deadbyte-mcp 0.15.44 → 0.15.45

package/test/r71-isolated-slot-rollback-restore.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
+
+const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.44-9f500af433df3e77');
+const parentManifestSha='9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e';
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function generation(state,label){
+  const root=path.join(state,'generations',label);
+  await mkdir(root,{recursive:true});
+  const config=Buffer.from(`@{ Label = '${label}' }\r\n`,'utf8');
+  await writeFile(path.join(root,'controller-config.psd1'),config,{flag:'wx'});
+  const manifest=Buffer.from(`${sha(config)}  controller-config.psd1\n`,'utf8');
+  await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
+  return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
+}
+
+test('R71 isolated immutable slot activates, rolls back exact sealed R70, and restores same R71 bytes with no authority',async()=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r71-slot-parity-'));
+  const state=path.join(base,'state');
+  try{
+    const parentManifest=await readFile(path.join(parent,'MANIFEST.SHA256'));
+    const candidateManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+    assert.equal(sha(parentManifest),parentManifestSha);
+    const candidateManifestSha=sha(candidateManifest);
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.44',manifestSha256:parentManifestSha});
+    const candidateSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version:'0.15.45',manifestSha256:candidateManifestSha});
+    const parentGeneration=await generation(state,'r70-parent');
+    const candidateGeneration=await generation(state,'r71-candidate');
+    const launcherSha=sha(Buffer.from(renderStableLauncherPs1(),'utf8'));
+    const pointerPath=path.join(state,'active-release.json');
+    const pointer=(slot,version,g)=>({schema:'deadbyte.active-release.v1',release_id:slot.release_id,version,
+      manifest_sha256:slot.manifest_sha256,release_root:slot.release_root,generation_root:g.root,
+      generation_manifest_sha256:g.manifest_sha256,launcher_sha256:launcherSha,config_path:g.config_path});
+
+    const activated=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.45',candidateGeneration));
+    assert.equal(activated.release_id,candidateSlot.release_id);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+
+    const rolledBack=await atomicWriteActivePointer(pointerPath,pointer(parentSlot,'0.15.44',parentGeneration));
+    assert.equal(rolledBack.release_id,parentSlot.release_id);
+    assert.equal(rolledBack.manifest_sha256,parentManifestSha);
+    await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));
+
+    const restored=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.45',candidateGeneration));
+    assert.deepEqual(restored,activated);
+    assert.deepEqual(parseActivePointer(await readFile(pointerPath,'utf8')),activated);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+    for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+      await assert.rejects(()=>lstat(path.join(state,'runtime',name)),{code:'ENOENT'});
+    }
+  }finally{
+    await rm(base,{recursive:true,force:true});
+  }
+});

