deadbyte-mcp 0.15.34 → 0.15.36

package/scripts/bridge-benchmark-r58.mjs

@@ -0,0 +1,67 @@
+import {mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import {randomBytes,createHash} from 'node:crypto';
+import {createServer} from 'node:net';
+import {performance} from 'node:perf_hooks';
+import {setTimeout as delay} from 'node:timers/promises';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+import {Client,StreamableHTTPClientTransport} from '@modelcontextprotocol/client';
+import {generateTrustKeypair} from '../src/trust.mjs';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+
+const run=path.resolve(process.argv[2]||'');const base=path.resolve('D:/Projects/deadbyte-mcp/testing/0.15.35');const rel=path.relative(base,run);
+if(!rel||rel.startsWith('..')||path.isAbsolute(rel))throw new Error('new D: R58 run root required');await mkdir(run);
+const core='C:/Users/DEADBYTE/.deadbyte-mcp/releases/v0.15.34-2199bb59f0e0fc20';
+const targets={baseline:'D:/Projects/deadbyte-chatgpt-bridge-r40-dev',candidate:'D:/Projects/deadbyte-mcp/development/deadbyte-mcp-0.15.35-r58/bridge'};
+const entries=Object.entries(targets);if(process.argv[3]==='candidate-first')entries.reverse();
+const sha=b=>createHash('sha256').update(b).digest('hex');
+if(sha(await readFile(path.join(core,'MANIFEST.SHA256')))!=='2199bb59f0e0fc205d470d11f990d3ce3df444be5eba2a7d8dbc60d5f5b790bb')throw new Error('core baseline drift');
+const summaries={};
+const extended=process.argv.includes('--extended');
+const corpus=[{name:'coding_session_status',arguments:{}},{name:'capability_manifest',arguments:{}}];
+if(extended)corpus.push({name:'coding_file_read',arguments:{root_id:'bench',path:'input.txt'}},{name:'coding_tree',arguments:{root_id:'bench',path:'.',max_depth:2,max_entries:100}});
+for(const [label,target] of entries){
+ const root=path.join(run,label);await mkdir(root);const state=path.join(root,'state'),workspace=path.join(root,'workspace'),temp=path.join(root,'temp');
+ for(const dir of [state,workspace,temp])await mkdir(dir);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+ const policy=path.join(root,'policy.json');
+ await writeFile(policy,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:path.join(state,'grant.json'),evidence_dir:path.join(state,'evidence'),roots:{bench:{path:workspace,read:true,write:false,exec:false,deny_paths:[]}},commands:{},max_read_bytes:65536,max_write_bytes:65536}),{flag:'wx'});
+ const fixture='bounded fixture alpha\n'.repeat(100);await writeFile(path.join(workspace,'input.txt'),fixture,{flag:'wx'});
+ if(extended){const loaded=await loadCodingPolicy(policy);await writeFile(path.join(state,'grant.json'),JSON.stringify({schema:'deadbyte.coding-grant.v2',policy_sha256:loaded.policy_sha256,instance_nonce:randomBytes(32).toString('hex'),root_ids:['bench']}),{flag:'wx'});}
+ const reservation=createServer();await new Promise(resolve=>reservation.listen(0,'127.0.0.1',resolve));const port=reservation.address().port;await new Promise(resolve=>reservation.close(resolve));
+ const token=randomBytes(32).toString('hex');const env={...process.env};for(const key of Object.keys(env))if(key.startsWith('DEADBYTE_'))delete env[key];
+ Object.assign(env,{TEMP:temp,TMP:temp,npm_config_cache:path.join(root,'npm-cache'),DEADBYTE_CORE_ROOT:core,DEADBYTE_STATE_ROOT:state,DEADBYTE_WORKSPACE_ROOT:workspace,DEADBYTE_BRIDGE_PORT:String(port),DEADBYTE_BRIDGE_PATH_TOKEN:token,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,DEADBYTE_PRIVILEGED_POLICY:'',DEADBYTE_CAPABILITY_PROFILE:'compact',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:policy,DEADBYTE_MACHINE_FS_RUNTIME:'0',DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0',DEADBYTE_AUDIT_RUNTIME:'0'});
+ const bridgePath=path.join(target,'src/bridge.mjs');const script=`process.on('message',m=>{if(m==='stop')process.emit('SIGTERM')});await import(${JSON.stringify(pathToFileURL(bridgePath).href)});`;
+ const start=performance.now();const child=spawn(process.execPath,['--input-type=module','-e',script],{cwd:target,env,windowsHide:true,stdio:['ignore','pipe','pipe','ipc']});
+ let stdout='',stderr='';child.stdout.on('data',b=>{stdout+=b;});child.stderr.on('data',b=>{stderr+=b;});const exited=new Promise(resolve=>child.once('exit',code=>resolve(code)));
+ const samples=[];let catalog;
+ try{
+  const deadline=Date.now()+20000;while(!stdout.includes('BRIDGE_READY')&&child.exitCode===null&&Date.now()<deadline)await delay(20);
+  if(!stdout.includes('BRIDGE_READY'))throw new Error(`${label} bridge startup failed: ${stderr}`);
+  const startup=performance.now()-start;
+  for(let batch=0;batch<3;batch++){
+   const client=new Client({name:'r58-isolated-bridge-benchmark',version:'1.0.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+   try{
+    await client.connect(new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${port}/mcp/${token}`)));
+    const tools=(await client.listTools()).tools;if(!catalog){catalog=tools;await writeFile(path.join(root,'catalog.json'),JSON.stringify(tools,null,2),{flag:'wx'});}
+    for(let iteration=0;iteration<120;iteration++)for(const request of corpus){
+     const {name}=request;const t=performance.now();const result=await client.callTool(request);const elapsed=performance.now()-t;
+     if(result.isError||!result.structuredContent)throw new Error(`${label} benchmark tool failed: ${name}`);
+     if(name==='coding_file_read'&&(result.structuredContent.content!==fixture||result.structuredContent.sha256!==sha(fixture)))throw new Error('read behavior/hash oracle mismatch');
+     if(iteration>=20)samples.push({batch,iteration:iteration-20,tool:name,roundtrip_ms:elapsed});
+    }
+   }finally{await client.close();}
+  }
+  const quant=values=>{const v=[...values].sort((a,b)=>a-b),q=p=>v[Math.ceil(v.length*p)-1];return{n:v.length,min:v[0],p50:q(.5),p90:q(.9),p95:q(.95),p99:q(.99),max:v.at(-1)}};
+  summaries[label]={startup_ms:startup,script_sha256:sha(await readFile(bridgePath)),catalog_count:catalog.length,rows:Object.fromEntries(corpus.map(({name})=>[name,quant(samples.filter(s=>s.tool===name).map(s=>s.roundtrip_ms))])),aggregate:quant(samples.map(s=>s.roundtrip_ms))};
+  await writeFile(path.join(root,'raw.json'),JSON.stringify(samples),{flag:'wx'});
+ }finally{
+  await rm(path.join(state,'grant.json'),{force:true});
+  if(child.connected)child.send('stop');
+  const code=await Promise.race([exited,delay(5000).then(()=>null)]);if(code===null){child.kill();throw new Error('owned fixture bridge did not close through normal shutdown');}
+  await writeFile(path.join(root,'stdout.log'),stdout,{flag:'wx'});await writeFile(path.join(root,'stderr.log'),stderr,{flag:'wx'});
+ }
+}
+const result={schema:'deadbyte.r58.isolated-bridge-performance.v1',status:'MEASURED_NOT_FULL_PERFORMANCE_ACCEPTANCE',core,corpus,workload_sha256:sha(JSON.stringify(corpus)),test_read_grant:extended,grant_removed_after_target:true,summaries,p95_reduction_pct:100*(1-summaries.candidate.aggregate.p95/summaries.baseline.aggregate.p95),limitations:['bounded read-only categories only','not production machine ping/public transport','no mutation/build/test/durable workload','sequential target order; no statistical inference','no production activation']};
+await writeFile(path.join(run,'summary.json'),JSON.stringify(result,null,2),{flag:'wx'});console.log(JSON.stringify(result,null,2));

