deadbyte-mcp 0.15.44 → 0.15.46

package/src/runtime-update.mjs

@@ -1,6 +1,6 @@
 import { createHash, createPrivateKey, createPublicKey, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -18,6 +18,9 @@ import {
 } from './release-slot.mjs';
 import { createGenerationBundle, verifyGenerationBundle } from './release-generation.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import {canonicalLauncherPaths,assertCanonicalLaunchers,renderStateBoundLauncherCmd} from './launcher-isolation.mjs';
+import {assertStageOwnedPath,assertStagingBootstrapInputs,assertStagingControlConfig} from './staging-input-isolation.mjs';
+import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
 
 const HEX64=/^[0-9a-f]{64}$/;
 const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -28,7 +31,6 @@ const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
 const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
 const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
 const DEFAULT_STATE_ROOT=undefined;
-const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
 const RUNTIME_STABILITY_MS=12000;
 const RUNTIME_STABILITY_POLL_MS=500;
 
@@ -48,8 +50,8 @@ function normalizePersistentPublicOrigin(value){
   return publicOrigin.origin;
 }
 export function parseUpdateArgs(argv){
-  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableDesktop:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,hostPolicyBootstrap:null,codingPolicyBootstrap:null,desktopPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
-  const cloud={},bridge={},processPolicy={},hostPolicy={},codingPolicy={},desktopPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
+  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableDesktop:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,hostPolicyBootstrap:null,codingPolicyBootstrap:null,autonomousPolicyBootstrap:null,ownerApprovalBootstrap:null,desktopPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
+  const cloud={},bridge={},processPolicy={},hostPolicy={},codingPolicy={},autonomousPolicy={},ownerApproval={},desktopPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
   const bridgeFlags=new Map([
     ['--bridge-root','root'],['--bridge-script-sha256','scriptSha256']
   ]);
@@ -62,6 +64,12 @@ export function parseUpdateArgs(argv){
   const codingPolicyFlags=new Map([
     ['--coding-policy','path'],['--coding-policy-sha256','sha256']
   ]);
+  const autonomousPolicyFlags=new Map([
+    ['--autonomous-policy','path'],['--autonomous-policy-sha256','sha256']
+  ]);
+  const ownerApprovalFlags=new Map([
+    ['--owner-approval','path'],['--owner-approval-sha256','sha256']
+  ]);
   const desktopPolicyFlags=new Map([
     ['--desktop-policy','path'],['--desktop-policy-sha256','sha256']
   ]);
@@ -73,7 +81,7 @@ export function parseUpdateArgs(argv){
     ['--cloud-token-file','tokenFilePath'],['--cloud-token-sha256','tokenFileSha256'],
     ['--cloud-child-working-directory','childWorkingDirectory'],['--cloud-public-origin','publicOrigin']
   ]);
-  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...hostPolicyFlags.keys(),...codingPolicyFlags.keys(),...desktopPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
+  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...hostPolicyFlags.keys(),...codingPolicyFlags.keys(),...autonomousPolicyFlags.keys(),...ownerApprovalFlags.keys(),...desktopPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
   for(let index=0;index<argv.length;index++){
     const arg=argv[index];
     if(arg==='--restore-standing-grants'||arg==='--recover-offline-predecessor'||arg==='--enable-machine-fs'||arg==='--enable-observation'||arg==='--enable-desktop'||arg==='--enable-autonomous-supervisor'){
@@ -110,6 +118,8 @@ export function parseUpdateArgs(argv){
     else if(processPolicyFlags.has(arg)) processPolicy[processPolicyFlags.get(arg)]=value;
     else if(hostPolicyFlags.has(arg)) hostPolicy[hostPolicyFlags.get(arg)]=value;
     else if(codingPolicyFlags.has(arg)) codingPolicy[codingPolicyFlags.get(arg)]=value;
+    else if(autonomousPolicyFlags.has(arg)) autonomousPolicy[autonomousPolicyFlags.get(arg)]=value;
+    else if(ownerApprovalFlags.has(arg)) ownerApproval[ownerApprovalFlags.get(arg)]=value;
     else if(desktopPolicyFlags.has(arg)) desktopPolicy[desktopPolicyFlags.get(arg)]=value;
     else if(semanticLspFlags.has(arg)) semanticLsp[semanticLspFlags.get(arg)]=value;
     else cloud[cloudFlags.get(arg)]=value;
@@ -146,6 +156,21 @@ export function parseUpdateArgs(argv){
     if(!HEX64.test(sha256)) throw new Error('coding policy SHA-256 must be lowercase hex');
     out.codingPolicyBootstrap={path:path.resolve(codingPolicy.path),sha256};
   }
+  const autonomousPolicyFields=[...autonomousPolicyFlags.values()],autonomousPolicyPresent=autonomousPolicyFields.filter(key=>autonomousPolicy[key]!==undefined);
+  if(autonomousPolicyPresent.length!==0&&autonomousPolicyPresent.length!==autonomousPolicyFields.length) throw new Error('autonomous policy bootstrap requires path plus SHA-256 as one pair');
+  if(autonomousPolicyPresent.length===autonomousPolicyFields.length){
+    const sha256=String(autonomousPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('autonomous policy SHA-256 must be lowercase hex');
+    out.autonomousPolicyBootstrap={path:path.resolve(autonomousPolicy.path),sha256};
+  }
+  const ownerApprovalFields=[...ownerApprovalFlags.values()],ownerApprovalPresent=ownerApprovalFields.filter(key=>ownerApproval[key]!==undefined);
+  if(ownerApprovalPresent.length!==0&&ownerApprovalPresent.length!==ownerApprovalFields.length) throw new Error('owner approval bootstrap requires path plus SHA-256 as one pair');
+  if(ownerApprovalPresent.length===ownerApprovalFields.length){
+    const sha256=String(ownerApproval.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('owner approval SHA-256 must be lowercase hex');
+    out.ownerApprovalBootstrap={path:path.resolve(ownerApproval.path),sha256};
+  }
+  if(Boolean(out.autonomousPolicyBootstrap)!==Boolean(out.ownerApprovalBootstrap)) throw new Error('autonomous policy bootstrap requires pinned owner approval, and owner approval requires autonomous policy');
   const desktopPolicyFields=[...desktopPolicyFlags.values()],desktopPolicyPresent=desktopPolicyFields.filter(key=>desktopPolicy[key]!==undefined);
   if(desktopPolicyPresent.length!==0&&desktopPolicyPresent.length!==desktopPolicyFields.length) throw new Error('desktop policy bootstrap requires path plus SHA-256 as one pair');
   if(desktopPolicyPresent.length===desktopPolicyFields.length){
@@ -446,6 +471,21 @@ async function verifyPinnedRegularFile(file,expected,label){
   return {path:absolute,sha256:actual};
 }
 