package/test/r71-native-diff-mcp-wire.test.mjs

@@ -0,0 +1,75 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,randomBytes} from 'node:crypto';
+import {access,mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {Client} from '@modelcontextprotocol/client';
+import {StdioClientTransport,getDefaultEnvironment} from '@modelcontextprotocol/client/stdio';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const exists=file=>access(file).then(()=>true,()=>false);
+
+test('R71 compact MCP tools/list and tools/call permit Coding-read preview without Autonomous apply authority',
+  {timeout:30_000},async()=>{
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r71-native-wire-'));
+  const project=path.join(state,'project');
+  const trust=path.join(state,'trust');
+  await mkdir(project);await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),
+    publicKeyPath:path.join(trust,'public.pem')});
+  const target=path.join(project,'candidate.txt');
+  await writeFile(target,'before\n');
+  const before=sha(await readFile(target));
+  const codingPath=path.join(state,'coding-policy.json');
+  const codingLease=path.join(state,'coding-lease.json');
+  await writeFile(codingPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:codingLease,evidence_dir:path.join(state,'coding-evidence'),
+    roots:{project:{path:project,read:true,write:true,exec:false,deny_paths:[]}},commands:{}}));
+  await writeFile(codingLease,JSON.stringify({schema:'deadbyte.coding-lease.v1',
+    policy_sha256:sha(await readFile(codingPath)),instance_nonce:randomBytes(32).toString('hex'),
+    root_ids:['project'],armed_at_utc:new Date().toISOString(),
+    expires_at_utc:new Date(Date.now()+60_000).toISOString()}));
+  const autonomousPath=path.join(state,'autonomous-policy.json');
+  await writeFile(autonomousPath,JSON.stringify({schema:'deadbyte.autonomous-policy.v1',enabled:true,
+    lease_file:path.join(state,'autonomous-lease.json'),evidence_dir:path.join(state,'autonomous-evidence'),
+    root_ids:['project'],coding_policy_sha256:sha(await readFile(codingPath)),
+    planner:{backend:'client_sampling',max_tokens:2048},profiles:{},limits:{max_files_per_diff:8}}));
+  const client=new Client({name:'deadbyte-r71-native-wire',version:'0.15.45'},
+    {versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,
+    args:[path.join(root,'src','mcp-server.mjs')],cwd:root,
+    env:{...getDefaultEnvironment(),DEADBYTE_STATE_ROOT:state,DEADBYTE_CAPABILITY_PROFILE:'compact',
+      DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath,
+      DEADBYTE_PRIVILEGED_POLICY:'',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_CODING_POLICY:codingPath,
+      DEADBYTE_AUTONOMOUS_RUNTIME:'1',DEADBYTE_AUTONOMOUS_POLICY:autonomousPath},stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const tools=(await client.listTools()).tools;
+    const preview=tools.find(tool=>tool.name==='native_diff_preview');
+    assert.ok(preview,'compact catalog must expose native_diff_preview');
+    assert.match(preview.description,/Coding read authority/i);
+    assert.equal(preview.outputSchema?.additionalProperties,false);
+    const request={root_id:'project',title:'read only wire proof',operations:[
+      {kind:'replace',path:'candidate.txt',expected_sha256:before,old_string:'before',
+        new_string:'after',expected_replacements:1}]};
+    const accepted=await client.callTool({name:'native_diff_preview',arguments:request});
+    assert.equal(accepted.isError,false);
+    assert.equal(accepted.structuredContent.status,'preview_only');
+    assert.equal(accepted.structuredContent.diff_id,undefined);
+    assert.equal(sha(await readFile(target)),before);
+    assert.equal(await exists(path.join(state,'autonomous-evidence','native-diffs')),false);
+    const denied=await client.callTool({name:'native_diff_preview',arguments:{...request,root_id:'outside'}});
+    assert.equal(denied.isError,true);
+    await rm(codingLease);
+    const revoked=await client.callTool({name:'native_diff_preview',arguments:request});
+    assert.equal(revoked.isError,true);
+    assert.equal(sha(await readFile(target)),before);
+  }finally{
+    await client.close().catch(()=>{});
+    await rm(state,{recursive:true,force:true});
+  }
+});

package/test/r71-publish-fence.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {assertR71NpmPublishReady} from '../scripts/npm-release-readiness-r71.mjs';
+
+test('R71 publish script enforces successor metadata before packing or dispatch',async()=>{
+  const source=await readFile(new URL('../scripts/npm-release-r48.mjs',import.meta.url),'utf8');
+  const guard=source.indexOf('assertR71NpmPublishReady(release)');
+  const pack=source.indexOf("'pack', '--json'");
+  const submit=source.indexOf("'publish',publishTarball");
+  assert.ok(guard>0&&guard<pack&&guard<submit,'R71 release fence must precede pack and publish');
+});
+
+test('R71 publication stays blocked while candidate gates are pending',async()=>{
+  const release=JSON.parse(await readFile(new URL('../RELEASE.json',import.meta.url),'utf8'));
+  assert.throws(()=>assertR71NpmPublishReady(release),/PUBLISH_BLOCKED/);
+});
+
+test('R71 fence accepts only the exact sealed parent and complete independently verified gate vector',()=>{
+  const release={version:'0.15.45',train:'R71',parent:{
+    release_id:'v0.15.44-9f500af433df3e77',
+    manifest_sha256:'9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e',
+    generation_manifest_sha256:'c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'},
+    r71_candidate:{status:'CANDIDATE_SEALED',full_regression:'PASS',manifest:'PASS',
+      windows_gate:'PASS',hot_swap:'PASS',package_acceptance:'PASS',
+      local_coding_preview:'PASS_CODING_READ_ONLY_NO_AUTONOMOUS_APPLY',
+      public_catalog:'PASS_43_TOOLS',signed_public_mcp:'PASS',performance_l0:'PASS',
+      owner_independent_project_grant:'DISABLED_FAIL_CLOSED_NO_OWNER_ENROLLMENT'}};
+  assert.doesNotThrow(()=>assertR71NpmPublishReady(release));
+  for(const key of Object.keys(release.r71_candidate)){
+    const altered=structuredClone(release);
+    altered.r71_candidate[key]='PENDING';
+    assert.throws(()=>assertR71NpmPublishReady(altered),/PUBLISH_BLOCKED/);
+  }
+  const wrongParent=structuredClone(release);
+  wrongParent.parent.manifest_sha256='0'.repeat(64);
+  assert.throws(()=>assertR71NpmPublishReady(wrongParent),/PUBLISH_BLOCKED/);
+});