package/scripts/deploy-r48.mjs

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { loadPowerShellDataFile, runSlotUpdateCli } from '../src/runtime-update.mjs';
+import { runSlotUpdateCli } from '../src/runtime-update.mjs';
 import { parseActivePointer } from '../src/release-slot.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
@@ -58,8 +58,7 @@ async function waitForActivation({handoffPath,expectedVersion,expectedManifest,t
 
 const manifest=await sha(path.join(root,'MANIFEST.SHA256'));
 const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
-const cfg=await loadPowerShellDataFile(pointer.config_path);
-const bridgeRoot=path.resolve(cfg.Bridge.WorkingDirectory);
+const bridgeRoot=path.join(root,'bridge');
 const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
 const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
 const expectedVersion=pkg.version;

package/scripts/gate-windows-r58.ps1

@@ -0,0 +1,33 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.35 / R58 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.35 / R58 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r58-package-boundary' @('test/package-boundary.test.mjs','test/r58-bundled-bridge.test.mjs')
+Invoke-NodeTest 'r58-process-policy' @('test/process-policy-refresh.test.mjs','test/process-release-gate.test.mjs')
+Invoke-GateStep 'r58-focused-contracts' @('run','r58:focused:test')
+
+Write-Host '==== recorded-prepublish-evidence ===='
+$matrix=Get-Content -LiteralPath (Join-Path (Split-Path $PSScriptRoot -Parent) 'TEST-MATRIX.json') -Raw | ConvertFrom-Json
+if($matrix.observed_pre_release_evidence.performance.status -ne 'PASS_BOUNDED_PREPUBLISH'){ throw 'R58 performance evidence is not PASS_BOUNDED_PREPUBLISH' }
+if($matrix.observed_pre_release_evidence.cross_plane.status -ne 'PASS'){ throw 'R58 cross-plane evidence is not PASS' }
+if($matrix.observed_pre_release_evidence.public_surface.status -ne 'PASS'){ throw 'R58 public surface evidence is not PASS' }
+if($matrix.observed_pre_release_evidence.full_regression.status -ne 'PASS'){ throw 'R58 fresh full regression evidence is not PASS' }
+
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r58.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R58 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.35 / R58 WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r59-prepublish.ps1

