deadbyte-mcp 0.15.65 → 0.15.67

package/docs/R168-ACTIVATION-RECONCILIATION-BLOCKER-20261026.md

@@ -0,0 +1,39 @@
+# R168 activation reconciliation blocker
+
+Status: DEVELOPMENT_SUCCESSOR_ONLY / PRODUCTION_UNCHANGED
+
+## Verified publication
+
+- `deadbyte-mcp@0.15.65` was accepted by npm and reconciled to `REGISTRY_IDENTITY_VERIFIED`.
+- Registry `latest` is `0.15.65`.
+- Registry and local tarball SHA-256: `fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc4bb84c9484`.
+- npm integrity: `sha512-f/oM6h4yU7HBWr/x3OOnwIAuVpDB7ZE45FCc/NF/1yVqha1KTudXHUiMolUpvNiYsZPfiHcPn5SwNoes7kxaTA==`.
+- npm shasum: `e21c96b0340a02112a3128d85ccc1cb158b7d0f8`.
+- A fresh-cache external invocation returned version `0.15.65`.
+
+## Activation attempt
+
+- R167 protected preflight from `C:\Program Files\DEADBYTE-R167-Protected-0.15.65-3316654646cc8705-Fix6` returned `ONLINE_READY`, `EPOCH_NATIVE`, and `TRUSTED_READY`.
+- Captured authority vector was Coding armed only; Process, Autonomous, Desktop, and Host were disarmed.
+- The canonical activation attempt was rejected before candidate mutation with `CONCURRENT_ACTIVATION` because the preserved R166/R65 activation claim is unresolved.
+
+## Preserved ambiguous evidence
+
+- Lock operation: `c84d7ffa4eee80a2f467acda3ddd9332`.
+- Lock subject: `fba80e0128da9657dcbfcaa27d3a4dc8d9d8939146e81a097293fa5fcb6ae8fc`.
+- Outcome file: `C:\Users\DEADBYTE\.deadbyte-mcp\evidence\updates\r65-activation-outcome-1792993876612-cc7c498632c7757d.json`.
+- Candidate was `0.15.64`, update/state paths are null, and the outcome remains `ACTIVATION_OUTCOME_UNKNOWN` after an R89 `UNTRUSTED_WRITE_ACE` failure.
+- The outcome contains continuity id `r65-ef42bc84451ce024c4dee736d4047b36`; no matching continuity record was found in the bounded evidence search. Absence alone is not terminal proof and does not authorize deleting the claim.
+
+## Live state after rejection
+
+- Active release remains `v0.15.61-055d1ff0aa99e60b`.
+- Active manifest remains `055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf`.
+- Runtime is ONLINE with Bridge/Core/Cloud verified and supervisor RUNNING.
+- Coding is still ARMED; all other planes are DISARMED.
+
+## Required next boundary
+
+Implement a narrow signed reconciliation contract in this isolated successor. It must prove the old continuity transition never reached a durable epoch mutation by binding the exact old claim/outcome, predecessor pointer, current verified authority head/grant, policy hashes, and complete bounded continuity evidence inventory. Only a verified no-mutation reconciliation receipt may terminalize the old claim. Never delete the lock from age, PID, missing files, or an unsigned observation. Also fix npm publication resume so preserved claim metadata supplies the original shasum/integrity instead of passing `undefined` to the R167 closure guard.
+
+No R168 publication or production activation is authorized by this document.

