deadbyte-mcp 0.15.45 → 0.15.47

package/src/kernel-lock-r74.mjs

@@ -0,0 +1,125 @@
+import {spawn} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {lstat, readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {performance} from 'node:perf_hooks';
+import {fileURLToPath} from 'node:url';
+
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const exePath = path.join(root, 'bin', 'deadbyte-kernel-lock-r74.exe');
+const metaPath = path.join(root, 'docs', 'R74-KERNEL-LOCK-BINARY.json');
+
+const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+export async function verifyKernelLockBinary() {
+  if (process.platform !== 'win32') {
+    return { ok: false, reason: 'unsupported platform; win32 required' };
+  }
+  try {
+    const meta = JSON.parse(await readFile(metaPath, 'utf8'));
+    if (meta?.schema !== 'deadbyte.r74-kernel-lock-binary.v1' ||
+        meta?.exe !== 'bin/deadbyte-kernel-lock-r74.exe' ||
+        !/^[0-9a-f]{64}$/.test(String(meta?.sha256 ?? ''))) {
+      return { ok: false, reason: 'R74 kernel lock metadata invalid' };
+    }
+    const info = await lstat(exePath);
+    if (!info.isFile() || info.isSymbolicLink()) {
+      return { ok: false, reason: 'R74 kernel lock executable is not a regular file' };
+    }
+    const bytes = await readFile(exePath);
+    const hash = sha256Bytes(bytes);
+    if (hash !== meta.sha256) {
+      return { ok: false, reason: 'R74 kernel lock executable hash pin mismatch' };
+    }
+    return { ok: true, path: exePath, sha256: hash };
+  } catch (err) {
+    return { ok: false, reason: err?.message ?? String(err) };
+  }
+}
+
+export async function acquireKernelExclusiveLock(lockPath, { timeoutMs = 30000, pollMs = 20 } = {}) {
+  const verified = await verifyKernelLockBinary();
+  if (!verified.ok) {
+    throw new Error(`atomic mutation lock recovery blocked: native exclusive locking unavailable (${verified.reason})`);
+  }
+
+  const started = performance.now();
+  while (true) {
+    let child = null;
+    try {
+      const outcome = await new Promise((resolve, reject) => {
+        child = spawn(verified.path, ['acquire', path.resolve(lockPath)], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          windowsHide: true,
+          shell: false
+        });
+        let line = '';
+        let resolved = false;
+
+        child.stdout.on('data', chunk => {
+          if (resolved) return;
+          line += chunk.toString('utf8');
+          const newline = line.indexOf('\n');
+          if (newline !== -1) {
+            resolved = true;
+            try {
+              const parsed = JSON.parse(line.slice(0, newline).trim());
+              resolve(parsed);
+            } catch (parseError) {
+              reject(parseError);
+            }
+          }
+        });
+
+        child.once('error', err => {
+          if (!resolved) {
+            resolved = true;
+            reject(err);
+          }
+        });
+
+        child.once('close', code => {
+          if (!resolved) {
+            resolved = true;
+            resolve({ status: 'exited', code });
+          }
+        });
+      });
+
+      if (outcome.status === 'acquired') {
+        const lockChild = child;
+        const release = async () => {
+          if (lockChild.exitCode !== null) {
+            throw new Error('atomic mutation lock ownership lost: lock process exited unexpectedly');
+          }
+          try {
+            lockChild.stdin.write('q\n');
+            lockChild.stdin.end();
+          } catch {}
+          await new Promise(resolve => {
+            if (lockChild.exitCode !== null) return resolve();
+            lockChild.once('close', resolve);
+          });
+        };
+        release.pid = outcome.pid;
+        return release;
+      }
+
+      if (outcome.status === 'locked') {
+        if (performance.now() - started >= timeoutMs) {
+          throw new Error('atomic mutation lock timed out');
+        }
+        await sleep(pollMs);
+        continue;
+      }
+
