deadbyte-mcp 0.15.68 → 0.15.70

package/RELEASE.json

@@ -1,31 +1,48 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.68",
-  "train": "R173",
-  "label": "R173 epoch-revoked authority proof hotfix",
+  "version": "0.15.70",
+  "train": "R190",
+  "label": "R190 explicit protected foreground ownership recovery candidate",
   "protocol_revision": "2026-07-28",
   "parent": {
-    "version": "0.15.61",
-    "release_id": "v0.15.61-055d1ff0aa99e60b",
-    "manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
-    "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4",
+    "version": "0.15.68",
+    "release_id": "v0.15.68-ff29dbb2fbb89862",
+    "manifest_sha256": "ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885",
+    "generation_manifest_sha256": "2887d4a8d54ea6fc6b28869072f72491c892dfe28178b3537936dce958147bd2",
     "activation_status": "PRODUCTION_ACTIVE"
   },
   "runtime_predecessor": {
-    "version": "0.15.61",
-    "release_id": "v0.15.61-055d1ff0aa99e60b",
-    "manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
-    "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4"
+    "version": "0.15.68",
+    "release_id": "v0.15.68-ff29dbb2fbb89862",
+    "manifest_sha256": "ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885",
+    "generation_manifest_sha256": "2887d4a8d54ea6fc6b28869072f72491c892dfe28178b3537936dce958147bd2"
+  },
+  "r190_foreground_recovery": {
+    "status": "PREPUBLISH_VERIFIED",
+    "npm_published": false,
+    "production_activated": false,
+    "live_marker_reconciled": true,
+    "authority_mutation_allowed": false,
+    "runtime_mutation_allowed": false,
+    "confirmed_live_defect": "R179 requires an explicit owner command for legacy foreground recovery but 0.15.69 exposes no such command",
+    "command": "remote reconcileforeground --confirm-marker-sha256 <sha256>",
+    "protected_full_regression": "PASS_2090_OF_2141_51_CLASSIFIED_SKIP_0_FAIL",
+    "protected_full_transcript_sha256": "85bbd8088ee25fabd37bd062cf1ec0ad83c43e04abeee81881fc009755a9dd32",
+    "npm_verify_only": "PASS_EXACT_TREE_PRE_METADATA_SEAL",
+    "live_foreground": "PASS_ACTIVE_0.15.68_READY_SIGNED_PING_AND_MCP_CALLS",
+    "legacy_guardian_cleanup": "ACTIVE_0.15.68_RETAINED_MARKER_RECONCILED_BY_PROTECTED_R190_CAS",
+    "public_tool_delta": 0,
+    "authority_scope_delta": 0
   },
   "source_predecessor": {
-    "version": "0.15.67",
-    "train": "R172",
-    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery",
+    "version": "0.15.69",
+    "train": "R179",
+    "source_path": "https://registry.npmjs.org/deadbyte-mcp/-/deadbyte-mcp-0.15.69.tgz",
     "release_status": "PUBLISHED_REGISTRY_VERIFIED",
-    "manifest_status": "VERIFIED_FINAL_BYTES",
-    "manifest_sha256": "4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8",
-    "tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d"
+    "manifest_status": "PUBLISHED_PREVIEW_MANIFEST_VERIFIED_NOT_ACTIVE",
+    "manifest_sha256": "cfede112761da00e73b626cfbce23d17e1d4b6e3a325bb675415196d31142ba0",
+    "tarball_sha256": "578c1630608f9df816524c78abc9e1a55357fdc3cd25e142122f1a823e1d69e3"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -548,5 +565,18 @@
     "npm_publish": "NOT_RUN",
     "production_activation": "NOT_RUN",
     "stable_final_claim": false
+  },
+  "r179": {
+    "scope": "FOREGROUND_OBSERVATION_ONLY_CRASH_GUARDIAN_AND_READABLE_WINDOWS_LOGS",
+    "source_predecessor_version": "0.15.68",
+    "source_predecessor_manifest_sha256": "ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885",
+    "source_predecessor_tarball_sha256": "1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf",
+    "owner_approved_autonomous_grant": "NOT_ISSUED",
+    "protected_full_regression": "NOT_VERIFIED",
+    "windows_gate": "BLOCKED_R89_UNTRUSTED_INSTALLATION",
+    "foreground_live_integration": "NOT_VERIFIED",
+    "npm_publish": "NOT_RUN",
+    "production_activation": "NOT_RUN",
+    "stable_final_claim": false
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r173:0.15.68",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r190:0.15.70",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.68"
+      "version": "0.15.70"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.68",
-  "train": "R173",
+  "version": "0.15.70",
+  "train": "R190",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,11 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r190-explicit-foreground-recovery",
+      "command": "node --test --test-concurrency=1 test/r190-foreground-owner-recovery.test.mjs test/r190-foreground-cli.test.mjs",
+      "expected": "Exact legacy marker hash, PID-reuse proof, pointer and authority vector are bound; native CAS deletion is marker-only and crash-resumable"
+    },
     {
       "id": "r160-receipt-startup-identity",
       "command": "node --test test/r153-marker-reconcile-receipt.test.mjs test/r159-legacy-marker-evidence.test.mjs test/r160-marker-proof.test.mjs test/r160-package-decision-manifest.test.mjs",
@@ -124,6 +129,21 @@
       "id": "r168-claim-preservation",
       "command": "Verify read-only R168 signed epoch audit and old R65 claim",
       "expected": "Unresolved claim is preserved; no test key used as owner approval; production pointer and Coding scope unchanged"
+    },
+    {
+      "id": "r179-owner-authorized-autonomous",
+      "command": "Issue independently signed owner consent from protected broker, verify exact policy and epoch, then arm Autonomous",
+      "expected": "Owner proof bound to active release, scoped project, policy hashes, expiry and independently protected signing key"
+    },
+    {
+      "id": "r179-protected-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs in exact protected 0.15.69 installation",
+      "expected": "Zero failures; all skips reviewed; R89 trusted installation and native tests pass"
+    },
+    {
+      "id": "r179-live-log-and-foreground",
+      "command": "Run Ctrl+C, restart, crash and concurrent sessions with pre-existing standing grants and confirm no implicit revocation",
+      "expected": "Owner standing grants unchanged; observation-only marker CAS; signed audit remains verifiable"
     }
   ],
   "observed_pre_release_evidence": {
@@ -645,5 +665,27 @@
     "new_authority_scopes": 0,
     "publication": "NOT_RUN",
     "production_activation": "NOT_RUN"
+  },
+  "r179": {
+    "owner_consent": "NOT_VERIFIED",
+    "protected_full": "NOT_VERIFIED",
+    "foreground_live": "NOT_VERIFIED",
+    "package_verify_only": "PASS_2552_MANIFEST_ENTRIES",
+    "registry_publish": "NOT_RUN",
+    "production_activation": "NOT_RUN"
+  },
+  "r190": {
+    "status": "PREPUBLISH_VERIFIED_BEFORE_FINAL_METADATA_SEAL",
+    "targeted_source": "PASS_14_OF_14",
+    "targeted_protected": "PASS_14_OF_14",
+    "full_protected": "PASS_2090_OF_2141_51_CLASSIFIED_SKIP_0_FAIL",
+    "full_protected_transcript_sha256": "85bbd8088ee25fabd37bd062cf1ec0ad83c43e04abeee81881fc009755a9dd32",
+    "npm_verify_only": "PASS_PRE_FINAL_METADATA_SEAL",
+    "live_marker_reconciliations": 2,
+    "live_foreground_mcp": "PASS_23_CALLS_22_OK_1_EXPECTED_DENIED_0_UNKNOWN_0_MUTATIONS",
+    "active_runtime_after_test": "v0.15.68-ff29dbb2fbb89862_ONLINE",
+    "authority_after_test": "ALL_FIVE_PLANES_DISARMED",
+    "publication": "NOT_RUN",
+    "production_activation": "NOT_RUN"
   }
 }

