deadbyte-mcp 0.15.61 → 0.15.63

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.61",
-  "train": "R154",
+  "version": "0.15.63",
+  "train": "R165",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,21 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r160-receipt-startup-identity",
+      "command": "node --test test/r153-marker-reconcile-receipt.test.mjs test/r159-legacy-marker-evidence.test.mjs test/r160-marker-proof.test.mjs test/r160-package-decision-manifest.test.mjs",
+      "expected": "Located receipts require R153 proof binding and exact startup decision bytes before foreground claim"
+    },
+    {
+      "id": "r160-protected-r89",
+      "command": "Run R158 live preflight with distinct protected epoch root and writable exact release view",
+      "expected": "Protected exact source accepted; untrusted source remains denied"
+    },
+    {
+      "id": "r160-protected-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs from exact protected final candidate",
+      "expected": "Zero failures; every skip classified"
+    },
     {
       "id": "r146-scoped-policy-generation",
       "command": "node --test test/r146-generation-scope-narrowing.test.mjs test/r146-legacy-offline-policy-proof.test.mjs test/r65-activation-orchestration.test.mjs",
@@ -557,5 +572,19 @@
     "rollback": "PENDING",
     "windows_gate": "PENDING",
     "publisher": "BLOCKED_UNTIL_RELEASE_VERIFIED"
+  },
+  "r163": {
+    "windows_final": "PENDING_NEW_PROTECTED_FIXTURE",
+    "isolated_rollback_restore": "PENDING_CURRENT_VERSION_TEST",
+    "npm_verify_only": "PENDING_FINAL_BYTES",
+    "classified_skips": "R162_43_HISTORICAL_3_POSIX_3_R35_OPTIONAL",
+    "publish_guard": "REQUIRES_EXTERNAL_EVIDENCE"
+  },
+  "r165": {
+    "real_cli_version_skew": "4_PASS_0_FAIL_WITH_CONTROLLED_PREDEPLOY_STOP",
+    "full_protected_regression": "PENDING",
+    "isolated_activation_rollback_restore": "PENDING",
+    "npm_artifact_verify_only": "PENDING",
+    "publish_readiness": "PENDING"
   }
 }

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.61",
+  "version": "0.15.63",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-controller.ps1

@@ -952,8 +952,85 @@ function Get-AuthorityEpochStatus($Cfg, [string]$Plane, [string]$GrantFile, [str
     }
 }
 
+function Assert-ProtectedEpochSourceAcl([string[]]$Files) {
+    # Check the OS path and its ancestors BEFORE executing any JS from it.
+    # The native R89 loader still performs its more complete independent check.
+    $trustedSids = @('S-1-5-18','S-1-5-32-544','S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464')
+    $visited = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $commonMutation = [long]0x000d0150
+    $genericMutation = [long]0x52000000
+    foreach ($file in $Files) {
+        $node = [System.IO.Path]::GetFullPath($file)
+        while ($true) {
+            if ($visited.Add($node)) {
+                $item = Get-Item -LiteralPath $node -Force -ErrorAction Stop
+                if ([bool]($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
+                    Fail "authority epoch protected path reparse denied: $node"
+                }
+                $acl = Get-Acl -LiteralPath $node -ErrorAction Stop
+                $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+                if ($owner -cnotin $trustedSids) { Fail "authority epoch protected path owner denied: $node" }
+                $mutation = $commonMutation -bor $genericMutation
+                if (-not $item.PSIsContainer) { $mutation = $mutation -bor 6 }
+                foreach ($rule in $acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])) {
+                    $mask = [long]$rule.FileSystemRights -band [long]4294967295
+                    if ($rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and
+                        $rule.IdentityReference.Value -cnotin $trustedSids -and
+                        -not ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -and
+                        (($mask -band $mutation) -ne 0)) {
+                        Fail "authority epoch protected path writable by an untrusted principal: $node"
+                    }
+                }
+            }
+            $parent = [System.IO.Directory]::GetParent($node)
+            if ($null -eq $parent) { break }
+            $node = $parent.FullName
+        }
+    }
+}
+
 function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [string]$GrantFile, [string]$UpdateId = '', [string]$ExpectedHead = '') {
-    $cli = Join-Path ([string]$Cfg.CoreRoot) 'src\authority-epoch-cli-r65.mjs'
+    # R156: a privileged native Epoch Lock must execute from an OS-protected
+    # package, not from the writable npm release in the user's profile.
+    # This root is supplied by the pinned generation config, never by a CLI
+    # argument, caller environment, or a fallback search under Program Files.
+    $epochRoot = [string]$Cfg.CoreRoot
+    if ($Cfg.ContainsKey('AuthorityEpochRoot') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.AuthorityEpochRoot)) {
+        $epochRoot = [System.IO.Path]::GetFullPath([string]$Cfg.AuthorityEpochRoot)
+        $release = [System.IO.Path]::GetFullPath([string]$Cfg.CoreRoot)
+        # Fail closed if the protected source does not match this exact release.
+        $releaseManifest = Join-Path $release 'MANIFEST.SHA256'
+        $epochManifest = Join-Path $epochRoot 'MANIFEST.SHA256'
+        if (-not (Test-Path -LiteralPath $releaseManifest -PathType Leaf) -or -not (Test-Path -LiteralPath $epochManifest -PathType Leaf) -or
+            (Get-ExecutableHash $releaseManifest) -cne (Get-ExecutableHash $epochManifest)) {
+            Fail 'authority epoch trusted root release manifest mismatch'
+        }
+        $critical = @(
+            'src\authority-epoch-cli-r65.mjs', 
+            'src\authority-continuity-r65.mjs',
+            'src\privileged-install-trust-r89.mjs',
+            'src\epoch-lock-r85.mjs',
+            'src\canonical-json.mjs',
+            'src\text-policy.mjs',
+            'src\foreground-marker-cas-win32.mjs',
+            'src\foreground-process-identity.mjs',
+            'src\windows-powershell-environment.mjs',
+            'bin\deadbyte-epoch-lock-r85.node',
+            'docs\R85-EPOCH-LOCK-BINARY.json',
+            'native\deadbyte-epoch-lock-r85.cpp'
+        )
+        foreach ($relative in $critical) {
+            $source = Join-Path $release $relative
+            $protected = Join-Path $epochRoot $relative
+            if (-not (Test-Path -LiteralPath $source -PathType Leaf) -or
+                -not (Test-Path -LiteralPath $protected -PathType Leaf) -or
+                (Get-ExecutableHash $source) -cne (Get-ExecutableHash $protected)) {
+                Fail "authority epoch trusted root source mismatch: $relative"
+            }
+        }
+        Assert-ProtectedEpochSourceAcl -Files @($critical | ForEach-Object { Join-Path $epochRoot $_ })
+    }
+    $cli = Join-Path $epochRoot 'src\authority-epoch-cli-r65.mjs'
     if (-not (Test-Path -LiteralPath $cli -PathType Leaf)) { Fail "authority epoch CLI missing: $cli" }
     $node = [string]$Cfg.Bridge.FilePath
     if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'authority epoch Node executable unavailable' }