+export async function readPinnedJsonPolicy(bootstrap,label,readBytes=readFile){
+  const file=bootstrap?.path,expected=bootstrap?.sha256;
+  if(typeof file!=='string'||!path.isAbsolute(file)||!HEX64.test(String(expected??''))) throw new Error(`${label} pin contract invalid`);
+  const absolute=path.resolve(file),stat=await lstat(absolute);
+  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} must be a regular file`);
+  const bytes=await readBytes(absolute);
+  if(!Buffer.isBuffer(bytes)) throw new Error(`${label} read must return bytes`);
+  const actual=sha256Bytes(bytes);
+  if(actual!==expected) throw new Error(`${label} SHA-256 mismatch: expected ${expected}, found ${actual}`);
+  let policy;
+  try{policy=JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error(`${label} JSON invalid`);}
+  return {path:absolute,sha256:actual,policy};
+}
+
 export async function prepareProcessPolicyBootstrap(bootstrap){
   if(!bootstrap) return null;
   const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'process policy');
@@ -470,8 +510,7 @@ export async function prepareHostPolicyBootstrap(bootstrap){
 
 export async function prepareCodingPolicyBootstrap(bootstrap){
   if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'coding policy');
-  const policy=await readJson(pinned.path);
+  const {policy,...pinned}=await readPinnedJsonPolicy(bootstrap,'coding policy');
   if(policy?.schema!=='deadbyte.coding-policy.v1'||policy?.enabled!==true||
      !policy?.roots||typeof policy.roots!=='object'||Array.isArray(policy.roots)||
      !policy?.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
@@ -480,6 +519,110 @@ export async function prepareCodingPolicyBootstrap(bootstrap){
   return {...pinned,policy};
 }
 