package/test/r71-release-identity.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+
+const json=async rel=>JSON.parse(await readFile(new URL('../'+rel,import.meta.url),'utf8'));
+const parent={release_id:'v0.15.44-9f500af433df3e77',
+  manifest_sha256:'9f500af433df3e7778d4f11acf418526d5889f478114c955c8c72c0077a0636e',
+  generation_manifest_sha256:'c35f6ccca58083acd53484a983ef401ee18f28b11185cd02c7b1eb3e29028c71'};
+
+test('R71 current source, package, bridge, provenance and Windows gate bind exact predecessor',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,sbom,version]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
+    json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),
+    readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
+  for(const observed of [pkg.version,lock.version,lock.packages[''].version,bridge.version,
+    release.version,provenance.version,matrix.version,sbom.metadata.component.version]){
+    assert.equal(observed,'0.15.45');
+  }
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.45'/);
+  assert.equal(release.train,'R71');
+  assert.equal(matrix.train,'R71');
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r71:0.15.45');
+  assert.deepEqual(release.runtime_predecessor,parent);
+  assert.equal(release.parent.release_id,parent.release_id);
+  assert.equal(release.parent.manifest_sha256,parent.manifest_sha256);
+  assert.equal(release.parent.generation_manifest_sha256,parent.generation_manifest_sha256);
+  assert.equal(provenance.parent_release_id,parent.release_id);
+  assert.equal(provenance.parent_manifest_sha256,parent.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r71\.ps1/);
+});

package/test/remote-result-journal.test.mjs

@@ -71,3 +71,15 @@ test('remote result journal preserves explicit unknown side-effect state across
     await assert.rejects(journal.recordTerminal({...item('req-invalid',H('5'),'error'),side_effect_state:'committed'}),/side_effect_state invalid/);
   }finally{await rm(root,{recursive:true,force:true});}
 });
+
+test('R69 replay retains an input-required result as pending, never ok',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r69-remote-pending-'));
+  try{
+    const file=path.join(root,'journal.json');
+    let journal=await openRemoteResultJournal({filePath:file,sessionId:session,maxEntries:8});
+    await journal.recordTerminal(item('req-input',H('6'),'pending'));
+    journal=await openRemoteResultJournal({filePath:file,sessionId:session,maxEntries:8});
+    const replay=await journal.replayAfter('r1:'+session+':0',{limit:8});
+    assert.equal(replay.events[0].status,'pending');
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/remote-session-cli.test.mjs

@@ -273,7 +273,8 @@ winTest('bare remote uses one unified live timeline, keeps authority semantics,
     assert.deepEqual(ready.slice(0,8),['status','start','status','status','armprocess','armcoding','armautonomous','status']);
     assert.equal(child.exitCode,null,'remote session must remain foreground after becoming ready');
     const tailDeadline=Date.now()+3000;
-    while(Date.now()<tailDeadline&&!/\[AUTH\] process ARMED \| coding ARMED \| autonomous ARMED \| desktop DISARMED \| host DISARMED/.test(output.stdout)) await sleep(50);
+    while(Date.now()<tailDeadline&&(!/\[AUTH\] process ARMED \| coding ARMED \| autonomous ARMED \| desktop DISARMED \| host DISARMED/.test(output.stdout)||
+      !/\[READY\] DEADBYTE MCP online/.test(output.stdout))) await sleep(50);
     assert.match(output.stdout,/\[DISPLAY\] ASCII fallback: stdout_not_tty/);
     assert.match(output.stdout,/\[DEVICE\] Starting DEADBYTE MCP/);
     assert.match(output.stdout,/\[BRIDGE\] Local bridge connected/);

package/test/standing-grants.test.mjs

@@ -85,13 +85,13 @@ test('host standing grant remains armed until explicit revocation', async () =>
   assert.equal(status.remaining_ms, null);
 });
 