@@ -0,0 +1,41 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-NodeTest([string]$Name,[string[]]$Files){
+  Write-Host "==== $Name ===="
+  & node.exe --test --test-concurrency=1 @Files
+  if($LASTEXITCODE -ne 0){ throw "R59 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R59 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+$active=Get-Content -LiteralPath (Join-Path $env:USERPROFILE '.deadbyte-mcp\active-release.json') -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.35-1b5715b276facbc0'){ throw "R59 predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '1b5715b276facbc00f8e341a554472cb4829e5af60e221c357c41b66053af9d4'){ throw 'R59 predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '047e73b62d7b7819b84201a221a09b7e647cacf21f82101ebed4fbd7e23fc430'){ throw 'R59 predecessor generation mismatch' }
+
+Invoke-NodeTest 'r59-contracts' @(
+ 'test/capability-snapshot-r59.test.mjs',
+ 'test/capability-resolver.test.mjs',
+ 'test/runtime-plane-registry-r59.test.mjs',
+ 'test/optional-plane-degraded-r59.test.mjs',
+ 'test/bridge-runtime-r59.test.mjs',
+ 'test/controller-policy-preflight-r59.test.mjs',
+ 'test/r59-tool-surface-compat.test.mjs',
+ 'test/r58-controller-state-coherence.test.mjs'
+)
+
+$proof=Get-Content -LiteralPath (Join-Path $root 'proof\r59-full-regression-current.json') -Raw | ConvertFrom-Json
+if($proof.schema -ne 'deadbyte.r59-full-regression-capture.v1' -or -not $proof.pass -or $proof.exit_code -ne 0){ throw 'R59 full regression proof is not green' }
+if($proof.stderr_bytes -ne 0){ throw 'R59 full regression stderr is non-empty' }
+
+Invoke-Npm 'manifest-write' @('run','manifest:write')
+Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+Invoke-Npm 'doctor' @('run','doctor')
+
+Write-Host '==== R59 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/owner-probe-r58.mjs

@@ -0,0 +1,31 @@
+import {spawn,spawnSync} from 'node:child_process';
+import {writeFile} from 'node:fs/promises';
+import {performance} from 'node:perf_hooks';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {windowsPowerShellEnvironment} from '../src/runtime-update.mjs';
+
+// Diagnostic only. Queries only a child created and held by this process.
+// Not an ownership authority, cleanup path, or public PID control tool.
+const out=path.resolve(process.argv[2]||'');
+const base=path.resolve('D:/Projects/deadbyte-mcp/testing/0.15.35');
+const rel=path.relative(base,out);
+if(!rel||rel.startsWith('..')||path.isAbsolute(rel))throw new Error('D: R58 evidence destination required');
+const ps=path.join(process.env.SystemRoot,'System32/WindowsPowerShell/v1.0/powershell.exe');
+const child=spawn(process.execPath,['-e','setTimeout(()=>{},30000)'],{stdio:'ignore',windowsHide:true});
+const closed=new Promise(resolve=>child.once('close',resolve));
+const samples=[];
+try{
+ if(!Number.isInteger(child.pid)||child.pid<1)throw new Error('diagnostic child failed');
+ for(let i=0;i<3;i++){
+  const query=`$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${child.pid}'; if ($null -eq $p) {exit 2}; [pscustomobject]@{pid=$p.ProcessId; parent_pid=$p.ParentProcessId; creation_utc=$p.CreationDate.ToUniversalTime().ToString('o'); executable_path=$p.ExecutablePath; command_line=$p.CommandLine} | ConvertTo-Json -Compress`;
+  const t=performance.now();const result=spawnSync(ps,['-NoLogo','-NoProfile','-Command',query],{encoding:'utf8',windowsHide:true,env:windowsPowerShellEnvironment(process.env),timeout:15000});
+  if(result.error||result.status!==0)throw new Error('narrow process diagnostic failed');
+  const info=JSON.parse(result.stdout);
+  if(info.pid!==child.pid||info.parent_pid!==process.pid||path.resolve(info.executable_path).toLowerCase()!==path.resolve(process.execPath).toLowerCase())throw new Error('owned diagnostic process identity mismatch');
+  samples.push({pid:info.pid,parent_pid:info.parent_pid,creation_utc:info.creation_utc,executable_path:info.executable_path,command_line_sha256:createHash('sha256').update(info.command_line).digest('hex'),query_ms:performance.now()-t});
+ }
+ if(new Set(samples.map(s=>s.creation_utc)).size!==1)throw new Error('creation identity changed');
+ await writeFile(out,JSON.stringify({schema:'deadbyte.r58.owner-probe.v1',observed_at:new Date().toISOString(),status:'DIAGNOSTIC_ONLY',samples,limitations:['not production ownership verification','not PID-reuse recovery acceptance','CIM spawn latency unsuitable for frequent guardian polling without measured redesign']},null,2),{flag:'wx'});
+ console.log(JSON.stringify({status:'DIAGNOSTIC_ONLY',samples:samples.length,query_ms:samples.map(s=>s.query_ms)}));
+} finally {if(child.exitCode===null)child.kill();await closed;}

