deadbyte-mcp 0.15.5 → 0.15.7

package/MANIFEST.SHA256

@@ -52,11 +52,11 @@ e74d45bd9facf03c9a2a0ff52600252924deb804a87e4b5503f48662a2b45a3b  conpty-input-o
 0ed1dfaa324eccadd4f6a07385df73feac8bdfef83a4b3ab3f31139885649841  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
+70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP-local.cmd
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
 9aaf6d07e7511a1f0046ee8cc731d4b9660bbbf47dcea785a9c6b6cec95640bc  DEADBYTE-MCP-R27-FINAL/R27-SLOT-UPDATE-RECEIPT.json
-70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP.cmd
 7994082e4340b5f43272e8cb111ce54043af64dc3a04d5279e251f3dae16f654  docs/ADR-0001-PRODUCTION-BASELINE-SEAMS.md
 c945b519454c6cb4c89a2b432a3f7ad29a5e7d4bc1db638972104f0093639b18  docs/ARCHITECTURE.md
 3f455f407933d8e044682f3415bdb51e68d7c4b508411dda7d8ed65b6e1d7e79  docs/AUTHORITY.md
@@ -95,6 +95,7 @@ c3d651efa0355e88f6ab4f1978ef581058646b9d82a10ca6641294a191a882fa  docs/V081-R25-
 ed23ebd2512563d45fb200706ec7b887781ed39c4e9836ef0e81af2b81db2b61  docs/V083-R27-IMMUTABLE-RELEASE-SLOTS.md
 c40cba16657dad75b2380876d8eeaa0bc81ad68b1a4bd20876442874e92caab7  docs/V084-R28-PERSISTENT-NAMED-TUNNEL.md
 9ac697e2b85ee2f2bb981274e8efd0ff91b25c316eebd491911c8949435e1443  docs/V085-R29-MACHINE-IDENTITY.md
+18c0403516fda2d7fd135663a5b8b1d3ec29da16229dcb846d742870d6874fad  docs/V085-R47-JEV-DECISION-PLANE.md
 f31bcbc42ef171de27d19369a6012dc31f0d8c50b67add9b2f195235f300619c  harness/r42-agent-evals.json
 b9870c5f3057712b178d65b1627c02874f178d9048e11fc3dca693a2caa073a4  harness/task-contract.schema.json
 3c6e49fda86d80e372403746e4be9c2c3506f1298de5fc4bc3832673dfc92f3b  mcp-server.mjs
@@ -1328,7 +1329,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-b5e2798ff6a37ab05fe61965c3cfb5a0c171c3062f83adf3fc1c378ca9cf08da  package.json
+c2e60730f0406fc7dac480a0fe96f4e9b221d6937a43cc646b74ca0b99200a97  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1400,9 +1401,11 @@ d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.jso
 4c490e8bcc0c2ea977a8f839cde247680bead95f6bbfb90d9a98b4f0e4eb8921  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
+8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
 1d4e9dee6f0669bd825334a6a72e13ee85ee29ab430dcef21d893ffd744774b5  scripts/autonomous-benchmark.mjs
 34f9318b6f4afb29948fdc5ab973edca4dfc4fbd63c9a5105478b5e95812dabf  scripts/autonomous-build.ps1
 075acd7616740135973497d676dcd0431f0437bdba87e4eedba4751cb148ff02  scripts/autonomous-tests.ps1
+70bccc3572de7e26ac91154b9d87185feab0c2dbfc4cbd40f89660e5769f53b0  scripts/build-combined-skill.mjs
 92f23292ce358af88e6c42e126791c57b25d2b0689c538940d8c0745b7447d4e  scripts/build-containment.ps1
 f29c45250e58c5bfbf60089c17317845b6d8e3ef4a4874a37b7ed28538072ca7  scripts/build-desktop-r40.ps1
 b2a3bd0238953842b0d090dd8405b925e21042b77d9f8286aacc8a5f65d5aed3  scripts/build-hardware-r45.ps1
@@ -1426,9 +1429,11 @@ a64b6779eff80d68d90d238dee7f2feda5ada3c5c59bcaeae2ab7812bd28404e  scripts/deferr
 751632aeb2e56b093f9589897bbe7e874db61e9238a13bd1506bde2df0b706e9  scripts/deferred-slot-operation-r45.mjs
 d4710039ceff7380f3b6a0040ad118a81eabdda2706c459f9b81f8e08978fba4  scripts/deferred-slot-operation-r46.mjs
 34116370895aeff9a424475558f4aca3b05460146455d9bb0bafcacd1a270910  scripts/deferred-slot-operation.mjs
+cabea0b3dbfccc2b24f276f8ccba9bffa9b006497eaedc83c7dd04875aa82e4d  scripts/deploy-r47.mjs
 2cc7a37231f8836a48c3bf4024887f38c10bfc89296ac483e4b98b3f18281933  scripts/derive-r45-parent.mjs
 67221c5619019a9d19611432d4361c99c365f14e89483e4c8f78451839960176  scripts/derive-r45-release.mjs
 87c6acc0df96a6e8bb6692bc7b12e8b386196a80cba554d9b214ff8bb12147fe  scripts/derive-r45-tests.mjs
+899de2ec448597d2a7432f4c25a2c2b7002e19a9297af42acc8a90cb6d37a72b  scripts/disarm-host-for-update-r47.mjs
 a66155921f249a960d83ba1c79b2ab255b6e8b148197498a1d184644818a0e77  scripts/extract-r46-failures.mjs
 69e3beb55573b5fc3ba30a220fabf9e3585e7757430fb3264caf27e41254b789  scripts/final-closure-r36.mjs
 4b7dce462db12237e9f3bb8637e703689140c16e5ddd8bf08b41f8a4b35de95d  scripts/final-closure-r37-0110.mjs
@@ -1457,6 +1462,7 @@ c1a16ed8b9e3bde9622d288e7274d7677eec7fa1783cbb090fb8df96db3d6e2a  scripts/final-
 d329183a7bb564879563e6341d232d3b6c99ffc45f27ed0b0f0705004f5475ad  scripts/finalize-r43.mjs
 6b2096cf5a42c333e47c3cbf583ead93965fbe313a58c29c0a929edc0dd211f2  scripts/finalize-r44.mjs
 c1f063bb6918bf7cfacdf4b0c6a5d429ac8978a48b436e10797157992856ab94  scripts/finalize-r45.mjs
+a51799081afabecca7dd576689fe09afef51f9d17fbfd38ffe6f5849f9441442  scripts/find-internet-skill-finder-zip-r47.mjs
 41fa45fe6d75356d1600aa1a8fcc10db776ed9ca0f9db05de3d5e695f7f7d139  scripts/full-regression-r43.mjs
 519c586d7c462b34989c28f41f6e7af868a316ea3cda6ed7ec6b9ec16773b55d  scripts/full-regression-r44.mjs
 26d14418f441672a843e85236583d83c5001b89a9dac2aa1ed94b04c4c0562de  scripts/full-regression-r45.mjs
@@ -1478,8 +1484,13 @@ a0ad824eed1d8be051d5f731579f9bf4115b311f202b75ea0d03aa257b13a671  scripts/gate-w
 1f076a5d55616027d7a272c860118fb437f67a629cf4aa4258f1d4acd56043c7  scripts/init-host-policy.ps1
 1a771b5b8a62d57f26762d53472ed68a3e733674b1c91e08becf0dc2e4325039  scripts/inspect-active-release-r45.mjs
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
+7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
+50b333bf712062e951bcc933ebf1a0c3a761132e4ff736f1fc57a452e9cc50db  scripts/npm-release-r47.mjs
+453dd636b452f4343a36f31a93a763e97f58ed5d6c9df3d2ba05b236934a3a1f  scripts/probe-source-zips.mjs
+8f9d97a4d23e9d05e7cadfb6a519b1ddb9da04894bca98bdc293fc3797e8423c  scripts/probe-zips.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
 68b9a60aca3f3e3e9ec239710f8368594ef3c8a98fff0816d2e9a7950df48287  scripts/r47-core-failures.mjs
+38ff2864fb657f7c7b9970db9db153d8b29be89184ba8b234c47ce02ce3078d0  scripts/read-source-zips.mjs
 bec6b4e8eb554e579db60af6f2acc1714e6a615926c55886b56e62fdc9dd1249  scripts/refresh-process-policy.mjs
 f549bb7642ac7c38d735952f4c97cfe393a6ba1b049d1664f501761090086d76  scripts/release-manifest.mjs
 2272ceab04fba9030fe3dad5ccb14b8313f7dea963873ca64a86945608b6e7fb  scripts/release-parity-r36.mjs
@@ -1503,9 +1514,12 @@ cf22007de7774404b2baaa5741771b4fb19926c78254c3d72d9d39bec25f50f2  scripts/releas
 d42efb6dd8e6abc79c66e768f8c0feb10fa3341bcce0888750461f56612f0fd3  scripts/release-parity-tests-r45.ps1