-test('controller emits standing grants and hides expiry UX', async () => {
+test('controller retains coding/host standing grants but issues bounded autonomous expiry', async () => {
   const controller = await import('node:fs/promises').then(fs => fs.readFile(
     new URL('../controller/deadbyte-controller.ps1', import.meta.url), 'utf8'));
   assert.match(controller, /deadbyte\.host-grant\.v2/);
   assert.match(controller, /deadbyte\.coding-grant\.v2/);
   assert.match(controller, /deadbyte\.autonomous-grant\.v2/);
-  assert.doesNotMatch(controller, /expires_at_utc/);
+  assert.match(controller, /expires_at_utc=\$now\.AddHours\(1\)\.ToString\('o'\)/);
   assert.doesNotMatch(controller, /AddMinutes\((?:15|30|60)\)/);
   assert.doesNotMatch(controller, /expires=/);
 });

package/test/tool-audit.test.mjs

@@ -71,6 +71,20 @@ test('tool wrapper durably records request before handler and writes correlated
   }finally{await rm(root,{recursive:true,force:true});}
 });
 
+test('R69 audit retains explicit unknown side effect even when a tool envelope says ok',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);
+    const audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context()});
+    const server=fakeServer();installToolAudit(server,audit);
+    server.registerTool('uncertain_write',{},async()=>({isError:false,
+      structuredContent:{status:'ok',side_effect_state:'unknown'}}));
+    await server.handlers.get('uncertain_write')({path:'scratch.txt'});
+    const all=await events(root);
+    assert.equal(all.at(-1).outcome.side_effect_state,'unknown');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
 test('audit failure before request commit prevents handler side effects',async()=>{
   const server=fakeServer();let sideEffect=false;
   installToolAudit(server,{async recordRequest(){throw new Error('audit unavailable');},async recordResult(){throw new Error('unexpected');}});

package/proof/CONTAINMENT-BUILD.txt

@@ -1,163 +0,0 @@
-==== launcher ====
-deadbyte-contain.cpp
-exit_code=0
-==== probe ====
-containment-probe.cpp
-exit_code=0
-==== bootstrap-kernel32 ====
-bootstrap-kernel32.cpp
-exit_code=0
-==== bootstrap-advapi32 ====
-bootstrap-advapi32.cpp
-exit_code=0
-==== construction-launcher ====
-appcontainer-stage.cpp
-exit_code=0
-==== bootstrap-exitcode ====
-bootstrap-exitcode.cpp
-exit_code=0
-==== child-control-launcher ====
-child-control-stage.cpp
-exit_code=0
-==== child-control-probe ====
-child-control-probe.cpp
-exit_code=0
-==== contained-launcher ====
-deadbyte-exec.cpp
-exit_code=0
-==== contained-worker ====
-contained-transform-worker.cpp
-exit_code=0
-==== contained-reverse-worker ====
-contained-reverse-worker.cpp
-exit_code=0
-==== named-tunnel-host ====
-deadbyte-tunnel-host.cpp
-exit_code=0
-==== process-host ====
-deadbyte-process-host.cpp
-exit_code=0
-==== probe-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\containment-probe.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    ADVAPI32.dll
-    KERNEL32.dll
-
-  Summary
-
-        2000 .data
-        1000 .fptable
-        2000 .pdata
-        E000 .rdata
-        1000 .reloc
-       19000 .text
-exit_code=0
-==== contained-launcher-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-exec.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    USERENV.dll
-    ADVAPI32.dll
-    ole32.dll
-    bcrypt.dll
-    WS2_32.dll
-    KERNEL32.dll
-
-  Summary
-
-        3000 .data
-        1000 .fptable
-        3000 .pdata
-       17000 .rdata
-        1000 .reloc
-       3B000 .text
-exit_code=0
-==== contained-worker-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\contained-transform-worker.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    ADVAPI32.dll
-    WS2_32.dll
-    KERNEL32.dll
-
-  Summary
-
-        2000 .data
-        1000 .fptable
-        2000 .pdata
-        F000 .rdata
-        1000 .reloc
-       19000 .text
-exit_code=0
-==== contained-reverse-worker-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\contained-reverse-worker.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    ADVAPI32.dll
-    WS2_32.dll
-    KERNEL32.dll
-
-  Summary
-
-        2000 .data
-        1000 .fptable
-        2000 .pdata
-        F000 .rdata
-        1000 .reloc
-       19000 .text
-exit_code=0
-==== named-tunnel-host-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-tunnel-host.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    KERNEL32.dll
-
-  Summary
-
-        2000 .data
-        1000 .fptable
-        2000 .pdata
-        C000 .rdata
-        1000 .reloc
-       18000 .text
-exit_code=0
-==== process-host-dependencies ====
-
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-process-host.exe
-
-File Type: EXECUTABLE IMAGE
-
-  Image has the following dependencies:
-
-    KERNEL32.dll
-
-  Summary
-
-        2000 .data
-        1000 .fptable
-        2000 .pdata
-        F000 .rdata
-        1000 .reloc
-       1C000 .text
-exit_code=0