package/scripts/performance-r58.mjs

@@ -0,0 +1,57 @@
+import { performance } from 'node:perf_hooks';
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+
+// Stage-one stdio measurements only. Never substitutes for bridge/public,
+// machine-bound, mutating or durable-job release acceptance measurements.
+const [targetArg,runArg]=process.argv.slice(2);
+if(!targetArg||!runArg) throw new Error('usage: performance-r58.mjs <package-root> <new-D-testing-run-root>');
+const target=path.resolve(targetArg), run=path.resolve(runArg);
+const allowed=path.resolve('D:/Projects/deadbyte-mcp/testing/0.15.35');
+const relative=path.relative(allowed,run);
+if(!relative||relative.startsWith('..')||path.isAbsolute(relative)) throw new Error('benchmark run must be inside R58 D: testing root');
+await mkdir(run); // Exclusive run identity; never rerun into existing evidence.
+const state=path.join(run,'state'),workspace=path.join(run,'workspace'),demo=path.join(workspace,'demo');
+await mkdir(demo,{recursive:true});await mkdir(state,{recursive:true});
+const fixture='alpha benchmark fixture\n'.repeat(100);
+await writeFile(path.join(demo,'input.txt'),fixture,{flag:'wx'});
+const keys=await generateTrustKeypair({privateKeyPath:path.join(run,'private.pem'),publicKeyPath:path.join(run,'public.pem')});
+const policyPath=path.join(run,'coding-policy.json');
+await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:path.join(state,'coding-grant.json'),evidence_dir:path.join(state,'evidence'),roots:{bench:{path:demo,read:true,write:false,exec:false,deny_paths:[]}},commands:{},max_read_bytes:65536,max_write_bytes:65536}),{flag:'wx'});
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sourceHashes={};
+for(const file of ['package.json','MANIFEST.SHA256','src/mcp-server.mjs','src/coding-plane.mjs','src/compact-gateway-mcp-tools.mjs']) sourceHashes[file]=sha(await readFile(path.join(target,file)));
+const workload=[
+ {name:'workspace_open',arguments:{workspace_id:'demo'}},
+ {name:'file_read',arguments:{workspace_id:'demo',path:'input.txt'}},
+ {name:'coding_session_status',arguments:{}}
+];
+const samples=[],cold=[];
+let catalog;
+const start=new Date().toISOString();
+for(let batch=0;batch<3;batch++){
+ const client=new Client({name:'deadbyte-r58-performance',version:'1.0.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+ const transport=new StdioClientTransport({command:process.execPath,args:[path.join(target,'src/mcp-server.mjs')],cwd:target,stderr:'pipe',env:{...getDefaultEnvironment(),DEADBYTE_STATE_ROOT:state,DEADBYTE_WORKSPACE_ROOT:workspace,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,DEADBYTE_PRIVILEGED_POLICY:'',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_CAPABILITY_PROFILE:'full'}});
+ const errors=[];transport.stderr?.on('data',b=>errors.push(b.toString()));
+ try{
+  const connectStart=performance.now();await client.connect(transport);cold.push({batch,connect_ms:performance.now()-connectStart});
+  const tools=(await client.listTools()).tools;
+  if(!catalog){catalog=tools;await writeFile(path.join(run,'catalog.json'),JSON.stringify(tools,null,2),{flag:'wx'});}
+  for(let i=0;i<220;i++)for(const request of workload){
+   const t=performance.now();const result=await client.callTool(request);const elapsed=performance.now()-t;
+   if(result.isError) throw new Error(`benchmark ${request.name} error: ${JSON.stringify(result.structuredContent??result.content)}`);
+   if(request.name==='file_read'&&result.structuredContent?.text!==fixture)throw new Error('file read behavioral oracle failed');
+   if(i>=20)samples.push({batch,iteration:i-20,tool:request.name,total_stdio_roundtrip_ms:elapsed});
+  }
+ }finally{await client.close();await writeFile(path.join(run,`stderr-${batch}.log`),errors.join(''),{flag:'wx'});}
+}
+function summary(values){const v=[...values].sort((a,b)=>a-b);const q=p=>v[Math.ceil(p*v.length)-1];return {n:v.length,min:v[0],p50:q(.5),p90:q(.9),p95:q(.95),p99:q(.99),max:v.at(-1)};}
+const rows=Object.fromEntries(workload.map(w=>[w.name,summary(samples.filter(s=>s.tool===w.name).map(s=>s.total_stdio_roundtrip_ms))]));
+const result={schema:'deadbyte.r58.performance-stage1.v1',status:'MEASURED_NOT_RELEASE_ACCEPTANCE',start,end:new Date().toISOString(),target,node:process.version,sourceHashes,workload_sha256:sha(JSON.stringify(workload)),fixture_sha256:sha(fixture),cold_start:cold,rows,aggregate:summary(samples.map(s=>s.total_stdio_roundtrip_ms)),failures:0,timeouts:0,scope:'stdio client through MCP dispatch/core/response; coding disarmed; no live bridge/cloud or active machine binding',missing:['capability_manifest (compact profile)','machine_status','machine_ping','mutating actions','durable jobs','bridge/cloud','latency decomposition','contention','candidate comparison']};
+await writeFile(path.join(run,'raw.json'),JSON.stringify(samples),{flag:'wx'});
+await writeFile(path.join(run,'summary.json'),JSON.stringify(result,null,2),{flag:'wx'});
+console.log(JSON.stringify(result,null,2));