 4c8ff3df2d3c5bb06984be8887381f29d87c468c6a0c87db7ba623717907e79a  scripts/release-parity-tests.ps1
 1b83f49d9798188533c8cfca0030a98af34560fe181b3e593db790319e1b7bc5  scripts/release-parity.mjs
+21ddee002ddfc1d7c34bf92a4cc02abac38630c4814366216efda66217db6baa  scripts/remove-source-archives-r47.mjs
+817c2f5ce7f2c935a268e16f4a2d8b8611ddf89df8776682082baafb63a84921  scripts/repair-builder-template.mjs
 fb6e47bf46f86887bcbde703b2618ead594ba430a6faf298be6b34432a87e030  scripts/run-r46-full-regression-background.mjs
 46751fc8c4f25329c235e1946c662f33c23c46428d4075a2f7c9543c801c5cfd  scripts/run-r46-windows-gate-background.mjs
 cabfa63d5edb83f32b3e6e5ce22e76223644d81a3361d52a28de2dbc07e59a54  scripts/run-r46-windows-gate-background.ps1
+abf8ac3074e8964c9648b5b60069730c255faa5f4169f3aefc7a9eff350a1efc  scripts/run-skill-creator-scaffold.mjs
 caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtime-self-update.mjs
 b0cc75c38e0163dbcf7fb1b0d21f2dc34c71f2d0e2a156a53e570ff84afc64e6  scripts/semantic-preflight.ps1
 0a115aa9829576c86cc247f754cae69ae09ba146b637d3a1c9fbc16420d20a5d  scripts/tool-surface-snapshot.mjs
@@ -1515,6 +1529,7 @@ e64878a14b5bf1eb22a011abe0ca2d6ff58c5c22b08cf6e01170ce1e1bf8ea91  scripts/verify
 4896279b3f855ad0f20288fbab36717e4b2040dc0c4fca31232d5b1d5de1c166  scripts/verify-r43-parent.mjs
 ac538a9bdf7dd1594833b5ec6873651a0949128dffe45b8a422f06aaffc1951c  scripts/verify-r44-parent.mjs
 236abbb55c61a2ae2520a37710ef390450550ff82fb68b662f709905f1fea5b8  scripts/verify-r45-parent.mjs
+90f42a1791b60b4f164e3c960c70c09906fd44310e8d814932ea9e84fcb918ee  scripts/wait-r47-handoff.mjs
 eb59d412712270bedc33bcdabd65fe9c31994339858a4947d0dc4bac371256fc  scripts/windows-gate-evidence-r36.mjs
 ea68d948b9e3bf155b7782b5745d75d98c142a199785ba52840aff7d2272ea17  scripts/windows-gate-evidence-r37-0110.mjs
 3d7c5092b080cae079607e5f741edd5c106117b962b0ebdc2c647431517a2282  scripts/windows-gate-evidence-r38.mjs
@@ -1553,7 +1568,7 @@ ff05f616bdcd6552affca58bf26459b899a467782f012c07f6a54da6df4e496f  src/autonomous
 1228a83490a35a656bea9a3e2f814a13d9f568d86b0738279ca9d1a3602bce92  src/autonomous-planner.mjs
 5a85c30f9b4e30a9a366a738298928fe074e0cc6c82dc328ab85745c145f7bf4  src/autonomous-policy.mjs
 f9bf3b46e4b32ab7dd7864c646809e13fea64f72accf114929588dac7dc82014  src/autonomous-progress.mjs
-3d2f74d3ef468c08690fd3594b24ce93e3a38587cf5adfc6e2edaaec03f714c5  src/autonomous-runtime.mjs
+ffde3dbd761d7e642a03f0cab506a38e38fc60dcb505557c5c01279629696d57  src/autonomous-runtime.mjs
 5c2fc073cc989121f775735600e96809ec2a51bf4167c877a263f54f2aa9a680  src/autonomous-supervisor-host.mjs
 b3fbc640f5edca562ffc1f5b1d455762525baa644996ff34e92e825f98bfc82a  src/autonomous-supervisor.mjs
 61de686111e5b5d24ceb1e2adc8da175d69a4f22af08691c4edaea1c763cf859  src/autonomous-timeout-recovery.mjs
@@ -1603,6 +1618,7 @@ f89acac9935ec9e757ee611893d1ffbe04ae3c2a03c43feb87af0427da39e830  src/fuzzy-sear
 880e942358ba4fae2139027f924b79045a7cc90c775b09761d35cd5e411b005f  src/host-plane.mjs
 cd00584f346160c8ad16b4dcf64b3fb6499668f3bc299c199b67f53caa995746  src/ingress-mode.mjs
 e1afae872e4252a4002032f1610033d41f5224896b0b06be077f54b267ed4f4f  src/invocation.mjs
+12c5347b87bf7b42276a1c3fef4c3d7271c06219c653cf55b95612d0f9bc7913  src/jev-decision-plane.mjs
 9efb25c69ecb0cf5778483d24a3944d2f08f52ebcbd271a212e89189add50167  src/job-supervisor-host-r44.mjs
 532fbd7d5402bb9d65b81a1efdfa9ea1d7292d96e1d9c2d1e8d40ccc52af2670  src/lsp-stdio-client.mjs
 6856b81e8aab42d144b88d0c4be5b2b4c9ad7e51b5bb36d2d4e8fd134935ae56  src/machine-fs-mcp-tools.mjs
@@ -1676,7 +1692,7 @@ fc5407ef8338ebeeede16225b3249166dc4d45e903d873eb46c15c3df07dc9ad  src/semantic-b
 17472b07dbfc1f6eff6831d79926a526e668ed0278cacbf9b4c421019174f505  src/semantic-lsp-backend.mjs
 a14cb827602d74f7c9822098815add8bf1ab6b27598d22b44880c8c98e754c1b  src/semantic-lsp-config.mjs
 3fc8d3786b981ec173e7ff634f117c1464e3e80f13cf471bd5e0fa38e4d4ac3b  src/skill-mcp-tools-r44.mjs
-5cabfef0c7d9571c5bf85b77afb724ebcac1c785334d52b4ee41faf1541e7d53  src/skill-plane-r44.mjs
+4c3523126e3056ef1f30bc0f162c396868fca96d3ad8df2e7a0f5ae573a6f31d  src/skill-plane-r44.mjs
 3dc2102335cd1e86ee52a11950f80ff6e1771f4291325d4f95a8ea2b849617cc  src/stdio-console-guard.mjs
 6dccdb538be9783276399a5ad2cce54b1f0d8cc305fd58bee9f0f46d6a412af6  src/text-policy.mjs
 144c75f8e8a4c2a182db82642475359459e5c108b2a4cecd80488bea1e6ab3bb  src/tool-audit.mjs
@@ -1687,7 +1703,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-f125aeb288ccf11f6f94970bfe2a54b167dfc2f48d52665b5b5b81280f56202f  src/version.mjs
+0ce4c08618f4e846d6c978e5d5b39229130d786c3b17c737dcf02010434d5afb  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
@@ -1845,6 +1861,7 @@ f95c920ee2b24d5ec940a9bae277771562ce275556bd89f0071f183b13c154b8  test/fixtures/
 981e9bc8cad0635ac280f0ad494b86adea6d714d575234d5423d2eed7a511d55  test/host-inline-r45.test.mjs
 e80f4172b400f126d0280eba53ffcc748597442ef57c4a62b3fd6f76c27e5fdc  test/host-plane.test.mjs
 1205e33a1924dcc33a18372f0c973076fff39e99203a671b39d14269d51b2999  test/human-clarification-r42.test.mjs
+682096cf689608970adce4ecb35b63d953dec5d3e152f9430871054bb41310a4  test/jev-decision-plane.test.mjs
 b12322450d23f44513b02d2c54f216520f392bf76e221af22fdcb5a11261ec3d  test/lsp-stdio-client.test.mjs
 af1716b6b831eabe8f43e1276b85519c3cedee9ecb98d261033ac3f5e6f84166  test/machine-fs-mcp-tools.test.mjs
 6eae806805d59a844e27ff410313874bc263c84a84d83dc166b442448092c3be  test/machine-fs-runtime.test.mjs
@@ -1928,7 +1945,7 @@ abfbc97af4a3337694f2362c00da24fd2a06b526ba324e04d0d0816197c75595  test/semantic-
 1a3567cd485f127ff66f8e0f39c4a66eeb29d0a8d417173040764ff072907927  test/semantic-runtime-routing.test.mjs
 27e2bf4ffd18c51cd2b62dfca836fb24288a75ff8a7f55ed9d45f5ba0dd1578a  test/semantic-server-config-integration.test.mjs
 7f9b1e4f2f53d20386b721b57490c43268954982cff4522da26b1acdac2cb23a  test/skill-mcp-r44.test.mjs
-83d87fad68128d3366962b21c9d91bf258ab00ae4101ed3a3debb803dfbf7f6d  test/skill-plane-r44.test.mjs
+b59577750bce1dbff3058716c5107517312eb1b0a1b24220dba6702fed573bf2  test/skill-plane-r44.test.mjs
 a98537d1136988251572f424b29ff8f798356dcfd9a7a1d4238a9c7e943e6a52  test/standing-grants.test.mjs
 2c8ad3d273965fa6f7ba2f3aa1ee50791a28f4dcf6dfc8cd8d73510f2577f9f9  test/task-contract-r42.test.mjs
 6ecc712b7bcb2abdb934e7d40232ed97ac355f3f47665f557c2168b04d113b41  test/tool-audit.test.mjs

