deadbyte-mcp 0.15.43 → 0.15.45

package/docs/R68-COMPAT-HOST-EXEC-CANDIDATE.md

@@ -0,0 +1,63 @@
+# R68 Candidate — Host Execution Compatibility Hardening
+
+Status: SOURCE CANDIDATE ONLY. No release, activation, npm publication, policy change, or Host grant widening.
+
+## Source of truth and defect
+
+Target: D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67 (coding root `core`).
+The active machine reported release `v0.15.44-9f500af433df3e77` during inspection; no restart/activation was requested.
+
+The actual `src/host-plane.mjs` already supports policy-approved `script`, `inline`, and `native` modes. In contrast, `src/commander-compat-runtime.mjs` required `script_path` and `script_sha256` for every `host_exec` call, including inline/native. A second defect accepted a malformed script SHA-256. Neither defect authorized execution; they made the compatibility contract diverge from the native implementation.
+
+## Change
+
+- `src/commander-compat-runtime.mjs`: mode-specific required fields and allowed fields; default mode remains `script`. Reject unknown modes, mixed mode fields, invalid SHA-256 pins, invalid root/command identifiers, overlong or NUL-bearing inline command. Pass validated arguments through unchanged to native `host.exec`.
+- `test/commander-compat-runtime.test.mjs`: positive cases for three modes, negative cases for cross-mode arguments and malformed input, adapter routing and proof rejected requests never reach `invoke`.
+- Execution policy, standing grants, native Host executor, MCP public surface, release slots, and controller were not edited.
+
+This is strict request-shape validation, NOT authorization. The native Host plane still independently checks local grant, policy, root, executable pin, timeout and live revocation.
+
+## Verification on Windows, 2026-10-12
+
+Baseline before editing:
+`node --test test/commander-compat-runtime.test.mjs` -> 4 PASS / 0 FAIL.
+
+New tests before production-code fix:
+6 tests -> 4 PASS / 2 FAIL (missing script fields for inline; malformed digest accepted). This was an observed RED.
+
+Final focused/regression invocation:
+`node --test --test-concurrency=2 test/commander-compat-runtime.test.mjs test/commander-parity-gate-r47.test.mjs test/commander-schema-differential-r48.test.mjs test/host-inline-r45.test.mjs test/r59-tool-surface-compat.test.mjs`
+-> 17 PASS / 0 FAIL / 0 SKIP; command exit code 0. Output SHA-256: `cb9bc7fe0a9055bdc6d1fd506f161bf300ba032785508a1685ee611d27885405`.
+
+Targeted local benchmark: Node v24.18.0 on Windows, 50,000 warmups per mode, 9 measurement runs of 100,000 validations per mode; median of per-run nanoseconds/validation:
+- script 409.6 ns
+- inline 325.9 ns
+- native 388.7 ns
+
+This does NOT establish end-to-end MCP round-trip latency or individual-call p99. Native child launch is far slower than one microsecond.
+
+Final source SHA-256: `8572050daacfde66223bac3a6470644caf60334d17162f8d353ed33ab9ca6ce8`.
+Final test SHA-256: `84a0080298e065ab19fb18e411d7c3eaaff71659bfad331fd5846726a15e089c`.
+Original source SHA-256: `018e7f204e3a529ec2fa7d380acfd3b8b9cc230f0292ae7fed0de9c00fc9fa85`.
+Original test SHA-256: `0de59bc71219f18559e21cedb9594d47d6ae7b52a84b952a1e5eaa5883a5cd48`.
+
+## Release-gate negative observation
+
+Fresh `node scripts/r67-focused-gate.mjs` after source mutation -> 136 PASS / 1 FAIL, exit code 1. Isolated single-test reproduction `node --test test/r67-isolated-slot-rollback-restore.test.mjs` -> 0 PASS / 1 FAIL. The exact cause is `hash mismatch: src/commander-compat-runtime.mjs` from `verifyManifestTree` during candidate slot materialization: the immutable candidate manifest correctly rejects our unsealed source changes. This is an expected release-integrity block, not a verified rollback algorithm defect. Do not regenerate the release manifest or defeat this check merely to obtain green until the release candidate is explicitly frozen and full verification is planned.
+
+## Open requirements (NOT verified)
+
+- Entire R67 full-shard regression / Windows release gate. Signed coding receipts for the seven source/test/doc changes and two exact-preimage snapshots were independently verified (9/9; signature_valid=true).
+- An external ChatGPT client-to-bridge-to-MCP replay for the newly routed `host_exec` modes. The adapter test only verifies in-process routing; actual Host inline/native execution had been tested separately.
+- Native Host grants are privileged account execution: root_id is not an OS sandbox for a PowerShell command.
+- Autonomous planning-to-command routing remains script-profile based; do NOT silently substitute Host grant for Coding grant.
+- Compare with live Remote Desktop Commander once online, using identical workload and success/failure criteria.
+- Current R67 workspace lacks Git metadata, so do not claim Git HEAD or clean-tree evidence.
+
+## Rollback
+
+No production rollback is needed unless a later activation changes the active runtime. Before any further mutation, check the two final source hashes. Restore from `proof/R68-COMPAT-SOURCE-PREIMAGE.mjs.txt` and `proof/R68-COMPAT-TEST-PREIMAGE.mjs.txt`, whose bytes were independently reconstructed and measured to equal the original hashes above. Apply only under current-file SHA-256 preconditions; re-run the 4-case baseline test and check active runtime release/generation identity. No blind overwrite or source copying from an unverified mirror.
+
+## Next candidate focus
+
+R69: make ChatGPT bridge failure semantics reflect MCP tool-level `isError` and distinguish input-required / timeout / unknown-result from verified completion; add fault-injection and replay deduplication. R70: unify agent command selection through separately authorized Coding/Host profiles, with durable action identities and immediate grant revocation. R71: benchmark local hot-path, IPC, transport and process spawn separately; capture p50/p95/p99 with warmup, fresh target environment and negative-case budgets.

package/docs/R69-LIVE-OUTCOME-R70-POLICY-TRANSFER.md

@@ -0,0 +1,136 @@
+# R69 Live Outcome Truth / R70 Autonomous Scope Transfer — 2026-10-12
+
+## 2026-10-12 continuation — request/tool correlation
+
+The earlier "Final source SHA-256" below describes the prior focused candidate, not the current bytes. A fresh behavioral RED test showed that a `tool.result` carrying the same request ID but a different tool inherited a mutating START and falsely printed `SUCCEEDED` with the unrelated result's receipt. A second RED test showed `status=unknown` presentation filtering hid that mismatch. The tracker now classifies the pair as `CORRELATION_MISMATCH` with unknown effect, never displays the unrelated receipt as proof, and counts it as unknown; the filter uses the same request/tool identity rule. The original signed audit remains authoritative.
+
+Focused command: `node --test test/r69-live-outcome.test.mjs test/remote-live-log-r37.test.mjs test/r60-live-timeline.test.mjs test/r61-live-timeline-bounds.test.mjs test/r51-live-log-polling.test.mjs` → **41/41 PASS**, exit 0. Current source SHA-256: `b44fdbec152964f42e90ec2e4e2ecf8291d0704c1ca350e3aa67c21fb701f238`. Current R69 test SHA-256: `5aa887132b36879948e6168f9704b2d03516ad8969b8a336a843c98fcab17fb5`. Full `npm test` completed **1412 PASS / 1 FAIL / 43 SKIP** (1456 total, exit 1). The sole failure is `test/r67-isolated-slot-rollback-restore.test.mjs` at manifest verification: `src/commander-compat-runtime.mjs` hash mismatch. `npm run manifest:verify` also failed with nine known candidate-tree mismatches/additions spanning R68 and R69. The manifest has **not** been rewritten because behavior/release freeze is not complete. No release seal, deployment, policy change, or grant issuance occurred.
+
+## 2026-10-12 continuation — R70 bounded policy bootstrap seam
+
+The canonical updater already accepted an exact path/SHA pair for Coding policy, but had no corresponding Autonomous policy input. Two behavioral RED tests showed unknown `--autonomous-policy` and no pinned bootstrap function; a third RED showed a selected Autonomous root with a missing directory was accepted by the first implementation. `src/runtime-update.mjs` now accepts a paired Autonomous policy path/SHA, validates exact regular-file bytes and policy shape, checks every selected Autonomous root against the selected Coding policy and raw Coding policy SHA, and requires each root to resolve to an existing, non-indirected real directory **before** the updater's mutation boundary. It threads the selected policy into canonical generation creation; no grant is issued or renewed. Combined command-repin plus Autonomous bootstrap is rejected to avoid stale reviewed-policy binding.
