deadbyte-mcp 0.15.44 → 0.15.45

package/docs/R70-TRUST-GUARD-EXPIRY-CHECKPOINT-20261013.md

@@ -0,0 +1,47 @@
+# R70 owner trust guard + expiring grant checkpoint — 2026-10-13
+
+## Status (candidate only)
+No deploy, npm publish, change to active release, generation switch, owner key enrollment, policy broadening, or new Coding/Autonomous grant. Mutable Windows candidate root:
+`D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67`
+
+Production known-good `v0.15.44-9f500af433df3e77`. Initial active release manifest SHA-256 `9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e`; generation manifest `c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71`.
+
+Existing R70 updater approval verifier is NOT equivalent to independent controller owner approval; real trust-anchor enrollment is absent. Existing Coding grant includes broad `local_c`/`local_d`, Autonomous grant remains scoped only to `core`.
+
+## New observed RED->GREEN (verified Windows)
+1. RED: updater accepts project approval while Coding policy `exec:true` remains enabled, permitting OS-level execution without a filesystem sandbox.
+   - Fix `src/runtime-update.mjs`: reject any selected Coding root with `exec:true` in `verifyAutonomousOwnerBootstrap`, while retaining rejection of writable owner-key paths.
+   - Focused related Windows policy/controller/updater tests: 59 PASS / 0 FAIL / 0 SKIP; exit code 0, stdout SHA-256 `0f859c250fc9bf31aee6edb89b94a3d0abafc28604ac6287e294c2f515eb90ce`.
+2. RED: `Arm-Autonomous` accepts arbitrary new project policy and reaches grant creation without owner approval.
+   - Controller candidate `controller/deadbyte-controller.ps1` has R70 fail-closed MIGRATION FENCE: exact known-good legacy policy SHA-256 `6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5` with the single `core` root retains existing explicit manual arm route; all successor policy digests and project root selections fail `R70_OWNER_ENROLLMENT_REQUIRED` before any grant writes.
+   - `test/r70-controller-owner-issue-boundary.test.mjs`: RED 1 PASS / 1 FAIL, GREEN 2 PASS / 0 FAIL; fake `Ensure-Directory` prevents real grant I/O in the test.
+   - Broader Windows regression with 24 test files `r70-*`, `autonomous-*`, `runtime-self-update.test.mjs`: 174 PASS / 0 FAIL / 1 historical SKIP, exit 0, stdout SHA-256 `d0a27d691c5e2268744dc2c97b242581888edf49b64a8f2bd66645cc6a87c9dc`. **This predates the optional-expiry edit below.**
+
+## New expiration RED and unverified candidate edit
+3. `test/r70-autonomous-grant-expiry.test.mjs`: before change, RED 0 PASS / 2 FAIL: a v2 signed grant with expired `expires_at_utc` was still reported ARMED by controller, and `inspectAutonomousStandingWindow` helper did not exist.
+4. Candidate edit made AFTER that RED:
+   - `src/autonomous-policy.mjs` adds `inspectAutonomousStandingWindow` with canonical UTC, positive lifetime <=1 hour, not-yet-valid/expired/reject cases and calls it before live v2 standing authority validation; grants without `expires_at_utc` retain legacy behavior.
+   - `controller/deadbyte-controller.ps1` checks same optional expiry and lifetime before `Get-AuthorityEpochStatus`; legacy without field remains unchanged.
+   - **NOT VERIFIED GREEN**. Direct authorized Windows test execution was blocked by the platform safety layer immediately after the edits. Do NOT route via a different executor, claim PASS, freeze, deploy or publish; check this test only if a future normally authorized test execution succeeds. Signed mutation receipts and file hashes alone DO NOT prove runtime test correctness.
+   - This optional field has NOT been issued in a real owner-signed grant. Wall-clock rollback resistance and independent controller owner trust are not solved.
+
+## Exact final candidate file hashes (read-only)
+- `src/runtime-update.mjs`: `bcf90f70cfc8316f7d3aac033a772ba8c048061e83e76cacd4a290cc0e307c6c`
+- `src/autonomous-policy.mjs`: `4eb2070a3c25fe5299c42ced065ba652ee0ec95549bb366d46f691e64248f73d`
+- `controller/deadbyte-controller.ps1`: `0f378871888962cc24b0e89873699ecd0de21d0d89fa9147b049765cd21fee1a`
+- `test/r70-autonomous-grant-expiry.test.mjs`: `94a4ca838f4b67a14f1873a5497419e0853306bf60150b5c76024813cc95b85c`
+
+## Byte-identical rollback snapshots
+- `proof/R70-TRUST-EXEC-GUARD-UPDATER-PREIMAGE.mjs.txt` SHA-256 `3328bbbc11a7ee09d8bb4bd88d16626f9160b889511014e82ad480b4fb2e6fd0`
+- `proof/R70-CONTROLLER-OWNER-ISSUE-PREIMAGE.ps1.txt` SHA-256 `f034be2ca85e3380491758cef3efef78121139d2488a5b3407167cbe9bf22b5c`
+- `proof/R70-GRANT-EXPIRY-AUTO-PREIMAGE.mjs.txt` SHA-256 `4df3073b9070617a31068ddf7bdab4bb8b6e669aa843f1f2072650f004f9439e`
+- `proof/R70-GRANT-EXPIRY-CONTROLLER-PREIMAGE.ps1.txt` SHA-256 `1c0b1d8814fcb393fc2658f3586b897688c3df399bf033d5e2c281b70f60e9f4`
+- `proof/R70-TRUST-EXEC-GUARD-TEST-PREIMAGE.mjs.txt` SHA-256 `676eb1a34d50bd4f326064c79ce56c3f3ee333e73a4d949e7f30de3f59820bb8`
+
+Restore only with current hash preconditions and signed receipts; never overwrite parallel work. No Git repository metadata in candidate folder.
+
+## Still blocked
+- Real independently held owner signing key and trusted, non-agent-writable owner key enrollment; the public key under stateRoot/trust does not establish this by itself.
+- Positive scoped owner authorization at controller issuance: current R70 fence DENIES new project grants until trustworthy verifier is integrated.
+- Finite grant issuance and authority epoch expiry/revoke test; optional expiry validator source still unverified.
+- Full candidate manifest freeze, full Windows regression, benchmark, immutable hot-swap crash/reconciliation and ChatGPT/MCP remote client round trip.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.44",
+  "version": "0.15.45",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r67.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r71.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",