package/docs/V085-R47-JEV-DECISION-PLANE.md

@@ -0,0 +1 @@
+# V085-R47 JEV Decision / Judgment Plane\n\n## Purpose\n\nJEV is integrated as a decision and judgment plane only. It can classify and reject a proposed planner decision, but it cannot execute a capability, arm a lease, mint authority, bypass policy, or invoke Host authority.\n\nThe execution authority remains DEADBYTE.\n\n## Execution boundary\n\nintent -> planner -> strict decision contract -> JEV judgment\nallow -> DEADBYTE authority recheck -> precondition -> effect -> observation -> verification -> signed evidence\nreject -> durable judgment-rejected event -> planner replan\n\nAn allow result never substitutes for the DEADBYTE authority check performed by the execution layer.\n\n## Trust invariants\n\n1. JEV receives the live configured capability ledger projection; it does not define authority.\n2. JEV output carries authority_source: DEADBYTE and execution_authority: DEADBYTE.\n3. Host operations are never delegated through JEV.\n4. Desktop, Process, Autonomous, and other authority classes remain separate.\n5. JEV does not receive raw shell, arbitrary executable, numeric PID, or machine-revocation authority.\n6. A rejected judgment is journaled and causes replanning; it is not silently discarded.\n7. Native Diff, leases, preconditions, receipts, release gates, and verification remain authoritative.\n8. Plan guards remain in the execution layer. JEV does not duplicate execution-state policy.\n\n## Judgment identity\n\nThe judgment binds planner round, request id, decision SHA-256, goal SHA-256, required authority, required capabilities, mutation classification, verdict, and rejection reasons.\n\nThe resulting judgment_sha256 is durable journal evidence.\n\n## Security model\n\nJEV is a membrane, not a second executor.\n\nJEV may decide: this proposed action is structurally or authority-incompatible.\nJEV may not decide: therefore execute it anyway.\n\nDEADBYTE decides whether the action is authorized now under the current live lease, generation, policy, preconditions, and release state.\n\nThis preserves a single execution authority while allowing a richer reasoning and judgment architecture to sit above it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/archive-source-zips.mjs

@@ -0,0 +1 @@
+import {rename,mkdir} from "node:fs/promises";import path from "node:path";import os from "node:os";const home=os.homedir(),src=path.join(home,".deadbyte-mcp","skills"),dst=path.join(home,".deadbyte-mcp","source-archives");await mkdir(dst,{recursive:true});for(const f of ["deadbyte-machine-truth.zip","lowlevel-reverse-engineering.zip"]){await rename(path.join(src,f),path.join(dst,f))}console.log(dst)