package/docs/R168-CRASH-JOURNAL-PROTECTED-PREFLIGHT-20261026.md

@@ -0,0 +1,46 @@
+# R168 — Crash journal and protected preflight engineering evidence
+Date: 2026-10-26
+Status: R168_SCRATCH_E2E_VERIFIED / PROTECTED_PRODUCTION_GATE_PENDING / ACTIVATION_NOT_RUN
+
+## Production left unchanged
+- Active machine release observed before engineering: v0.15.61-055d1ff0aa99e60b
+- Active release SHA-256: 055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf
+- Coding standing-grant ARMED and no new authority requested
+- Production old claim c84d7ffa4eee80a2f467acda3ddd9332 not deleted
+- No production owner Ed25519 authorization available
+- 0.15.65 published is NOT activated, 0.15.66 not published
+
+## New R168 work (isolated successor only)
+1. src/activation-reconciliation-journal-r168.mjs
+   SHA-256 f5b2b82f830bfeaa1c1c20cf8020dc0b0ff6437072e67c48adf96cbebe4cb7d7
+   Exclusive "wx" terminal intent, file fsync, readback, exact owner approval/prepared receipt binding and one-use nonce. Read-only restart classification:
+   - PRECOMMIT_CLAIM_PRESENT_BLOCKED
+   - CLAIM_CHANGED_BLOCKED
+   - CAS_OUTCOME_UNKNOWN_BLOCKED
+   - TERMINAL_VERIFIED_ACTIVATION_SEPARATE
+   NO path-delete, authority revoke/restore, auto-retry or auto-activation.
+2. test/r168-crash-journal.test.mjs
+   SHA-256 44818657894db72a0ead65e96e734f30c11f10f5914e2c4e2961ee3a3e5b2c70
+   Five pure fixture crash/interruption cases PLUS a live scratch Win32 integration test. The latter uses the protected R167 0.15.65 R85 addon and the REAL FileIdInfo-pinned native CAS against one disposable simulated claim while all five native R85 locks are held. It verifies intent-before-CAS, claim readback, signed terminal fixture and lock cleanup. Does NOT touch production claim.
+3. scripts/r168-protected-preflight.mjs
+   SHA-256 c8b3551936ff7e24d851d6cad580d11fbf495150558d963b7215230481412e2e
+   Read-only gate requires C:\Program Files, future exact R168/0.15.66 candidate identity, all critical reconciliation sources in the manifest, complete installed-tree byte verification and R89 ACL trust before reporting READY. Rejects skip flags. No CAS, owner signing, grant changes or activation.
+4. test/r168-protected-entrypoint.test.mjs
+   SHA-256 e65c5a762c769ce065d58ce6b75d800609b62a9221f839086129e106bf335980
+   Confirms writable D: successor is rejected, skip-trust rejected and no mutation functions in preflight.
+5. test/r168-combined-targeted-runner.mjs
+   SHA-256 f815c24b39c8f2cc14bc4567d0812df70858a755e6839fadf4106a449ad54f9e
+   Windows observed 42 PASS / 0 FAIL / 0 SKIP, signed execution receipt d4e645ee50b7244bbc2d7054, receipt SHA-256 5f1f95a7e32afe01044fa8c360065c4c1f75f935957aa3f03b23cb4e06f40dda
+   Includes both simulated five-plane cases and one real Native R85 held-handle + FileId CAS scratch case.
+
+## Critical limitations / next gate
+- The R168 source working directory still carries R167/0.15.65 package metadata and the old manifest. This is deliberate NOT a releasable 0.15.66 artifact. The new preflight currently DENIES execution from D: as intended. Full R168 manifest, packaging and protected installation are NOT verified.
+- Journal tests simulate crash outcomes by reopening durable files; they do not establish power-loss-safe parent-directory fsync or signed production crash recovery. The journal file and containing directory still require a protected, handle-pinned commit protocol.
+- The real scratch native CAS test runs with fixture Ed25519 keys, synthetic epoch histories and a disposable claim. It does NOT prove live signed five-plane epoch history/pointer continuity inside a production owner-approved transaction.
+- The production commit entrypoint has NOT been implemented. Must use protected R168 source, real owner-signed subject, exclusive native five-plane R85 fence, final signed audit, native FileId CAS only for exact old claim, signed terminal result and durable crash readback, with activation a separately authorized later operation.
+- If the claim is absent without a valid terminal receipt, remain blocked (do not replay or invent terminal success).
+- The owner has not supplied an independently pinned Ed25519 public key/approval. Do not create or treat ephemeral test keys as production authority.
+- No npm publish, R65 claim deletion, Coding grant change, pointer change, activation or standing authorization mutation was performed in this work.
+
+## Already-published option
+Existing deadbyte-mcp@0.15.65 can be invoked in an isolated npm CLI process for read-only version/doctor checks without switching ChatGPT's production bridge. The production bridge remains on 0.15.61 until the strict activation gate is passed.

package/docs/R168-FIVE-PLANE-FENCE-20261026.md

@@ -0,0 +1,41 @@
+# R168 five-plane epoch exclusion — observed engineering result
+Date: 2026-10-26
+Status: SIMULATED_EXCLUSION_GREEN / R85_PROTECTED_NATIVE_NOT_RUN / NO_PRODUCTION_MUTATION
+
+## Exact source
+- Isolated successor: D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.66-r168-activation-reconcile
+- src/activation-reconciliation-fence-r168.mjs SHA-256 585f0abd6fd9747448b8345bd5b51e80b458eaac162770bc74928242a0cc1549
+- test/r168-five-plane-fence.test.mjs SHA-256 680e97d56a76de152d78c17865c37d627ca9b7c9424edff10565a7a42485170a
+- test/r168-five-plane-fence-runner.mjs SHA-256 4be327e980dba25723d4c5149f501de8fb591b86bba39210f714dc95a4d6a8f0
+- test/r168-combined-targeted-runner.mjs SHA-256 8e6fb457134b9157be68334c0e091de6fdf73afbb1101d3c06754658d82c37bb
+
+## Evidence
+- RED: five tests fail on unimplemented fence, signed receipt c766ff7c0d433e6324128617.
+- GREEN with Node --test worker simulation: eight tests PASS / zero FAIL.
+- Combined R168 focused suite: 25 PASS / zero FAIL, receipt 53183186a60bcad87448201e, signature verification pending independent check.
+- Five-plane sequence: process -> coding -> autonomous -> desktop -> host. Held until callback returns; release in reverse.
+- Full-set directory checks precede any native acquisition. No silent stale-lock recovery.
+- If one plane is locked, callback is never invoked and acquired handles release in reverse.
+- If audit work throws, acquired handles are released; release ambiguity is not suppressed.
+- A simulated concurrent ordinary append cannot acquire the held per-plane lock.
+- The production exported API cannot accept injected/mock acquisitions, including in Node test worker.
+- Simulation exported as separate non-authoritative helper; it is NEVER proof of R85/R89 trust.
+
+## Connection to existing native authority semantics
+- Existing authority-continuity-r65.mjs append uses per-plane authority-epochs/<plane>/.lock.
+- Existing epoch-lock-r85.mjs acquires with the Windows x64 native addon, validates R89 protected installed root, metadata and addon source/digest.
+- Existing native/deadbyte-epoch-lock-r85.cpp holds an exclusive handle with non-reparse ancestor pins. The implementation uses FileRenameInfo on a new temporary leaf and releases by FileDispositionInfo on that held handle.
+- R168 reads and guards all five planes under the same native lock paths, but an actual protected native integration test is still required.
+
+## Remaining release/activation blockers
+1. Candidate metadata still describes 0.15.65/R167: package.json, RELEASE.json and source manifest cannot be used as a final 0.15.66 release.
+2. Exclusive fence is simulated only; exact R168 source must be installed and R89-verified in Program Files, then native exclusion tested there.
+3. Protected owner Ed25519 key must be independently provisioned and pinned, with a fresh one-time owner approval to the exact claim and FileId.
+4. Atomic signed terminal intent/CAS/readback needs an implementation whose authorization, crash-recovery and claim-gating paths are protected; no production deletion has been wired.
+5. Before any activation, recheck same live predecessor, Coding grant, signed five-plane heads, existing old R65 claim and full evidence.
+6. Full protected Windows regression, exact npm package and registry release verification remain pending for 0.15.66. Existing published npm 0.15.65 is unchanged.
+
+## Never infer
+- 25 PASS simulation is not evidence that 0.15.65 or 0.15.66 activated.
+- No signed R168 owner approval has been given.
+- No runtime authority, claim, UAC grants, npm tags or production pointer were changed.

