 machine fs fails closed on traversal, denied paths and stale source identity (5.339ms)
+✔ R31 machine fs mutation receipt verifies independently (6.5779ms)
+✔ R46 machine fs read timeout kills a hung read worker instead of abandoning live I/O (120.0758ms)
+✔ R47 machine fs list cursor is signed, canonical, and snapshot-bound (7.3727ms)
+✔ R47 machine fs signed cursor rejects reordered canonical envelope (6.9383ms)
+✔ R47 machine fs move rejects destination race without losing source identity (5.9889ms)
+✔ R47 machine fs delete recovery preserves identity when receipt persistence fails (6.3311ms)
+✔ R47 machine fs read_many is bounded, deterministic, and rejects duplicate paths (4.1852ms)
+✔ R47 read-only machine fs remains usable without an active coding lease (6.8312ms)
+✔ R41 planner request binds verified bounded memory before a mutating decision (51.7719ms)
+✔ coding_files_read reads bounded mixed encodings in one MCP call and fails closed on denied input (1810.5928ms)
+✔ R32 core registers observation only behind explicit read-only feature flag (3.1849ms)
+✔ R32 controller and generation bind observation runtime explicitly (1.9063ms)
+✔ R32 updater exposes explicit observation enable and threads it into the candidate (0.6756ms)
+✔ R34 exact remote catalog keeps observation and disarmed gate bound to the canonical 73-tool surface (0.8957ms)
+✔ R32 package and Windows gate include observation live smoke before final manifest verify (0.9738ms)
+✔ R37 effect ledger detects semantically identical repeated effects across planner wording (1.2413ms)
+✔ R37 memory plane derives deterministic core archival and graph views from journal (8.644ms)
+✔ R37 worker scheduler enforces resources, leases and expiry recovery (0.7544ms)
+✔ R37 observation leases bind effects to fresh observed state and mutation epoch (0.3543ms)
+✔ R37 autonomous runtime integrates memory, effect guard, worker scheduler and observation lease (3.4727ms)
+✔ R37 timeout recovery accepts signed durable terminal success (1.0871ms)
+✔ R37 timeout recovery surfaces paused or cancelled as terminal failure (0.1304ms)
+✔ R37 timeout recovery waits while planner or decision is still in flight (0.0965ms)
+✔ R37 timeout recovery resumes only after durable head advance and cleared pending state (0.1332ms)
+✔ R37 public autonomous smoke binds timeout recovery to pre-run journal head and resumes yielded work (4.63ms)
+✔ R37 timeout recovery waits until server-side run lock is released even after durable progress (0.1483ms)
+✔ R37 autonomous goal status exposes run-lock state for timeout-safe clients (1.2429ms)
+✔ R44 parity requires exact R43 predecessor, 81/43 surface and feature contract (1.4609ms)
+✔ R44 release machinery is isolated from R43 and binds 0.15.0 signed closure domains (4.2076ms)
+✔ R45 autonomous quick-test is fixture-scoped and does not invoke legacy npm test matrix (2.8166ms)
+✔ R45 detached finalizer requires Process+Coding+Autonomous and Desktop+Host DISARMED (0.7806ms)
+✔ R45 finalizer binds exact R44 parent and all Machine Freedom gate proofs (0.2653ms)
+✔ R45 release machinery binds 0.15.1, 82/43 surfaces, Host v2 bootstrap and FINAL closure (11.9807ms)
+✔ R48 compatibility release contract remains coherent in the current successor (3.645ms)
+✔ R55 excludes the verified foreground remote guardian sibling owned by an activation ancestor (1.136ms)
+✔ R55 does not exempt a guardian whose parent does not equal its declared ancestor owner (0.3089ms)
+✔ R55 does not exempt a guardian whose owner is outside the activation lineage (0.202ms)
+✔ R55 does not exempt a guardian without the signed-session-shaped nonce contract (0.1699ms)
+﹣ R55 release identity is coherent across package lock source metadata SBOM and gate (0.4947ms) # SKIP
+﹣ R55 source predecessor is exact immutable published 0.15.31 while runtime predecessor remains exact 0.15.29 (0.0869ms) # SKIP
+﹣ R55 records the guardian sibling RED to GREEN and preserves fail-closed negative controls (0.0645ms) # SKIP
+﹣ R56 release identity is coherent across package lock source metadata SBOM and gate (0.4832ms) # SKIP
+﹣ R56 source and runtime predecessor are exact active published 0.15.32 (0.0778ms) # SKIP
+﹣ R56 records signed rollback launcher ordering RED to GREEN and preserves non-final claim (0.0656ms) # SKIP
+✔ R58 foreground cleanup failure retains ownership evidence for recovery (3320.2074ms)
+✔ R58 completed update cannot return PASS without its signed subject-bound completion receipt (58.5068ms)
+✔ R58 repeated completed update verifies signed subject, not merely a signature or journal flag (981.3552ms)
+✔ R59 identity is coherent and binds exact accepted 0.15.35 predecessor (4.0146ms)
+✔ R59 release records runtime hardening without expanding public authority (1.5309ms)
+✔ R44 remote device reported online is not reachable until identity-bound probe ACK (25.1181ms)
+✔ R44 remote dispatch is durable-before-send, replay-idempotent and silent drop is terminal (20.9158ms)
+✔ R44 remote routing requires local capability authorization and revoke invalidates epoch (10.7207ms)
+✔ R44 credential rotation commits encrypted replacement before supersede callback (10.9495ms)
+✔ R44 remote state corruption fails closed (1.5764ms)
+✔ R46 remote readiness probe retries only the idempotent probe and remains bounded by timeout (120.1016ms)
+✔ R46 remote reachability expires after the bounded probe freshness window (1123.5289ms)
+✔ R46 remote dispatch timeout is not retried and downgrades reachability (126.1458ms)
+✔ semantic runtime routes all operations through an injected backend registry without changing public arguments (8.1095ms)
+✔ semantic runtime fails closed instead of falling back to text search for unknown extensions (0.4307ms)
+✔ failed guardian cleanup preserves ownership evidence and reports failure (702.6377ms)
+✔ probe adapter handles legacy initialize locally without forwarding it to strict core (1.5493ms)
+✔ probe adapter counteroffers only a legacy revision when initialize names modern era (0.114ms)
+✔ probe adapter consumes only notifications/initialized without an id (0.0991ms)
+✔ probe adapter forwards modern server/discover unchanged (0.098ms)
+✔ probe adapter does not modernize legacy tools/list or tools/call (0.1119ms)
+✔ probe adapter forwards malformed and unknown input unchanged (0.0821ms)
+✔ strict MCP core still rejects legacy at the SDK serving boundary (5.1682ms)
+✔ probe adapter source cannot execute subprocesses or write files and keeps a bounded buffer (0.7274ms)
+✔ installed stdio prefilter answers legacy startup probe and forwards split Unicode modern bytes exactly (35.3389ms)
+✔ tunnel compatibility smoke derives exact modern catalog and explicitly disables Host (0.8472ms)
+✔ Windows target gate executes real tunnel stdio compatibility smoke before containment stages (0.9417ms)
+{"status":"pass","stream_id":"test","logical_last_seq":3,"retained_first_seq":2,"truncated":true}
+✔ test\workload-substrate.test.mjs (35.841ms)
+ℹ tests 128
+ℹ suites 0
+ℹ pass 121
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 7
+ℹ todo 0
+ℹ duration_ms 27018.4566
+R48-BOUNDED-REGRESSION PASS files=265 batches=8