package/scripts/public-baseline-r58.mjs

@@ -0,0 +1,72 @@
+import { readFile, mkdir, writeFile } from 'node:fs/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { performance } from 'node:perf_hooks';
+import path from 'node:path';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { verifyMachinePingPublic } from '../src/machine-identity.mjs';
+
+const run=path.resolve(process.argv[2]||'');
+const mode=process.argv[3]||'public';
+if(!['public','local'].includes(mode))throw new Error('transport must be public or local');
+const base=path.resolve('D:/Projects/deadbyte-mcp/testing/0.15.35');
+const rel=path.relative(base,run);
+if(!rel||rel.startsWith('..')||path.isAbsolute(rel))throw new Error('new R58 testing run root required');
+await mkdir(run);
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const prod='C:/Users/DEADBYTE/.deadbyte-mcp';
+const before=await readFile(path.join(prod,'active-release.json'));
+const pointer=JSON.parse(before);
+if(pointer.release_id!=='v0.15.34-2199bb59f0e0fc20'||pointer.manifest_sha256!=='2199bb59f0e0fc205d470d11f990d3ce3df444be5eba2a7d8dbc60d5f5b790bb')throw new Error('production baseline changed');
+const config=await readFile(pointer.config_path,'utf8');
+const urlPath=config.match(/McpUrlFile\s*=\s*'([^']+)'/)?.[1];
+const urlHash=config.match(/McpUrlFileSha256\s*=\s*'([0-9a-f]{64})'/)?.[1];
+if(!urlPath||!urlHash)throw new Error('pinned public endpoint metadata missing');
+const bytes=await readFile(urlPath);
+if(sha(bytes)!==urlHash)throw new Error('public endpoint metadata hash mismatch');
+const endpoint=new URL(bytes.toString().trim());
+if(endpoint.protocol!=='https:')throw new Error('HTTPS endpoint required');
+let transportEndpoint=endpoint;
+if(mode==='local'){
+ const readyText=config.match(/LocalReadyUri\s*=\s*'([^']+)'/)?.[1];
+ if(!readyText)throw new Error('pinned loopback readiness address missing');
+ const ready=new URL(readyText);
+ if(ready.protocol!=='http:'||ready.hostname!=='127.0.0.1')throw new Error('local benchmark must use configured loopback only');
+ transportEndpoint=new URL(endpoint.pathname+endpoint.search,ready.origin);
+}
+const client=new Client({name:'deadbyte-r58-public-readonly-baseline',version:'1.0.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+const traceFetch=process.argv[4]==='--trace-fetch';
+const httpEvents=[];
+const measuredFetch=async(input,init)=>{
+ let request;try{request=JSON.parse(init?.body||'null');}catch{}
+ const event={method:request?.method??init?.method??'GET',tool:request?.params?.name??null,started_ms:performance.now()};
+ httpEvents.push(event);
+ const response=await fetch(input,init);
+ event.headers_ms=performance.now();event.fetch_to_headers_ms=event.headers_ms-event.started_ms;
+ event.http_status=response.status;event.content_type=response.headers.get('content-type');
+ const json=response.json.bind(response);
+ response.json=async()=>{const t=performance.now();try{return await json();}finally{event.json_body_ms=performance.now()-t;event.body_finished_ms=performance.now();}};
+ return response;
+};
+const transport=new StreamableHTTPClientTransport(transportEndpoint,traceFetch?{fetch:measuredFetch}:undefined);
+const samples=[];const start=new Date().toISOString();
+function body(result){if(result.isError)throw new Error('public read-only call failed');const s=result.structuredContent;if(!s||typeof s!=='object')throw new Error('structured response missing');return s.result??s;}
+try{
+ await client.connect(transport);
+ const catalog=(await client.listTools()).tools;
+ await writeFile(path.join(run,'catalog.json'),JSON.stringify(catalog,null,2),{flag:'wx'});
+ const status=body(await client.callTool({name:'machine_observe',arguments:{op:'machine_status'}}));
+ if(status.release_id!==pointer.release_id||status.release_manifest_sha256!==pointer.manifest_sha256||status.generation_manifest_sha256!==pointer.generation_manifest_sha256)throw new Error('public machine baseline binding mismatch');
+ for(let i=0;i<100;i++){
+  const nonce=randomBytes(24).toString('hex');const t=performance.now();const eventOffset=httpEvents.length;
+  const ping=body(await client.callTool({name:'machine_observe',arguments:{op:'machine_ping',nonce}}));
+  const elapsed=performance.now()-t;
+  if(ping.nonce!==nonce||ping.release_id!==pointer.release_id||ping.generation_manifest_sha256!==pointer.generation_manifest_sha256||!await verifyMachinePingPublic({ping,publicKeySpkiBase64:status.public_key_spki_base64}))throw new Error('public signed ping independent verification failed');
+  samples.push({tool:'machine_ping',iteration:i,public_roundtrip_ms:elapsed,...(traceFetch?{http_requests:httpEvents.slice(eventOffset).map(e=>({...e,after_body_to_client_ms:e.body_finished_ms===undefined?null:t+elapsed-e.body_finished_ms}))}:{})});
+ }
+ if(!before.equals(await readFile(path.join(prod,'active-release.json'))))throw new Error('production pointer changed during snapshot');
+ const v=samples.map(x=>x.public_roundtrip_ms).sort((a,b)=>a-b),q=p=>v[Math.ceil(v.length*p)-1];
+ const result={schema:'deadbyte.r58.public-baseline.v1',status:'OBSERVED_BASELINE_NOT_CANDIDATE_ACCEPTANCE',transport_scope:mode==='local'?'LOOPBACK_BRIDGE':'HTTPS_PUBLIC',start,end:new Date().toISOString(),pointer,endpoint_metadata_sha256:urlHash,catalog_count:catalog.length,catalog_sha256:sha(JSON.stringify(catalog)),signed_ping_count:samples.length,latency:{n:v.length,min:v[0],p50:q(.5),p90:q(.9),p95:q(.95),p99:q(.99),max:v.at(-1)},limitations:['100 samples only','transport difference is not exact causal layer decomposition','no candidate comparison','read-only observation not authority lifecycle acceptance']};
+ await writeFile(path.join(run,'raw.json'),JSON.stringify(samples),{flag:'wx'});
+ await writeFile(path.join(run,'summary.json'),JSON.stringify(result,null,2),{flag:'wx'});
+ console.log(JSON.stringify({status:result.status,catalog_count:catalog.length,signed_ping_count:samples.length,latency:result.latency}));
+} finally {await client.close();}