+export async function prepareAutonomousPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const {policy,...pinned}=await readPinnedJsonPolicy(bootstrap,'autonomous policy');
+  if(policy?.schema!=='deadbyte.autonomous-policy.v1'||policy?.enabled!==true||
+     !HEX64.test(String(policy.coding_policy_sha256??''))||
+     !Array.isArray(policy.root_ids)||policy.root_ids.length<1||
+     !policy.profiles||typeof policy.profiles!=='object'||Array.isArray(policy.profiles)) {
+    throw new Error('autonomous policy schema/enabled/coding digest/roots/profiles mismatch');
+  }
+  return {...pinned,policy};
+}
+
+export function assertAutonomousBootstrapRoots(autonomousPolicy,codingPolicy,selectedCodingSha256=null){
+  const roots=autonomousPolicy?.root_ids;
+  for(const codingRoot of Object.values(codingPolicy?.roots??{})){
+    const candidate=codingRoot?.path;
+    if((codingRoot?.read===true||codingRoot?.write===true||codingRoot?.exec===true)&&
+       typeof candidate==='string'&&path.isAbsolute(candidate)){
+      const resolved=path.resolve(candidate),filesystemRoot=path.parse(resolved).root;
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)===normalize(filesystemRoot)) throw new Error('coding policy contains a broad filesystem root');
+    }
+  }
+  if(!Array.isArray(roots)||roots.length<1||roots.some(id=>typeof id!=='string'||
+     !/^[A-Za-z0-9._-]{1,64}$/.test(id)||!Object.hasOwn(codingPolicy?.roots??{},id))) {
+    throw new Error('autonomous bootstrap root is outside selected coding policy');
+  }
+  const profiles=autonomousPolicy?.profiles??{};
+  if(!profiles||typeof profiles!=='object'||Array.isArray(profiles)) throw new Error('autonomous bootstrap profiles invalid');
+  for(const [id,profile] of Object.entries(profiles)){
+    if(typeof profile?.root_id!=='string'||!roots.includes(profile.root_id)){
+      throw new Error(`autonomous bootstrap profile '${id}' root outside autonomous roots`);
+    }
+  }
+  if(selectedCodingSha256!==null&&autonomousPolicy.coding_policy_sha256!==selectedCodingSha256) {
+    throw new Error('autonomous bootstrap coding policy SHA-256 mismatch');
+  }
+  for(const id of roots){
+    const rootPath=codingPolicy.roots[id]?.path;
+    if(typeof rootPath==='string'&&path.isAbsolute(rootPath)){
+      const resolved=path.resolve(rootPath),filesystemRoot=path.parse(resolved).root;
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)===normalize(filesystemRoot)) throw new Error('autonomous bootstrap requires a project-scoped root');
+    }
+    try{
+      if(typeof rootPath!=='string'||!path.isAbsolute(rootPath)) throw new Error('path invalid');
+      const stat=lstatSync(rootPath);
+      if(!stat.isDirectory()||stat.isSymbolicLink()) throw new Error('not a regular directory');
+      const resolved=path.resolve(rootPath),real=realpathSync(rootPath);
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)!==normalize(path.resolve(real))) throw new Error('path indirection');
+    }catch{ throw new Error(`autonomous bootstrap root '${id}' must be an existing real directory`); }
+  }
+  return roots;
+}
+
+// R70: Admission check for successor POLICY BOOTSTRAP only. This does not
+// grant authority or establish the owner trust anchor by itself.
+export async function verifyAutonomousOwnerBootstrap({
+  stateRoot,bootstrap,autonomousPolicy,codingPolicy,
+  codingPolicySha256,autonomousPolicySha256,expectedManifest,now=new Date()
+}={}){
+  if(!bootstrap) throw new Error('owner approval bootstrap is required');
+  if(typeof stateRoot!=='string'||!path.isAbsolute(stateRoot)) throw new Error('owner approval state root invalid');
+  if(!HEX64.test(String(codingPolicySha256??''))||
+     !HEX64.test(String(autonomousPolicySha256??''))||
+     !HEX64.test(String(expectedManifest??''))) throw new Error('owner approval digest inputs invalid');
+  const ids=assertAutonomousBootstrapRoots(autonomousPolicy,codingPolicy,codingPolicySha256);
+  if(ids.length!==1) throw new Error('owner approval requires exactly one project-scoped autonomous root');
+  const rootId=ids[0];
+  const projectRoot=codingPolicy.roots[rootId].path;
+  const trustRoot=path.resolve(stateRoot,'trust');
+  const ownerKeyPath=path.join(trustRoot,'r70-owner-public.pem');
+  const normalize=p=>process.platform==='win32'?path.resolve(p).toLowerCase():path.resolve(p);
+  const under=(file,root)=>{
+    const relative=path.relative(normalize(root),normalize(file));
+    return relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative));
+  };
+  // Coding commands execute as the owner OS principal, not inside a
+  // filesystem sandbox. Project-scoped write checks cannot protect a trust
+  // anchor while any selected Coding root can execute arbitrary scripts.
+  for(const root of Object.values(codingPolicy.roots)){
+    if(root?.exec===true) throw new Error('owner approval cannot trust an anchor with unsandboxed Coding execution');
+    if(root?.write===true&&typeof root.path==='string'&&path.isAbsolute(root.path)&&
+       under(ownerKeyPath,root.path)) throw new Error('owner trust key is writable by Coding policy');
+  }
+  const trustStat=await lstat(trustRoot);
+  const keyStat=await lstat(ownerKeyPath);
+  if(!trustStat.isDirectory()||trustStat.isSymbolicLink()||
+     !keyStat.isFile()||keyStat.isSymbolicLink()||
+     normalize(await realpath(trustRoot))!==normalize(trustRoot)||
+     normalize(await realpath(ownerKeyPath))!==normalize(ownerKeyPath)){
+    throw new Error('owner trust key must be a regular file below a real trust directory');
+  }
+  const ownerPublicKey=await readFile(ownerKeyPath);
+  const pinned=await readPinnedJsonPolicy(bootstrap,'owner approval');