package/docs/R168-NATIVE-EXCLUSION-TERMINAL-CONTRACT-20261026.md

@@ -0,0 +1,53 @@
+# R168 — native exclusion and terminal evidence engineering report
+Date: 2026-10-26
+Status: NATIVE_SCRATCH_VERIFIED / CONTRACT_GREEN / LIVE_RECONCILIATION_NOT_RUN
+
+## Current machine identity
+- Live DEADBYTE MCP runtime: v0.15.61-055d1ff0aa99e60b ONLINE
+- Live manifest SHA-256: 055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf
+- Coding plane: ARMED standing-grant; policy SHA-256 e1351f62567a58ed2444211b2bfc7c0ffceb2eec30895a47594f1974b45f9783
+- Prior ambiguous R65 activation claim and outcome unchanged. R168 owner signature NOT PRESENT.
+- Published npm 0.15.65 remains separate from runtime activation. No publish or activation was attempted.
+
+## Verified changes in isolated R168 successor
+- src/activation-reconciliation-fence-r168.mjs
+  SHA-256 585f0abd6fd9747448b8345bd5b51e80b458eaac162770bc74928242a0cc1549
+  Non-injectable protected production entrypoint; calls R85 native held-handle addon (which enforces R89) on the same .lock used by authority append, in order process/coding/autonomous/desktop/host.
+  All five directories must already exist. Acquired handles are released in reverse. Missing/busy or ambiguous release is fail-closed. No stale automatic reclaim.
+  Separate test-only simulator exists; it is not production authority, and production API rejects injected acquisitions.
+- src/activation-reconciliation-consent-r168.mjs
+  SHA-256 a82b05e1c521cc77f3398985d6faa1beb0fe8f65595f50bed474227550d462c5
+  Strict subject field shape, Ed25519 owner/machine key independence on create AND verify, time-bounded one-time approval, no extra machine-signed authority fields.
+- src/activation-reconciliation-terminal-r168.mjs
+  SHA-256 c1e2672913b70f3f922d7ff4690bb4934cf58147999da9f926d77de8126da44a
+  Pure signed terminal-result create/verify contract. Rejects any CAS outcome except REMOVED and observed claim absence. Requires exact predecessor pointer, outcome, Coding grant/policy and five signed epoch histories unchanged.
+  Archived terminal receipts remain cryptographically verifiable after owner approval expires, but expired approval cannot authorize NEW terminalization.
+  IMPORTANT: this module does NOT perform native CAS, read production files, load signing keys, or create any production terminal receipt.
+
+## Windows observed test evidence
+- Combined targeted suite: 33 PASS, 0 FAIL. Runner: test/r168-combined-targeted-runner.mjs, SHA-256 8e6fb457134b9157be68334c0e091de6fdf73afbb1101d3c06754658d82c37bb.
+  Signed execution receipt: a348c16de229a71112982f0a; SHA-256 310e4083c04469c6b8c5792d25f5571130cbe9ba5f1b9d0c4c2dc6e4021c14bb.
+- Actual R85 protected addon on one scratch lock: 1 PASS, 0 FAIL.
+  Source: C:\Program Files\DEADBYTE-R167-Protected-0.15.65-3316654646cc8705-Fix6
+  Fixture MANIFEST.SHA256 verified SHA-256: 3316654646cc870584a7c969c2032af6c795229ff8c65e5a8b794f97c2458c41
+  Signed execution receipt: 7f2b90542e03ab543ebe8ea1; SHA-256 1ff47595595df331b9d2e546be264b8b0b787db8d30ff8e85a80e70f72b88d11.
+  Two contenders cannot simultaneously acquire the same native lock. Release removes lock and permits reacquisition.
+- Actual R85 addon on all FIVE scratch-plane locks held concurrently: 1 PASS, 0 FAIL.
+  Signed execution receipt: f3f6f17ea14ce6b2c5438b19; SHA-256 17b349ef0a41eeee969347f4f26d4a370a67a9f0f15914c6c78d3a3363f16f36.
+  Competing acquisition for each held native lock returned null. All five files absent after release. No production authority paths touched.
+- Live read-only old claim identity remains stable:
+  Old operation c84d7ffa4eee80a2f467acda3ddd9332
+  Subject SHA-256 b9353eb0e1b20aff9a8af472def677df7b5a9fc21d85a9ccd67b46ddc4b02d83
+  Native FileIdInfo 526e54a56e54841f:79c90100000033000000000000000000
+  Signed history 134 events. Runner receipt 5a4fc88d132616cb0595081b.
+- All four listed signed execution receipts independently verified with signature_valid=true.
+
+## Remaining strict blockers before real use of published 0.15.65 as production
+1. Build a protected exact-byte R168 reconciliation entrypoint and full signed journal with explicit crash-recovery design. R168 source still carries R167/0.15.65 package metadata and old MANIFEST.SHA256; release gate has NOT run for 0.15.66.
+2. Run five-plane Native R85 exclusion with the FINAL real signed audit and native FileIdInfo snapshot under those held handles in an R89 protected R168 entrypoint.
+3. Bind a properly provisioned independent owner Ed25519 public key and obtain per-claim signed owner approval. No owner key provisioned/approved in this session.
+4. Write an exclusive, durable terminal intent proof before any production CAS; make every activation entrypoint honor unresolved intent. Validate windows crash/restart ambiguity and prohibit silent retry.
+5. Under exclusive handles and approved intent, use native handle-identity+SHA-256 CAS only for exact old claim, verify no claim file remains, inspect all five heads/pointer/grant again, and record a durable signed terminal result. On any uncertain result stop without reenabling authority.
+6. Only after separate authorization, perform R167/0.15.65 production activation with signed restoration/rollback proof and remote readback. Do not merge publication with activation.
+
+No one has yet authorized or executed production claim removal. No production grants, pointer, R65 lock or npm release tag was changed by this R168 session.