+
+`node --test test/r70-autonomous-policy-bootstrap.test.mjs test/runtime-self-update.test.mjs test/release-generation.test.mjs test/r65-activation-preflight.test.mjs test/r65-activation-orchestration.test.mjs test/r65-activation-lock.test.mjs test/r65-activation-lock-recovery.test.mjs` → **61/61 PASS**, exit 0. `node --check src/runtime-update.mjs` → exit 0. Source SHA-256 `5554650830dde6d1db237bde184cbc5912c369259e5f0fbe844ec92e1f15a727`; new test SHA-256 `3b4524b926ed04aaf4afb88847828a923e10c79d7ddcfcc2e9347a400fc3eed9`. These hashes describe the bytes at this checkpoint, not a frozen release.
+
+Fresh post-updater-mutation `npm test` completed **1415 PASS / 1 FAIL / 43 SKIP** (1459 total, exit 1). The sole failure is again `test/r67-isolated-slot-rollback-restore.test.mjs` at the pre-existing stale candidate manifest for `src/commander-compat-runtime.mjs`; this is not a green release gate. Still unproven: controller-owned human approval artifact, exact `gfx_r3_dev` policy proposal, new authority epoch, positive/negative live client Native Diff, drain/hot-swap, ChatGPT tool refresh, independent receipts and final Windows gate. Active pointer remains `v0.15.44-9f500af433df3e77`; no production action or npm publish occurred.
+
+Critical next boundary observed in `controller/deadbyte-controller.ps1`: `Arm-Coding` writes a standing grant with `root_ids=@($meta.RootIds)` for **all** Coding policy roots, and `Arm-Autonomous` does the same for all Autonomous roots; neither command accepts a reviewed root scope or expiry. The R70 pinned-policy bootstrap above therefore does **not** authorize activation or grant issuance. Before any GFX generation is used, implement and test a controller-owned, artifact-bound scope/lifetime approval path and verify exact read-back of the resulting authority epoch; otherwise the project-specific guarantee is false. Do not use the existing broad `local_d` root as the approved GFX scope.
+
+Status: R69 SOURCE CANDIDATE, focused Windows regression PASS. R70 AUTHORITY NOT YET GRANTED. No release seal, deployment, live grant modification, restart, or npm publish.
+
+## Target and immutable boundary
+
+Mutable candidate: `D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67`, coding root `core`. Active machine before changes reported `v0.15.44-9f500af433df3e77`, release manifest `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`; confirm fresh after changes. The original R69 source matches the immutable release source, and was saved byte-for-byte as a recovery artifact.
+
+User-owned DBYTE GFX workspace: `D:\TECHNICAL\ProgramingLangPJ\tmp\gfx_r3_dev`, branch `feature/gfx-r3`, HEAD `96cbc280509be1681a9fa9914816eb06e02d4296`. Existing tracked/untracked changes are intentional and untouched.
+
+## Reproduced display defect
+
+`createLiveTimelineTracker` inferred `SUCCEEDED` solely from `is_error=false`, even for terminal `status=failed` or `status=denied`, and for nonterminal `status=pending`. The status-based filter and compact line formatter used inconsistent rules; the TTY writer could erase a wrapped line after terminal resizing. A RED suite had 6 failures out of 7 tests before the source fix.
+
+## R69 candidate changes
+
+- `src/remote-live-log.mjs`: one outcome classifier across compact output, human timeline, stats and status filters; explicit failure, pending and unknown-side-effect classes. Timeout without effect proof remains unknown, never a replay authorization.
+- TTY writer reads columns for each write. ASCII single-line updates rewrite in place only when width fits; uncertain Unicode width, non-TTY, resized overflow, or long lines append as complete lines. No truncation or arbitrary staging files.
+- Human result lines preserve the original request-derived root/path. No raw source bytes in the logs; existing credential/ANSI-protection checks retain their expected behavior.
+- Positive submillisecond `duration_ms` prints fractional milliseconds rather than false `0ms`.
+- Summary reports p50/p95/p99 from a bounded **first 2048 valid-duration samples**, with `sample X/Y` count to expose sampling bias. These are **tool-reported durations**, not ChatGPT-to-Windows end-to-end timings.
+- `test/r69-live-outcome.test.mjs` adds negative status scenarios, pending/unknown semantics, status filters, location preservation, terminal resize, fractional latency and p99 coverage.
+
+Final source SHA-256: `73c189736b3e92b70b73ec462356f195576699164c460cacf143b7db00e747f0`.
+Final test SHA-256: `18d3ff17885d6e9b314dbe47c4c9a434e4be51d90a7db9677d5902ba5ef58430`.
+Exact original source preimage: `proof/R69-LIVELOG-PREIMAGE.mjs.txt` SHA-256 `630d4d833a2e8cb42a9cd385c4dfac512a0b3b66fb5726c4117a5be28df2754a` (30491 bytes).
+
+Windows check:
+`node --test test/r69-live-outcome.test.mjs test/remote-live-log-r37.test.mjs test/r60-live-timeline.test.mjs test/r61-live-timeline-bounds.test.mjs test/r51-live-log-polling.test.mjs`
+-> **39 PASS / 0 FAIL / 0 SKIP**, exit 0, stdout digest `f37dbea79bc624bc447a81d91f4444aa998ecc79c4517d99bdfd03590ee6fdc6`. A transient test-only syntax error in a new regex was corrected; no source assertion was bypassed.
+
+## Independent signed receipt and local performance proof
+
+All **22/22** R69 coding mutation/recovery/document receipts were individually passed to `coding_receipt_verify`; each returned `ok=true` and `signature_valid=true`. This verifies the receipts' reported Ed25519 authenticity, not the correctness of every untested end-to-end behavior.
+
+Fresh Windows Node v24.18.0 microbenchmark, no staging script, of `createLiveTimelineTracker.observe` across request/result pairs: 40,000 warm-up PAIRS, nine measured batches of 20,000 PAIRS / 40,000 EVENTS each; measured wall-clock, amortized per event:
+- median of nine batch-derived averages: **4,178.4 ns/event (4.1784 µs)**;
+- 95th percentile of the **nine batch averages**: **4,593.8 ns/event (4.5938 µs)**;
+- minimum batch average: 3,909.5 ns/event.
+- process returned exit code 0; stdout SHA-256 `73544f46b97d9a9048a5e552452364c0da91580c2095fabe720e424fdb81d296`.
+
+**NOT** individual-call p95/p99, IPC, PowerShell process startup, disk persist, network RTT, Bridge or ChatGPT-to-Windows latency; these remain unverified. Focused in-process speed does not demonstrate reliable end-to-end submillisecond completion.
+
+## R70 exact local_d blocker
+
+Observed actual active `autonomous-policy.json` SHA-256:
+`6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5`.
+`root_ids=["core"]`. Four autonomous profiles remain rooted at `core`.
+Active Coding policy digest: `a895fce25c7ab209a8cf17ae299e5e0b7c1e6a5c806675387fd03d183f85cdec`; Coding standing grant includes `local_d`.
+`local_d` maps to **all `D:\`**, with read=true, write=true, exec=true and zero denied paths in its coding root. `src/native-diff.mjs:105-107` rejects any root not named in autonomous policy before preview; `assertAutonomousArmed` separately checks live lease root IDs. This is a real authority boundary, not a missing API.
+
+The active policy is in a content-addressed controller generation, its SHA-256 is bound into an Ed25519-backed authority epoch and grant nonce. Editing the generation in place or forging a new grant would break the machine's known-good invariant.
+
+## R70 policy-transfer contract (design, not activated)
+
+1. Owner chooses a project-specific named Coding root whose path is `D:\TECHNICAL\ProgramingLangPJ\tmp\gfx_r3_dev`; prefer this over a standing autonomous grant for entire `D:\`. A deliberate **separate** high-risk owner approval is required for unrestricted `local_d`.
+2. Trusted local controller validates the new root's resolved real path, writable/exec rights, deny boundaries, coding policy digest, existing controller generation and machine identity. Capture the exact approved action, root, project and duration, not an 'always allow anything' checkbox.