+      throw new Error(`atomic mutation lock acquisition failed: ${JSON.stringify(outcome)}`);
+    } catch (err) {
+      if (child && child.exitCode === null) {
+        child.kill('SIGKILL');
+      }
+      throw err;
+    }
+  }
+}

package/src/launcher-isolation.mjs

@@ -0,0 +1,58 @@
+/** R72: state-root-owned launcher routing. No staging caller may write the user-wide Downloads launcher. */
+import {lstatSync} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const normalize=file=>process.platform==='win32'?path.resolve(file).toLowerCase():path.resolve(file);
+function contains(parent,child){
+  const rel=path.relative(parent,child);
+  return rel===''||(!path.isAbsolute(rel)&&rel!=='..'&&!rel.startsWith(`..${path.sep}`));
+}
+function assertNoReparseParts(file){
+  let cursor=path.resolve(file);
+  while(true){
+    try{
+      const info=lstatSync(cursor);
+      if(info.isSymbolicLink())throw new Error(`staging launcher boundary is a reparse/symlink: ${cursor}`);
+    }catch(error){if(error?.code!=='ENOENT')throw error;}
+    const parent=path.dirname(cursor);
+    if(parent===cursor)break;
+    cursor=parent;
+  }
+}
+export function canonicalLauncherPaths(stateRoot,{home=os.homedir()}={}){
+  if(typeof stateRoot!=='string'||!path.isAbsolute(stateRoot)||stateRoot.includes('\0'))throw new Error('launcher state root must be absolute');
+  const state=path.resolve(stateRoot),productionState=path.resolve(home,'.deadbyte-mcp');
+  const production=normalize(state)===normalize(productionState);
+  if(!production){
+    if(contains(normalize(productionState),normalize(state))||contains(normalize(state),normalize(productionState)))
+      throw new Error('staging state overlaps production state root');
+    assertNoReparseParts(state);
+    assertNoReparseParts(path.join(state,'bin'));
+    assertNoReparseParts(path.join(state,'launchers'));
+  }
+  const top=production?path.join(home,'Downloads','DEADBYTE-MCP.cmd'):path.join(state,'launchers','DEADBYTE-MCP.cmd');
+  if(!production)assertNoReparseParts(top);
+  return Object.freeze({state,production,top,ps1:path.join(state,'bin','DEADBYTE-MCP.ps1'),cmd:path.join(state,'bin','DEADBYTE-MCP.cmd')});
+}
+export function assertCanonicalLaunchers(stateRoot,launchers){
+  const expected=canonicalLauncherPaths(stateRoot);
+  if(!launchers||typeof launchers!=='object')throw new Error('launcher paths absent');
+  for(const field of ['top','ps1','cmd']){
+    if(typeof launchers[field]!=='string'||!path.isAbsolute(launchers[field])||
+       normalize(launchers[field])!==normalize(expected[field]))
+      throw new Error(`launcher ${field} is not canonical for selected state root`);
+  }
+  return expected;
+}
+/** Relative to bin/ or launchers/, so the entry point always selects its own state root. */
+export function renderStateBoundLauncherCmd(){
+  return [
+    '@echo off',
+    'setlocal EnableExtensions DisableDelayedExpansion',
+    'set "DEADBYTE_STATE_ROOT=%~dp0.."',
+    'powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%DEADBYTE_STATE_ROOT%\\bin\\DEADBYTE-MCP.ps1" %*',
+    'exit /b %ERRORLEVEL%',
+    ''
+  ].join('\r\n');
+}

package/src/remote-authority.mjs

@@ -1,75 +1,75 @@
-import path from 'node:path';
-
-export const AUTHORITY_PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
-
-export function authorityVector(mode='default'){
-  if(!['default','desktop','host','full'].includes(mode)) throw new Error('remote authority mode invalid');
-  return Object.freeze({
-    process:true,coding:true,autonomous:true,
-    desktop:mode==='desktop'||mode==='full',
-    host:mode==='host'||mode==='full'
-  });
-}
-
-export function authorityRestorePlan(snapshot){
-  const disarm=[],arm=[];
-  for(const plane of AUTHORITY_PLANES){
-    const entry=snapshot?.authority?.[plane];
-    if(!entry||typeof entry.armed!=='boolean') throw new Error(`authority ${plane} observation invalid`);
-    (entry.armed?arm:disarm).push(`${entry.armed?'arm':'disarm'}${plane}`);
-  }
-  return Object.freeze([...disarm,...arm]);