package/scripts/public-surface-r58.mjs

@@ -0,0 +1,84 @@
+import {createHash,randomBytes} from 'node:crypto';
+import {createServer} from 'node:net';
+import {mkdir,readFile,writeFile} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import {setTimeout as delay} from 'node:timers/promises';
+import path from 'node:path';
+import {Client,StreamableHTTPClientTransport} from '@modelcontextprotocol/client';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+const [generationArg,baselineArg,runArg]=process.argv.slice(2);
+if(!generationArg||!baselineArg||!runArg) throw new Error('usage: public-surface-r58.mjs <generation-root> <baseline-catalog-json> <new-run-root>');
+const root=path.resolve(new URL('..',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+const gen=path.resolve(generationArg),baselinePath=path.resolve(baselineArg),run=path.resolve(runArg);
+const allowed=path.resolve('D:/Projects/deadbyte-mcp/testing/0.15.35'),rel=path.relative(allowed,run);
+if(!rel||rel.startsWith('..')||path.isAbsolute(rel)) throw new Error('run root must be inside R58 testing root');
+await mkdir(run);
+const state=path.join(run,'state');await mkdir(state);
+const keys=await generateTrustKeypair({privateKeyPath:path.join(run,'private.pem'),publicKeyPath:path.join(run,'public.pem')});
+const semanticPath=path.join(gen,'semantic-lsp-config.json');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const semanticSha=sha(await readFile(semanticPath));
+const baseline=JSON.parse(await readFile(baselinePath,'utf8'));
+const baseSurface=baseline.map(x=>({name:x.name,inputSchema:x.inputSchema,outputSchema:x.outputSchema})).sort((a,b)=>a.name.localeCompare(b.name));
+const reservation=createServer();await new Promise(resolve=>reservation.listen(0,'127.0.0.1',resolve));const port=reservation.address().port;await new Promise(resolve=>reservation.close(resolve));
+const token=randomBytes(32).toString('hex');
+const env={...process.env};for(const key of Object.keys(env))if(key.startsWith('DEADBYTE_'))delete env[key];
+Object.assign(env,{
+ DEADBYTE_CORE_ROOT:root,
+ DEADBYTE_STATE_ROOT:state,
+ DEADBYTE_WORKSPACE_ROOT:path.join(root,'workspaces'),
+ DEADBYTE_BRIDGE_PORT:String(port),
+ DEADBYTE_BRIDGE_PATH_TOKEN:token,
+ DEADBYTE_SIGNING_KEY:keys.privateKeyPath,
+ DEADBYTE_VERIFY_KEY:keys.publicKeyPath,
+ DEADBYTE_CAPABILITY_PROFILE:'compact',
+ DEADBYTE_AUDIT_RUNTIME:'0',
+ DEADBYTE_MACHINE_RUNTIME:'1',
+ DEADBYTE_AGENT_RUNTIME:'1',
+ DEADBYTE_PROCESS_RUNTIME:'1',
+ DEADBYTE_PROCESS_POLICY:path.join(gen,'process-policy.json'),
+ DEADBYTE_CODING_RUNTIME:'1',
+ DEADBYTE_CODING_POLICY:path.join(gen,'coding-policy.json'),
+ DEADBYTE_MACHINE_FS_RUNTIME:'1',
+ DEADBYTE_OBSERVATION_RUNTIME:'1',
+ DEADBYTE_DESKTOP_RUNTIME:'1',
+ DEADBYTE_DESKTOP_POLICY:path.join(gen,'desktop-policy.json'),
+ DEADBYTE_SEMANTIC_LSP_CONFIG:semanticPath,
+ DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:semanticSha,
+ DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+ DEADBYTE_AUTONOMOUS_POLICY:path.join(gen,'autonomous-policy.json'),
+ DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external',
+ DEADBYTE_PRIVILEGED_POLICY:path.join(gen,'host-policy.json')
+});
+const bridge=path.join(root,'bridge','src','bridge.mjs');
+const child=spawn(process.execPath,[bridge],{cwd:path.join(root,'bridge'),env,windowsHide:true,stdio:['ignore','pipe','pipe']});
+let stdout='',stderr='';child.stdout.on('data',b=>stdout+=b);child.stderr.on('data',b=>stderr+=b);
+const exited=new Promise(resolve=>child.once('exit',code=>resolve(code)));
+try{
+ const deadline=Date.now()+20000;while(!stdout.includes('BRIDGE_READY')&&child.exitCode===null&&Date.now()<deadline)await delay(20);
+ if(!stdout.includes('BRIDGE_READY')) throw new Error('candidate bridge failed startup: '+stderr);
+ const client=new Client({name:'deadbyte-r58-public-surface',version:'1.0.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+ try{
+  await client.connect(new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${port}/mcp/${token}`)));
+  const listed=(await client.listTools()).tools;
+  const candidate=listed.map(x=>({name:x.name,inputSchema:x.inputSchema,outputSchema:x.outputSchema})).sort((a,b)=>a.name.localeCompare(b.name));
+  const baseNames=baseSurface.map(x=>x.name),candidateNames=candidate.map(x=>x.name);
+  if(JSON.stringify(candidateNames)!==JSON.stringify(baseNames)) throw new Error(`public compact name drift baseline=${baseNames.length} candidate=${candidateNames.length}`);
+  const drift=[];
+  for(let i=0;i<baseSurface.length;i++){
+    if(JSON.stringify(baseSurface[i].inputSchema)!==JSON.stringify(candidate[i].inputSchema)||JSON.stringify(baseSurface[i].outputSchema)!==JSON.stringify(candidate[i].outputSchema)) drift.push(baseSurface[i].name);
+  }
+  if(drift.length) throw new Error('public schema drift: '+drift.join(','));
+  const result={schema:'deadbyte.r58.public-surface-compat.v1',status:'PASS',tool_count:candidate.length,names_sha256:sha(Buffer.from(JSON.stringify(candidateNames))),schema_sha256:sha(Buffer.from(JSON.stringify(candidate))),baseline_catalog_sha256:sha(await readFile(baselinePath)),candidate_bridge_sha256:sha(await readFile(bridge)),drift:[]};
+  await writeFile(path.join(run,'candidate-catalog.json'),JSON.stringify(listed,null,2));
+  await writeFile(path.join(run,'summary.json'),JSON.stringify(result,null,2));
+  console.log(JSON.stringify(result,null,2));
+ }finally{await client.close().catch(()=>{});}
+}finally{
+ child.kill('SIGTERM');
+ await Promise.race([exited,delay(5000)]);
+ if(child.exitCode===null) child.kill();
+ await writeFile(path.join(run,'bridge.stdout.log'),stdout);
+ await writeFile(path.join(run,'bridge.stderr.log'),stderr);
+}