+  return verifyProjectOwnerApproval({
+    approval:pinned.policy,ownerPublicKey,
+    expected:{rootId,projectRoot,codingPolicySha256,autonomousPolicySha256,
+      reviewedArtifactSha256:expectedManifest},
+    now
+  });
+}
+
 export async function prepareDesktopPolicyBootstrap(bootstrap){
   if(!bootstrap) return null;
   const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'desktop policy');
@@ -1000,7 +1143,9 @@ async function loadControlInputs({stateRoot,sourceRoot,pointerInfo,bridgeBootstr
     if(!sourceRoot) throw new Error('--source-root is required for initial slot migration');
     ctx=legacyContext(sourceRoot); configPath=path.join(ctx.source_root,'controller','deadbyte-controller.config.psd1');
   }
+  assertStageOwnedPath(configPath,stateRoot,'controller config file');
   let config=await loadPowerShellDataFile(configPath);
+  assertStagingControlConfig(config,stateRoot,{configPath});
   if(bridgeBootstrap){
     if(!bridgeBootstrap.root||!path.isAbsolute(bridgeBootstrap.root)||!HEX64.test(String(bridgeBootstrap.scriptSha256??''))) throw new Error('bridge bootstrap requires absolute root plus lowercase script SHA-256');
     const bootstrapRoot=path.resolve(bridgeBootstrap.root);
@@ -1030,7 +1175,33 @@ export function assertDevelopmentRootSafe(developmentRoot,stateRoot){
   if(forbidden.some(prefix=>lower===prefix||lower.startsWith(`${prefix}${path.sep}`))) throw new Error('development root cannot live inside immutable/runtime state stores');
   return dev;
 }
-async function workspacePlan(currentWorkspace,stateRoot){
+function assertStageWorkspaceBoundary(currentWorkspace,stateRoot){
+  const state=path.resolve(stateRoot),source=path.resolve(currentWorkspace);
+  const production=path.resolve(os.homedir(),'.deadbyte-mcp');
+  const normalized=file=>process.platform==='win32'?file.toLowerCase():file;
+  if(normalized(state)===normalized(production)) return;
+  // Fail closed before staging can plan, mutate or roll back a workspace migration.
+  canonicalLauncherPaths(state);
+  const within=(parent,child)=>{
+    const relative=path.relative(normalized(parent),normalized(child));
+    return relative===''||(!path.isAbsolute(relative)&&relative!=='..'&&!relative.startsWith('..'+path.sep));
+  };
+  if(!within(state,source)) throw new Error('STAGING_WORKSPACE_OUTSIDE_STATE');
+  if(normalized(state)===normalized(source)) throw new Error('STAGING_WORKSPACE_STATE_ROOT');
+  const forbidden=['releases','generations','runtime','bin','launchers','trust','evidence','controller'];
+  if(forbidden.some(child=>within(path.join(state,child),source))) throw new Error('STAGING_WORKSPACE_RESERVED_STATE');
+  // Reject reparse points on either path, even when final leaf is absent.
+  for(const file of [source,path.join(state,'workspaces')]){
+    let cursor=file;
+    for(;;){
+      try {if(lstatSync(cursor).isSymbolicLink())throw new Error('STAGING_WORKSPACE_REPARSE');}
+      catch(error){if(error?.code!=='ENOENT')throw error;}
+      const parent=path.dirname(cursor);if(parent===cursor)break;cursor=parent;
+    }
+  }
+}
+export async function workspacePlan(currentWorkspace,stateRoot){
+  assertStageWorkspaceBoundary(currentWorkspace,stateRoot);
   const source=path.resolve(currentWorkspace),target=path.join(path.resolve(stateRoot),'workspaces');
   if(source.toLowerCase()===path.resolve(target).toLowerCase()) return {source,target,mode:'existing',moved:false};
   const sourceExists=existsSync(source),targetExists=existsSync(target);
@@ -1044,7 +1215,8 @@ async function workspacePlan(currentWorkspace,stateRoot){
   if(path.parse(source).root.toLowerCase()!==path.parse(target).root.toLowerCase()) throw new Error('workspace migration requires same-volume rename');
   return {source,target,mode:'rename',moved:false};
 }
-async function applyWorkspacePlan(plan){
+export async function applyWorkspacePlan(plan){
+  assertStageWorkspaceBoundary(plan.source,path.dirname(plan.target));
   if(plan.mode==='existing'||plan.mode==='target-existing') return plan;
   const sourceExists=existsSync(plan.source),targetExists=existsSync(plan.target);
   if(plan.mode==='create'){
@@ -1057,29 +1229,41 @@ async function applyWorkspacePlan(plan){
   await mkdir(path.dirname(plan.target),{recursive:true});
   await rename(plan.source,plan.target); plan.moved=true; return plan;
 }
-async function rollbackWorkspacePlan(plan){
+export async function rollbackWorkspacePlan(plan){
+  assertStageWorkspaceBoundary(plan.source,path.dirname(plan.target));
   if(plan.mode==='rename'&&existsSync(plan.target)&&!existsSync(plan.source)){ await rename(plan.target,plan.source); plan.moved=false; return true; }
   if(plan.mode==='create'&&existsSync(plan.target)){ await rm(plan.target,{recursive:true,force:true}); plan.created=false; return true; }
   return false;
 }
 async function launcherPlan(stateRoot){
-  const bin=path.join(path.resolve(stateRoot),'bin');
-  const ps1=path.join(bin,'DEADBYTE-MCP.ps1'),cmd=path.join(bin,'DEADBYTE-MCP.cmd'),top=TOP_LAUNCHER;
-  const ps1Bytes=Buffer.from(renderStableLauncherPs1(),'utf8'),cmdBytes=Buffer.from(renderStableLauncherCmd(),'utf8');
-  return {ps1,cmd,top,ps1Bytes,cmdBytes,launcher_sha256:sha256Bytes(ps1Bytes),
+  const target=canonicalLauncherPaths(stateRoot);
+  const {state,ps1,cmd,top}=target;
+  const ps1Bytes=Buffer.from(renderStableLauncherPs1(),'utf8');
+  const cmdBytes=Buffer.from(target.production?renderStableLauncherCmd():renderStateBoundLauncherCmd(),'utf8');
+  return {stateRoot:state,ps1,cmd,top,ps1Bytes,cmdBytes,launcher_sha256:sha256Bytes(ps1Bytes),
     snapshots:{ps1:await snapshotFile(ps1),cmd:await snapshotFile(cmd),top:await snapshotFile(top)},installed:false};