-}
-
-export function parseAuthorityObservation(raw){
-  let value;
-  try{value=typeof raw==='string'?JSON.parse(raw.replace(/^\uFEFF/,'')):raw;}
-  catch{throw new Error('controller observation JSON invalid');}
-  if(value?.schema!=='deadbyte.controller-observation.v1'||!value.authority||typeof value.authority!=='object'||Array.isArray(value.authority))
-    throw new Error('controller observation schema invalid');
-  const authority={};
-  for(const plane of AUTHORITY_PLANES){
-    const entry=value.authority[plane];
-    if(!entry||typeof entry!=='object'||typeof entry.armed!=='boolean'||typeof entry.configured!=='boolean'||typeof entry.reason!=='string')
-      throw new Error(`controller authority ${plane} observation invalid`);
-    const hasEpochSeq=Object.hasOwn(entry,'epoch_seq'),hasEpochSha=Object.hasOwn(entry,'epoch_sha256');
-    if(hasEpochSeq!==hasEpochSha)throw new Error(`controller authority ${plane} epoch observation incomplete`);
-    let epochSeq=null,epochSha256=null;
-    if(hasEpochSeq){
-      if(!Number.isSafeInteger(entry.epoch_seq)||entry.epoch_seq<1||typeof entry.epoch_sha256!=='string'||!/^[0-9a-f]{64}$/.test(entry.epoch_sha256))
-        throw new Error(`controller authority ${plane} epoch observation invalid`);
-      epochSeq=entry.epoch_seq;epochSha256=entry.epoch_sha256;
-    }
-    authority[plane]=Object.freeze({configured:entry.configured,armed:entry.armed,reason:entry.reason.slice(0,128),
-      epoch_seq:epochSeq,epoch_sha256:epochSha256});
-  }
-  return Object.freeze({...value,authority:Object.freeze(authority)});
-}
-
-export function assertAuthorityVector(snapshot,expected){
-  for(const plane of AUTHORITY_PLANES){
-    const entry=snapshot?.authority?.[plane];
-    if(!entry||typeof expected?.[plane]!=='boolean') throw new Error(`authority ${plane} observation or expectation invalid`);
-    if(entry.armed!==expected[plane]) throw new Error(`${plane} authority expected ${expected[plane]?'ARMED':'DISARMED'}; observed ${entry.armed?'ARMED':'DISARMED'} (${entry.reason})`);
-    if(expected[plane]&&!entry.configured) throw new Error(`${plane} authority unconfigured`);
-  }
-  return snapshot;
-}
-
-export function authorityBanner(snapshot){
-  return AUTHORITY_PLANES.map(plane=>`${plane} ${snapshot.authority[plane].armed?'ARMED':'DISARMED'}`).join(' | ');
-}
-
-export function assertRuntimeReadyObservation(snapshot,{coreRoot=null}={}){
-  if(snapshot?.state!=='ONLINE') throw new Error(`runtime state not ONLINE: ${String(snapshot?.state)}`);
-  for(const name of ['bridge','core','cloud']){
-    if(snapshot[name]?.alive!==true||snapshot[name]?.reason!=='verified') throw new Error(`${name} runtime identity unverified`);
-  }
-  if(snapshot.local_ready!==true) throw new Error('local MCP readiness unverified');
-  if(snapshot.supervisor?.running!==true) throw new Error('autonomous supervisor not running');
-  if(coreRoot!==null){
-    if(typeof snapshot.core_root!=='string'||path.win32.resolve(snapshot.core_root).toLowerCase()!==path.win32.resolve(coreRoot).toLowerCase())
-      throw new Error('core root does not match active release');
-  }
-  return snapshot;
-}
+import path from 'node:path';
+
+export const AUTHORITY_PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+
+export function authorityVector(mode='default'){
+  if(!['default','operator','desktop','host','full'].includes(mode)) throw new Error('remote authority mode invalid');
+  return Object.freeze({
+    process:mode!=='default',coding:mode!=='default',autonomous:mode!=='default',
+    desktop:mode==='desktop'||mode==='full',
+    host:mode==='host'||mode==='full'
+  });
+}
+
+export function authorityRestorePlan(snapshot){
+  const disarm=[],arm=[];
+  for(const plane of AUTHORITY_PLANES){
+    const entry=snapshot?.authority?.[plane];
+    if(!entry||typeof entry.armed!=='boolean') throw new Error(`authority ${plane} observation invalid`);
+    (entry.armed?arm:disarm).push(`${entry.armed?'arm':'disarm'}${plane}`);
+  }