+3. Build a new content-addressed generation with matching Coding and Autonomous policy digests. Revoke old Autonomous authority before atomic transition; issue a new grant with the approved root and event epoch. Do not mutate an immutable release slot or reuse an old nonce.
+4. Implement a controlled hot-swap/reload for the policy runtime only when all current actions have reached an observed terminal boundary. If any action has unknown side effects, preserve its journal and block replay until reconciliation. Preserve the previous trusted generation as rollback.
+5. On the next `native_diff_preview` for that exact project root, assert current Coding and Autonomous epochs, file preimages and root path; verify a signed application receipt and post-state. No Host-plane substitution when Autonomous denies.
+6. Emit a readable live action lifecycle with `intent`, `root:path`, `expected_sha256`, `actual_sha256`, `receipt`, `elapsed`, `state`, `recovery` while keeping user payloads/secrets out of default logs. Preserve a raw restricted evidence chain separately.
+7. Native `FAILED`, `DENIED`, `PENDING`, `OUTCOME_UNKNOWN` and `SUCCEEDED` are distinct. Unknown mutation may never be blindly retried.
+
+Definition of Done for R70: positive new project-root Native Diff preview/apply, negative D-drive traversal, new grant/source identity mismatch, stale SHA, revoke-mid-flight, simulated disconnected/unknown output, rollback and fresh ChatGPT-to-Bridge-to-MCP read/write tests. **UNVERIFIED** in this candidate.
+
+## DBYTE GFX acceptance provenance
+
+`D:\TECHNICAL\ProgramingLangPJ\tmp\gfx_r1_evidence\DBYTE-GFX-R3-ACCEPTANCE.json`: SHA-256 `93252b96f9140e35b5770cb253c4d820a3957998fb68181a398f1baca3457a4c`, verdict `INCOMPLETE`. Its `q3_optin_native_20261012` renderer hashes were verified against three current workspace files:
+- `runtime/gfx/dbyte_gfx3d.dby`: `9493982b4ee2543d9fbc241f6a043900a016a252e9fc1c9fc0fb5d6c02217d15`
+- `runtime/gfx/dbyte_gfx_clip3d.dby`: `72454c6122247a394bfd1e412eb9a0dba392d738b0560843c416fb84102e3670`
+- `runtime/gfx/dbyte_gfx_mesh3d.dby`: `c24680f3745bfa500961bcac6adcada6a80ebdfd09af3ed1996fef877f5c060f`
+
+Thus the top-level checkpoint is historically anchored but the 2026-10-12 Q3 hashes are not stale; leave R3/R4 acceptance and all dirty GFX source untouched until its own fresh full tests.
+
+## Static reference reuse / unsupported claims
+
+Read-only local README evidence: Better Remote Commander (OAuth/device pairing/audit), CUA (typed cross-OS desktop driver), DesktopCommander stable (long-running session/history), Open Remote MCP (two-layer permission/persistent audit), ReMCP (small model-visible tool catalog and local unrestricted-mode boundary), Secure Host MCP (monotonic PTY output offsets and droppedBytes; scoped OAuth), WinRemote MCP (authenticated remote transport). R67 separately inspected the immutable DesktopCommander 0.3.1-alpha.2 archive. No donor scripts were executed or copied. These are design/test ideas, not verified runtime superiority.
+
+For MCP 2026-07-28, `tools/call` distinguishes `resultType=complete`, `resultType=input_required`, tool `isError`, and JSON-RPC protocol errors. R69's local timeline classification does not itself prove real ChatGPT client/bridge propagation. Confirm against primary spec: https://modelcontextprotocol.io/specification/2026-07-28/server/tools
+
+## Boundaries and rollback
+
+R69 change is in mutable source only. The candidate's frozen `MANIFEST.SHA256` is stale after source mutation; the existing isolated-release-slot test must fail until a deliberate new freeze/manifest and full gate. Do not weaken that integrity test.
+
+Rollback exact source from `proof/R69-LIVELOG-PREIMAGE.mjs.txt` under current-source SHA precondition. Remove the R69 test only with absent/current SHA precondition and signed receipt if reverting the feature. Keep audit/receipt ledger immutable. Run original R69 predecessors again and verify active release identity and generation hash. No shell-created temporary scripts, no release activation, no authority rearm, no new bridge service, no deployment.
+
+## 2026-10-13 implementation checkpoint
+- R70 TOCTOU RED: pinned JSON helper absent, 3/6 focused tests failed with `readPinnedJsonPolicy is not a function` before fix. New helper hashes and parses one Buffer; Coding and Autonomous bootstrap now use it. Identical focused test GREEN 4/4; updater/generation/Native Diff bundle GREEN 49/49.
+- R70 controller RED: Autonomous policy root outside selected Coding roots returned `UNEXPECTED_PASS`. Controller `Get-AutonomousPolicyMetadata` now rejects any outside root before arm; isolated negative and positive controller checks GREEN. Nearby policy tests GREEN 6/6.
+- Current source SHA-256: `src/runtime-update.mjs` 6cccd3afc53982d68141ba7da1ca71ab16d0a8e09b3980509536168d1680e706; `controller/deadbyte-controller.ps1` c26570453f5f705187e19ea2db4ab2861055461c0265b71280bbcb086c730562; `src/remote-live-log.mjs` b44fdbec152964f42e90ec2e4e2ecf8291d0704c1ca350e3aa67c21fb701f238.
+- Added `test/r70-controller-autonomous-root.test.mjs`; expanded `test/r70-autonomous-policy-bootstrap.test.mjs`. No grants, deployment, publish, rollback, or production mutation performed.
+- Full regression was started after the source changes; result must be recorded separately. Manifest remains stale until final R69/R70 freeze.
+- Remaining R70 gate: controller-issued scoped, time-limited, artifact-bound owner approval and runtime enforcement are not implemented. Current `Arm-Coding` and `Arm-Autonomous` still issue all policy root IDs as standing grants; do not activate project policy or claim Policy Freedom acceptance yet.
+- Fresh full `node --test --test-concurrency=4 test/*.test.mjs` (345 files) after source edits: 1461 tests, 1414 pass, 4 fail, 43 skip, exit 1. Failures: stale frozen candidate manifest in `r67-isolated-slot-rollback-restore`; three nested-shell/harness failures under this tool environment (`r58-launcher-shell`, `r65-controller-authority-epoch-live`, `stabilization-state-root`). The tool-launched Node environment lacks `ComSpec` and `PSModulePath`; PowerShell native subprocess invocations from it produced no exit code/output. These are not adjudicated as product defects or PASS; rerun through normal project shell before release.
+- Read-only active pointer recheck: `v0.15.44-9f500af433df3e77`, release manifest `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`, generation manifest `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`. No production write.
+- Added `docs/R70-REFERENCE-MECHANISMS.json`: eight donor roots inspected with source-backed ADAPT/KEEP/DEFER decisions; no donor source bytes copied.
+- Effective-grant RED: isolated controller reported Autonomous `Armed=true` when its grant requested `other` but active Coding grant allowed only `project`. GREEN: Coding status now exposes effective RootIds; Autonomous status returns `coding-roots` and `Arm-Autonomous` refuses the mismatch before writing a grant. R70/controller-focused bundle 7/7 PASS.
+- Final current controller SHA-256 after grant-scope change: `d455a686fcd55b4349e82d08b17561de71ad8b733ea8df8c3f7450179cb79fe6`; new test `test/r70-controller-grant-subset.test.mjs` SHA-256 `3205f5267a8c098940d1654c2461bffc62c5c2b4bbffe0bf7d9afc18d9d75a1a`.
+- Requested GFX root rechecked read-only: existing ordinary directory, realpath equals `D:\TECHNICAL\ProgramingLangPJ\tmp\gfx_r3_dev`. No grant issued.
+- Normal PowerShell rerun of the three environment-sensitive suites passed 7/7. Fresh `npm test` after the final controller source mutation: 1462 tests, 1418 PASS, 1 FAIL, 43 historical skips. The sole failure is the expected stale R67 candidate `MANIFEST.SHA256` in isolated slot rollback/restore; this candidate is not release-ready.
+- R69/LIVELOG focused suites (`r69-live-outcome`, `remote-live-log-r37`, `r61-live-timeline-bounds`) passed 35/35 after the controller changes. `manifest:verify` fails with 15 candidate-tree mismatches/additions because R68/R69/R70 work has not been frozen.