package/scripts/r58-cross-plane.ps1

@@ -0,0 +1,6 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+& node.exe --test --test-concurrency=1 test/r58-concurrent-recovery.test.mjs test/r58-controller-core-observation.test.mjs test/r58-controller-state-coherence.test.mjs test/r58-guardian-channel.test.mjs test/r58-owner-identity.test.mjs test/r58-session-lock.test.mjs test/r58-stale-owner.test.mjs test/remote-session-cli.test.mjs test/coding-runtime.test.mjs test/durable-job-r44.test.mjs test/external-job-provider-r44.test.mjs test/autonomous-local-supervisor.test.mjs test/autonomous-supervisor-integration.test.mjs test/runtime-self-update.test.mjs test/release-slot.test.mjs test/release-activation-gate.test.mjs test/named-tunnel-host.test.mjs test/r56-rollback-launcher-restore.test.mjs test/r57-core-startup-race.test.mjs
+exit $LASTEXITCODE

package/scripts/r58-focused.ps1

@@ -0,0 +1,6 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+& node.exe --test --test-concurrency=1 test/r58-*.test.mjs test/release-generation.test.mjs test/runtime-self-update.test.mjs test/r57-core-startup-race.test.mjs test/r56-rollback-launcher-restore.test.mjs test/r51-runtime-coherence.test.mjs test/production-docs.test.mjs
+exit $LASTEXITCODE

package/scripts/r59-full-regression-capture.mjs

@@ -0,0 +1,35 @@
+import { createHash } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const proofDir=path.join(root,'proof');
+await mkdir(proofDir,{recursive:true});
+const started=new Date().toISOString();
+const child=spawnSync(process.execPath,[path.join(root,'scripts','full-regression-r48.mjs')],{
+  cwd:root,encoding:'utf8',windowsHide:true,shell:false,maxBuffer:64*1024*1024
+});
+const stdout=child.stdout??'';
+const stderr=child.stderr??'';
+const sha=s=>createHash('sha256').update(s,'utf8').digest('hex');
+const result={
+  schema:'deadbyte.r59-full-regression-capture.v1',
+  started_at_utc:started,
+  finished_at_utc:new Date().toISOString(),
+  exit_code:child.status,
+  signal:child.signal??null,
+  error:child.error?String(child.error.message??child.error):null,
+  stdout_sha256:sha(stdout),
+  stderr_sha256:sha(stderr),
+  stdout_bytes:Buffer.byteLength(stdout),
+  stderr_bytes:Buffer.byteLength(stderr),
+  pass:child.status===0&&!child.signal&&!child.error
+};
+await writeFile(path.join(proofDir,'r59-full-regression-current.stdout.log'),stdout,'utf8');
+await writeFile(path.join(proofDir,'r59-full-regression-current.stderr.log'),stderr,'utf8');
+await writeFile(path.join(proofDir,'r59-full-regression-current.json'),JSON.stringify(result,null,2)+'\n','utf8');
+console.log(JSON.stringify(result));
+if(!result.pass) process.exitCode=1;