package/scripts/benchmark-l0-r71.mjs

@@ -0,0 +1,76 @@
+import {randomBytes,createHash} from 'node:crypto';
+import {mkdir,mkdtemp,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy,codingSessionStatus} from '../src/coding-plane.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {registerAutonomousTools} from '../src/autonomous-mcp-tools.mjs';
+import {classifyRemoteOperation} from '../bridge/src/remote-dispatch-r60.mjs';
+import {prepareAuthorityTestTrust} from '../test/r65-authority-test-trust.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const evidenceDir=path.join(root,'testing','r71-l0-benchmark');
+const samples=100_000;
+const warmup=5_000;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const percentile=(sorted,p)=>Number(sorted[Math.min(sorted.length-1,Math.ceil(sorted.length*p)-1)]/1e6).toFixed(6);
+
+await mkdir(evidenceDir,{recursive:true});
+const state=await mkdtemp(path.join(evidenceDir,'state-'));
+try{
+  const runtime=await prepareAuthorityTestTrust(state);
+  const project=path.join(state,'project');
+  await mkdir(project);
+  const policyPath=path.join(state,'coding-policy.json');
+  const grantFile=path.join(runtime,'coding-grant.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:grantFile,evidence_dir:path.join(state,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{}}));
+  const policy=await loadCodingPolicy(policyPath);
+  const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,
+    instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],granted_at_utc:new Date().toISOString()};
+  await writeFile(grantFile,JSON.stringify(grant));
+  const grantBytes=await readFile(grantFile);
+  const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes:await readFile(policyPath)});
+  await store.append({plane:'coding',action:'grant',grantBytes,grantInstanceNonce:grant.instance_nonce,updateId:null});
+  const contracts=new Map();
+  registerAutonomousTools({registerTool:(name,contract)=>contracts.set(name,contract)},
+    {autonomousRuntime:{},nativeDiffRuntime:{}});
+  const schema=contracts.get('native_diff_preview')?.inputSchema;
+  if(!schema)throw new Error('native_diff_preview schema unavailable');
+  const request={root_id:'project',title:'L0 read-only probe',operations:[{kind:'write',path:'scratch.txt',
+    content:'x',encoding:'utf8',expected_sha256:'absent'}]};
+  const observed=new Float64Array(samples);
+  const execute=async()=>{
+    const parsed=schema.parse(request);
+    if(classifyRemoteOperation({name:'native_diff_preview'},parsed)!=='read_only')throw new Error('dispatch classification drift');
+    const authority=await codingSessionStatus(policy);
+    if(authority.armed!==true||authority.authority_epoch?.trusted!==true||
+       !authority.root_ids.includes(parsed.root_id)||policy.roots[parsed.root_id]?.read!==true)
+      throw new Error('signed Coding authority decision failed');
+  };
+  for(let i=0;i<warmup;i++)await execute();
+  const started=process.hrtime.bigint();
+  for(let i=0;i<samples;i++){
+    const tick=process.hrtime.bigint();
+    await execute();
+    observed[i]=Number(process.hrtime.bigint()-tick);
+  }
+  const elapsedMs=Number(process.hrtime.bigint()-started)/1e6;
+  observed.sort();
+  const result={schema:'deadbyte.r71-l0-benchmark.v1',created_at_utc:new Date().toISOString(),
+    scope:'native_diff_preview input validation + remote dispatch classification + real isolated signed Coding grant/epoch decision; excludes IPC, filesystem operation, native execution and ChatGPT',
+    clock:'process.hrtime.bigint',warmup,samples,elapsed_ms:elapsedMs,
+    p50_ms:Number(percentile(observed,0.50)),p95_ms:Number(percentile(observed,0.95)),
+    p99_ms:Number(percentile(observed,0.99)),max_ms:Number((observed.at(-1)/1e6).toFixed(6)),
+    threshold_p95_ms:1,pass:observed[Math.ceil(samples*0.95)-1]<1e6,
+    coding_policy_sha256:policy.policy_sha256,source_manifest_sha256:sha(await readFile(path.join(root,'MANIFEST.SHA256')))};
+  const bytes=Buffer.from(JSON.stringify(result)+'\n');
+  const output=path.join(evidenceDir,`result-${Date.now()}-${randomBytes(4).toString('hex')}.json`);
+  await writeFile(output,bytes,{flag:'wx'});
+  process.stdout.write(JSON.stringify({...result,evidence_path:output,evidence_sha256:sha(bytes)})+'\n');
+  if(!result.pass)process.exitCode=1;
+}finally{
+  await rm(state,{recursive:true,force:true});
+}