package/scripts/build-combined-skill.mjs

@@ -0,0 +1,146 @@
+import {readFile,writeFile,mkdir,rm} from "node:fs/promises";
+import path from "node:path";import os from "node:os";import zlib from "node:zlib";
+import {createHash,createPrivateKey,createPublicKey,sign} from "node:crypto";
+const home=os.homedir(), srcDir=path.join(home,".deadbyte-mcp","skills"), out=path.join(srcDir,"deadbyte-lowlevel-machine-truth");
+const filesA=["references/mode-routing.md","references/proof-engineering.md","references/advanced-technique-selector.md","references/capability-discovery.md","references/build-provenance.md","references/kernel-baremetal.md","references/reverse-archaeology.md","references/data-performance.md","references/conversation-contract.md"];
+const filesB=["references/analysis-patterns.md","references/safe-lab-and-reporting.md","references/tooling-and-evidence.md","scripts/triage_artifact.py"];
+const wanted=[...filesA,...filesB];
+const sha=b=>createHash("sha256").update(b).digest("hex");
+function entries(buf){const eocd=buf.lastIndexOf(Buffer.from([0x50,0x4b,0x05,0x06]));if(eocd<0)throw Error("zip EOCD missing");const cdOff=buf.readUInt32LE(eocd+16),cdSize=buf.readUInt32LE(eocd+12);let p=cdOff,out=[];while(p<cdOff+cdSize){if(buf.readUInt32LE(p)!==0x02014b50)throw Error("central directory corrupt");const method=buf.readUInt16LE(p+10),csize=buf.readUInt32LE(p+20),n=buf.readUInt16LE(p+28),x=buf.readUInt16LE(p+30),c=buf.readUInt16LE(p+32),off=buf.readUInt32LE(p+42);const name=buf.subarray(p+46,p+46+n).toString("utf8");out.push({name,method,csize,off});p+=46+n+x+c}return out}
+function extract(buf,e){const p=e.off,n=buf.readUInt16LE(p+26),x=buf.readUInt16LE(p+28),raw=buf.subarray(p+30+n+x,p+30+n+x+e.csize);return e.method===0?raw:zlib.inflateRawSync(raw)}
+function canonical(v){return Array.isArray(v)?v.map(canonical):v&&typeof v==="object"?Object.fromEntries(Object.keys(v).sort((a,b)=>a.localeCompare(b,"en")).map(k=>[k,canonical(v[k])])):v}
+const a=await readFile(path.join(srcDir,"deadbyte-machine-truth.zip")),b=await readFile(path.join(srcDir,"lowlevel-reverse-engineering.zip"));
+const maps=new Map();for(const e of entries(a))maps.set(e.name,extract(a,e));for(const e of entries(b))maps.set("B:"+e.name,extract(b,e));
+await rm(out,{recursive:true,force:true});
+await mkdir(path.join(out,"references"),{recursive:true});await mkdir(path.join(out,"scripts"),{recursive:true});
+const description="Evidence-first low-level engineering and reverse-engineering workflow that combines DEADBYTE machine-truth verification, proof engineering, capability routing, binary archaeology, compiler-aware analysis, safe lab practice, and reproducible evidence.";
+const skill=`---
+name: deadbyte-lowlevel-machine-truth
+description: ${description}
+version: 1.0.0
+audience: agent
+---
+
+# DEADBYTE LOWLEVEL MACHINE TRUTH
+
+Use this skill for substantial low-level engineering, reverse engineering, binary and firmware analysis, kernel or bare-metal work, debugging, performance investigation, and evidence-heavy technical research.
+
+## Core doctrine
+
+The machine is the final witness. Treat source, bytes, traces, measurements, specifications, and reproducible experiments as evidence. Separate KNOWN, INFERRED, UNKNOWN, HYPOTHESIS, ESTIMATE, and RECOMMENDATION.
+
+Do not confuse implementation with verification:
+
+\\`COMPILES != WORKS\\`
+\\`PATCHED != FIXED\\`
+\\`REPORTS PASS != MACHINE VERIFIED\\`
+
+## Operating loop
+
+1. CLASSIFY the actual problem and target artifact.
+2. DEFINE DONE with measurable acceptance criteria.
+3. ESTABLISH the strongest available evidence and preserve hashes.
+4. CHECK premises: architecture, ABI, bitness, endianness, addresses, ownership, versions, privilege, and provenance.
+5. ISOLATE the failure surface to the first broken invariant.
+6. FORM one falsifiable hypothesis.
+7. Choose one high-information decision.
+8. Perform the smallest responsible action.
+9. VERIFY with fresh observed evidence.
+10. Apply an adversarial test that could falsify the conclusion.
+11. Report the narrowest truthful status: PASS, FAIL, PARTIALLY VERIFIED, BLOCKED BY EVIDENCE, or HYPOTHESIS ONLY.
+
+## Low-level route
+
+For native binaries, firmware, drivers, bootloaders, memory dumps, undocumented protocols, or compiler/ABI reconstruction:
+
+- preserve the original and SHA-256;
+- identify format, architecture, endianness, bitness, ABI, image base, sections, symbols, imports, relocations, and entry points;
+- establish file-offset versus RVA/VA/runtime address domains;
+- map control flow and data flow before assigning semantic names;
+- treat decompiler output as a hypothesis, not ground truth;
+- recover structures from repeated offsets, widths, alignment, lifetime, and cross-references;
+- account for compiler optimization, inlining, tail calls, jump tables, thunks, exception paths, and generated wrappers;
+- cross-validate important conclusions with independent representations;
+- use dynamic execution only in an authorized, disposable, controlled environment.
+
+## Evidence workflow
+
+Maintain a hypothesis ledger:
+
+\\`\\`\\`
+CLAIM:
+EVIDENCE:
+ALTERNATIVE:
+DISCRIMINATOR:
+EXPECTED IF TRUE:
+EXPECTED IF FALSE:
+STATUS:
+\\`\\`\\`
+
+For each major conclusion, preserve the exact artifact hash, tool/version, configuration, address domain, command or observation, and exit status. If evidence conflicts, preserve the conflict and design the smallest safe experiment that distinguishes the explanations.
+
+## Safety boundary
+
+Only analyze software, devices, samples, and environments the operator owns or is explicitly authorized to assess. For suspicious or malicious artifacts, prefer metadata-only triage, static analysis, emulation, containment, controlled sinks, snapshots, and remediation-oriented findings. Do not provide credential theft, persistence, destructive payloads, unauthorized access, evasion, or weaponized exploit instructions.
+
+## Mode routing
+
+Use the smallest applicable mode:
+
+- DESIGN for architecture and tradeoffs.
+- BUILD for software creation or modification.
+- DEBUG for unknown or broken behavior.
+- VERIFY for correctness or release claims.
+- RESEARCH for changing or externally sourced facts.
+- LOWLEVEL for kernel, boot, ABI, ISA, firmware, MMIO, and bare metal.
+- REVERSE for binary, file-format, firmware-image, and native-code analysis.
+- ARCHIVE for historical reconstruction and provenance.
+- DATA/PERF for data quality and performance.
+- COLLAB when intent or consequential action needs clarification.
+
+Load only the references needed for the current phase.
+
+## Advanced techniques
+
+Do not use advanced tooling because it sounds advanced. First state the uncertainty and why ordinary testing cannot resolve it. Then select a technique with a discriminating signal and a stop condition. Useful classes include differential testing, property-based testing, fuzzing, symbolic/concolic execution, model checking, fault injection, emulation traces, profilers, hardware counters, reproducible-build comparison, and mutation testing.
+
+## Deterministic triage
+
+Before opening an unknown artifact in a debugger or decompiler, run the bundled metadata-only \\`scripts/triage_artifact.py\\`. Preserve its output and the original hash. It never executes the input.
+
+## Completion contract
+
+Before claiming \\`fixed\\`, \\`ready\\`, \\`safe\\`, \\`verified\\`, or \\`PASS\\`, answer:
+
+- WHAT IS THE CLAIM?
+- WHAT FRESH EVIDENCE SUPPORTS IT?
+- WHAT WAS NOT TESTED?
+- WHAT COULD STILL BREAK?
+
+Do not invent commands, output, tests, file contents, citations, or observations.
+`;
+await writeFile(path.join(out,"SKILL.md"),skill,"utf8");
+for(const rel of filesA){const data=maps.get(rel);if(!data)throw Error("missing source "+rel);await writeFile(path.join(out,rel),data)}
+for(const rel of filesB){const data=maps.get("B:"+rel);if(!data)throw Error("missing source "+rel);await writeFile(path.join(out,rel),data)}
+const provenance=`# Source Integration
+
+This skill was built by applying the DEADBYTE R44 skill-creator workflow to two local source archives.
+
+- deadbyte-machine-truth.zip: ${sha(a)}
+- lowlevel-reverse-engineering.zip: ${sha(b)}
+
+The two source skills were not concatenated. Their shared evidence-first doctrine was normalized into one SKILL.md. Domain-specific material remains in references and the deterministic metadata triage helper remains in scripts/.
+
+The original archives remain outside the R44 skill registry. Nested ZIP resources from the source packages were intentionally not imported because R44 requires a closed, directly verifiable resource tree.
+`;
+await writeFile(path.join(out,"references/source-integration.md"),provenance,"utf8");
+const resourcePaths=[...wanted,"references/source-integration.md"].sort((x,y)=>x.localeCompare(y,"en"));
+const resources=[];
+for(const rel of resourcePaths){const bytes=await readFile(path.join(out,...rel.split("/")));resources.push({path:rel,sha256:sha(bytes),kind:rel.startsWith("scripts/")?"script":"reference"})}
+const body={schema:"deadbyte.skill-manifest.v1",name:"deadbyte-lowlevel-machine-truth",version:"1.0.0",description,audience:"agent",skill_md_sha256:sha(Buffer.from(skill,"utf8")),resources,required_capabilities:[],authority_planes:["coding"],provenance:{source:"deadbyte-machine-truth.zip+lowlevel-reverse-engineering.zip",origin_url:null,source_revision:"combined-r44-1.0.0"}};
+const bodyBytes=Buffer.from(JSON.stringify(canonical(body)),"utf8"),body_sha256=sha(bodyBytes);
+const priv=createPrivateKey(await readFile(path.join(home,".deadbyte-mcp","trust","ed25519-private.pem"))),pub=createPublicKey(priv),keyId=sha(pub.export({type:"spki",format:"der"}));
+const attestation={algorithm:"ed25519",domain:"DEADBYTE-SKILL-MANIFEST-V1",key_id:keyId,signature_base64:sign(null,Buffer.concat([Buffer.from("DEADBYTE-SKILL-MANIFEST-V1\0","utf8"),bodyBytes]),priv).toString("base64")};
+const unsigned={body,body_sha256,attestation},envelope={...unsigned,manifest_sha256:sha(Buffer.from(JSON.stringify(canonical(unsigned)),"utf8"))};
+await writeFile(path.join(out,"skill.json"),JSON.stringify(envelope,null,2),"utf8");
+console.log(JSON.stringify({status:"built",out,manifest_sha256:envelope.manifest_sha256,source_archives:{machine_truth:sha(a),lowlevel_reverse:sha(b)},resource_count:resources.length,verify_key_id:keyId}));