package/docs/R168-NPX-REMOTE-SKEW-HOTFIX-20261026.md

@@ -0,0 +1,41 @@
+# R168 — npm cache CLI remote skew / accidental activation hotfix
+Date: 2026-10-26
+Status: SOURCE_HOTFIX_VERIFIED / 48_TARGETED_PASS / LIVE_REMOTE_STATUS_PASS / NOT_PUBLISHED / NOT_ACTIVATED
+
+## User-observed bug in published deadbyte-mcp@0.15.65
+- `npx deadbyte-mcp@latest remote status` auto-executed Runtime 0.15.61 -> 0.15.65 activation.
+- Invocation originated from a writable npm _npx cache path and called deploy-r48.mjs without required --authority-epoch-root.
+- R167 denied with '--authority-epoch-root requires a path'. This is expected fail-closed enforcement and NOT proof of a damaged release.
+- A series of `npx@latest remote armprocess/armcoding/...` commands triggered the same unwanted activation attempt. Do not repeat these commands to arm existing production.
+
+## Engineering fix in isolated R168 successor
+- `src/remote-one-shot-coherence-r168.mjs`: pure classification of read-only status commands vs authority/runtime operations when npm CLI version differs from active pointer version. No state writes.
+- `src/deadbyte-cli.mjs`: before any one-shot coherence upgrade, read the active release and select dispatch:
+  1. `status`, `processstatus`, `codingstatus`, `autonomousstatus`, `desktopstatus`, `hoststatus` on skew directly call installed active launcher and issue a VERSION SKEW notice without running npm-cache deployment.
+  2. All arm/disarm/restart and other one-shot actions on skew fail closed before runtime activation, session cleanup or grant mutation.
+  3. Coherent version still goes through original manifest identity and signed coherence checks.
+- Bare foreground `remote` is guarded BEFORE foreground marker acquisition, session recovery and synchronizeForegroundRuntime. On skew, rejects without touching authority. Do not launch foreground remote as an observation substitute: by existing implementation, default foreground session can disarm existing grants on entry/cleanup.
+- The published 0.15.65 package is IMMUTABLE and DOES NOT contain the hotfix. Candidate metadata/manifest for 0.15.66 not yet finalized, and no npm publication authorized.
+
+## Live evidence
+- R168 one-shot regression: 6 PASS / 0 FAIL.
+- Combined R168 focused regression: 48 PASS / 0 FAIL.
+- Combined runner: `test/r168-combined-targeted-runner.mjs`, SHA256 eb5a5e73fd0284297959f4e6ca1631ebf0f23749c56ec1b4cc75cad5f8f1ca6b
+- Signed combined execution receipt: 5af81da9912af1c0c7026688 (signature_valid=true); receipt SHA-256 1d12fe7539d2df5e36bf4c5d6b4fe69a1978f6984f67e1dd2dba12f7c1c54392.
+- Live execution of the R168 successor CLI `remote status`: exit 0; displayed current 0.15.61 ONLINE, Bridge/Core/Cloud verified, Coding ARMED; printed VERSION SKEW. Receipt: e1c1b5b291b0e43766f88767, signature_valid=true.
+- Live `remote armcoding` from R168 successor: exit 1, explicit version skew without calling the controller. Receipt 30f59d4947ffc58edecf985c, signature_valid=true.
+- Live bare `remote` from R168 successor: exit 1 on skew BEFORE a foreground session is claimed.
+- Machine identity after tests: v0.15.61-055d1ff0aa99e60b ONLINE. Coding still ARMED standing-grant.
+
+## Operator-safe immediate use
+- Read current connected runtime with the installed stable launcher (not npx latest):
+  `& "$HOME\.deadbyte-mcp\bin\DEADBYTE-MCP.ps1" status -Json`
+- Or read active pinned version with `npx -y deadbyte-mcp@0.15.61 remote status` when exact published byte identity is verified.
+- Do NOT chain `npx@latest remote arm*`; each command tries incompatible automatic deployment from npm cache.
+- No need to re-arm Coding: the installed runtime's Coding remains ARMED.
+- If a previous npm foreground process remains interactive, end that foreground npm process only; do not stop the existing DEADBYTE bridge or delete R65 claims.
+
+## Still blocked / next release gate
+- R168 successor source still holds R167 0.15.65 package version and old manifest; targeted tests alone do not justify a 0.15.66 publication.
+- Complete separate protected R168 exact-byte release installation, R89 ACL check, full regression, npm packaging closure, and controlled registry publish.
+- Owner-approved terminal reconciliation of old unknown R65 activation claim and independent post-switch activation checks remain required. No production claim deleted, no grants changed.