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r146-scoped-policy-dev\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r146-scoped-policy-dev\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r146-scoped-policy-dev\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r146-scoped-policy-dev",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/R156-LOOP-AND-EPOCH-ROUTING.md

@@ -0,0 +1,86 @@
+# R156 — loop pacing and privileged Epoch routing
+
+Status: DEVELOPMENT / TESTED FOCUSED / NOT PUBLISHED. Predecessor is the
+R155 isolated candidate. The live 0.15.61 release, configured grants,
+foreground session, R89 ACL rules, R70 owner admission, registry, and
+production pointers are intentionally unchanged.
+
+## What was wrong
+
+1. The outer autonomous supervisor counted backoff-blocked goals as
+   runnable. Its 25 ms hot-scan path could therefore run when no provider
+   dispatch was eligible, wasting cycles on status scans and filesystem work.
+2. The supervisor host provisions a trusted `codex_app_server` planner, and
+   the R24 runtime supports it, but the scheduler excluded the backend from
+   its provider-backed dispatch list. A running supervisor was not proof a
+   Codex goal would actually advance.
+3. The normal npm release is installed under the owner's writable
+   `.deadbyte-mcp\releases` directory. Its controller launches
+   `authority-epoch-cli-r65.mjs` from that path. R89 correctly refuses
+   loading the native epoch lock with `UNTRUSTED_WRITE_ACE`. It is *not*
+   appropriate to weaken R89 or chmod the user release.
+
+## Change: same engine, better outer loop
+
+- Count only dispatched goals as runnable. A backoff-blocked goal now
+  permits the idle interval instead of triggering the 25 ms hot path.
+- Include `codex_app_server` among the supervisor's provider-backed
+  planners. Leave `client_sampling` excluded: it requires a live model
+  through a client and must never be mistaken for unattended planning.
+- Keep standing authority, task policy, Native Diff, approvals,
+  cancellation, journal replay and per-goal stop conditions unchanged.
+- Add four isolated behavioral tests for provider backoff, Codex dispatch,
+  client sampling and paused owner-approval goals.
+
+## Change: R89 exact protected root selection
+
+The controller accepts an *optional generation-config-only*
+`AuthorityEpochRoot`. When set, before invoking the epoch CLI it checks:
+- `MANIFEST.SHA256` matches the active release
+- exact SHA-256 equivalence for the Epoch CLI and its 11 supporting native/
+  JS trust files
+- Windows R89 OS ACL verification still executes inside the selected native
+  Epoch Lock, denying untrusted write access to any checked ancestor
+
+There is no CLI/env override and no automatic selection of an unverified
+Program Files directory. The generation renderer preserves an existing
+`AuthorityEpochRoot` only when supplied by the trusted deployment process.
+If missing, the old fail-closed path remains and npm arm commands still
+cannot work from a writable package alone.
+
+**Important:** shipping the R156 source is not sufficient to fix new
+installations. The release/activation workflow must provision an exact
+manifest-matched, OS-owned native installation via owner-authorized Windows
+privilege escalation, bind that absolute path to the generation config,
+and verify the byte identity and ACL before issuing any grant.
+R70 independent Autonomous owner enrollment is still required.
+
+## Observed evidence
+
+- R156 supervisor pacing TDD: first 1 RED / 1 PASS, then 2/2 PASS
+- R156 Codex dispatch TDD: first 1 RED / 3 PASS, then 4/4 PASS
+- R156 autonomous focused suite: 32 PASS / 0 FAIL
+- R156 generation and native ACL guard suite: 16 PASS / 0 FAIL
+- R156 PowerShell verifier:
+  - identical trusted stage accepted before a deliberately invalid plane
+  - unrelated root rejected with manifest mismatch
+  - protected Epoch module source SHA-256 equality PASS
+  - NO lease issued / process started / grant altered
+- Two earlier Windows native integration tests remain RED when executed
+  directly under the user-writable development tree. This is expected
+  under R89 and is **not** counted as release readiness.
+
+## Release gate
+
+Must still be proven for the exact repackaged 0.15.62 candidate:
+1. UAC-owned protected Epoch installation, exact artifact/manifest and
+   recovery proof, and generation-config path binding
+2. protected Windows full regression (not user-writable dev tree)
+3. clean install and `remote armprocess`, `armcoding`, `armdesktop`,
+   `armhost` with explicit local authorization, and successful revoke
+4. Autonomous R70 owner enrollment and independent project-scope isolation
+5. LiveLogs default START/DONE/FAIL plus audit continuity regression
+6. npm tarball verification, release metadata, rollback, registry identity
+
+No npm publish or production activation has been attempted by this R156
+development pass.