package/scripts/deploy-r47.mjs

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadPowerShellDataFile, runSlotUpdateCli } from '../src/runtime-update.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const state=path.join(os.homedir(),'.deadbyte-mcp');
+const sha=async f=>createHash('sha256').update(await readFile(f)).digest('hex');
+const manifest=await sha(path.join(root,'MANIFEST.SHA256'));
+const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+const cfg=await loadPowerShellDataFile(pointer.config_path);
+const bridgeRoot=path.resolve(cfg.Bridge.WorkingDirectory);
+const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const expectedVersion=pkg.version;
+const args=[
+'--stage',root,'--development-root',root,'--expected-version',expectedVersion,'--expected-manifest',manifest,
+'--process-policy',path.join(root,'controller','deadbyte-process-policy.json'),'--process-policy-sha256',await sha(path.join(root,'controller','deadbyte-process-policy.json')),
+'--desktop-policy',path.join(root,'controller','deadbyte-desktop-policy.json'),'--desktop-policy-sha256',await sha(path.join(root,'controller','deadbyte-desktop-policy.json')),
+'--semantic-lsp-config',path.join(root,'controller','deadbyte-semantic-lsp-config.json'),'--semantic-lsp-config-sha256',await sha(path.join(root,'controller','deadbyte-semantic-lsp-config.json')),
+'--bridge-root',bridgeRoot,'--bridge-script-sha256',await sha(bridgeScript),
+'--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor','--restore-standing-grants'
+];
+const result=await runSlotUpdateCli(args,{stateRoot:state});
+console.log(JSON.stringify({status:'deployed',manifest_sha256:manifest,previous_release:pointer.release_id,result}));

package/scripts/disarm-host-for-update-r47.mjs

@@ -0,0 +1,3 @@
+import { spawnSync } from 'node:child_process';
+const r=spawnSync(process.execPath,['src/deadbyte-cli.mjs','remote','disarmhost'],{cwd:process.cwd(),stdio:'inherit',shell:false,windowsHide:false});
+process.exit(r.status??1);

package/scripts/find-internet-skill-finder-zip-r47.mjs

@@ -0,0 +1 @@
+import {execFile} from "node:child_process";import {promisify} from "node:util";const ex=promisify(execFile);const r=await ex("powershell.exe",["-NoProfile","-Command","Get-ChildItem -Path C:\\Users\\DEADBYTE -Filter internet-skill-finder.zip -File -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName"],{timeout:120000,maxBuffer:1048576});console.log(r.stdout)

package/scripts/list-source-zips.mjs

@@ -0,0 +1,3 @@
+import {readFile} from "node:fs/promises";import path from "node:path";import os from "node:os";
+function listZip(buf){let p=0,out=[];while(p+4<=buf.length){if(buf.readUInt32LE(p)!==0x04034b50){p++;continue}const method=buf.readUInt16LE(p+8),csize=buf.readUInt32LE(p+18),n=buf.readUInt16LE(p+26),e=buf.readUInt16LE(p+28);const name=buf.subarray(p+30,p+30+n).toString("utf8");out.push({name,method,csize});p+=30+n+e+csize}return out}
+for(const f of ["deadbyte-machine-truth.zip","lowlevel-reverse-engineering.zip"]){const b=await readFile(path.join(os.homedir(),".deadbyte-mcp","skills",f));console.log("=="+f+"==");console.log(JSON.stringify(listZip(b),null,2))}