+- R70 drive-root RED: `assertAutonomousBootstrapRoots` accepted `local_d` mapped to all `D:\\` as a project scope. It now rejects filesystem roots before update mutation; identical focused test and updater/controller regressions passed 48/48. A read-only call accepted the actual `D:\\TECHNICAL\\ProgramingLangPJ\\tmp\\gfx_r3_dev` path as the specifically named `gfx_project` root. This is policy validation only, not a grant or live edit.
+- Security finding: the active Coding policy includes `local_c` and `local_d` mapped to whole drives with read/write/exec and empty deny lists. The existing signing private key path lies under `local_c`; only existence/path metadata was inspected, never key bytes. Reusing that key to attest a human approval would not create an independent consent boundary. R70 needs a separate owner-controlled trust boundary before grant issuance.
+- R70 policy-wide scope RED: selecting a narrow Autonomous root while keeping an empowered whole-drive Coding root passed preflight. `assertAutonomousBootstrapRoots` now rejects any empowered filesystem-root entry in the selected Coding policy as well as an Autonomous filesystem root. Focused updater/controller/generation bundle passed 49/49 after the fix. Existing active generation is unchanged; a successor Coding policy must be genuinely narrowed before this path can activate.
+
+## 2026-10-13 continuation checkpoint
+- Controller policy TOCTOU RED: policy metadata parsed one file read but obtained SHA-256 from a second read. `Read-ControllerPolicySnapshot` now decodes/parses/hashes the same byte buffer for Coding and Autonomous. New behavioral snapshot tests and affected controller tests passed 11/11; live epoch/authority compatibility tests passed 3/3 in normal PowerShell.
+- Fresh `npm test` after that controller mutation: 1466 tests, 1422 PASS, 1 FAIL, 43 historical skips, exit 1. Sole failure: `r67-isolated-slot-rollback-restore` detects `controller/deadbyte-controller.ps1` mismatch against stale candidate `MANIFEST.SHA256`. Do not treat as release PASS or rewrite the manifest until final freeze.
+- LIVELOG RED: a mutating `coding_file_write` terminal envelope with `status=unavailable` and `is_error=false` printed `SUCCEEDED`. `unsupported` had the same classification. The exact behavioral test failed 11 PASS / 1 FAIL before repair, then R69/LIVELOG regression passed 36/36 after adding those two error statuses. Full regression must be rerun after this latest source mutation.
+- Current SHA-256: `src/runtime-update.mjs` `7391f32ee167025288131be6bfa44ffedef127d81ac25d41334a1593019a97e1`; `src/remote-live-log.mjs` `5606b82fc81f0f0de0157e977389cd0c653511b06114c6d62e872672a0e9bd56`; `controller/deadbyte-controller.ps1` `12665fba8855868b4dc6c78e537f6218f68f2e828df7408e0220e7ac8737f6ae`.
+- R70 owner-bound, time-limited scoped grant and real ChatGPT/live/benchmark/hot-swap gates remain unproven. Active sealed release, authority grants, npm registry and production runtime were not modified.
+- Fresh `npm test` after latest LIVELOG repair: 1467 tests, 1423 PASS, 1 FAIL, 43 historical skips, exit 1. Sole failure remains the expected stale candidate manifest (`controller/deadbyte-controller.ps1` mismatch) in `r67-isolated-slot-rollback-restore`. The final R69/R70 release gate is not passed.
+- Controller scope RED/GREEN: direct Autonomous policy root equal to a whole drive and a project-looking Windows junction to a whole drive both passed preflight before repair. `Get-CodingPolicyMetadata` now carries root paths; `Get-AutonomousPolicyMetadata` rejects volume root and any reparse ancestor before arm. Identical focused RED cases and controller regressions passed 7/7. The requested GFX path and its ancestors were observed ordinary/non-reparse read-only.
+- Fresh full `npm test` after controller scope repair: 1469 tests, 1425 PASS, 1 FAIL, 43 historical skips. Sole failure remained stale candidate manifest; no release claim.
+- R69 replay RED/GREEN: journal projection classified `unavailable` as `ok` from `is_error=false`, and result journal rejected `pending`/`input_required`. Two tests RED (16 pass, 2 fail); source now shares LIVELOG outcome classification with projection, allows pending in the presentation journal, and renders replay as `PENDING` rather than success. LIVELOG/journal/remote-session focused suite passed 68/68. Fresh full `npm test` after these final source edits: 1471 tests, 1427 PASS, 1 FAIL, 43 historical skips; sole failure is stale candidate manifest in isolated slot rollback/restore.
+- Current production source SHA-256: `src/runtime-update.mjs` `7391f32ee167025288131be6bfa44ffedef127d81ac25d41334a1593019a97e1`; `src/remote-live-log.mjs` `c64d4f18847e7151017baaaf6bb36adb2f38b154cfa5d0ab6478348a2fa14b35`; `src/remote-result-journal.mjs` `849560ec163e1837de7c75bcfad307e15f33354b938dc1923a5d080e15b63d4a`; `src/deadbyte-cli.mjs` `c03a4960805e3d0c98bb20a64ee321d413d215840814d9f5587a058a93a7fd4d`; `controller/deadbyte-controller.ps1` `e4b00f51b11a159d4e983126e1b34f32be7d9e69c9f508c943d4aa865fe555bb`.
+- Do not claim R70 owner consent from existing `agent-governance-r42` bound approval alone: it checks subject/expiry/provenance but not an independent owner signature. The active authority signing private key was previously reachable through a broad Coding root, so R70 needs a new independent owner-controlled approval trust boundary before any project grant. No grant, production activation or npm publication was performed.
+- R69 audit RED/GREEN: a structured MCP result with `status=ok`, `side_effect_state=unknown`, and `isError=false` lost the unknown-effect field in signed tool audit. New behavioral test failed 8 pass / 1 fail, then source now retains only the exact `unknown` value (including nested result envelope); audit/journal/LIVELOG focused tests passed 34/34.
+- Fresh full `npm test` after that last source mutation: 1472 tests, 1428 PASS, 1 FAIL, 43 historical skips, exit 1. Sole failure is again the intentionally stale candidate `MANIFEST.SHA256` in `r67-isolated-slot-rollback-restore` (`controller/deadbyte-controller.ps1` mismatch). Final freeze/version metadata/Windows gate/live proof have not run.
+- Current `src/tool-audit.mjs` SHA-256 `b9257a8647e80c7e6bb997e01dedf32f6888f2f5f5301514dc15dfcab5eb5b74`; `test/tool-audit.test.mjs` SHA-256 `7f586b8ff89f67c7cc181ab392772e6561aa0da0f427022731408d488349a370`.

package/docs/R70-CODING-DIGEST-SUPERVISOR-CHECKPOINT-20261013.md

@@ -0,0 +1,42 @@
+# R70 R71 candidate — Coding policy binding, supervisor fixtures and release truth (2026-10-13)
+
+Status: **SOURCE CANDIDATE VERIFIED IN TARGETED REGRESSION; FULL RELEASE UNVERIFIED; NOT DEPLOYED.**
+
+## Machine and authority invariants
+- Candidate: `D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67` (mutable).
+- Active production observed: `v0.15.44-9f500af433df3e77`, release manifest `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`, generation manifest `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`.
+- Coding standing authority is ARMED with broad existing roots including local_c/local_d; Autonomous standing authority is ARMED with only `core` and policy digest `6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5`.
+- No new owner approval, project grant, policy authority epoch, production mutation, deploy, npm publish, immutable slot seal, or restart.
+
+## Fresh R70 evidence
+1. Previously-unverified R70 expiry focused tests were rerun through the same authorized Windows Host inline path. GREEN **2/2**, exit 0, stdout SHA-256 `73d46533177103ae57a98f5e4b59faf0ca6eda4f8e1716f6b11745fb50bb22a7`. Tests covered bounded <=1-hour v2 expiry calculation and Windows controller refusal on expired, oversized and valid-window lease records. Do not misrepresent mocked epoch tests as a full production live grant.
+2. New RED: JavaScript `autonomousSessionStatus` accepted signed v2 grant with missing or changed `coding_policy_sha256` far enough to fail later as `epoch-policy-unavailable`, whereas Windows controller explicitly denied mismatched Coding policy digest. RED **2 PASS/1 FAIL**.