package/scripts/gate-windows-r71.ps1

@@ -0,0 +1,64 @@
+param(
+ [ValidateSet('preflight','focused','full','manifest','doctor','all')]
+ [string]$Stage='preflight'
+)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=Split-Path -Parent $PSScriptRoot
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parent=Join-Path $state 'releases\v0.15.44-9f500af433df3e77'
+$expected='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e'
+$generation='c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'
+$releaseId='v0.15.44-9f500af433df3e77'
+function Sha256-File([string]$File){
+ $algorithm=[System.Security.Cryptography.SHA256]::Create()
+ try{
+  $stream=[System.IO.File]::OpenRead($File)
+  try{return ([BitConverter]::ToString($algorithm.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}
+  finally{$stream.Dispose()}
+ }finally{$algorithm.Dispose()}
+}
+if(!(Test-Path -LiteralPath $parent -PathType Container)){throw 'R71 sealed predecessor slot missing'}
+if((Sha256-File (Join-Path $parent 'MANIFEST.SHA256')) -ne $expected){throw 'R71 predecessor manifest mismatch'}
+$pointer=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+if($pointer.release_id -ne $releaseId -or $pointer.manifest_sha256 -ne $expected -or
+   $pointer.generation_manifest_sha256 -ne $generation){throw 'R71 active predecessor pointer mismatch'}
+$pkg=Get-Content -LiteralPath (Join-Path $root 'package.json') -Raw | ConvertFrom-Json
+if($pkg.version -ne '0.15.45'){throw 'R71 package version mismatch'}
+Write-Output 'R71_PREDECESSOR_PREFLIGHT=PASS'
+if($Stage -eq 'preflight'){return}
+function Invoke-Node([string]$Label,[string[]]$Arguments){
+ Write-Output "R71_STAGE_START=$Label"
+ & node @Arguments
+ if($LASTEXITCODE -ne 0){throw "R71 stage $Label exit=$LASTEXITCODE"}
+ Write-Output "R71_STAGE_PASS=$Label"
+}
+if($Stage -eq 'focused' -or $Stage -eq 'all'){
+ Invoke-Node 'focused' @('--test','test/native-diff.test.mjs','test/native-diff-topology-r36.test.mjs',
+  'test/capability-resolver.test.mjs','test/capability-ledger-r36.test.mjs',
+  'test/r70-owner-approval.test.mjs','test/r70-autonomous-policy-bootstrap.test.mjs',
+  'test/r71-publish-fence.test.mjs','test/r71-release-identity.test.mjs',
+  'test/r71-full-verifier-artifact.test.mjs','test/r71-native-diff-mcp-wire.test.mjs')
+ if($Stage -eq 'focused'){return}
+}
+if($Stage -eq 'full' -or $Stage -eq 'all'){
+ Write-Output 'R71_STAGE_START=full'
+ & powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $root 'scripts\verify-r70-full-regression.ps1')
+ if($LASTEXITCODE -ne 0){throw "R71 full regression exit=$LASTEXITCODE"}
+ Write-Output 'R71_STAGE_PASS=full'
+ if($Stage -eq 'full'){return}
+}
+if($Stage -eq 'manifest' -or $Stage -eq 'all'){
+ Invoke-Node 'manifest' @('scripts/release-manifest.mjs','verify')
+ if($Stage -eq 'manifest'){return}
+}
+if($Stage -eq 'doctor' -or $Stage -eq 'all'){
+ $previous=$env:DEADBYTE_STATE_ROOT
+ $isolated='D:\Projects\deadbyte-mcp\testing\0.15.45-r71\doctor-isolated-empty'
+ if(Test-Path -LiteralPath (Join-Path $isolated 'active-release.json')){throw 'R71 isolated doctor state has an unexpected pointer'}
+ try{
+  $env:DEADBYTE_STATE_ROOT=$isolated
+  Invoke-Node 'isolated-doctor' @('src/deadbyte-cli.mjs','doctor')
+ }finally{$env:DEADBYTE_STATE_ROOT=$previous}
+}
+Write-Output 'R71_WINDOWS_GATE=PASS_PREDEPLOY_CANDIDATE'

package/scripts/npm-release-r48.mjs

@@ -4,6 +4,7 @@ import { reconcileNpmPublication } from './npm-publication-r65.mjs';
 import { mkdtemp, readFile, rm, unlink, mkdir } from 'node:fs/promises';
 import {preserveNpmTarball,assertVacantPackDestination} from './npm-preserve-artifact-r67.mjs';
 import {assertR67NpmPublishReady} from './npm-release-readiness-r67.mjs';
+import {assertR71NpmPublishReady} from './npm-release-readiness-r71.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -89,6 +90,7 @@ async function main() {
     throw new Error(`PROVENANCE.json version mismatch: package=${version} provenance=${provenance.version}`);
   }
   if (!isVerifyOnly && version==='0.15.44') assertR67NpmPublishReady(release);
+  if (!isVerifyOnly && version==='0.15.45') assertR71NpmPublishReady(release);
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {

package/scripts/npm-release-readiness-r71.mjs

@@ -0,0 +1,21 @@
+/** Publication fence for the exact R71 successor, not an execution receipt. */
+export function assertR71NpmPublishReady(release){
+  if(release?.version!=='0.15.45'||release?.train!=='R71'||
+     release?.parent?.release_id!=='v0.15.44-9f500af433df3e77'||
+     release?.parent?.manifest_sha256!=='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e'||
+     release?.parent?.generation_manifest_sha256!=='c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'){
+    throw new Error('PUBLISH_BLOCKED R71 release or sealed predecessor identity mismatch');
+  }
+  const state=release.r71_candidate;
+  const required={status:'CANDIDATE_SEALED',full_regression:'PASS',manifest:'PASS',
+    windows_gate:'PASS',hot_swap:'PASS',package_acceptance:'PASS',
+    local_coding_preview:'PASS_CODING_READ_ONLY_NO_AUTONOMOUS_APPLY',
+    public_catalog:'PASS_43_TOOLS',signed_public_mcp:'PASS',performance_l0:'PASS'};
+  for(const [field,expected] of Object.entries(required)){
+    if(state?.[field]!==expected) throw new Error(`PUBLISH_BLOCKED R71 ${field}=${String(state?.[field]??'MISSING')}; require ${expected}`);
+  }
+  if(!['PASS_OWNER_ENROLLED','DISABLED_FAIL_CLOSED_NO_OWNER_ENROLLMENT'].includes(state?.owner_independent_project_grant)){
+    throw new Error('PUBLISH_BLOCKED R71 owner project grant must be proven or explicitly fail-closed disabled');
+  }
+  return {status:'R71_METADATA_GATES_MATCH',policy:'PUBLISH_REQUIRES_INDEPENDENT_RELEASE_EVIDENCE'};
+}

package/scripts/verify-r70-full-regression.ps1

@@ -0,0 +1,72 @@
+#requires -Version 5.1
+# R70 verifier artifact: runs the candidate test suite without altering release manifests.
+param([switch]$SelfTest)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Continue'
+Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)
+$timer = [System.Diagnostics.Stopwatch]::StartNew()
+if ($SelfTest) {
+    $lines = @('tests 1', 'pass 0', 'fail 1', 'skipped 0', 'hash mismatch: SYNTHETIC_TEST')
+    $exitCode = 1
+} else {
+    $lines = @(& npm.cmd test 2>&1 | ForEach-Object { [string]$_ })
+    $exitCode = [int]$LASTEXITCODE
+}
+$timer.Stop()
+$utf8 = New-Object System.Text.UTF8Encoding($false)
+$stdoutBytes = $utf8.GetBytes(($lines -join "`n"))
+$sha = [System.Security.Cryptography.SHA256]::Create()
+try {
+    $hash = ([BitConverter]::ToString($sha.ComputeHash($stdoutBytes))).Replace('-', '').ToLowerInvariant()
+} finally {
+    $sha.Dispose()
+}
+Write-Output 'R70_FULL_TEST_SCHEMA=deadbyte.verifier-output.r70.v1'
+Write-Output ('R70_FULL_TEST_EXIT_CODE=' + $exitCode)
+Write-Output ('R70_FULL_TEST_ELAPSED_MS=' + [math]::Round($timer.Elapsed.TotalMilliseconds))
+Write-Output ('R70_FULL_TEST_STDOUT_SHA256=' + $hash)
+Write-Output ('R70_FULL_TEST_LINE_COUNT=' + $lines.Count)
+$selected = @($lines | Where-Object {
+    $_ -match '(?i)(?:^|\s)(?:tests|pass|fail|skipped|cancelled|duration_ms)\s+[0-9.]+' -or
+    $_ -match '^✖' -or
+    $_ -match '^  (Error|AssertionError|SyntaxError):' -or
+    $_ -match 'hash mismatch:' -or
+    $_ -match '^# (tests|pass|fail|skipped) '
+})
+$summary = @($selected | Select-Object -Last 140 | ForEach-Object {
+    if ($_.Length -gt 512) { $_.Substring(0, 512) } else { $_ }
+})
+$artifactDir = Join-Path (Get-Location).Path 'testing\r70-verifier'
+if (-not (Test-Path -LiteralPath $artifactDir -PathType Container)) {
+    New-Item -ItemType Directory -Path $artifactDir -Force | Out-Null
+}
+$artifact = Join-Path $artifactDir ('result-{0}-{1}.json' -f (Get-Date -Format 'yyyyMMdd-HHmmss'), [Guid]::NewGuid().ToString('N'))
+$stdoutPath = [System.IO.Path]::ChangeExtension($artifact, '.stdout.txt')
+$stdoutStream = New-Object System.IO.FileStream($stdoutPath, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
+try { $stdoutStream.Write($stdoutBytes, 0, $stdoutBytes.Length); $stdoutStream.Flush($true) } finally { $stdoutStream.Dispose() }
+$record = [ordered]@{
+    schema = 'deadbyte.r70-full-regression-result.v1'
+    mode = if ($SelfTest) { 'synthetic-selftest' } else { 'candidate-full-regression' }
+    created_at_utc = [DateTime]::UtcNow.ToString('o')
+    exit_code = $exitCode
+    elapsed_ms = [math]::Round($timer.Elapsed.TotalMilliseconds)
+    stdout_sha256 = $hash
+    stdout_path = $stdoutPath
+    total_line_count = $lines.Count
+    summary = $summary
+}
+$json = ($record | ConvertTo-Json -Depth 5 -Compress) + "`n"
+$bytes = $utf8.GetBytes($json)
+$stream = New-Object System.IO.FileStream($artifact, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
+try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+$artifactHashAlgorithm = [System.Security.Cryptography.SHA256]::Create()
+try {
+    $artifactStream = [System.IO.File]::OpenRead($artifact)
+    try { $artifactSha = ([BitConverter]::ToString($artifactHashAlgorithm.ComputeHash($artifactStream))).Replace('-', '').ToLowerInvariant() }
+    finally { $artifactStream.Dispose() }
+} finally { $artifactHashAlgorithm.Dispose() }
+Write-Output ('R70_FULL_TEST_ARTIFACT=' + $artifact)
+Write-Output ('R70_FULL_TEST_ARTIFACT_SHA256=' + $artifactSha)
+foreach ($line in $summary) { Write-Output $line }
+if ($SelfTest) { exit 0 }
+exit $exitCode