package/scripts/npm-publish-r47.ps1

@@ -0,0 +1,22 @@
+$ErrorActionPreference = 'Stop'
+Set-Location (Join-Path $PSScriptRoot '..')
+$pkg = Get-Content package.json -Raw | ConvertFrom-Json
+$version = [string]$pkg.version
+if ($pkg.name -ne 'deadbyte-mcp') { throw 'unexpected package name' }
+$existing = $null
+try { $existing = & npm.cmd view "deadbyte-mcp@$version" version --json 2>$null } catch { $existing = $null }
+if ($LASTEXITCODE -eq 0 -and $existing) { throw "deadbyte-mcp@$version is already published: $existing" }
+$pack = (& npm.cmd pack --json 2>&1 | Out-String)
+if ($LASTEXITCODE -ne 0) { throw 'npm pack failed' }
+$packObj = $pack | ConvertFrom-Json
+$filename = [string]$packObj.'deadbyte-mcp'.filename
+if ([string]::IsNullOrWhiteSpace($filename)) { throw "npm pack did not return tarball filename. output=$pack" }
+$tarball = Join-Path (Get-Location) $filename
+& npm.cmd publish $tarball --access public
+if ($LASTEXITCODE -ne 0) { throw 'npm publish failed' }
+$published = (& npm.cmd view "deadbyte-mcp@$version" version dist.integrity dist.tarball --json | ConvertFrom-Json)
+$tags = (& npm.cmd view deadbyte-mcp dist-tags --json | ConvertFrom-Json)
+$npx = & npx.cmd --yes "deadbyte-mcp@$version" -- --version
+if ($LASTEXITCODE -ne 0) { throw 'npx verification failed' }
+Remove-Item -LiteralPath $tarball -Force -ErrorAction SilentlyContinue
+[pscustomobject]@{ status='published'; name=$pkg.name; version=$version; tarball=$filename; published=$published; dist_tags=$tags; npx_version_output=($npx -join "`n") } | ConvertTo-Json -Depth 8

package/scripts/npm-release-r47.mjs

@@ -0,0 +1,39 @@
+import { spawnSync } from 'node:child_process';
+import { readFile, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+const root=path.resolve(new URL('..',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,''));
+const npm=process.platform==='win32'?'npm.exe':'npm';
+
+function run(args,timeout=180000){
+  const r=spawnSync(npm,args,{cwd:root,encoding:'utf8',timeout,stdio:['ignore','pipe','pipe'],shell:false,windowsHide:true});
+  if(r.error) throw r.error;
+  if(r.status!==0) throw new Error('npm '+args.join(' ')+' failed exit='+r.status+'\n'+(r.stderr||r.stdout||'').slice(-12000));
+  return (r.stdout||'').trim();
+}
+function parseJson(text){
+  const start=Math.min(...[text.indexOf('{'),text.indexOf('[')].filter(n=>n>=0));
+  if(!Number.isFinite(start)) throw new Error('npm JSON output missing');
+  return JSON.parse(text.slice(start));
+}
+
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const version=pkg.version;
+if(pkg.name!=='deadbyte-mcp') throw new Error('unexpected package name');
+const existing=spawnSync(npm,['view',`deadbyte-mcp@${version}`,'version','--json'],{cwd:root,encoding:'utf8',stdio:['ignore','pipe','pipe'],shell:false,windowsHide:true});
+const existingText=(existing.stdout||'').trim();
+if(existing.status===0 && existingText && existingText!=='null'){
+  throw new Error(`deadbyte-mcp@${version} is already published: ${existingText}`);
+}
+
+const packed=parseJson(run(['pack','--json'],180000));
+const filename=packed?.[0]?.filename;
+if(!filename) throw new Error('npm pack did not return a tarball filename');
+const tarball=path.join(root,filename);
+const publishOut=run(['publish',tarball,'--access','public'],300000);
+const published=parseJson(run(['view',`deadbyte-mcp@${version}`,'version','dist.integrity','dist.tarball','--json'],120000));
+const tags=parseJson(run(['view','deadbyte-mcp','dist-tags','--json'],120000));
+const npxOut=run(['exec','--yes',`deadbyte-mcp@${version}`,'--','--version'],300000);
+await unlink(tarball).catch(()=>{});
+console.log(JSON.stringify({status:'published',name:pkg.name,version,tarball:filename,published,published_output_tail:publishOut.slice(-2000),dist_tags:tags,npx_version_output:npxOut},null,2));

package/scripts/probe-source-zips.mjs

@@ -0,0 +1 @@
+import {stat} from "node:fs/promises";import path from "node:path";import os from "node:os";for(const f of ["deadbyte-machine-truth.zip","lowlevel-reverse-engineering.zip"]){const p=path.join(os.homedir(),".deadbyte-mcp","skills",f);try{const x=await stat(p);console.log(JSON.stringify({file:f,exists:true,size:x.size}))}catch(e){console.log(JSON.stringify({file:f,exists:false}))}}

package/scripts/probe-zips.mjs

@@ -0,0 +1 @@
+import {stat,readFile} from "node:fs/promises";import path from "node:path";import os from "node:os";import {execFile} from "node:child_process";import {promisify} from "node:util";const ex=promisify(execFile);const d=path.join(os.homedir(),".deadbyte-mcp","skills");for(const f of ["deadbyte-machine-truth.zip","lowlevel-reverse-engineering.zip"]){const p=path.join(d,f);try{const x=await stat(p);console.log(f,x.size)}catch(e){console.log(f,"MISSING")}}

package/scripts/read-source-zips.mjs

@@ -0,0 +1,5 @@
+import {readFile} from "node:fs/promises";import path from "node:path";import os from "node:os";import zlib from "node:zlib";
+function entries(buf){let eocd=buf.lastIndexOf(Buffer.from([0x50,0x4b,0x05,0x06]));let cdOff=buf.readUInt32LE(eocd+16),cdSize=buf.readUInt32LE(eocd+12),p=cdOff,out=[];while(p<cdOff+cdSize){if(buf.readUInt32LE(p)!==0x02014b50)throw Error("bad central dir");const method=buf.readUInt16LE(p+10),csize=buf.readUInt32LE(p+20),usize=buf.readUInt32LE(p+24),n=buf.readUInt16LE(p+28),x=buf.readUInt16LE(p+30),c=buf.readUInt16LE(p+32),off=buf.readUInt32LE(p+42);const name=buf.subarray(p+46,p+46+n).toString("utf8");out.push({name,method,csize,usize,off});p+=46+n+x+c}return out}
+function data(buf,e){const p=e.off,n=buf.readUInt16LE(p+26),x=buf.readUInt16LE(p+28),raw=buf.subarray(p+30+n+x,p+30+n+x+e.csize);return e.method===0?raw:zlib.inflateRawSync(raw)}
+const wanted=new Set(["SKILL.md","references/advanced-technique-selector.md","references/capability-discovery.md","references/conversation-contract.md","references/lowlevel-analysis-patterns.md","references/lowlevel-reverse-engineering-core.md","references/lowlevel-safe-lab-and-reporting.md","references/lowlevel-tooling-and-evidence.md","references/mode-routing.md","references/proof-engineering.md","references/reverse-archaeology.md","references/build-provenance.md","references/data-performance.md","references/kernel-baremetal.md","references/manus-interop.md","references/software-work.md","references/research-live.md","references/analysis-patterns.md","references/safe-lab-and-reporting.md","references/tooling-and-evidence.md","scripts/triage_artifact.py","scripts/truthctl.py","templates/"]);
+for(const f of ["deadbyte-machine-truth.zip","lowlevel-reverse-engineering.zip"]){const b=await readFile(path.join(os.homedir(),".deadbyte-mcp","skills",f));console.log("=="+f+"==");for(const e of entries(b)){if(wanted.has(e.name)&&e.name!=="templates/"){const t=data(b,e).toString("utf8");console.log("\n---"+e.name+"---\n"+t)}}}