+3. Fix in `src/autonomous-policy.mjs`: require `lease.coding_policy_sha256 === policy.coding_policy_sha256` for `deadbyte.autonomous-grant.v2` before epoch verification. Does not alter historical legacy timed-lease schema. Focused GREEN **3 PASS/0 FAIL**, stdout SHA-256 `9884853991ef78f147923d9c2711a399fa03c36456d544eccc755657a9feafe9`.
+4. Broad regression initially **172 PASS/5 FAIL/1 historical SKIP** (25 files). Actual 5 failures traced to out-of-contract test fixtures in `test/autonomous-local-supervisor.test.mjs` and `test/autonomous-supervisor-integration.test.mjs`: test-generated v2 grants omitted Coding policy SHA-256 while production controller writes it. Do not remove security guard.
+5. Fixed only those fixture grants to include the actual selected Coding policy digest. Broad Windows suite `r70-*.test.mjs` + `autonomous-*.test.mjs` + `runtime-self-update.test.mjs`: **25 files, 177 PASS / 0 FAIL / 1 historical SKIP, exit_code=0, 16.258 seconds**; filtered stdout SHA-256 `8ee4d69dd806a85084c07bafae0bcaa6ebaa66a5bba375a2499d0e807d6872df`.
+
+## Full release outcome: UNKNOWN, not PASS and not FAIL
+- A fresh full `npm test` invocation was dispatched through Host but failed to return a verified terminal result: remote claim `5876b08ebddca4e05fec856d652f2a072e800ad5c7dbac046b389aaf17e7b90a` reported `outcome unknown after dispatch; no replay`. The call was NOT retried or rerouted. Read-only Windows process inspection found Node/npm related processes but did not prove they belong to this invocation.
+- Candidate `MANIFEST.SHA256` itself still has hash `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`, while listed source hashes do not match current bytes; isolated immutable-slot integrity verification must deny until a deliberate freeze. Do not edit manifest to artificially pass or treat that as a behavioral failure.
+
+## Current candidate SHA-256
+- `src/autonomous-policy.mjs` `1489f7edce0649347c0f6b7e7869c7e8fd840a5a23845c07a6e44c6461923dc8`
+- `test/r70-autonomous-grant-expiry.test.mjs` `1a95b2077b08c4cc1ce43ddec6eb5083b2e249c739560415b7fc97a8188e078a`
+- `test/autonomous-local-supervisor.test.mjs` `ed879edcaf324a1ded26b7c927b24c6edac34f9aeda311893e9c5d20f967ce09`
+- `test/autonomous-supervisor-integration.test.mjs` `5aa628715fd0e8fbddf0999879a4522dd6a95aa7387a1cf2f3379373514eb891`
+- `src/runtime-update.mjs` `bcf90f70cfc8316f7d3aac033a772ba8c048061e83e76cacd4a290cc0e307c6c`
+- `controller/deadbyte-controller.ps1` `0f378871888962cc24b0e89873699ecd0de21d0d89fa9147b049765cd21fee1a`
+
+## Byte-exact rollback snapshot artifacts
+- `proof/R70-CODING-DIGEST-AUTO-PREIMAGE.mjs.txt`: SHA `4eb2070a3c25fe5299c42ced065ba652ee0ec95549bb366d46f691e64248f73d`
+- `proof/R70-CODING-DIGEST-EXPIRY-TEST-PREIMAGE.mjs.txt`: SHA `94a4ca838f4b67a14f1873a5497419e0853306bf60150b5c76024813cc95b85c`
+- `proof/R70-CODING-DIGEST-LOCAL-SUPERVISOR-PREIMAGE.mjs.txt`: SHA `f0fa6a46a068bc5754ea44fbd1d20e29797a5751f4dd944afd39dc47c0bfe28a`
+- `proof/R70-CODING-DIGEST-INTEGRATION-SUPERVISOR-PREIMAGE.mjs.txt`: SHA `ffde18a4b2dc0c397489f207b301b290c0011a1d20647c225b30d16f35a36273`
+- Signed DEADBYTE coding action receipts for these four preimages and four edits independently verified **8/8** (`ok=true`, `signature_valid=true`).
+- Revert only after SHA precondition against the current file; never silently overwrite parallel work.
+
+## Next acceptance gates
+1. **Independent owner authority**: owner-controlled non-exportable signing mechanism requiring human verification (e.g. Windows Hello/FIDO2 or separate principal), protected trust anchor enrollment and replay/counter prevention. No AI-authored key file or signature is evidence of independent human consent; project grant issuance remains BLOCKED by R70 controller migration fence. No self-approval.
+2. **Scoped policy generation**: prepare a Coding/Autonomous successor without broad filesystem roots, with exact project realpath and deny rules. Present to the owner a legible `scope, path, artifact SHA, expiry, permitted effects` preview; only trusted controller may issue a finite grant and new epoch after independent signature verification.
+3. **Live enforcement**: prove grant expiration and revocation before dispatch AND before each mutation, including crash/restart, clock adjustments, in-flight side-effect UNKNOWN, and Native Diff path escape denial. Existing focused unit tests don't close this.
+4. **Durable regression**: reconcile any orphaned/full-test process before another full regression; use a durable receipt-backed command profile to make outcome recoverable. Then run fresh release gate on a frozen successor with new manifest/provenance and independently verified rollback, never touch active 0.15.44 without release approval.

package/docs/R70-FINITE-GRANT-OWNER-BOUNDARY-20261013.md

@@ -0,0 +1,80 @@
+# DEADBYTE MCP R70 — Finite Grant Verification & Owner Authority Boundary (2026-10-13)
+
+## Verdict
+
+**Candidate security improvement VERIFIED in the focused and relevant regression tests. R70 overall NOT CLOSED. Production unchanged.**
+
+User's requirements remain IMMUTABLE_HOT_SWAP, owner-controlled project grants, and L0 local fast path p95 <1 ms (not remote E2E). This checkpoint does not claim owner enrollment, scoped project grant, release freeze, hot swap, performance gate, or publication.
+
+## Live machine / immutable release
+
+- Windows x64; Node v24.18.0.
+- Connected active release: `v0.15.44-9f500af433df3e77`.
+- Active release manifest SHA-256 `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`.
+- Active generation manifest SHA-256 `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`.
+- Coding grant: ARMED; existing broad `local_c` / `local_d` among roots. Autonomous grant: ARMED, ONLY `core` (`6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5`).
+- `coding_tree(root_id=local_d, path=TECHNICAL/ProgramingLangPJ/tmp/gfx_r3_dev)` succeeded read-only and observed real project contents. **This is not Autonomous authorization**.
+- Observed `%WINDIR%\System32\webauthn.dll` present. No R70 owner trust enrollment at proposed `HKLM:\SOFTWARE\DEADBYTE\MCP\OwnerTrust`; this is a proposal, not an existing installed subsystem.
+- No owner-enrollment ceremony, no new project grant, no scope broadening, no reboot or deployment, no production changes, no npm publication.
+
+## Bounded new grants — TDD verified
+
+**Defect:** Windows controller already validated optional `expires_at_utc` in v2 Autonomous grant status, but `Arm-Autonomous` did not write this field. A newly issued grant remained effectively standing forever unless explicitly revoked.
+
+**Change:** `controller/deadbyte-controller.ps1` writes `expires_at_utc = granted_at_utc + 1 hour` in the v2 grant JSON before it calls `Invoke-AuthorityEpochCommand`. The R70 migration fence still rejects every new project or successor policy without independently verified owner enrollment; only the identical known-good core policy can reach this issuance path.
+
+**Test:** `test/r70-controller-owner-issue-boundary.test.mjs` now exercises PowerShell's REAL `Arm-Autonomous` on a fresh isolated scratch directory, stubbing only the authority-epoch command to prevent real authority side effects. It asserts signed-grant inputs include legacy policy hash, Coding policy hash, exact root ID and an expiry exactly 3,600,000 ms after issuance. New test RED **2 pass / 1 fail**, failing because valid expiry was absent; GREEN with previously implemented expiry/controller checks **6 pass / 0 fail**. This simulates grant creation but DOES NOT issue or cryptographically validate a real authority epoch.
+
+Source SHA-256: `controller/deadbyte-controller.ps1` `276346a4ec9187bb78c20bb3c23f395869e83722b70c046805959d19ceaa1277`.