package/docs/R168-READONLY-AUDIT-AND-RESUME-20261026.md

@@ -0,0 +1,56 @@
+# R168 — observed read-only reconciliation evidence
+Status: READONLY_AUDIT_PASS / CLAIM_NOT_TERMINALIZED / PRODUCTION_UNCHANGED
+Date: 2026-10-26
+
+## Verified Windows observation
+R168 diagnostic command ran via DEADBYTE Coding and returned exit 0.
+- Runner: scripts/r168-audit-readonly.mjs
+- Runner SHA-256: f39904be19bacf16344232e5722a210b74a96c844a1ee0b59e66cdfe41169478
+- Source: src/activation-reconciliation-audit-r168.mjs
+- Source SHA-256: 467268f6f195e9359b819e35c8b418c81e1cb40c9ba04b990fd2656e354c65a5
+- Signed execution receipt: 273b5b7acd1959ce3a694748
+- Receipt SHA-256: 00e16f59375a8756ac385930ba8298470f4b3ba94010637a523e6a45b1425a56
+- Receipt verification: signature_valid=true
+
+Audit result: NO_MATCHING_TRANSACTION_OBSERVED
+- Observation SHA-256: ea486f693d525267d1137b3a903373a155fb1a1b8ffdec7bbd13da3fba14ed7c
+- Old claim: c84d7ffa4eee80a2f467acda3ddd9332
+- Old claim SHA-256: 6ca42d7d0ea784526e3d4bc59309649503f326d8cae518f46622b44419aed748
+- Old outcome SHA-256: 03242edda1bcc09a1abdd954991e8fe31cf201b119fc4229635bd2dd64bcde82
+- Old continuity id: r65-ef42bc84451ce024c4dee736d4047b36
+- Predecessor pointer SHA-256: db806f3353e4ca435a5a3c323b9ddc8e34d719cee43a5193722f8010971050d4
+- Coding policy SHA-256: e1351f62567a58ed2444211b2bfc7c0ffceb2eec30895a47594f1974b45f9783
+- Coding grant SHA-256: 7be43f8421a5bc039e85844ade20d13d02f80cf6b17c7a21537a8080bbfdfb12
+- Coding epoch head SHA-256: e10e59ce8dbaddc8b7635cfe998d1bd20ac0f53b86b3d34bb2a353bb5670a7e3
+- Update inventory: 376 entries; one exact matching old outcome; no R27 candidate prefix for 0.15.64
+- Full signed epoch history: process 27, coding 29, autonomous 24, desktop 28, host 26; total 134 events
+- Every signed event predates old activation claim; none names the old continuity update ID
+- Coding grant remains trusted against signed head
+- Process, Autonomous, Desktop, Host grant files all absent
+- Process, Desktop, Host have historical grant heads without current grant file; that is not an active grant
+- Claim, outcome and pointer hashes unchanged across the audit
+- This is an observation, not a signed R168 terminalization certificate. terminalization_authorized=false.
+
+## Source changes in isolated R168 successor
+- src/activation-reconciliation-audit-r168.mjs: read-only bound inspection, complete signed epoch history checks, grant/policy/pointer comparisons, fail-closed output
+- scripts/r168-audit-readonly.mjs: exact old-claim runner with source SHA-256 pin; no writes
+- test/r168-reconciliation-audit.test.mjs: 5 PASS / 0 FAIL
+- src/npm-publication-resume-r168.mjs: derives integrity, shasum and SHA-256 from a claim-bound preserved tarball; rejects mismatches
+- scripts/npm-release-r48.mjs: uses the complete preserved resume record and checks source manifest against old immutable claim; no npm invocation performed
+- test/r168-npm-resume-identity.test.mjs: RED first 0/3, GREEN final 5/5 including publisher parser syntax
+- Signed GREEN receipt: 229ff91a2207785c8c142525, SHA-256 31b7f9f74ce1d59c0d8bb260b3bb870c6b84c6fd1504e6e9144ae17335d1ee5e
+
+## Still blocked
+Do NOT delete old claim, replay old mutation, activate 0.15.65, publish 0.15.66, or change ACL, authority grants or the active pointer.
+
+Required next engineering stage is an independent signed reconciliation contract that:
+1. Re-runs complete read-only R168 audit immediately before commit.
+2. Binds exact claim/outcome/pointer hash, full signed epoch heads/history inventory, Coding grant/policy, old continuity ID, and the expected operator-approved subject.
+3. Requires an exact ACL-protected release entrypoint before accessing owner signing authority or touching the claim.
+4. Writes a verifiable one-use owner-authorized Ed25519 reconciliation attestation with exclusive no-clobber receipt semantics.
+5. Confirms active runtime and all authority planes again.
+6. Uses Win32 ancestor/leaf-handle-pinned CAS to remove only the exact old claim after approval, never age/PID-based unlink.
+7. Records the signed terminal outcome and confirms state unchanged. If any step is ambiguous, stop without retrying the activation.
+8. Separately closes R168 version metadata, manifest, protected full Windows suite and exact artifact release gates before any new npm publication.
+
+No production mutation or R168 publication was performed in this session.