+  return Object.freeze([...disarm,...arm]);
+}
+
+export function parseAuthorityObservation(raw){
+  let value;
+  try{value=typeof raw==='string'?JSON.parse(raw.replace(/^\uFEFF/,'')):raw;}
+  catch{throw new Error('controller observation JSON invalid');}
+  if(value?.schema!=='deadbyte.controller-observation.v1'||!value.authority||typeof value.authority!=='object'||Array.isArray(value.authority))
+    throw new Error('controller observation schema invalid');
+  const authority={};
+  for(const plane of AUTHORITY_PLANES){
+    const entry=value.authority[plane];
+    if(!entry||typeof entry!=='object'||typeof entry.armed!=='boolean'||typeof entry.configured!=='boolean'||typeof entry.reason!=='string')
+      throw new Error(`controller authority ${plane} observation invalid`);
+    const hasEpochSeq=Object.hasOwn(entry,'epoch_seq'),hasEpochSha=Object.hasOwn(entry,'epoch_sha256');
+    if(hasEpochSeq!==hasEpochSha)throw new Error(`controller authority ${plane} epoch observation incomplete`);
+    let epochSeq=null,epochSha256=null;
+    if(hasEpochSeq){
+      if(!Number.isSafeInteger(entry.epoch_seq)||entry.epoch_seq<1||typeof entry.epoch_sha256!=='string'||!/^[0-9a-f]{64}$/.test(entry.epoch_sha256))
+        throw new Error(`controller authority ${plane} epoch observation invalid`);
+      epochSeq=entry.epoch_seq;epochSha256=entry.epoch_sha256;
+    }
+    authority[plane]=Object.freeze({configured:entry.configured,armed:entry.armed,reason:entry.reason.slice(0,128),
+      epoch_seq:epochSeq,epoch_sha256:epochSha256});
+  }
+  return Object.freeze({...value,authority:Object.freeze(authority)});
+}
+
+export function assertAuthorityVector(snapshot,expected){
+  for(const plane of AUTHORITY_PLANES){
+    const entry=snapshot?.authority?.[plane];
+    if(!entry||typeof expected?.[plane]!=='boolean') throw new Error(`authority ${plane} observation or expectation invalid`);
+    if(entry.armed!==expected[plane]) throw new Error(`${plane} authority expected ${expected[plane]?'ARMED':'DISARMED'}; observed ${entry.armed?'ARMED':'DISARMED'} (${entry.reason})`);
+    if(expected[plane]&&!entry.configured) throw new Error(`${plane} authority unconfigured`);
+  }
+  return snapshot;
+}
+
+export function authorityBanner(snapshot){
+  return AUTHORITY_PLANES.map(plane=>`${plane} ${snapshot.authority[plane].armed?'ARMED':'DISARMED'}`).join(' | ');
+}
+
+export function assertRuntimeReadyObservation(snapshot,{coreRoot=null}={}){
+  if(snapshot?.state!=='ONLINE') throw new Error(`runtime state not ONLINE: ${String(snapshot?.state)}`);
+  for(const name of ['bridge','core','cloud']){
+    if(snapshot[name]?.alive!==true||snapshot[name]?.reason!=='verified') throw new Error(`${name} runtime identity unverified`);
+  }
+  if(snapshot.local_ready!==true) throw new Error('local MCP readiness unverified');
+  if(snapshot.supervisor?.running!==true) throw new Error('autonomous supervisor not running');
+  if(coreRoot!==null){
+    if(typeof snapshot.core_root!=='string'||path.win32.resolve(snapshot.core_root).toLowerCase()!==path.win32.resolve(coreRoot).toLowerCase())
+      throw new Error('core root does not match active release');
+  }
+  return snapshot;
+}

package/src/remote-mcp-machine-smoke-client.mjs

@@ -1,84 +1,84 @@
-import { randomBytes } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
-import { verifyMachinePingPublic } from './machine-identity.mjs';
-import { parseActivePointer } from './release-slot.mjs';
-import { probeRemoteEnforcement } from './remote-enforcement-probe-r60.mjs';
-
-const endpointText = process.argv[2];
-if (!endpointText) throw new Error('usage: node src/remote-mcp-machine-smoke-client.mjs https://host/mcp/path');
-const endpoint = new URL(endpointText);
-if (endpoint.protocol !== 'https:') throw new Error('machine live gate requires HTTPS');
-const enforcementMode=process.argv[3]??null;
-if(enforcementMode!==null&&!['default','desktop','host','full','revoked'].includes(enforcementMode))throw new Error('remote enforcement probe mode invalid');