+Test SHA-256: `test/r70-controller-owner-issue-boundary.test.mjs` `6397799e9c00b8c139d5683fa951a3f885f63a0e4279b430553f9d358cb6a88f`.
+
+## Fresh broader regression
+
+After finite-grant code mutation, 25 test files (`r70-*.test.mjs`, `autonomous-*.test.mjs`, `runtime-self-update.test.mjs`) executed in Windows:
+- **179 tests: 178 PASS, 0 FAIL, 1 historical SKIP**.
+- exit code 0; 15,535.575 ms.
+- Bounded stdout SHA-256 `c82442d0126bfd7b624b4140df9018f709247148e4848ef4d53a5bffbe1d45cc`.
+
+## Durable full-test evidence (NOT PASS)
+
+- Original full-test verifier artifact `scripts/verify-r70-full-regression.ps1` SHA-256 `c992af21a997a450bcab343cee4dcbd38d8c36538218e2330958221f1fc38ca4` was the exact bytes bound to the prior failed durable run. It runs `npm.cmd test`, computes output SHA and prints bounded summary/failure lines. No release manifest change.
+- Submitted durable signed task ID `d3d7370f2e2afef08b87b21537613c18d75cab51669befc8ce425a4ad4e28833`, plan SHA `103d9a29e31bab90322c28610308ae7e21075de00e62cced3fb708ff7c060a42`, submission `r70-full-gate-c992af21-20261013`. `coding_task_run` returned `OUTCOME_UNKNOWN`; DID NOT RETRY.
+- `coding_task_status` and `coding_task_events` recovered exact terminal: **FAILED, exit_code=1, timed_out=false, elapsed_ms=183888.103**, one attempt, retry_limit=0, journal_verified true. Execution receipt `46480bf6ca588656c322f6f2` SHA `b251e25e31d0d3d0bebbdb3332f8ba1b3e3c26f19546699a2773d41c240a1336`, verified authentic Ed25519.
+- Durable task journal does NOT expose captured test stdout for a failed command; the detailed count and all failure identities of the full suite remain **UNKNOWN**, a real observability gap to address with append-only bounded verification-result artifact before future large runs.
+- Separately ran existing `test/r67-isolated-slot-rollback-restore.test.mjs`: failed in `verifyManifestTree` with exact `hash mismatch: controller/deadbyte-controller.ps1`; this is expected stale mutable candidate MANIFEST, not a proven rollback algorithm defect. This **does not establish that this was the only full-suite failure**.
+- Do not regenerate the old `MANIFEST.SHA256`, bypass integrity checks or mark full release PASS while other gates are unverified.
+
+## Durable verifier output hardening AFTER the full failure
+
+The previous full-test attempt had a signed terminal status, but the failed-task journal did not retain its stdout. To avoid repeating that information loss, the verifier script now writes a **create-new, append-only per-run JSON result** under `testing/r70-verifier/result-<timestamp>-<id>.json`; it stores a SHA-256 of the complete captured output, bounded summary lines, exit status, elapsed time, and mode, without storing the full potentially sensitive transcript. The actual script's current SHA-256 is `1d286eeed8baf9f70d70d0a4cdb071691f9c9d3c0ba2f6dab1abf2b1f7c568a0`, distinct from the prior full-test-run script hash.
+
+Fresh Windows `coding_command_run` signed `-SelfTest` returned status passed, exit 0, with synthetic test payload deliberately expressing `exit_code=1`. Parsed append-only artifact:
+`testing/r70-verifier/result-20261013-123740-8120c151a73342a7ad759bd5199a2bed.json`,
+SHA-256 `214a41181b73093e1d23b57a66f2862ccea209300b310d831de9faeec569a3ee`, content contains `tests 1 / pass 0 / fail 1 / skipped 0` and `hash mismatch: SYNTHETIC_TEST`. It was re-read by DEADBYTE coding_file_read and the signed command receipt `65377656c4013d315b76a429` verified. This is **ONLY a synthetic recording test; the full regression has NOT been repeated** with this improved verifier. The returned command's stderr showed Windows process-host pipe close messages (win32=109) after a successful exit; do not interpret those as independent correctness proof.
+
+## Exact preimages / recovery
+
+- `proof/R70-FINITE-GRANT-CONTROLLER-PREIMAGE.ps1.txt` identical to pre-change controller SHA-256 `0f378871888962cc24b0e89873699ecd0de21d0d89fa9147b049765cd21fee1a`.
+- `proof/R70-FINITE-GRANT-TEST-PREIMAGE.mjs.txt` identical to pre-change test SHA-256 `cb3a3ab454353bc477671b3569e16e435e7373a54cb17bd99f1f073a48309bf6`.
+- Preimage restoration only under exact current-file SHA-256 preconditions with signed action receipts.
+
+## Independent owner authentication — mandatory boundary NOT implemented
+
+The R70 verifier `src/r70-owner-approval.mjs` checks Ed25519 against an owner public key, signed scoped project realpath, exact Coding and Autonomous policy digests, immutable reviewed artifact hash and age <= 1 hour. However, merely storing a key in a folder writable by Coding/Host or letting the agent create an owner key is NOT human consent. The R70 controller migration fence deliberately rejects all successor project grants.
+
+Potential native owner-verification backend: Microsoft Windows WebAuthn can invoke Windows Hello/FIDO2 through `WebAuthNAuthenticatorMakeCredential` (enrollment) and `WebAuthNAuthenticatorGetAssertion` (challenge-bound user assertion). MUST validate RP ID, client data challenge and origin, signed authenticator data including User Verified flag, credential ID, public key and signature, and replay/signature counter behavior before bridging to a project approval. Microsoft's native docs:
+- https://learn.microsoft.com/en-us/windows/win32/webauthn/-webauthn-portal
+- https://learn.microsoft.com/en-us/windows/win32/api/webauthn/nf-webauthn-webauthnauthenticatorgetassertion
+- https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/webauthn-apis
+
+This is an ENGINEERING OPTION, **not a claim WebAuthn user enrollment was performed**, and it does not automatically make the existing Ed25519 approval format WebAuthn-compatible. A versioned verifier/format migration and an owner-controlled trust-anchor enrollment are needed; a local signer service running as the same AI-authorized principal would NOT be independent.
+
+### Owner-side action still required
+
+The machine owner must enroll their chosen owner-held credential using an independently guarded Windows security/interactive flow, review the exact project realpath, allowed effects, policy pair, release manifest and max-one-hour expiry, then explicitly authorize each scoped grant. The AI must never generate/sign this approval or trigger consent itself. The trusted controller must verify enrolled credential, one-time transaction challenge, replay journal, expiry, Coding/Autonomous scope subset, and epoch/revocation **at grant issuance** before the migration fence can be lifted.
+
+Only then can a real project-scoped Native Diff positive + out-of-scope negative test, post-grant expiry/revoke and release hot-swap be claimed. L0 p95<1ms and L1-L3 remain unmeasured in this R70 closure card.
+
+## Outcome state
+
+`R70_FINITE_GRANT_ISSUANCE_FOCUSED_GREEN / TARGETED_REGRESSION_178_PASS / FULL_TEST_FAILED_DETAILS_INCOMPLETE / OWNER_ENROLLMENT_BLOCKED / RELEASE_UNSEALED / PRODUCTION_UNCHANGED`

package/docs/R70-OWNER-BOOTSTRAP-CHECKPOINT-20261013.md

@@ -0,0 +1,60 @@
+# R70 — Owner-Bound Autonomous Bootstrap Checkpoint (2026-10-13)
+
+Status: **SOURCE CANDIDATE, NOT DEPLOYED, NOT OWNER-GRANTED, NOT RELEASE-SEALED**.
+
+## Authority and source baseline
+
+- Original goal: `C:\Users\DEADBYTE\.codex\attachments\4df46eb4-fab6-4d62-b12a-44448be9fb44\goal-objective.md`; SHA-256 `0e31b6c45e2891f17fec50fa88ab91fa12c476c89135fc0efb6210d81357402c`.
+- Mutable candidate root: `D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67`. No Git metadata at this candidate directory; do not assert a Git clean tree or commit identity.
+- Active release observed before work: `v0.15.44-9f500af433df3e77` with release manifest `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`. Active production was neither edited nor restarted.