package/src/authority-continuity-r65.mjs

@@ -207,6 +207,10 @@ const DURABLE_EPOCH_ACTIONS=new Set(['grant','transaction_revoke','user_revoke',
 const DURABLE_EPOCH_SCHEMA='deadbyte.authority-epoch-event.r65.v1';
 const DURABLE_HEAD_SCHEMA='deadbyte.authority-epoch-head.r65.v1';
 const DURABLE_EPOCH_DOMAIN=Buffer.from('DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1\0','utf8');
+// Cache parsed public keys by the exact bytes read from disk, never by path.
+// A changed trust file is re-read and yields a different entry immediately.
+const DURABLE_PUBLIC_KEY_CACHE_LIMIT=8;
+const durablePublicKeys=new Map();
 const RESTORE_BINDING_FIELDS=Object.freeze(['prior_grant_sha256','prior_grant_instance_nonce','predecessor_policy_envelope_sha256','successor_policy_envelope_sha256','candidate_manifest_sha256','continuity_subject_sha256']);
 function normalizeRestoreBinding(value,{required=false}={}){
   if(value===undefined||value===null){if(required)throw new Error('authority epoch transaction restore binding required');return null;}
@@ -218,9 +222,19 @@ function normalizeRestoreBinding(value,{required=false}={}){
 
 async function durableEpochKeys(runtimeDir,{privateRequired=false}={}){
   const trust=path.join(path.dirname(path.resolve(runtimeDir)),'trust');
-  const publicKey=createPublicKey(await readFile(path.join(trust,'ed25519-public.pem')));
-  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('authority epoch trust public key invalid');
-  const keyId=hashBytes(Buffer.from(publicKey.export({format:'der',type:'spki'})));
+  const publicBytes=await readFile(path.join(trust,'ed25519-public.pem'));
+  const publicSha=hashBytes(publicBytes);
+  let cached=durablePublicKeys.get(publicSha);
+  if(!cached){
+    const publicKey=createPublicKey(publicBytes);
+    if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('authority epoch trust public key invalid');
+    const keyId=hashBytes(Buffer.from(publicKey.export({format:'der',type:'spki'})));
+    cached={publicKey,keyId};
+    if(durablePublicKeys.size>=DURABLE_PUBLIC_KEY_CACHE_LIMIT)
+      durablePublicKeys.delete(durablePublicKeys.keys().next().value);
+    durablePublicKeys.set(publicSha,cached);
+  }
+  const {publicKey,keyId}=cached;
   if(!privateRequired)return {publicKey,keyId};
   const privateKey=createPrivateKey(await readFile(path.join(trust,'ed25519-private.pem')));
   if(privateKey.asymmetricKeyType!=='ed25519'||
@@ -315,7 +329,14 @@ async function readDurableHead(runtimeDir,plane){
   if(head.action!=='transaction_restore'&&headRestoreBinding!==null)throw new Error('authority epoch unexpected restore binding');
   const expectedName=durableEventName(head.seq,head.event_sha256);
   if(head.event_file!==expectedName)throw new Error('authority epoch head event name mismatch');
-  const eventNames=await readdir(path.join(dir,'events'));
+  // These are independent observations of one immutable event identity.
+  // Read them concurrently, then validate the complete set before trusting
+  // the head. The head remains freshly read on every authority decision.
+  const [eventNames,eventRead,keys]=await Promise.all([
+    readdir(path.join(dir,'events')),
+    readFile(path.join(dir,'events',head.event_file)).then(bytes=>({bytes}),()=>({bytes:null})),
+    durableEpochKeys(runtimeDir)
+  ]);
   if(eventNames.length>10000)throw new Error('authority epoch event budget exceeded');
   for(const name of eventNames){
     const match=/^(\d{16})-([0-9a-f]{64})\.json$/.exec(name);
@@ -324,13 +345,12 @@ async function readDurableHead(runtimeDir,plane){
     if(!Number.isSafeInteger(seq)||seq>head.seq||(seq===head.seq&&name!==head.event_file))
       throw new Error('authority epoch head replay or incomplete write');
   }
-  let eventBytes;
-  try{eventBytes=await readFile(path.join(dir,'events',head.event_file));}
-  catch{throw new Error('authority epoch event missing');}
+  const eventBytes=eventRead.bytes;
+  if(!eventBytes)throw new Error('authority epoch event missing');
   if(hashBytes(eventBytes)!==head.event_sha256)throw new Error('authority epoch event hash mismatch');
   let event;
   try{event=JSON.parse(decodeUtf8Strict(eventBytes));}catch{throw new Error('authority epoch event invalid');}
-  const {publicKey,keyId}=await durableEpochKeys(runtimeDir);
+  const {publicKey,keyId}=keys;
   if(!verifyDurableEvent(event,publicKey,keyId))throw new Error('authority epoch event signature invalid');
   for(const key of ['schema','plane','seq','action','update_id','grant_sha256','grant_instance_nonce','previous_event_sha256']){
     const expected=key==='schema'?DURABLE_EPOCH_SCHEMA:head[key];