 }
 async function installLaunchers(plan){
-  await atomicBytes(plan.ps1,plan.ps1Bytes); await atomicBytes(plan.cmd,plan.cmdBytes); await atomicBytes(plan.top,plan.cmdBytes);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
+  await atomicBytes(plan.ps1,plan.ps1Bytes);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
+  await atomicBytes(plan.cmd,plan.cmdBytes);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
+  await atomicBytes(plan.top,plan.cmdBytes);
   plan.installed=true;
   if(await sha256File(plan.ps1)!==plan.launcher_sha256) throw new Error('stable launcher post-install hash mismatch');
   return plan;
 }
 async function rollbackLaunchers(plan){
   if(!plan) return false;
+  assertCanonicalLaunchers(plan.stateRoot,plan);
   const touched=plan.installed===true || (existsSync(plan.ps1)&&sha256Bytes(await readFile(plan.ps1))===plan.launcher_sha256);
   if(!touched) return false;
-  await restoreFile(plan.ps1,plan.snapshots.ps1); await restoreFile(plan.cmd,plan.snapshots.cmd); await restoreFile(plan.top,plan.snapshots.top);
+  await restoreFile(plan.ps1,plan.snapshots.ps1);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
+  await restoreFile(plan.cmd,plan.snapshots.cmd);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
+  await restoreFile(plan.top,plan.snapshots.top);
   plan.installed=false; return true;
 }
 async function revokeAuthority(ctx,prior){
@@ -1205,9 +1389,10 @@ export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,
   if(!samePublicPointer(handoffPrior,priorPointer)||!samePublicPointer(handoffActive,activePointer)) throw new Error('rollback handoff pointer binding mismatch');
   const state=path.resolve(stateRoot);
   const launchers={
+    stateRoot:state,
     ps1:path.resolve(String(body.launchers?.ps1??'')),
     cmd:path.resolve(String(body.launchers?.cmd??'')),
-    top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    top:path.resolve(String(body.launchers?.top??'')),
     launcher_sha256:String(body.launchers?.launcher_sha256??''),
     ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),
     cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
@@ -1218,17 +1403,18 @@ export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,
     },
     installed:true
   };
-  if(launchers.ps1!==path.resolve(launcherPath(state))||
-     launchers.cmd!==path.resolve(path.join(state,'bin','DEADBYTE-MCP.cmd'))||
-     launchers.top!==path.resolve(TOP_LAUNCHER)) throw new Error('rollback launcher paths are not canonical');
+  assertCanonicalLaunchers(state,launchers);
   if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('rollback successor launcher bytes/hash mismatch');
   if(launchers.launcher_sha256!==activePointer.launcher_sha256) throw new Error('rollback successor launcher hash does not match active pointer');
   if(!launchers.snapshots.ps1.exists||launchers.snapshots.ps1.sha256!==priorPointer.launcher_sha256) throw new Error('rollback predecessor launcher snapshot does not match signed prior pointer');
   return launchers;
 }
 async function restoreRollbackLaunchers(plan){
+  assertCanonicalLaunchers(plan.stateRoot,plan);
   await restoreFile(plan.ps1,plan.snapshots.ps1);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
   await restoreFile(plan.cmd,plan.snapshots.cmd);
+  assertCanonicalLaunchers(plan.stateRoot,plan);
   await restoreFile(plan.top,plan.snapshots.top);
   if(await sha256File(plan.ps1)!==plan.snapshots.ps1.sha256) throw new Error('rollback predecessor launcher restore hash mismatch');
   return plan;
@@ -1442,6 +1628,7 @@ async function resumeSlotUpdate({handoffPath}){
       ...verifiedReceipt,historical_receipt_verified:true,current_runtime_verified:false};
   }
   if(phase.startsWith('failed')) throw new Error('slot update already failed at phase='+phase);
+  assertCanonicalLaunchers(stateRoot,body.launchers);
   const priorPointer=handoffPriorPointer(body),candidatePointer=handoffNewPointer(body);
   const statePrior=statePointer(releaseState,'prior_pointer'),stateCandidate=statePointer(releaseState,'new_pointer');
   if(!samePublicPointer(priorPointer,statePrior)||!samePublicPointer(candidatePointer,stateCandidate)) throw new Error('handoff pointer binding mismatch');
@@ -1459,7 +1646,8 @@ async function resumeSlotUpdate({handoffPath}){
   const oldRuntime=body.old_runtime?{bridge:body.old_runtime.bridge??null,cloud:body.old_runtime.cloud??null,core:body.old_runtime.core??null}:null;
   if(oldRuntime?.core&&(!Number.isInteger(Number(oldRuntime.core.pid))||String(oldRuntime.core.creation_date??'').length<1)) throw new Error('handoff old runtime core identity invalid');
   const launchers={
-    ps1:path.resolve(String(body.launchers?.ps1??'')),cmd:path.resolve(String(body.launchers?.cmd??'')),top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    stateRoot,
+    ps1:path.resolve(String(body.launchers?.ps1??'')),cmd:path.resolve(String(body.launchers?.cmd??'')),top:path.resolve(String(body.launchers?.top??'')),
     launcher_sha256:String(body.launchers?.launcher_sha256??''),
     ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
     snapshots:{
@@ -1467,6 +1655,7 @@ async function resumeSlotUpdate({handoffPath}){
     },
     installed:phaseRank(phase)>=phaseRank('launcher_installed')
   };
+  assertCanonicalLaunchers(stateRoot,launchers);
   if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('handoff launcher bytes/hash mismatch');
   const workspace={
     source:path.resolve(String(body.workspace?.source??releaseState.workspace?.source??'')),
@@ -1657,13 +1846,15 @@ export async function recoverInterruptedSlotUpdates({stateRoot=DEFAULT_STATE_ROO
   return {ok:true,launched,updates};
 }
 