-
-const machineTools = ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status'];
-const client = new Client(
-  { name: 'deadbyte-r29-machine-gate', version: '0.8.5' },
-  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
-);
-const transport = new StreamableHTTPClientTransport(endpoint);
-
-function structured(result, label) {
-  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
-  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
-  return result.structuredContent;
-}
-
-try {
-  await client.connect(transport);
-  const listed = await client.listTools();
-  const names = listed.tools.map(tool => tool.name).sort();
-  for (const name of machineTools) if (!names.includes(name)) throw new Error(`machine tool missing: ${name}`);
-  for (const tool of listed.tools.filter(tool => machineTools.includes(tool.name))) {
-    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
-      throw new Error(`machine tool ${tool.name} missing strict output schema`);
-    }
-  }
-
-  const status = structured(await client.callTool({ name: 'machine_status', arguments: {} }), 'machine_status');
-  if (status.status !== 'ok') throw new Error(`machine_status status=${String(status.status)}`);
-  const machines = structured(await client.callTool({ name: 'machine_list', arguments: {} }), 'machine_list');
-  if (machines.status !== 'ok' || !Array.isArray(machines.machines)) throw new Error('machine_list invalid');
-  const self = machines.machines.find(item => item.machine_id === status.machine_id);
-  if (!self) throw new Error('machine_list does not contain current machine');
-  for (const field of ['public_key_spki_base64','identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
-    if (self[field] !== status[field]) throw new Error(`machine_list/status mismatch: ${field}`);
-  }
-
-  const nonce = randomBytes(32).toString('hex');
-  const ping = structured(await client.callTool({ name: 'machine_ping', arguments: { nonce } }), 'machine_ping');
-  if (ping.status !== 'ok' || ping.nonce !== nonce || ping.machine_id !== status.machine_id) throw new Error('machine_ping identity/nonce mismatch');
-  for (const field of ['identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
-    if (ping[field] !== status[field]) throw new Error(`machine_ping/status mismatch: ${field}`);
-  }
-  const signatureVerified = await verifyMachinePingPublic({ ping, publicKeySpkiBase64: status.public_key_spki_base64 });
-  if (!signatureVerified) throw new Error('machine ping public Ed25519 verification failed');
-  if(enforcementMode!==null){
-    const stateRoot=process.env.DEADBYTE_STATE_ROOT;
-    if(!stateRoot||!path.isAbsolute(stateRoot))throw new Error('remote enforcement probe state root missing');
-    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
-    for(const [actual,expected] of [
-      [status.release_id,pointer.release_id],
-      [status.release_manifest_sha256,pointer.manifest_sha256],
-      [status.generation_manifest_sha256,pointer.generation_manifest_sha256]
-    ])if(actual!==expected)throw new Error('signed machine status does not bind active release/generation');
-    await probeRemoteEnforcement({client,mode:enforcementMode});
-  }
-
-  console.log(JSON.stringify({
-    status: 'passed',
-    protocol_revision: client.getNegotiatedProtocolVersion(),
-    tool_count: names.length,
-    machine_id: status.machine_id,
-    identity_generation: status.identity_generation,
-    release_id: status.release_id,
-    release_manifest_sha256: status.release_manifest_sha256,
-    generation_manifest_sha256: status.generation_manifest_sha256,
-    signature_verified: true,
-    ...(enforcementMode?{enforcement_mode:enforcementMode,enforcement_verified:true}:{})
-  }));
-} finally {
-  await client.close().catch(() => {});
-}
+import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { verifyMachinePingPublic } from './machine-identity.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+import { probeRemoteEnforcement } from './remote-enforcement-probe-r60.mjs';