package/src/autonomous-mcp-tools.mjs

@@ -48,7 +48,7 @@ export function registerAutonomousTools(server,{ autonomousRuntime, nativeDiffRu
     catch(error){ return fail(autonomousSessionStatusOutputSchema,error); } });
 
   server.registerTool('native_diff_preview',{
-    description:'Create a signed content-addressed DEADBYTE Native Diff v1 after validating exact file SHA-256 preconditions. No Git metadata is used.',
+    description:'Validate exact file SHA-256 preconditions. With Coding read authority alone, return a read-only preview_only result that cannot be applied; a signed applicable diff additionally requires Autonomous authority. No Git metadata is used.',
     inputSchema:z.strictObject({ root_id:id, title:z.string().max(160).default(''), operations:z.array(nativeOperation).min(1).max(32) }),
     outputSchema:nativeDiffPreviewOutputSchema
   },async({root_id,title,operations})=>{ try { return result(nativeDiffPreviewOutputSchema,

package/src/autonomous-output-contracts.mjs

@@ -83,10 +83,13 @@ export const autonomousSessionStatusOutputSchema = statusContract({
 });
 
 export const nativeDiffPreviewOutputSchema = statusContract({
-  statuses:['ready','failed'], success:['ready'], required:['diff_id','root_id','operation_count','payload_bytes','paths','operations'],
+  statuses:['ready','preview_only','failed'], success:['ready','preview_only'], required:['root_id','operation_count','payload_bytes','paths','operations'],
   shape:{ schema:z.enum(['deadbyte.native-diff.v1','deadbyte.native-diff.v2']).optional(), diff_id:hex64.optional(), root_id:z.string().min(1).max(64).optional(), operation_count:z.number().int().min(1).max(32).optional(),
     payload_bytes:z.number().int().min(0).optional(), paths:z.array(z.string()).max(64).optional(),
     operations:z.array(jsonObject).max(32).optional() }
+}).superRefine((value,ctx)=>{
+  if(value.status==='ready'&&value.diff_id===undefined) ctx.addIssue({code:'custom',path:['diff_id'],message:'signed ready diff requires diff_id'});
+  if(value.status==='preview_only'&&value.diff_id!==undefined) ctx.addIssue({code:'custom',path:['diff_id'],message:'coding-only preview must not have an applicable diff_id'});
 });
 export const nativeDiffApplyOutputSchema = statusContract({
   statuses:['committed','existing','failed'], success:['committed','existing'],

package/src/autonomous-policy.mjs

@@ -80,11 +80,11 @@ function normalizePlanner(raw,codingPolicy,rootIds) {
   }
   return provider;
 }
-function normalizeProfile(id, raw, codingPolicy) {
+function normalizeProfile(id, raw, codingPolicy, rootIds) {
   if (!ID_RE.test(id)) throw new Error(`invalid autonomous profile '${id}'`);
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error(`autonomous profile '${id}' malformed`);
   if (!['command','benchmark'].includes(raw.kind)) throw new Error(`autonomous profile '${id}' kind invalid`);
-  if (!ID_RE.test(raw.root_id ?? '') || !codingPolicy.roots[raw.root_id]) throw new Error(`autonomous profile '${id}' root invalid`);
+  if (!ID_RE.test(raw.root_id ?? '') || !codingPolicy.roots[raw.root_id] || !rootIds.includes(raw.root_id)) throw new Error(`autonomous profile '${id}' root invalid`);
   if (!ID_RE.test(raw.command_id ?? '') || !codingPolicy.commands[raw.command_id]) throw new Error(`autonomous profile '${id}' command invalid`);
   validatePortableRelativePath(raw.script_path);
   if (!SHA256_RE.test(raw.script_sha256 ?? '')) throw new Error(`autonomous profile '${id}' script hash invalid`);
@@ -130,7 +130,7 @@ export async function loadAutonomousPolicy(policyPath, codingPolicy) {
   const rootIds = Array.isArray(raw.root_ids) ? [...new Set(raw.root_ids)] : [];
   if (rootIds.length < 1 || rootIds.some(id => !ID_RE.test(id) || !codingPolicy.roots[id])) throw new Error('autonomous root_ids invalid');
   const profiles = {};
-  for (const [id, value] of Object.entries(raw.profiles ?? {})) profiles[id] = normalizeProfile(id, value, codingPolicy);
+  for (const [id, value] of Object.entries(raw.profiles ?? {})) profiles[id] = normalizeProfile(id, value, codingPolicy, rootIds);
   const limits = raw.limits ?? {};
   const policy = {
     schema: AUTONOMOUS_POLICY_SCHEMA, enabled: true, policy_path: absolute,
@@ -154,6 +154,43 @@ export async function loadAutonomousPolicy(policyPath, codingPolicy) {
   return Object.freeze(policy);
 }
 