package/proof/MCP-SMOKE-STATUS.txt

@@ -1,9 +0,0 @@
-DEADBYTE MCP V0.6.0 MCP LIVE SMOKE
-STATUS=PASS
-PROTOCOL_REVISION=2026-07-28
-PROTOCOL_ERA=modern
-TOOLS=contained_transform,evidence_verify,file_read,proof_execute,workspace_open
-SIGNATURE_ALGORITHM=ed25519
-SIGNATURE_VALID=true
-INDEPENDENT_VERIFY=true
-OUTPUT_SHA256=72562501a654ddbb4f8810f8ba9017d02b29516853101456445e7642988fbd1b

package/proof/NODE-SYNTAX.txt

@@ -1,4 +0,0 @@
-DEADBYTE_MCP_VERSION=0.7.3
-NODE_SYNTAX_FILES=44
-NODE_SYNTAX_PASS=44
-NODE_SYNTAX_FAIL=0

package/proof/PROOF.txt

@@ -1,6 +0,0 @@
-DEADBYTE MCP V0.6.0 SIGNED PROOF REGRESSION
-STATUS=PASS
-RECEIPT_SHA256=5bc4f1ace478b79fc491811888b039ebffb72d09f7cd51f520f6569a0cc3d0d4
-KEY_ID=64ee8445e138c19a2049dc4242924d056f2b62913ed65364916413eb684a946e
-SIGNATURE_ALGORITHM=ed25519
-OUTPUT_SHA256=72562501a654ddbb4f8810f8ba9017d02b29516853101456445e7642988fbd1b

package/proof/R34-TASK8-SUPERVISOR-CHECKPOINT.json

@@ -1,29 +0,0 @@
-{
-  "schema": "deadbyte.r34.task8-checkpoint.v1",
-  "task": 8,
-  "status": "passed",
-  "workspace": "D:\\Projects\\deadbyte-mcp-r34-loop-engine",
-  "node_executable_sha256": "9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de",
-  "sources": {
-    "src/autonomous-local-supervisor.mjs": "ab0158c3f6e270ee367ae96455dd2b75a902c808b2a10ac2c5b75fdda00be6c3",
-    "src/autonomous-supervisor.mjs": "8ea06b5941de9b346ab4e97ff6ed236964b864fbe725602baee3a54dd74527c0",
-    "src/autonomous-supervisor-host.mjs": "335022086ef41e6cc9853468d928acc864deab8009383dc22518a6ec7e749fa1",
-    "src/deadbyte-cli.mjs": "0b0d41a51559502a6ff377a4f74e6f80ea77d37002a700e04bd7c4dd3f226b42",
-    "controller/deadbyte-controller.ps1": "279dfe20345193ca229cc442b25796f12d4c8ec9f9d3e2d26a607a7342b96a5a",
-    "controller/deadbyte-controller.config.psd1.example": "f20a5bf0df576dbdd32af657640b26c5c50c39dce0b465b7488c218917c729f7"
-  },
-  "regression": {
-    "tests": 40,
-    "passed": 40,
-    "failed": 0,
-    "receipt_id": "473fb1f0f7e6a2dec1ea9d80",
-    "receipt_sha256": "255e3679051eff46ae745b16f07d6a3c40f87e42259ac651ef286c9d876ceae2",
-    "receipt_signature_valid": true,
-    "marker": "TASK8_REGRESSION=PASS"
-  },
-  "authority_contract": {
-    "self_arm": false,
-    "recovery_operations": ["resume","disarmautonomous","disarmcoding","disarmprocess","disarmhost","status"],
-    "final_required": "ONLINE + process/coding/autonomous/host DISARMED"
-  }
-}