+
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-machine-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('machine live gate requires HTTPS');
+const enforcementMode=process.argv[3]??null;
+if(enforcementMode!==null&&!['default','operator','desktop','host','full','revoked'].includes(enforcementMode))throw new Error('remote enforcement probe mode invalid');
+
+const machineTools = ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status'];
+const client = new Client(
+  { name: 'deadbyte-r29-machine-gate', version: '0.8.5' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StreamableHTTPClientTransport(endpoint);
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+
+try {
+  await client.connect(transport);
+  const listed = await client.listTools();
+  const names = listed.tools.map(tool => tool.name).sort();
+  for (const name of machineTools) if (!names.includes(name)) throw new Error(`machine tool missing: ${name}`);
+  for (const tool of listed.tools.filter(tool => machineTools.includes(tool.name))) {
+    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
+      throw new Error(`machine tool ${tool.name} missing strict output schema`);
+    }
+  }
+
+  const status = structured(await client.callTool({ name: 'machine_status', arguments: {} }), 'machine_status');
+  if (status.status !== 'ok') throw new Error(`machine_status status=${String(status.status)}`);
+  const machines = structured(await client.callTool({ name: 'machine_list', arguments: {} }), 'machine_list');
+  if (machines.status !== 'ok' || !Array.isArray(machines.machines)) throw new Error('machine_list invalid');
+  const self = machines.machines.find(item => item.machine_id === status.machine_id);
+  if (!self) throw new Error('machine_list does not contain current machine');
+  for (const field of ['public_key_spki_base64','identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
+    if (self[field] !== status[field]) throw new Error(`machine_list/status mismatch: ${field}`);
+  }
+
+  const nonce = randomBytes(32).toString('hex');
+  const ping = structured(await client.callTool({ name: 'machine_ping', arguments: { nonce } }), 'machine_ping');
+  if (ping.status !== 'ok' || ping.nonce !== nonce || ping.machine_id !== status.machine_id) throw new Error('machine_ping identity/nonce mismatch');
+  for (const field of ['identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
+    if (ping[field] !== status[field]) throw new Error(`machine_ping/status mismatch: ${field}`);
+  }
+  const signatureVerified = await verifyMachinePingPublic({ ping, publicKeySpkiBase64: status.public_key_spki_base64 });
+  if (!signatureVerified) throw new Error('machine ping public Ed25519 verification failed');
+  if(enforcementMode!==null){
+    const stateRoot=process.env.DEADBYTE_STATE_ROOT;
+    if(!stateRoot||!path.isAbsolute(stateRoot))throw new Error('remote enforcement probe state root missing');
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    for(const [actual,expected] of [
+      [status.release_id,pointer.release_id],
+      [status.release_manifest_sha256,pointer.manifest_sha256],
+      [status.generation_manifest_sha256,pointer.generation_manifest_sha256]
+    ])if(actual!==expected)throw new Error('signed machine status does not bind active release/generation');
+    await probeRemoteEnforcement({client,mode:enforcementMode});
+  }
+
+  console.log(JSON.stringify({
+    status: 'passed',
+    protocol_revision: client.getNegotiatedProtocolVersion(),
+    tool_count: names.length,
+    machine_id: status.machine_id,
+    identity_generation: status.identity_generation,
+    release_id: status.release_id,
+    release_manifest_sha256: status.release_manifest_sha256,
+    generation_manifest_sha256: status.generation_manifest_sha256,
+    signature_verified: true,
+    ...(enforcementMode?{enforcement_mode:enforcementMode,enforcement_verified:true}:{})
+  }));
+} finally {
+  await client.close().catch(() => {});
+}