+export function inspectAutonomousStandingWindow(lease,now=new Date()){
+  // v2 legacy standing grants have no expiry. New bounded grants must be
+  // checked on every authority observation, including after a runtime restart.
+  if(!lease||typeof lease!=='object'||Array.isArray(lease)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  if(!Object.hasOwn(lease,'expires_at_utc')){
+    return {ok:true,reason:null,expires_at_utc:null,remaining_ms:null};
+  }
+  const canonical=value=>typeof value==='string'&&
+    /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3,7}Z$/.test(value);
+  const expiry=lease.expires_at_utc;
+  const issued=lease.granted_at_utc;
+  if(!canonical(expiry)||!canonical(issued)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  const end=Date.parse(expiry),start=Date.parse(issued);
+  if(!Number.isFinite(end)||!Number.isFinite(start)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  const duration=end-start;
+  if(duration<=0||duration>3_600_000){
+    return {ok:false,reason:'expiry-window-invalid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  const observed=now instanceof Date?now.getTime():NaN;
+  if(!Number.isFinite(observed)){
+    return {ok:false,reason:'clock-invalid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  if(observed<start){
+    return {ok:false,reason:'not-yet-valid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  if(observed>=end){
+    return {ok:false,reason:'expired',expires_at_utc:expiry,remaining_ms:0};
+  }
+  return {ok:true,reason:null,expires_at_utc:expiry,remaining_ms:end-observed};
+}
+
 export async function autonomousSessionStatus(policy, now = new Date()) {
   let lease,leaseBytes;
   try { leaseBytes=await readFile(policy.lease_file); lease = JSON.parse(decodeUtf8Strict(leaseBytes)); }
@@ -164,15 +201,25 @@ export async function autonomousSessionStatus(policy, now = new Date()) {
     return { configured:true, armed:false, reason:'lease-schema', expires_at_utc:null };
   }
   if (lease.policy_sha256 !== policy.policy_sha256) return { configured:true, armed:false, reason:'policy-digest', expires_at_utc:null };
+  // Controller and runtime must agree on the exact Coding authority policy
+  // for every signed v2 Autonomous grant, including after generation changes.
+  if (lease.schema === AUTONOMOUS_GRANT_SCHEMA &&
+      lease.coding_policy_sha256 !== policy.coding_policy_sha256) {
+    return { configured:true, armed:false, reason:'coding-policy-digest', expires_at_utc:null };
+  }
   if (typeof lease.instance_nonce !== 'string' || !SHA256_RE.test(lease.instance_nonce)) return { configured:true, armed:false, reason:'nonce-invalid', expires_at_utc:null };
   const roots = Array.isArray(lease.root_ids) ? [...new Set(lease.root_ids)] : [];
   if (roots.length < 1 || roots.some(id => !policy.root_ids.includes(id))) return { configured:true, armed:false, reason:'roots-invalid', expires_at_utc:null };
   if (lease.schema === AUTONOMOUS_GRANT_SCHEMA) {
+    const window=inspectAutonomousStandingWindow(lease,now);
+    if(!window.ok) return {configured:true,armed:false,reason:window.reason,
+      expires_at_utc:window.expires_at_utc,remaining_ms:window.remaining_ms,
+      standing:false,instance_nonce:lease.instance_nonce,root_ids:roots};
     const epoch=await verifyStandingGrantEpoch({plane:'autonomous',grantFile:policy.lease_file,grantBytes:leaseBytes,grantInstanceNonce:lease.instance_nonce,policyPath:policy.policy_path});
-    if(!epoch.trusted)return { configured:true,armed:false,reason:epoch.reason,expires_at_utc:null,
-      remaining_ms:null,standing:false,instance_nonce:lease.instance_nonce,root_ids:roots };
-    return { configured:true, armed:true, reason:'standing-grant', expires_at_utc:null,
-      remaining_ms:null, standing:true, instance_nonce:lease.instance_nonce, root_ids:roots, authority_epoch:epoch };
+    if(!epoch.trusted)return { configured:true,armed:false,reason:epoch.reason,expires_at_utc:window.expires_at_utc,
+      remaining_ms:window.remaining_ms,standing:false,instance_nonce:lease.instance_nonce,root_ids:roots };
+    return { configured:true, armed:true, reason:'standing-grant', expires_at_utc:window.expires_at_utc,
+      remaining_ms:window.remaining_ms, standing:true, instance_nonce:lease.instance_nonce, root_ids:roots, authority_epoch:epoch };
   }
   const expires = Date.parse(lease.expires_at_utc);
   if (!Number.isFinite(expires)) return { configured:true, armed:false, reason:'expiry-invalid', expires_at_utc:null };