package/docs/R168-SIGNED-RECONCILIATION-PRECOMMIT-20261026.md

@@ -0,0 +1,45 @@
+# R168 — owner authorization precommit engineering evidence
+Status: PRECOMMIT_CONSENT_VERIFIED / NATIVE_CAS_NOT_RUN / CLAIM_UNCHANGED
+Date: 2026-10-26
+
+## Existing evidence and identity
+- Production: v0.15.61-055d1ff0aa99e60b ONLINE and Coding ARMED.
+- Old claim operation: c84d7ffa4eee80a2f467acda3ddd9332
+- Old outcome: ACTIVATION_OUTCOME_UNKNOWN for 0.15.64 after R89 UNTRUSTED_WRITE_ACE.
+- Read-only observation SHA-256: ea486f693d525267d1137b3a903373a155fb1a1b8ffdec7bbd13da3fba14ed7c
+- Claim exact SHA-256: 6ca42d7d0ea784526e3d4bc59309649503f326d8cae518f46622b44419aed748
+- Native Win32 File ID: 526e54a56e54841f:79c90100000033000000000000000000
+- R168 signed subject SHA-256: b9353eb0e1b20aff9a8af472def677df7b5a9fc21d85a9ccd67b46ddc4b02d83
+- Subject derivation read the claim twice through native FileIdInfo-pinned handles, compared exact identity around a fresh signed five-plane audit, and did not modify any release.
+- Signed command receipt: 8e5ea7840e605eadef6de76a
+- Signed command receipt SHA-256: 1a67398d72c7c66eb66308301a4b9431ecd7ce77d3b2ab56c77996fb5e38b046
+
+## Implemented in R168 successor only
+- src/activation-reconciliation-consent-r168.mjs: canonical subject digest binding, exact per-claim human confirmation, narrow time-bounded Ed25519 owner approval verifier, independently keyed machine authorization attestation, explicit terminalization_committed:false.
+- src/activation-reconciliation-receipt-store-r168.mjs: no-clobber 'wx' file creation, sync, readback and digest verification for one-use authorization evidence. Test fixtures only; not invoked on production.
+- scripts/r168-subject-readonly.mjs: exact pinned live subject audit, fails closed on any drift; no signing or deletion.
+- test/r168-owner-reconciliation-contract.test.mjs: 7 pass / 0 fail, including wrong key, expired approval, tamper, unsigned, duplicate record and independent owner/machine signer roles.
+- test/r168-focused-suite.test.mjs: 17 pass / 0 fail, combining signed epoch evidence, owner consent, and npm resume focused suites.
+- Focused suite signed execution receipt ID: 1a0dbfb8ef111c012038284e
+- Focused suite receipt SHA-256: abedcf8a3ce92a4a12647c3308d02a4de22299269648b5ac13d9ac6bd0a9d53e
+- Only ephemeral Ed25519 test keys were created. No production owner approval exists.
+
+## Why native CAS is not called yet
+The Win32 module src/foreground-marker-cas-win32.mjs supports readPinnedEpochLockSnapshot and deletePinnedRemoteMarker(expectedSha, expectedFileId); it pins ancestor handles and validates exact SHA-256/FileIdInfo.
+However, the five independently mutable authority epoch histories and the activation claim do NOT have an established shared exclusion lock. A read-only audit followed by a deletion is not an atomic proof of absence of intervening authority changes. Therefore no production CAS has been wired or run.
+
+### Required owner/production gate
+1. Establish a trusted, independently pinned owner Ed25519 public key that is NOT the machine signer key. Its origin and provisioning must be reviewed; no default, guessed or generated production approval.
+2. Run only from an R89 verified protected install whose shipped bytes match the intended candidate; never from writable D: or npm cache.
+3. Provide a separate one-time action preview: old claim operation, native File ID, subject digest, exact Code grant, active runtime, consequences of terminalization. Default is decline.
+4. Obtain owner signature and exact typed confirmation for that subject. Treat a changed audit or lock identity as requiring new consent.
+5. Engineer and verify exclusive authority/claim handoff across all five epoch planes, with no writes/revokes permitted between final audit and native CAS.
+6. Persist a signed, bounded, no-clobber terminal intent proof before CAS; verify it and the epoch/pointer state with handles held. Only then use native CAS to remove the exact old claim. A crash after intent but before CAS must leave activation blocked; never age/PID cleanup.
+7. Post-CAS verified readback and signed terminal outcome. If ambiguous, do not replay or attempt activation.
+8. Separately finish R168 version metadata, manifest, full protected Windows regression, npm packaging and external release gates. 0.15.65 registry publication and 0.15.66 production activation remain separate.
+
+## Forbidden
+- No deletion of r65-activation.lock by pathname or manually.
+- No manual grant edits/re-arm, UAC bypass or new standing grants.
+- No reinterpretation of test-signing keys as production owner authorization.
+- No publish of 0.15.66 or activation from this precommit test evidence.