-export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableDesktop=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
+export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,autonomousPolicyBootstrap=null,ownerApprovalBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableDesktop=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
   // R64 grants have no signed revocation epoch. The historical boolean restore
   // cannot prove continuity, and must never materialize a successor grant.
   if(restoreStandingGrants)throw new Error('R65 standing grant auto-restore disabled: explicit reauthorization required');
+  if(Boolean(autonomousPolicyBootstrap)!==Boolean(ownerApprovalBootstrap)) throw new Error('autonomous policy bootstrap requires pinned owner approval');
   stateRoot=resolveStateRoot(stateRoot);
   if(process.platform!=='win32') throw new Error('R27 slot update is Windows-only');
   const state=path.resolve(stateRoot),stageRoot=path.resolve(stage),development=assertDevelopmentRootSafe(developmentRoot,state);
+  assertStagingBootstrapInputs({stateRoot:state,sourceRoot,bridgeBootstrap,cloudTransport,processPolicyBootstrap,hostPolicyBootstrap,codingPolicyBootstrap,autonomousPolicyBootstrap,ownerApprovalBootstrap,desktopPolicyBootstrap,semanticLspBootstrap});
   const key=await loadUpdateKey(state),updateId='r27-'+expectedManifest.slice(0,16)+'-'+Date.now().toString(36)+'-'+randomBytes(4).toString('hex');
   const evidenceDir=path.join(state,'evidence','updates',updateId),statePath=path.join(evidenceDir,'state.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
   await mkdir(evidenceDir,{recursive:true});
@@ -1679,13 +1870,27 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     const stageVerified=await verifyPackageRoot(stageRoot,expectedVersion,expectedManifest,'stage');
     const developmentVerified=await verifyPackageRoot(development,expectedVersion,expectedManifest,'development');
     control=await loadControlInputs({stateRoot:state,sourceRoot,pointerInfo,bridgeBootstrap});
+    const codingBootstrap=await prepareCodingPolicyBootstrap(codingPolicyBootstrap);
+    const autonomousBootstrap=await prepareAutonomousPolicyBootstrap(autonomousPolicyBootstrap);
+    let ownerApprovalProof=null;
+    if(autonomousBootstrap){
+      if(hostCommandPins.length>0) throw new Error('autonomous bootstrap cannot combine with command repinning');
+      const selectedCoding=codingBootstrap?.policy??control.codingPolicy;
+      const selectedCodingSha256=codingBootstrap?.sha256??await sha256File(control.config.CodingPolicyFile);
+      ownerApprovalProof=await verifyAutonomousOwnerBootstrap({
+        stateRoot:state,bootstrap:ownerApprovalBootstrap,autonomousPolicy:autonomousBootstrap.policy,
+        codingPolicy:selectedCoding,codingPolicySha256:selectedCodingSha256,
+        autonomousPolicySha256:autonomousBootstrap.sha256,expectedManifest
+      });
+    }
     // Read-only predecessor authority and process identity must be safe before
     // materializing a slot or changing any stable runtime file.
     await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});
     mutationBegan=true;
     const slot=await materializeReleaseSlot({source:stageRoot,stateRoot:state,version:expectedVersion,manifestSha256:expectedManifest});
     const hostBootstrap=await prepareHostPolicyBootstrap(hostPolicyBootstrap);if(hostBootstrap) control.hostPolicy=hostBootstrap.policy;
-    const codingBootstrap=await prepareCodingPolicyBootstrap(codingPolicyBootstrap);if(codingBootstrap) control.codingPolicy=codingBootstrap.policy;
+    if(codingBootstrap) control.codingPolicy=codingBootstrap.policy;
+    if(autonomousBootstrap) control.autonomousPolicy=autonomousBootstrap.policy;
     const processBootstrap=await prepareProcessPolicyBootstrap(processPolicyBootstrap);
     if(processBootstrap){ control.processPolicy=processBootstrap.policy;control.config.ProcessRuntimeEnabled=true; }
     const desktopBootstrap=await prepareDesktopPolicyBootstrap(desktopPolicyBootstrap);if(desktopBootstrap) control.desktopPolicy=desktopBootstrap.policy;
@@ -1730,6 +1935,8 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       stable_mcp_url:stableMcpUrl?{path:stableMcpUrl.path,sha256:stableMcpUrl.sha256,origin:stableMcpUrl.origin,changed:stableMcpUrl.changed}:null,
       bridge:{working_directory:control.config.Bridge.WorkingDirectory,script_path:control.config.Bridge.ScriptPath,script_sha256:control.config.Bridge.ScriptSha256},
       host_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.hostRepinned},coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},
+      owner_approval:ownerApprovalProof?{subject_sha256:ownerApprovalProof.subject_sha256,owner_key_id:ownerApprovalProof.owner_key_id,
+        root_id:ownerApprovalProof.root_id,scope:ownerApprovalProof.scope,expires_at_utc:ownerApprovalProof.expires_at_utc}:null,
       new_pointer:publicPointer(newPointer)});
     predecessor=await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});oldRuntime=predecessor.runtime;priorStatus=predecessor.status;
     await writeState(statePath,journal,'old_runtime_verified',{predecessor_mode:predecessor.mode,old_runtime:generationTuple(oldRuntime),
@@ -1865,7 +2072,8 @@ export async function runSlotUpdateCli(argv=process.argv.slice(2),{stateRoot=DEF
     stage:args.stage,developmentRoot:args.developmentRoot,expectedVersion:args.expectedVersion,expectedManifest:args.expectedManifest,
     sourceRoot:args.sourceRoot,stateRoot,restoreStandingGrants:args.restoreStandingGrants,recoverOfflinePredecessor:args.recoverOfflinePredecessor,
     cloudTransport:args.cloudTransport,bridgeBootstrap:args.bridgeBootstrap,processPolicyBootstrap:args.processPolicyBootstrap,
-    hostPolicyBootstrap:args.hostPolicyBootstrap,codingPolicyBootstrap:args.codingPolicyBootstrap,desktopPolicyBootstrap:args.desktopPolicyBootstrap,
+    hostPolicyBootstrap:args.hostPolicyBootstrap,codingPolicyBootstrap:args.codingPolicyBootstrap,
+    autonomousPolicyBootstrap:args.autonomousPolicyBootstrap,ownerApprovalBootstrap:args.ownerApprovalBootstrap,desktopPolicyBootstrap:args.desktopPolicyBootstrap,
     semanticLspBootstrap:args.semanticLspBootstrap,enableMachineFs:args.enableMachineFs,enableObservation:args.enableObservation,
     enableDesktop:args.enableDesktop,enableAutonomousSupervisor:args.enableAutonomousSupervisor,hostCommandPins:args.hostCommandPins
   });