+- Do not use Coding-authorized access to C: as evidence of independent owner approval. No approval has been signed by the real owner, and no grant, activation, npm publication or production mutation was made in this iteration.
+
+## Fresh observed RED
+
+- The previous interrupted R70 test, `test/r70-autonomous-policy-bootstrap.test.mjs`, reported **11 pass / 1 fail**. The failure was `update.verifyAutonomousOwnerBootstrap is not a function`; parsing had a pinned approval pair but no execution-time owner-verifier admission in the updater.
+- New negative test for `autonomous.root_ids=['gfx_project']` and command profile `root_id='other_project'`: **8 pass / 1 fail** before the fix. The updater accepted a profile outside Autonomous scope because it was a Coding root.
+
+## Implemented changes
+
+- `src/runtime-update.mjs`:
+  - `verifyAutonomousOwnerBootstrap` validates exact owner approval input; selected project realpath, scope and single root; SHA-256-pinned single-read approval JSON; Ed25519 signature; policy pair, reviewed release manifest digest and one-hour maximum approval window.
+  - Owner public key is loaded from `stateRoot/trust/r70-owner-public.pem`. The preflight requires a real, non-symlink trust directory and regular key file, and refuses a trust-key path contained in a writable Coding root.
+  - `performSlotUpdate` rejects unpaired Autonomous policy/owner approval before update setup and performs owner preflight before immutable-slot materialization; records limited proof metadata in candidate-prepared state, without storing approval private keys.
+  - The CLI forwards pinned owner approval to `performSlotUpdate`. Raw policy profiles must have root IDs within the selected Autonomous roots.
+- `src/autonomous-policy.mjs`: policy loader now also requires each command/benchmark profile root to be inside `autonomous.root_ids`, not merely in Coding roots.
+- `test/r70-autonomous-policy-bootstrap.test.mjs`: fixed pre-existing fixture omission of `coding_policy_sha256`; added negatives for owner trust inside writable Coding scope, owner-key substitution, altered approval bytes, unpaired direct updater call, and cross-root profile bypass.
+
+## Verification
+
+1. After owner-preflight implementation: targeted tests **12 pass / 0 fail**.
+2. Windows controller/updater integration: **58 pass / 0 fail / 0 skip**.
+3. Profile-root RED reproduced before loader/preflight patch.
+4. After profile-root patch: focused Autonomous/adversarial tests **35 pass / 0 fail / 1 historical skip**.
+5. Final `node --check` on both touched source files plus 11 targeted Node test files: **88 pass / 0 fail / 1 historical skip**, exit 0, Windows Node v24, stdout SHA-256 `2547d567f12e3b05b92422cd7d8ecd8cfc12c94eca2b9d30f808be6712baa4f8`.
+6. Final source/test bytes re-read through DEADBYTE MCP:
+   - `src/runtime-update.mjs` SHA-256 `3328bbbc11a7ee09d8bb4bd88d16626f9160b889511014e82ad480b4fb2e6fd0`
+   - `src/autonomous-policy.mjs` SHA-256 `4df3073b9070617a31068ddf7bdab4bb8b6e669aa843f1f2072650f004f9439e`
+   - `test/r70-autonomous-policy-bootstrap.test.mjs` SHA-256 `676eb1a34d50bd4f326064c79ce56c3f3ee333e73a4d949e7f30de3f59820bb8`.
+
+Additional fresh broader regression after the profile-scope fix:
+- 22 test files matching `autonomous-*.test.mjs` and `r70-*.test.mjs` -> **132 pass / 0 fail / 1 historical skip**, exit 0, duration 15,446.6303 ms, output SHA-256 `650615ab657f95da94003875ae7c863dff82cade781147c114a878ff972da497`.
+- 18 R70 coding action/preimage/document receipt signatures independently verified as valid. This signature count refers to the initial checkpoint revision, not the new document update receipt.
+
+## Reversible exact preimages
+
+- `proof/R70-UPDATER-PREIMAGE.mjs.txt` SHA-256 `add5326a77ec14fad5df2afe64e1d0b5c8567840eab436e86ad9a7f1e919c8fb`.
+- `proof/R70-AUTONOMOUS-POLICY-PREIMAGE.mjs.txt` SHA-256 `38d4cdf27e7e69babdccea5c686aaee245b39093dac14bd9e3a70810a5192e9c`.
+- `proof/R70-AUTONOMOUS-BOOTSTRAP-TEST-PREIMAGE.mjs.txt` SHA-256 `0c739dceed23eb07d9e7c0b4b5f33a403640d1cf34edd4e3268bbbb4e2674832`.
+- Restore only with exact current-file SHA preconditions and independently checked receipts; do not overwrite parallel edits.
+
+## Must not claim closed
+
+- This is a successor update **admission check**, not a production-grade independently owned signing/approval channel. A public key stored under an owner-writable state root is replaceable by any process with effective write authority there. A separate owner-held signing key/trust enrollment, restrictive ACLs or hardware-backed key identity, and protected long-lived trust-anchor fingerprint are unresolved.
+- No real owner approval or new scoped Coding/Autonomous generation/grant has been issued. Approval expiry must also be enforced at the actual grant issuance and applicable runtime boundaries; approving a future update is not the grant.
+- Project root junction, reparse-point race and all policy-owner-approval fields must be verified through the full controller plus updater plus client boundary, not only helper tests.
+- Existing candidate `MANIFEST.SHA256` is stale relative to this mutable source; immutable-slot verification is expected to reject current bytes until a deliberate freeze, independent manifest signing and full release gating. Do not edit the manifest merely to silence the gate.
+- Full Windows regression, reproducible artifact build, remote ChatGPT MCP parity, policy hot-swap, in-flight effect reconciliation, scoped Native Diff positive/negative end-to-end, and p95 L0 performance are not proven by these focused tests.
+
+## Next engineering card
+
+Secure independent owner trust-anchor enrollment so neither Coding nor Host authority can self-issue approvals; verify update admission against a pinned owner key identity that cannot be rewritten by an AI-authorized tool. Then wire scoped approval to the trusted controller's generation/grant issuance and revoke/expiry behavior, with negative credential substitution and trust-anchor replay tests. Only then attempt immutable hot-swap validation or publication.