package/docs/R169-NPX-ACTIVE-CONTROLLER-DELEGATION-20261026.md

@@ -0,0 +1,57 @@
+# R169 — npx latest active-controller delegation
+Date: 2026-10-26
+Status: DELEGATION_IMPLEMENTED / 57_OF_57_TARGETED_PASS / PRODUCTION_R89_GRANT_BLOCKED / NOT_PUBLISHED
+
+## User objective
+Allow explicit `npx deadbyte-mcp@latest remote armprocess` and the other exact arm/disarm verbs to reach the currently installed stable controller when the npm CLI and active runtime have version skew, without automatic activation, R65 claim removal, modifying grants to bypass authorization, or downgrading.
+
+## Published baseline preserved
+- Public npm latest: deadbyte-mcp@0.15.66, immutable
+- Active runtime: v0.15.61-055d1ff0aa99e60b ONLINE, Coding ARMED
+- Process DISARMED, Autonomous/Desktop/Host not changed
+- R65 activation claim preserved
+- Isolated copy of published R168 source at:
+  D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.67-r169-npx-delegation
+- Exact predecessor MANIFEST.SHA256: 962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8
+- R169 is DEVELOPMENT ONLY. package.json and release metadata still 0.15.66; no candidate release closure and no npm publish.
+
+## Surgical source changes
+- src/remote-one-shot-coherence-r168.mjs
+  SHA-256 cd3e021e1f53d36a11ffee07f8e8538933e76f33b7daa5bd497f22a7d33f5731
+  Explicit arm/disarm verbs from NEWER CLI to OLDER active runtime => delegate_active
+  Read-only status => observe_active
+  Restart, stop, start, clean, toggles, menu, tests => blocked_version_skew
+  CLI older than installed runtime => blocked_version_skew
+  No active binding => mutating verbs rejected
+- src/active-controller-delegation-r169.mjs
+  SHA-256 ab2bcc118e3b4898e942e60d639ef8b2d9c6964c8036a57bd37ce2aa600de302
+  Guard requires stable launcher path under active state root, exact launcher SHA256 matching active pointer, exact active release manifest digest, generation manifest digest, bounded regular files, and ancestry constraints. Does not sign, arm or activate.
+- src/deadbyte-cli.mjs
+  SHA-256 6531590c658012a2aae238f9bcb21421249b31a9b6527079655fa0a5869e797c
+  One-shot runRemote dispatches delegated commands only via installed PowerShell controller, with active pointer identity checks before and after.
+  It skips synchronizeOneShotRuntime / npm cache deployment in delegated path. The installed launcher still enforces existing R89/authority policy.
+
+## Tests and live evidence
+- R169 selector behavioral TDD RED (expected blocked_version_skew), GREEN 4/4 PASS.
+- R169 CLI integration test TDD RED (attempted runtime coherence instead of delegation), GREEN.
+- Four CLI integration cases: success in scratch, tampered launcher rejected, altered release manifest rejected, escaped release root rejected.
+- Combined R168/R169 targeted regression: 57 PASS / 0 FAIL / 0 SKIP.
+- Signed combined run receipt d3d10ab64ed6316c08fcfe74, receipt SHA-256 75fe5165727008e997ebbce5eed7082a19ac2c898d97eea39b62cac4dc14892a, signature_valid=true.
+- Live read-only Process controller status: DISARMED.
+- Live exact R169 code delegated `remote armprocess` to ACTIVE 0.15.61 controller (not npm deployment); the controller rejected grant:
+  `DEADBYTE AUTHORITY EPOCH: R89 privileged installation not protected: UNTRUSTED_WRITE_ACE`
+  `DEADBYTE controller: authority epoch command 'grant' failed for process (exit=1)`
+- Live failed grant command signed execution receipt 9abb7b902bc68638a9d24d09, receipt SHA-256 221ecc71038e34ff1546c5f2e2b091514a03b1f6d3a493df75d8a2dd6d8b3225, signature_valid=true.
+- Post-failure production machine_status: 0.15.61 same release ID ONLINE, Coding ARMED. Process remains DISARMED.
+
+## Root blocker and next gate
+The R89 native addon loader src/epoch-lock-r85.mjs derives its source root from the installed runtime release and calls inspectTrustedInstallation(privilegedEpochInstallFiles(root,process.execPath)). Production 0.15.61 authority-grant execution resolves to a runtime package under a user-writable state installation; its ACL chain was rejected as UNTRUSTED_WRITE_ACE. Forwarding via npx successfully reaches the existing controller but cannot make a denied grant lawful.
+Do NOT use weaker ACL rules, rewrite signatures, remove an old R65 claim, alter policy files, or assume a successful arm from a successful process dispatch.
+
+Before release/activation:
+1. Resolve the protected R89 authority runtime install and binding so grant requests run from exact trusted protected bytes. Observe and test under Windows ACL evidence without widening permissions.
+2. Complete owner-authorized R65 old-claim reconciliation and crash-safe terminal outcome under native five-plane exclusion, separately from new production activation.
+3. Only then activate the intended published/runtime version under explicit authorization, verify all five planes, preserve Coding, and validate `npx@latest` at the real controller boundary.
+4. If R169 forwarding is still desired afterward, finalize 0.15.67 package identity, manifest/provenance, protected focused/full regression, npm verify-only, exact-byte closure and explicit npm publish. Never publish development code as 0.15.66 again.
+
+R169 tests do NOT prove successful live privilege granting or a new published npm version. No production activation, R65 claim deletion or manual grant edits occurred.