package/scripts/remove-source-archives-r47.mjs

@@ -0,0 +1 @@
+import {rm,stat} from "node:fs/promises";import os from "node:os";import path from "node:path";const p=path.join(os.homedir(),".deadbyte-mcp","source-archives");try{await stat(p);await rm(p,{recursive:true,force:true});console.log("REMOVED",p)}catch(e){if(e.code==="ENOENT")console.log("ABSENT",p);else throw e}

package/scripts/repair-builder-template.mjs

@@ -0,0 +1 @@
+import {readFile,writeFile} from "node:fs/promises";const p="scripts/build-combined-skill.mjs";let s=await readFile(p,"utf8");const start=s.indexOf("const skill=`")+13;const end=s.indexOf("`;",start);let body=s.slice(start,end);body=body.replaceAll("`","\\`");s=s.slice(0,start)+body+s.slice(end);await writeFile(p,s,"utf8");console.log("escaped-skill-template-backticks")

package/scripts/run-skill-creator-scaffold.mjs

@@ -0,0 +1 @@
+import {execFile} from "node:child_process";import {promisify} from "node:util";const ex=promisify(execFile);const root=process.env.USERPROFILE+"\\.deadbyte-mcp\\skills";const script=root+"\\skill-creator\\scripts\\create-skill.mjs";const r=await ex(process.execPath,[script,root,"deadbyte-lowlevel-machine-truth","1.0.0"],{maxBuffer:1048576});console.log(r.stdout);console.error(r.stderr)

package/scripts/wait-r47-handoff.mjs

@@ -0,0 +1 @@
+import { readFile } from 'node:fs/promises'; import os from 'node:os'; import path from 'node:path'; await new Promise(r=>setTimeout(r,15000)); const root=path.join(os.homedir(),'.deadbyte-mcp'); const p=JSON.parse(await readFile(path.join(root,'active-release.json'),'utf8')); const s=JSON.parse(await readFile(path.join(root,'evidence','updates','r27-3d25be23cd6af36c-mueei50q-756d8a75','state.json'),'utf8')); console.log(JSON.stringify({pointer:p,state:s}));

package/src/autonomous-runtime.mjs

@@ -19,6 +19,7 @@ import { createWorkerScheduler } from './worker-scheduler.mjs';
 import { issueObservationLease, verifyObservationLease } from './observation-lease.mjs';
 import { createJournalStream } from './workload-substrate.mjs';
 import { createDeadline, deadlineState } from './deadline-cancellation.mjs';
+import { judgeDecision } from './jev-decision-plane.mjs';
 
 export const AUTONOMOUS_GOAL_SCHEMA = 'deadbyte.autonomous-goal.v1';
 export const AUTONOMOUS_EVENT_SCHEMA = 'deadbyte.autonomous-event.v1';
@@ -125,7 +126,7 @@ function deriveState(goal, events) {
       plannerRejections.push({ ...p, event_sha256:event.event_sha256 });
       if (pendingRequest?.request_id === p.request_id) pendingRequest = null;
     }
-    if (event.type === 'decision_completed' && p.decision_event_sha256) completedDecisions.add(p.decision_event_sha256);
+    if ((event.type === 'decision_completed' || event.type === 'decision_judgment_rejected') && p.decision_event_sha256) completedDecisions.add(p.decision_event_sha256);
     if (event.type === 'inspect_completed') for (const item of p.contexts ?? []) contexts.set(item.path, item);
     if (event.type === 'profile_completed') observations.push({ ...p, event_sha256:event.event_sha256 });
     if (event.type === 'delegated_action_completed') {
@@ -654,6 +655,24 @@ async function acceptPlannerDecision({ ctx, events, goal, state, policy, codingR
       if (policy.planner.backend === 'client_sampling') return { needs_planner:true, request:pending };
       continue;
     }
+    const jev = judgeDecision({ decision, goal:{ goal_id:goal.goal_id,title:goal.title,goal:goal.goal,acceptance:goal.acceptance,task_contract:goal.task_contract },
+      capabilities:capabilityManifest?.entries ?? [], state:currentState,
+      planner_round:pending.planner_round, request_id:pending.request_id });
+    const judgmentEvent = await appendEvent(ctx,events,signingKeyPath,'decision_judgment',{ request_id:pending.request_id,
+      planner_round:pending.planner_round, mutation_epoch:pending.mutation_epoch, decision_sha256:jev.decision_sha256,
+      judgment_sha256:jev.judgment_sha256, verdict:jev.verdict, authority:jev.authority, mutation:jev.mutation,
+      action_kind:jev.action_kind, reasons:jev.reasons, required_capabilities:jev.required_capabilities,
+      authority_source:jev.authority_source, execution_authority:jev.execution_authority });
+    if (jev.verdict === 'reject') {
+      await appendEvent(ctx,events,signingKeyPath,'decision_judgment_rejected',{ request_id:pending.request_id,
+        planner_round:pending.planner_round, decision_event_sha256:judgmentEvent.event_sha256,
+        decision_sha256:jev.decision_sha256, judgment_sha256:jev.judgment_sha256, reasons:jev.reasons });
+      currentState = deriveState(goal,events);
+      pending = await requestPlanner(ctx,goal,events,currentState,policy,codingRuntime,capabilityManifest,desktopMemoryProvider,memoryProvider,signingKeyPath);
+      if (!pending) return null;
+      if (policy.planner.backend === 'client_sampling') return { needs_planner:true, request:pending };
+      continue;
+    }
     const event = await appendEvent(ctx,events,signingKeyPath,'planner_decision',{
       request_id:pending.request_id, planner_round:pending.planner_round, mutation_epoch:pending.mutation_epoch,
       backend:response.backend, model:response.model ?? 'unknown', response_sha256:sha256Bytes(Buffer.from(response.raw_text,'utf8')),