package/src/staging-input-isolation.mjs

@@ -0,0 +1,79 @@
+import {lstatSync} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const canonical = value => process.platform === 'win32' ? value.toLowerCase() : value;
+function within(parent,child){
+  const relative=path.relative(canonical(parent),canonical(child));
+  return relative===''||(!path.isAbsolute(relative)&&relative!=='..'&&!relative.startsWith('..'+path.sep));
+}
+function productionRoot(){return path.resolve(os.homedir(),'.deadbyte-mcp');}
+function isStage(stateRoot){
+  const state=path.resolve(stateRoot),production=productionRoot();
+  if(state===production||canonical(state)===canonical(production))return false;
+  if(within(production,state)||within(state,production))throw new Error('STAGING_STATE_OVERLAPS_PRODUCTION');
+  return true;
+}
+function noReparseComponents(file,label){
+  let current=file;
+  for(;;){
+    try {if(lstatSync(current).isSymbolicLink())throw new Error('STAGING_REPARSE_INPUT: '+label);}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+    const parent=path.dirname(current);
+    if(parent===current)break;
+    current=parent;
+  }
+}
+/** A stage never reads policy, token, executable or config bytes from a production state. */
+export function assertStageOwnedPath(file,stateRoot,label){
+  if(!isStage(stateRoot))return;
+  if(typeof file!=='string'||!path.isAbsolute(file)||file.includes('\0'))throw new Error('STAGING_ABSOLUTE_PATH_REQUIRED: '+label);
+  const state=path.resolve(stateRoot),target=path.resolve(file);
+  if(!within(state,target)||canonical(state)===canonical(target))throw new Error('STAGING_EXTERNAL_INPUT: '+label);
+  noReparseComponents(target,label);
+}
+export function assertStageNoProductionPath(file,stateRoot,label){
+  if(!isStage(stateRoot))return;
+  if(typeof file!=='string'||!path.isAbsolute(file)||file.includes('\0'))throw new Error('STAGING_ABSOLUTE_PATH_REQUIRED: '+label);
+  const target=path.resolve(file),production=productionRoot();
+  if(within(production,target))throw new Error('STAGING_PRODUCTION_INPUT: '+label);
+  noReparseComponents(target,label);
+}
+export function assertStagingBootstrapInputs({stateRoot,sourceRoot=null,bridgeBootstrap=null,cloudTransport=null,
+  processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,autonomousPolicyBootstrap=null,
+  ownerApprovalBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null}={}){
+  if(!isStage(stateRoot))return;
+  noReparseComponents(path.resolve(stateRoot),'state root');
+  if(sourceRoot!==null)assertStageOwnedPath(sourceRoot,stateRoot,'legacy source root');
+  if(bridgeBootstrap)assertStageOwnedPath(bridgeBootstrap.root,stateRoot,'bridge bootstrap root');
+  for(const [label,item] of Object.entries({processPolicyBootstrap,hostPolicyBootstrap,codingPolicyBootstrap,
+    autonomousPolicyBootstrap,ownerApprovalBootstrap,desktopPolicyBootstrap,semanticLspBootstrap})){
+    if(item)assertStageOwnedPath(item.path,stateRoot,label);
+  }
+  if(cloudTransport){
+    assertStageOwnedPath(cloudTransport.tokenFile?.path,stateRoot,'named tunnel token file');
+    assertStageOwnedPath(cloudTransport.childWorkingDirectory,stateRoot,'named tunnel child directory');
+    assertStageNoProductionPath(cloudTransport.cloudflared?.path,stateRoot,'named tunnel executable');
+  }
+}
+export function assertStagingControlConfig(config,stateRoot,{configPath}={}){
+  if(!isStage(stateRoot))return;
+  assertStageOwnedPath(configPath,stateRoot,'controller config file');
+  const owned=['CoreRoot','WorkspaceRoot','CodingPolicyFile','AutonomousPolicyFile','HostPolicyFile',
+    'ProcessPolicyFile','DesktopPolicyFile','SemanticLspConfigFile','McpPathFile','McpUrlFile'];
+  for(const key of owned)if(config[key]!==undefined&&config[key]!==null&&config[key]!=='')
+    assertStageOwnedPath(config[key],stateRoot,key);
+  if(!config.CodingPolicyFile||!config.AutonomousPolicyFile)throw new Error('STAGING_REQUIRED_POLICIES_MISSING');
+  for(const [name,component] of [['Bridge',config.Bridge],['Cloud',config.Cloud]]){
+    if(!component||typeof component!=='object')throw new Error('STAGING_COMPONENT_MISSING: '+name);
+    // A hash-pinned executable (e.g. system Node) may be shared. Its script,
+    // cwd, policy inputs and secrets may not be shared with production.
+    if(component.FilePath)assertStageNoProductionPath(component.FilePath,stateRoot,name+'.FilePath');
+    for(const key of ['WorkingDirectory','ScriptPath'])if(component[key])
+      assertStageOwnedPath(component[key],stateRoot,name+'.'+key);
+    if(Array.isArray(component.Dependencies))for(const dep of component.Dependencies){
+      if(dep?.Name==='cloudflared'&&name==='Cloud')assertStageNoProductionPath(dep.Path,stateRoot,'Cloud.cloudflared');
+      else assertStageOwnedPath(dep?.Path,stateRoot,name+'.dependency.'+String(dep?.Name??''));
+    }
+  }
+}