package/node_modules/which/CHANGELOG.md

@@ -0,0 +1,166 @@
+# Changes
+
+
+## 2.0.2
+
+* Rename bin to `node-which`
+
+## 2.0.1
+
+* generate changelog and publish on version bump
+* enforce 100% test coverage
+* Promise interface
+
+## 2.0.0
+
+* Parallel tests, modern JavaScript, and drop support for node < 8
+
+## 1.3.1
+
+* update deps
+* update travis
+
+## v1.3.0
+
+* Add nothrow option to which.sync
+* update tap
+
+## v1.2.14
+
+* appveyor: drop node 5 and 0.x
+* travis-ci: add node 6, drop 0.x
+
+## v1.2.13
+
+* test: Pass missing option to pass on windows
+* update tap
+* update isexe to 2.0.0
+* neveragain.tech pledge request
+
+## v1.2.12
+
+* Removed unused require
+
+## v1.2.11
+
+* Prevent changelog script from being included in package
+
+## v1.2.10
+
+* Use env.PATH only, not env.Path
+
+## v1.2.9
+
+* fix for paths starting with ../
+* Remove unused `is-absolute` module
+
+## v1.2.8
+
+* bullet items in changelog that contain (but don't start with) #
+
+## v1.2.7
+
+* strip 'update changelog' changelog entries out of changelog
+
+## v1.2.6
+
+* make the changelog bulleted
+
+## v1.2.5
+
+* make a changelog, and keep it up to date
+* don't include tests in package
+* Properly handle relative-path executables
+* appveyor
+* Attach error code to Not Found error
+* Make tests pass on Windows
+
+## v1.2.4
+
+* Fix typo
+
+## v1.2.3
+
+* update isexe, fix regression in pathExt handling
+
+## v1.2.2
+
+* update deps, use isexe module, test windows
+
+## v1.2.1
+
+* Sometimes windows PATH entries are quoted
+* Fixed a bug in the check for group and user mode bits. This bug was introduced during refactoring for supporting strict mode.
+* doc cli
+
+## v1.2.0
+
+* Add support for opt.all and -as cli flags
+* test the bin
+* update travis
+* Allow checking for multiple programs in bin/which
+* tap 2
+
+## v1.1.2
+
+* travis
+* Refactored and fixed undefined error on Windows
+* Support strict mode
+
+## v1.1.1
+
+* test +g exes against secondary groups, if available
+* Use windows exe semantics on cygwin & msys
+* cwd should be first in path on win32, not last
+* Handle lower-case 'env.Path' on Windows
+* Update docs
+* use single-quotes
+
+## v1.1.0
+
+* Add tests, depend on is-absolute
+
+## v1.0.9
+
+* which.js: root is allowed to execute files owned by anyone
+
+## v1.0.8
+
+* don't use graceful-fs
+
+## v1.0.7
+
+* add license to package.json
+
+## v1.0.6
+
+* isc license
+
+## 1.0.5
+
+* Awful typo
+
+## 1.0.4
+
+* Test for path absoluteness properly
+* win: Allow '' as a pathext if cmd has a . in it
+
+## 1.0.3
+
+* Remove references to execPath
+* Make `which.sync()` work on Windows by honoring the PATHEXT variable.
+* Make `isExe()` always return true on Windows.
+* MIT
+
+## 1.0.2
+
+* Only files can be exes
+
+## 1.0.1
+
+* Respect the PATHEXT env for win32 support
+* should 0755 the bin
+* binary
+* guts
+* package
+* 1st

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.65",
+  "version": "0.15.67",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -95,7 +95,10 @@
     "r67:shard:run": "node scripts/r67-regression-shard-run.mjs",
     "r67:shard:verify": "node scripts/r67-regression-reconcile.mjs",
     "r167:focused:test": "node --test --test-concurrency=1 test/r167-activation-path.test.mjs test/r167-release-contract.test.mjs test/r167-release-readiness.test.mjs test/r160-release-contract.test.mjs test/r158-epoch-bootstrap.test.mjs test/r65-activation-orchestration.test.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r167.ps1 -Stage all"
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r168.ps1 -Stage all",
+    "r168:focused:test": "node test/r168-combined-targeted-runner.mjs",
+    "r168:release:verify": "node scripts/npm-release-r48.mjs --verify-only",
+    "r172:focused:test": "node --test --test-concurrency=1 test/r172-activation-recovery.test.mjs test/r172-release-contract.test.mjs test/r169-delegate-active.test.mjs test/r169-delegate-cli-integration.test.mjs test/r65-activation-lock-recovery.test.mjs test/r65-activation-orchestration.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",