package/docs/R70-REFERENCE-MECHANISMS.json

@@ -0,0 +1,95 @@
+{
+  "schema": "deadbyte.r70-reference-mechanisms.v1",
+  "scope": "read-only local donor inspection; pattern comparison, no donor source copied",
+  "references": [
+    {
+      "reference": "better-remote-commander",
+      "evidence": [
+        "packages/relay/src/device-hub.ts",
+        "packages/relay/src/mcp/invoke.ts"
+      ],
+      "mechanism": "Authenticated device hello, stale-socket replacement, correlated pending calls and timeout.",
+      "decision": "ADAPT",
+      "deadbyte_status": "Shared dispatch and durable remote claims already stronger for mutation replay; use watchdog/correlation adversarial cases only.",
+      "license": "MIT declared in package.json"
+    },
+    {
+      "reference": "cua",
+      "evidence": [
+        "rfcs/3682-typed-native-window-sdk.md",
+        "tests/cold_start_benchmark.py"
+      ],
+      "mechanism": "Typed window identity, snapshot-bound target token, explicit action delivery and post-action observation.",
+      "decision": "ADAPT",
+      "deadbyte_status": "Keep existing native Desktop plane; add exact identity/fresh-effect tests, not broad adapter rewrite.",
+      "license": "Component licenses vary; no source copied"
+    },
+    {
+      "reference": "desktop-commander",
+      "evidence": [
+        "dist/utils/toolHistory.js",
+        "package.json"
+      ],
+      "mechanism": "Bounded human tool-history entries, output previews and persistence.",
+      "decision": "KEEP",
+      "deadbyte_status": "DEADBYTE already bounds LIVELOG presentation and preserves signed audit separately.",
+      "license": "MIT declared in package.json"
+    },
+    {
+      "reference": "desktop-commander-0.3.1-alpha.2",
+      "evidence": [
+        "desktop-commander-0.3.1-alpha.2.tgz!package/dist/utils/toolHistory.js",
+        "static/LICENSE"
+      ],
+      "mechanism": "Alpha history implementation compared byte-for-byte with stable donor.",
+      "decision": "KEEP",
+      "deadbyte_status": "toolHistory SHA-256 identical to stable: 9ba40b29b628af7fa4e336d9c88a00880948c4bf532af272c74b1fef5311f641; no new retention mechanism.",
+      "license": "Archive contains package/LICENSE; no source copied"
+    },
+    {
+      "reference": "open-remote-mcp",
+      "evidence": [
+        "docs/ARCHITECTURE.md",
+        "apps/agent/src/index.ts",
+        "NOTICE.md"
+      ],
+      "mechanism": "Relay policy narrows local device capability and local filesystem realpath remains final authority.",
+      "decision": "KEEP",
+      "deadbyte_status": "Signed local planes and root enforcement already implement narrower-than-local semantics; add cross-plane negative tests.",
+      "license": "Root package license not declared; no source copied"
+    },
+    {
+      "reference": "remcp",
+      "evidence": [
+        "scripts/score-tool-selection-eval.mjs",
+        "scripts/check-distribution.mjs"
+      ],
+      "mechanism": "Golden tool selection and distribution/package coherence checks.",
+      "decision": "ADAPT",
+      "deadbyte_status": "Use catalog and package coherence as verification inputs without new runtime dependency.",
+      "license": "MIT declared in package.json"
+    },
+    {
+      "reference": "secure-host-mcp",
+      "evidence": [
+        "src/workspace.ts",
+        "test/workspace.test.ts"
+      ],
+      "mechanism": "Reject broad root/home workspace and symlink path escape.",
+      "decision": "KEEP",
+      "deadbyte_status": "R70 new autonomous bootstrap requires real directory and controller verifies root subset; extend adversarial scope tests.",
+      "license": "MIT declared in package.json"
+    },
+    {
+      "reference": "winremote-mcp",
+      "evidence": [
+        "src/winremote/security.py",
+        "tests/test_security_hardening.py"
+      ],
+      "mechanism": "SSRF/IP restrictions and explicit Windows security-hardening tests.",
+      "decision": "DEFER",
+      "deadbyte_status": "No new URL/network authority in R69/R70; keep native Windows Desktop implementation and test its existing bounds.",
+      "license": "MIT declared in pyproject.toml"
+    }
+  ]
+}

package/docs/R70-TRUST-GUARD-EXPIRY-CHECKPOINT-20261013.md

@@ -0,0 +1,47 @@
+# R70 owner trust guard + expiring grant checkpoint — 2026-10-13
+
+## Status (candidate only)
+No deploy, npm publish, change to active release, generation switch, owner key enrollment, policy broadening, or new Coding/Autonomous grant. Mutable Windows candidate root:
+`D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67`
+
+Production known-good `v0.15.44-9f500af433df3e77`. Initial active release manifest SHA-256 `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`; generation manifest `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`.
+
+Existing R70 updater approval verifier is NOT equivalent to independent controller owner approval; real trust-anchor enrollment is absent. Existing Coding grant includes broad `local_c`/`local_d`, Autonomous grant remains scoped only to `core`.
+
+## New observed RED->GREEN (verified Windows)
+1. RED: updater accepts project approval while Coding policy `exec:true` remains enabled, permitting OS-level execution without a filesystem sandbox.
+   - Fix `src/runtime-update.mjs`: reject any selected Coding root with `exec:true` in `verifyAutonomousOwnerBootstrap`, while retaining rejection of writable owner-key paths.
+   - Focused related Windows policy/controller/updater tests: 59 PASS / 0 FAIL / 0 SKIP; exit code 0, stdout SHA-256 `0f859c250fc9bf31aee6edb89b94a3d0abafc28604ac6287e294c2f515eb90ce`.
+2. RED: `Arm-Autonomous` accepts arbitrary new project policy and reaches grant creation without owner approval.
+   - Controller candidate `controller/deadbyte-controller.ps1` has R70 fail-closed MIGRATION FENCE: exact known-good legacy policy SHA-256 `6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5` with the single `core` root retains existing explicit manual arm route; all successor policy digests and project root selections fail `R70_OWNER_ENROLLMENT_REQUIRED` before any grant writes.
+   - `test/r70-controller-owner-issue-boundary.test.mjs`: RED 1 PASS / 1 FAIL, GREEN 2 PASS / 0 FAIL; fake `Ensure-Directory` prevents real grant I/O in the test.
+   - Broader Windows regression with 24 test files `r70-*`, `autonomous-*`, `runtime-self-update.test.mjs`: 174 PASS / 0 FAIL / 1 historical SKIP, exit 0, stdout SHA-256 `d0a27d691c5e2268744dc2c97b242581888edf49b64a8f2bd66645cc6a87c9dc`. **This predates the optional-expiry edit below.**
+
+## New expiration RED and unverified candidate edit
+3. `test/r70-autonomous-grant-expiry.test.mjs`: before change, RED 0 PASS / 2 FAIL: a v2 signed grant with expired `expires_at_utc` was still reported ARMED by controller, and `inspectAutonomousStandingWindow` helper did not exist.
+4. Candidate edit made AFTER that RED:
+   - `src/autonomous-policy.mjs` adds `inspectAutonomousStandingWindow` with canonical UTC, positive lifetime <=1 hour, not-yet-valid/expired/reject cases and calls it before live v2 standing authority validation; grants without `expires_at_utc` retain legacy behavior.
+   - `controller/deadbyte-controller.ps1` checks same optional expiry and lifetime before `Get-AuthorityEpochStatus`; legacy without field remains unchanged.
+   - **NOT VERIFIED GREEN**. Direct authorized Windows test execution was blocked by the platform safety layer immediately after the edits. Do NOT route via a different executor, claim PASS, freeze, deploy or publish; check this test only if a future normally authorized test execution succeeds. Signed mutation receipts and file hashes alone DO NOT prove runtime test correctness.
+   - This optional field has NOT been issued in a real owner-signed grant. Wall-clock rollback resistance and independent controller owner trust are not solved.
+
+## Exact final candidate file hashes (read-only)
+- `src/runtime-update.mjs`: `bcf90f70cfc8316f7d3aac033a772ba8c048061e83e76cacd4a290cc0e307c6c`
+- `src/autonomous-policy.mjs`: `4eb2070a3c25fe5299c42ced065ba652ee0ec95549bb366d46f691e64248f73d`
+- `controller/deadbyte-controller.ps1`: `0f378871888962cc24b0e89873699ecd0de21d0d89fa9147b049765cd21fee1a`
+- `test/r70-autonomous-grant-expiry.test.mjs`: `94a4ca838f4b67a14f1873a5497419e0853306bf60150b5c76024813cc95b85c`
+
+## Byte-identical rollback snapshots
+- `proof/R70-TRUST-EXEC-GUARD-UPDATER-PREIMAGE.mjs.txt` SHA-256 `3328bbbc11a7ee09d8bb4bd88d16626f9160b889511014e82ad480b4fb2e6fd0`
+- `proof/R70-CONTROLLER-OWNER-ISSUE-PREIMAGE.ps1.txt` SHA-256 `f034be2ca85e3380491758cef3efef78121139d2488a5b3407167cbe9bf22b5c`
+- `proof/R70-GRANT-EXPIRY-AUTO-PREIMAGE.mjs.txt` SHA-256 `4df3073b9070617a31068ddf7bdab4bb8b6e669aa843f1f2072650f004f9439e`
+- `proof/R70-GRANT-EXPIRY-CONTROLLER-PREIMAGE.ps1.txt` SHA-256 `1c0b1d8814fcb393fc2658f3586b897688c3df399bf033d5e2c281b70f60e9f4`
+- `proof/R70-TRUST-EXEC-GUARD-TEST-PREIMAGE.mjs.txt` SHA-256 `676eb1a34d50bd4f326064c79ce56c3f3ee333e73a4d949e7f30de3f59820bb8`
+
+Restore only with current hash preconditions and signed receipts; never overwrite parallel work. No Git repository metadata in candidate folder.
+
+## Still blocked
+- Real independently held owner signing key and trusted, non-agent-writable owner key enrollment; the public key under stateRoot/trust does not establish this by itself.
+- Positive scoped owner authorization at controller issuance: current R70 fence DENIES new project grants until trustworthy verifier is integrated.
+- Finite grant issuance and authority epoch expiry/revoke test; optional expiry validator source still unverified.
+- Full candidate manifest freeze, full Windows regression, benchmark, immutable hot-swap crash/reconciliation and ChatGPT/MCP remote client round trip.