package/src/tool-audit.mjs

@@ -116,11 +116,13 @@ function summarizeOutcome(result,error,durationMs){
   const structured=result?.structuredContent;
   const status=typeof structured?.status==='string'?structured.status:(result?.isError===true?'error':'ok');
   const isError=result?.isError===true;
+  const unknownSideEffect=structured?.side_effect_state==='unknown'||structured?.result?.side_effect_state==='unknown';
   const capability=structured?.result;
   const snapshot=capability?.schema==='deadbyte.capability-manifest.v3'&&HEX64.test(String(capability.snapshot_id??''))&&
     Number.isInteger(capability.state_epoch)&&capability.state_epoch>0
     ?{snapshot_id:capability.snapshot_id,state_epoch:capability.state_epoch}:{};
   return {status:String(status).slice(0,128),is_error:isError,duration_ms:duration,receipt_sha256s:outcomeReceiptHashes(result),
+    ...(unknownSideEffect?{side_effect_state:'unknown'}:{}),
     ...snapshot,
     ...(isError?{reason:resultOutcomeReason(result)}:{})};
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.44';
+export const DEADBYTE_VERSION = '0.15.46';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/autonomous-local-supervisor.test.mjs

@@ -53,7 +53,8 @@ async function createProviderHostFixture(){
     planner:{backend:'openai_compatible',endpoint:`http://127.0.0.1:${planner.address().port}/v1/chat/completions`,model:'r34-host-test',max_tokens:2048,timeout_ms:30000,max_response_bytes:262144},
     limits:{max_iterations:8,max_mutations:8,max_wall_ms:null,max_context_bytes:262144,max_diff_bytes:262144,max_files_per_diff:4},profiles:{}}));
   const autonomousPolicy=await loadAutonomousPolicy(autonomousPath,codingPolicy);
-  await writeBoundStandingGrant('autonomous', autonomousPolicy.lease_file, {schema:'deadbyte.autonomous-grant.v2',policy_sha256:autonomousPolicy.policy_sha256,
+  await writeBoundStandingGrant('autonomous', autonomousPolicy.lease_file, {schema:'deadbyte.autonomous-grant.v2',policy_sha256:autonomousPolicy.policy_sha256,
+    coding_policy_sha256:codingPolicy.policy_sha256,
     instance_nonce:nonce(),root_ids:['project'],granted_at_utc:new Date().toISOString()});
   const codingRuntime=createCodingRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const nativeDiffRuntime=createNativeDiffRuntime({policy:autonomousPolicy,codingRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});

package/test/autonomous-output-contract.test.mjs

@@ -2,10 +2,26 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
   autonomousGoalApproveOutputSchema, autonomousGoalRunOutputSchema, autonomousGoalStatusOutputSchema,
-  autonomousGoalVerifyOutputSchema,
+  autonomousGoalVerifyOutputSchema, nativeDiffPreviewOutputSchema,
   autonomousStructuredResult
 } from '../src/autonomous-output-contracts.mjs';
 
+test('R71 preview-only MCP output cannot masquerade as a signed ready-to-apply diff',()=>{
+  const base={root_id:'preview',operation_count:1,payload_bytes:0,paths:['a.txt'],
+    operations:[{kind:'delete',path:'a.txt',expected_sha256:'a'.repeat(64)}]};
+  const unsigned=autonomousStructuredResult(nativeDiffPreviewOutputSchema,{
+    status:'preview_only',schema:'deadbyte.native-diff.v1',...base
+  });
+  assert.equal(unsigned.structuredContent.status,'preview_only');
+  assert.equal(unsigned.structuredContent.diff_id,undefined);
+  assert.throws(()=>autonomousStructuredResult(nativeDiffPreviewOutputSchema,{
+    status:'preview_only',diff_id:'b'.repeat(64),...base
+  }),/autonomous output contract violation/);
+  assert.throws(()=>autonomousStructuredResult(nativeDiffPreviewOutputSchema,{
+    status:'ready',...base
+  }),/autonomous output contract violation/);
+});
+
 test('autonomous_goal_verify structured contract preserves delegated action evidence count', () => {
   const value = {
     ok:true,

package/test/autonomous-supervisor-integration.test.mjs

@@ -73,7 +73,8 @@ async function startPlanner() {
   }));
   const autonomousSha = sha(await readFile(autonomousPath));
   await writeBoundStandingGrant('autonomous', path.join(root, 'runtime', 'autonomous-grant.json'), {
-    schema:'deadbyte.autonomous-grant.v2', policy_sha256:autonomousSha,
+    schema:'deadbyte.autonomous-grant.v2', policy_sha256:autonomousSha,
+    coding_policy_sha256:codingSha,
     instance_nonce:nonce(), root_ids:['project'], granted_at_utc:new Date().toISOString()
   });
   const client = new Client({ name:'deadbyte-supervisor-integration', version:'0.8.0' },