package/proof/R34-TASK9-MCP-SURFACE-CHECKPOINT.json

@@ -1,28 +0,0 @@
-{
-  "schema": "deadbyte.r34-task9-checkpoint.v1",
-  "status": "passed",
-  "workspace": "D:\\Projects\\deadbyte-mcp-r34-loop-engine",
-  "public_tool_count": 68,
-  "public_tool_unique_count": 68,
-  "public_tool_catalog_sha256": "bb7c08e116178e3da4b577b591f7058eb6caf7632358e765d28ccb20b2e36f45",
-  "mcp_server_sha256": "5a6cd82c332e4cef30c4ccfeb12f8cb3634cb6c92104931768b42ba6a84b62b3",
-  "controller_sha256": "cf8ab26a7481801da07c5c0a842df4ce1279854ed67781f967e5412da5c2aa3d",
-  "supervisor_integration_test_sha256": "127e170995460daabab88860f20f1b4c2416839e018df0e1cda23b58d032beab",
-  "exact_surface_gate": {
-    "tests": 19,
-    "pass": 19,
-    "fail": 0,
-    "receipt_id": "dc0b7e9c6c9e340c037bc54a",
-    "receipt_sha256": "f6b8ac9b6d499d51f60c7f8053a2e591e09654cdfe5bf69c449b15d133e48506"
-  },
-  "catalog_observation": {
-    "receipt_id": "7dd6df7d9b575e786101d1d0",
-    "receipt_sha256": "226e0861c01cb485ef94b91c1562a3cb70123698b9a52bb62ba883940be940cf"
-  },
-  "supervision": {
-    "in_process_compatibility": true,
-    "external_owner_mode": true,
-    "bridge_external_mode_does_not_execute_goal": true,
-    "standalone_host_advances_durable_goal": true
-  }
-}

package/proof/SECRET-SCAN.txt

@@ -1,4 +0,0 @@
-DEADBYTE_MCP_VERSION=0.7.3
-RESULT=PASS
-No private-key material, MCP secret path literal, node_modules, shell:true, broad taskkill-by-image, or Stop-Process -Name occurs in the source package.
-The tunnel stdio compatibility adapter imports no child_process API and performs no file write.

package/proof/SOURCE-GATES.txt

@@ -1,16 +0,0 @@
-DEADBYTE MCP V0.7.3 SOURCE/ADVERSARIAL GATES
-TESTS=142
-PASS=142
-FAIL=0
-TUNNEL_STDIO_COMPAT_TESTS=10_10_PASS
-NODE_SYNTAX=PASS_44_44
-PROTOCOL_REVISION=2026-07-28
-STRICT_SDK_LEGACY_POLICY=reject
-TUNNEL_STARTUP_PROBE_COMPAT=SOURCE_PASS_TARGET_PENDING
-LEGACY_CAPABILITY_TRANSLATION=NONE
-SIGNED_PROOF_REGRESSION=PASS
-INDEPENDENT_VERIFIER_REGRESSION=PASS
-ACTIVE_NETWORK_SOURCE_GATES=PASS
-EXECUTION_AUTHORITY_SOURCE_GATES=PASS
-PRIVILEGED_HOST_PLANE_SOURCE_GATES=PASS
-WINDOWS_NATIVE_BATCH_GATE=PENDING_TARGET

package/proof/STATUS.txt

@@ -1,11 +0,0 @@
-DEADBYTE MCP V0.7.3
-SOURCE_TESTS=PASS_142_142
-TUNNEL_STDIO_COMPAT=SOURCE_PASS_TARGET_PENDING
-MCP_PROTOCOL=2026-07-28
-STRICT_CORE_LEGACY=REJECT
-LEGACY_STARTUP_PROBE_ADAPTER=OPTIONAL_NARROW_PREFILTER
-LEGACY_CAPABILITY_TRANSLATION=NONE
-PRIVILEGED_HOST_PLANE=LOCAL_POLICY_PLUS_EXPIRING_ARM_LEASE
-GENERAL_UNBOUNDED_COMMAND_EXECUTION=NOT_EXPOSED
-WINDOWS_BATCH_GATE=PENDING_TARGET
-PUBLIC_TUNNEL_GATE=PENDING_TARGET

package/proof/TARGET-V0313-CONTAINMENT-PASS.sha256

@@ -1 +0,0 @@
-e6a8f91b62b5fdb861ee039ae05a9c3572535d16608297ec75c6440e5ea6d20d  TARGET-V0313-CONTAINMENT-PASS.txt