package/scripts/windows-gate-evidence-r58.mjs

@@ -0,0 +1,93 @@
+import {createHash} from 'node:crypto';
+import {mkdir,open,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {doctor} from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const [pkg,release,provenance,matrix,active]=await Promise.all([
+  readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'RELEASE.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'PROVENANCE.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'TEST-MATRIX.json'),'utf8').then(JSON.parse),
+  readFile(path.join(stateRoot,'active-release.json'),'utf8').then(JSON.parse)
+]);
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+
+insist(pkg.version==='0.15.35'&&release.version===pkg.version&&release.train==='R58','R58 candidate identity mismatch');
+insist(provenance.version===pkg.version&&matrix.version===pkg.version&&matrix.train==='R58','R58 release metadata identity mismatch');
+insist(release.parent?.version==='0.15.34','R58 parent version mismatch');
+insist(release.parent?.release_id==='v0.15.34-2199bb59f0e0fc20','R58 parent release mismatch');
+insist(release.parent?.manifest_sha256==='2199bb59f0e0fc205d470d11f990d3ce3df444be5eba2a7d8dbc60d5f5b790bb','R58 parent manifest mismatch');
+insist(release.parent?.generation_manifest_sha256==='1a20a62aaeb324a9b5c03d158952f35092d58fedf2ac7725820ba2b094a4a88f','R58 parent generation mismatch');
+insist(release.parent?.tarball_sha256==='a6f7b21faf34793ca17dfb6d0e9ec03320f1468d011e75d8349098df82fc2639','R58 parent tarball mismatch');
+insist(
+  active.release_id===release.runtime_predecessor.release_id&&
+  active.manifest_sha256===release.runtime_predecessor.manifest_sha256&&
+  active.generation_manifest_sha256===release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.34 predecessor'
+);
+insist(release.consolidation?.bridge_bundled_inside_release===true,'R58 bundled bridge contract missing');
+insist(release.consolidation?.bridge_recursive_local_dependency_binding===true,'R58 recursive bridge dependency contract missing');
+insist(release.consolidation?.performance_acceptance==='PASS_BOUNDED_PREPUBLISH','R58 performance acceptance metadata not green');
+insist(release.consolidation?.cross_plane_acceptance==='PASS','R58 cross-plane acceptance metadata not green');
+insist(release.consolidation?.public_surface_compatibility==='PASS_43_TOOLS_NO_SCHEMA_DRIFT','R58 public surface contract not green');
+insist(matrix.observed_pre_release_evidence?.full_regression?.status==='PASS','R58 fresh full regression evidence not green');
+insist(matrix.observed_pre_release_evidence?.performance?.status==='PASS_BOUNDED_PREPUBLISH','R58 performance evidence not green');
+insist(matrix.observed_pre_release_evidence?.cross_plane?.status==='PASS','R58 cross-plane evidence not green');
+insist(matrix.observed_pre_release_evidence?.public_surface?.status==='PASS','R58 public surface evidence not green');
+insist(provenance.operator_override?.four_hour_soak==='NOT_COMPLETED','R58 must preserve incomplete soak truth');
+insist(provenance.operator_override?.clean_machine==='NOT_COMPLETED','R58 must preserve incomplete clean-machine truth');
+insist(provenance.operator_override?.stable_final_claim===false,'R58 must not claim stable/final before external evidence');
+
+const health=await doctor();
+insist(health.assessment!=='FAIL'&&['ok','warn'].includes(health.status)&&health.package_version===pkg.version&&health.manifest?.verified===true,'R58 doctor evidence invalid');
+
+const evidenceBody={
+ schema:'deadbyte.r58-windows-gate.v1',
+ status:'passed',
+ exit_code:0,
+ version:pkg.version,
+ train:'R58',
+ completed_at_utc:new Date().toISOString(),
+ manifest_sha256:manifestSha256,
+ parent:release.parent,
+ runtime_predecessor:release.runtime_predecessor,
+ consolidation:release.consolidation,
+ operator_override:provenance.operator_override,
+ active_predecessor:{
+   release_id:active.release_id,
+   version:active.version,
+   manifest_sha256:active.manifest_sha256,
+   generation_manifest_sha256:active.generation_manifest_sha256
+ },
+ doctor:{status:health.status,assessment:health.assessment,verified_entries:health.manifest.verified_entries,warnings:health.findings.filter(item=>item.level==='WARN').length},
+ gates:{
+   r58_focused:true,
+   package_boundary:true,
+   process_policy:true,
+   performance_recorded:true,
+   cross_plane_recorded:true,
+   public_surface_recorded:true,
+   full_regression_recorded:true,
+   manifest_final_verify:true,
+   four_hour_soak_completed:false,
+   clean_machine_completed:false
+ }
+};
+const bytes=Buffer.from(JSON.stringify(evidenceBody,null,2)+'\n');
+const dir=path.join(stateRoot,'evidence','release');await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r58-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{
+ const handle=await open(target,'wx',0o600);
+ try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+}catch(error){
+ if(error?.code!=='EEXIST')throw error;
+ const prior=JSON.parse(await readFile(target,'utf8'));
+ insist(prior.schema===evidenceBody.schema&&prior.status==='passed'&&prior.version===evidenceBody.version&&prior.manifest_sha256===manifestSha256,'conflicting R58 gate evidence identity');
+}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));