package/src/capability-ledger.mjs

@@ -152,7 +152,7 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
   gateway('desktop.action','desktop_action','desktop_control','action','DEADBYTE_DESKTOP_RUNTIME','desktop',{mutating:true,receipt_class:'desktop'}),
 
   direct('autonomous.session_status','autonomous_session_status','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'autonomous'}),
-  direct('native_diff.preview','native_diff_preview','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
+  direct('native_diff.preview','native_diff_preview','DEADBYTE_AUTONOMOUS_RUNTIME','coding',{receipt_class:'native_diff'}),
   direct('native_diff.apply','native_diff_apply','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
   direct('native_diff.verify','native_diff_verify','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'verification'}),
   direct('autonomous.goal_submit','autonomous_goal_submit','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),

package/src/capability-resolver.mjs

@@ -3,7 +3,8 @@ import { assertHostArmed } from './host-plane.mjs';
 
 const CODING_ARMED_READ_CAPABILITIES = new Set([
   'coding.tree','coding.stat','coding.search','coding.files_read','coding.file_read',
-  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview'
+  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview',
+  'native_diff.preview'
 ]);
 
 export const CAPABILITY_STATES = Object.freeze({

package/src/commander-compat-runtime.mjs

@@ -20,7 +20,7 @@ const CONTRACTS = Object.freeze({
   get_recent_tool_calls:{native:'operation_history.recent',required:[],mutation:false},
   get_usage_stats:{native:'operation_history.stats',required:[],mutation:false},
   give_feedback_to_desktop_commander:{native:'commander.feedback',required:['message'],mutation:true},
-  host_exec:{native:'host.exec',required:['command_id','root_id','script_path','script_sha256'],mutation:true},
+  host_exec:{native:'host.exec',required:['root_id'],mutation:true},
   host_file_read:{native:'host.file_read',required:['path'],mutation:false},
   host_file_write:{native:'host.file_write',required:['path','content','expected_sha256'],mutation:true},
   interact_with_process:{native:'process.input',required:['session_id','input'],mutation:true},
@@ -53,13 +53,41 @@ export function commanderCompatibilityContract(name) {
   return CONTRACTS[name] ?? {native:DEADBYTE_NATIVE_TOOLS[name] ?? null,required:[],mutation:false};
 }
 
+function validateHostExecRequest(args) {
+  const mode=args.mode??'script';
+  const common=['mode','root_id','cwd','timeout_ms'];
+  let required, allowed;
+  if(mode==='script'){
+    required=['root_id','command_id','script_path','script_sha256'];
+    allowed=[...common,'command_id','script_path','script_sha256','args'];
+  }else if(mode==='inline'){
+    required=['root_id','command_id','command'];
+    allowed=[...common,'command_id','command'];
+  }else if(mode==='native'){
+    required=['root_id','executable','executable_sha256'];
+    allowed=[...common,'executable','executable_sha256','args'];
+  }else{
+    throw new Error('host_exec mode must be script, inline, or native');
+  }
+  const missing=required.filter(k=>!own(args,k)||args[k]===undefined||args[k]===null||args[k]==='');
+  if(missing.length) throw new Error(`missing required fields: ${missing.join(', ')}`);
+  const unknown=Object.keys(args).filter(k=>!allowed.includes(k));
+  if(unknown.length) throw new Error(`host_exec ${mode} unexpected fields: ${unknown.join(', ')}`);
+  const id=/^[A-Za-z0-9._-]{1,64}$/;
+  if(typeof args.root_id!=='string'||!id.test(args.root_id)) throw new Error('host_exec root_id invalid');
+  if(mode!=='native'&&(typeof args.command_id!=='string'||!id.test(args.command_id))) throw new Error('host_exec command_id invalid');
+  if(mode==='inline'&&(typeof args.command!=='string'||args.command.length>262144||args.command.includes(String.fromCharCode(0)))) throw new Error('host_exec inline command invalid');
+  if(mode==='script'&&!/^[0-9a-f]{64}$/.test(args.script_sha256)) throw new Error('host_exec script_sha256 invalid');
+  if(mode==='native'&&!/^[0-9a-f]{64}$/.test(args.executable_sha256)) throw new Error('host_exec executable_sha256 invalid');
+}
+
 export function validateCommanderRequest(name,args={}) {
   const c=commanderCompatibilityContract(name);
   if (!args || typeof args!=='object' || Array.isArray(args)) throw new Error('request arguments must be an object');
   const missing=c.required.filter(k=>!own(args,k)||args[k]===undefined||args[k]===null||args[k]==='');
   if(missing.length) throw new Error(`missing required fields: ${missing.join(', ')}`);
   if(c.mutation && !['create_directory','start_process','force_terminate','kill_process','interact_with_process','host_exec'].includes(name) && !('expected_sha256' in args) && !('expected_source_identity' in args)) throw new Error('mutation requires an explicit precondition');
-  if((name==='host_exec') && typeof args.script_sha256!=='string') throw new Error('host_exec requires hash-pinned script');
+  if(name==='host_exec') validateHostExecRequest(args);
   return Object.freeze({commander_tool:name,native_tool:c.native,mutation:c.mutation,args});
 }