package/docs/R157-ARCHITECTURE-DEPENDENCIES.md

@@ -0,0 +1,58 @@
+# DEADBYTE MCP R157 static dependency map
+
+Not a runtime reachability guarantee. Graph parses literal top-level relative ESM imports only.
+
+| Boundary | Runtime entry / related source | Security / compatibility rule |
+|---|---|---|
+| Public MCP and remote | mcp-server.mjs / deadbyte-cli.mjs / remote-live-log.mjs | machine identity and live request/result pairing |
+| Session ownership | foreground-marker-cas-win32.mjs / remote-session-guardian.mjs | file identity, PID+creation identity, explicit revoke |
+| Privileged epoch | authority-continuity-r65.mjs / privileged-install-trust-r89.mjs | owner-approved OS-owned root, deny untrusted ACL writes |
+| Coding and native diffs | coding-plane.mjs / native-diff.mjs / atomic-mutation.mjs | bounded roots and exact SHA-256 preconditions |
+| Autonomous engine | autonomous-supervisor.mjs / autonomous-runtime.mjs / autonomous-progress.mjs | bounded retries, receipts, owner approval and durable goals |
+| Release generation | runtime-update.mjs / release-generation.mjs | signed exact promotion, rollback, manifest match |
+
+## Entrypoint reachability from literal imports
+- mcp-server.mjs: present=true, static reachable files=134
+- deadbyte-cli.mjs: present=true, static reachable files=151
+- remote-live-log.mjs: present=true, static reachable files=7
+- autonomous-supervisor-host.mjs: present=true, static reachable files=50
+- autonomous-runtime.mjs: present=true, static reachable files=33
+- autonomous-supervisor.mjs: present=true, static reachable files=1
+
+## Most referenced modules within src/
+- canonical-json.mjs <- 50 static imports
+- trust.mjs <- 38 static imports
+- path-policy.mjs <- 16 static imports
+- coding-plane.mjs <- 12 static imports
+- text-policy.mjs <- 12 static imports
+- version.mjs <- 11 static imports
+- hash.mjs <- 10 static imports
+- desktop-policy-r40.mjs <- 9 static imports
+- desktop-runtime-r40.mjs <- 9 static imports
+- observation-runtime.mjs <- 9 static imports
+- state-root.mjs <- 9 static imports
+- authority-continuity-r65.mjs <- 8 static imports
+- machine-fs.mjs <- 8 static imports
+- release-slot.mjs <- 8 static imports
+- output-contracts.mjs <- 7 static imports
+- runtime-update.mjs <- 7 static imports
+- contained-executor.mjs <- 6 static imports
+- runtime-catalog-expectation.mjs <- 6 static imports
+- autonomous-policy.mjs <- 5 static imports
+- foreground-marker-cas-win32.mjs <- 5 static imports
+- process-policy.mjs <- 5 static imports
+- remote-mcp-r34-parity-client.mjs <- 5 static imports
+- deadline-cancellation.mjs <- 4 static imports
+- verifier.mjs <- 4 static imports
+- windows-powershell-environment.mjs <- 4 static imports
+
+## Explicit integration work
+
+- R89 protected source routing is candidate-only. Actual install provision / owner consent / revoke remains unverified.
+- R155 default LiveLogs focused checks pass, but full Windows regression and startup reconciliation are not closed.
+- R156/R157 autonomous supervisor is test-backed; release identity has not changed.
+- A code source import does not prove an IPC, host process, or cloud boundary. Prove via isolated end-to-end test.
+
+## Rebuild
+
+node test/r157-architecture-map.mjs