package/src/jev-decision-plane.mjs

@@ -0,0 +1,128 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from './canonical-json.mjs';
+
+export const JEV_DECISION_SCHEMA = 'deadbyte.jev-decision-judgment.v1';
+
+const SHA256_RE = /^[0-9a-f]{64}$/;
+
+function sha256(value) {
+  return createHash('sha256').update(Buffer.from(canonicalJson(value), 'utf8')).digest('hex');
+}
+
+function actionKind(decision) {
+  return decision?.action?.kind ?? decision?.kind ?? decision?.action ?? null;
+}
+
+function requiredAuthority(decision) {
+  const kind = actionKind(decision);
+  if (kind === 'desktop_action') return 'desktop';
+  if (kind === 'process_start' || kind === 'process_action' || kind === 'process_terminate') return 'process';
+  if (kind === 'native_diff_apply' || kind === 'patch' || kind === 'write' || kind === 'replace') return 'autonomous';
+  if (kind === 'run_profile' || kind === 'command' || kind === 'benchmark') return 'autonomous';
+  return 'none';
+}
+
+function isMutation(decision) {
+  const kind = actionKind(decision);
+  return new Set([
+    'act','patch','write','replace','delete','run_profile','command','benchmark',
+    'native_diff_apply','process_start','process_action','process_terminate','desktop_action'
+  ]).has(kind);
+}
+
+function capabilityForAuthority(authority) {
+  if (authority === 'desktop') return ['desktop.action'];
+  if (authority === 'process') return ['process.start','process.action','process.terminate'];
+  if (authority === 'autonomous') return ['autonomous.goal_run','native_diff.apply','autonomous.release_gate'];
+  return [];
+}
+
+function hasCapability(entries, wanted) {
+  const list = Array.isArray(entries) ? entries : [];
+  const ids = list.map(item => typeof item === 'string' ? item : item?.id).filter(Boolean);
+  return wanted.some(item => ids.includes(item) || ids.includes(item.replaceAll('.','_')));
+}
+
+function judgment({ decision, goal, capabilities, state }) {
+  const kind = actionKind(decision);
+  const authority = requiredAuthority(decision);
+  const mutation = isMutation(decision);
+  const reasons = [];
+  const required = capabilityForAuthority(authority);
+
+  if (!decision || typeof decision !== 'object') {
+    reasons.push('decision_missing');
+  }
+  if (!kind) reasons.push('action_kind_missing');
+
+  if (mutation && authority === 'none') reasons.push('mutation_without_typed_authority');
+
+  if (authority === 'desktop' && !hasCapability(capabilities, required)) {
+    reasons.push('desktop_authority_not_present');
+  }
+  if (authority === 'process' && !hasCapability(capabilities, required)) {
+    reasons.push('process_authority_not_present');
+  }
+
+  if (authority === 'autonomous' && !hasCapability(capabilities, required)) {
+    reasons.push('autonomous_authority_not_present');
+  }
+
+
+  if (goal?.task_contract?.non_goals && kind === 'act' && decision.action?.kind === 'delegate') {
+    const operationKind = decision.action.operation?.kind;
+    if (goal.task_contract.non_goals.some(item => typeof item === 'string' && item.includes(operationKind))) {
+      reasons.push('action_conflicts_with_non_goal');
+    }
+  }
+
+  if (decision?.action?.kind === 'delegate' && decision.action.operation?.kind === 'host_exec') {
+    reasons.push('host_authority_not_delegable');
+  }
+
+  if (decision?.action?.kind === 'delegate' && decision.action.operation?.kind === 'machine_revoke') {
+    reasons.push('machine_authority_not_delegable');
+  }
+
+  return {
+    schema:JEV_DECISION_SCHEMA,
+    verdict:reasons.length === 0 ? 'allow' : 'reject',
+    authority,
+    mutation,
+    action_kind:kind,
+    reasons,
+    required_capabilities:required
+  };
+}
+
+export function judgeDecision({ decision, goal = null, capabilities = [], state = null, planner_round = 0, request_id = null }) {
+  if (!Number.isInteger(planner_round) || planner_round < 0) throw new Error('JEV planner_round invalid');
+  if (request_id !== null && (typeof request_id !== 'string' || !SHA256_RE.test(request_id))) {
+    throw new Error('JEV request_id invalid');
+  }
+
+  const verdict = judgment({ decision, goal, capabilities, state });
+  const subject = {
+    schema:JEV_DECISION_SCHEMA,
+    planner_round,
+    request_id,
+    decision_sha256:sha256(decision),
+    goal_sha256:goal ? sha256(goal) : null,
+    authority:verdict.authority,
+    mutation:verdict.mutation,
+    action_kind:verdict.action_kind,
+    required_capabilities:verdict.required_capabilities,
+    verdict:verdict.verdict,
+    reasons:verdict.reasons
+  };
+  return {
+    ...verdict,
+    planner_round,
+    request_id,
+    decision_sha256:subject.decision_sha256,
+    judgment_sha256:sha256(subject),
+    authority_source:'DEADBYTE',
+    execution_authority:'DEADBYTE',
+    subject
+  };
+}

package/src/skill-plane-r44.mjs

@@ -53,12 +53,14 @@ function parseFrontmatter(text){
   exactKeys(meta,['name','description','version','audience'],'SKILL.md frontmatter');
   return meta;
 }
+const GENERATED_SKILL_FILES=new Set(['references/skills_cache.json']);
 async function walkFiles(root,rel=''){
   const dir=path.join(root,...(rel?rel.split('/'):[]));
   const names=(await readdir(dir)).sort((a,b)=>a.localeCompare(b,'en'));
   const out=[];
   for(const name of names){
     const childRel=rel?`${rel}/${name}`:name;
+    if(GENERATED_SKILL_FILES.has(childRel)) continue;
     const full=path.join(root,...childRel.split('/'));
     const st=await lstat(full);
     insist(!st.isSymbolicLink(),`skill symlink forbidden: ${childRel}`);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.5';
+export const DEADBYTE_VERSION = '0.15.7';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/jev-decision-plane.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { judgeDecision } from '../src/jev-decision-plane.mjs';
+
+const capabilities = [
+  { id:'native_diff.apply', authority:'autonomous', mutating:true },
+  { id:'autonomous.release_gate', authority:'autonomous', mutating:true },
+  { id:'process.start', authority:'process', mutating:true },
+  { id:'process.action', authority:'process', mutating:true },
+  { id:'process.terminate', authority:'process', mutating:true },
+  { id:'desktop.action', authority:'desktop', mutating:true }
+];
+
+const goal = {
+  goal_id:'a'.repeat(64),
+  title:'test',
+  goal:'test',
+  acceptance:'test',
+  task_contract:{ non_goals:[] }
+};
+
+test('JEV allows typed autonomous mutation without granting execution', () => {
+  const result = judgeDecision({
+    decision:{
+      schema:'deadbyte.autonomous-decision.v2',
+      kind:'act',
+      action:{kind:'native_diff_apply',diff_id:'b'.repeat(64),expected_operation_count:1}
+    },
+    goal, capabilities, planner_round:1, request_id:'c'.repeat(64)
+  });
+  assert.equal(result.verdict,'allow');
+  assert.equal(result.authority,'autonomous');
+  assert.equal(result.execution_authority,'DEADBYTE');
+  assert.equal(result.authority_source,'DEADBYTE');
+});
+
+test('JEV rejects host authority escape from delegated planner action', () => {
+  const result = judgeDecision({
+    decision:{
+      schema:'deadbyte.autonomous-decision.v2',
+      kind:'act',
+      action:{kind:'delegate',operation:{kind:'host_exec'}}
+    },
+    goal, capabilities, planner_round:2, request_id:'d'.repeat(64)
+  });
+  assert.equal(result.verdict,'reject');
+  assert.ok(result.reasons.includes('host_authority_not_delegable'));
+});
+
+test('JEV rejects desktop mutation when Desktop authority is absent', () => {
+  const result = judgeDecision({
+    decision:{
+      schema:'deadbyte.autonomous-decision.v2',
+      kind:'act',
+      action:{kind:'desktop_action',action_kind:'click_primary',expected_frame_id:'e'.repeat(64),
+        target_id:'f'.repeat(64),point:null,scroll_delta:null,key_chord:null,text:null}
+    },
+    goal, capabilities:capabilities.filter(item=>item.id!=='desktop.action'),
+    planner_round:3, request_id:'1'.repeat(64)
+  });
+  assert.equal(result.verdict,'reject');
+  assert.ok(result.reasons.includes('desktop_authority_not_present'));
+});

package/test/skill-plane-r44.test.mjs

@@ -46,6 +46,7 @@ test('R44 skill catalog is metadata-only and load is signature/content bound',as
   const f=await fixture();
   try{
     await installSkill(f,{});
+    await writeFile(path.join(f.registry,'repo-audit','references','skills_cache.json'),'generated cache\n','utf8');
     const plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
     const listed=await plane.list();
     assert.equal(listed.status,'ok');assert.equal(listed.skills.length,1);