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.68",
+  "version": "0.15.70",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-controller.ps1

@@ -1015,6 +1015,10 @@ function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [st
             'src\foreground-marker-cas-win32.mjs',
             'src\foreground-process-identity.mjs',
             'src\windows-powershell-environment.mjs',
+            'scripts\r186-owner-grant-cli.mjs',
+            'src\r186-owner-grant-broker.mjs',
+            'src\r186-owner-consent-preflight.mjs',
+            'src\r70-owner-approval.mjs',
             'bin\deadbyte-epoch-lock-r85.node',
             'docs\R85-EPOCH-LOCK-BINARY.json',
             'native\deadbyte-epoch-lock-r85.cpp'
@@ -1391,6 +1395,57 @@ function Get-AutonomousLeaseStatus($Cfg) {
     return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
+function Invoke-R186ProtectedAutonomousGrant($Cfg, $Meta) {
+    if (-not $Cfg.ContainsKey('AuthorityEpochRoot') -or [string]::IsNullOrWhiteSpace([string]$Cfg.AuthorityEpochRoot)) {
+        Fail 'R70_OWNER_ENROLLMENT_REQUIRED: protected authority root unavailable'
+    }
+    $protectedRoot = [System.IO.Path]::GetFullPath([string]$Cfg.AuthorityEpochRoot)
+    $releaseRoot = [System.IO.Path]::GetFullPath([string]$Cfg.CoreRoot)
+    $relativeFiles = @(
+        'scripts\r186-owner-grant-cli.mjs',
+        'src\r186-owner-grant-broker.mjs',
+        'src\r186-owner-consent-preflight.mjs',
+        'src\r70-owner-approval.mjs',
+        'src\authority-continuity-r65.mjs',
+        'src\privileged-install-trust-r89.mjs',
+        'src\epoch-lock-r85.mjs',
+        'src\canonical-json.mjs',
+        'src\text-policy.mjs',
+        'src\foreground-marker-cas-win32.mjs',
+        'src\foreground-process-identity.mjs',
+        'src\windows-powershell-environment.mjs',
+        'src\release-slot.mjs',
+        'bin\deadbyte-epoch-lock-r85.node',
+        'docs\R85-EPOCH-LOCK-BINARY.json',
+        'native\deadbyte-epoch-lock-r85.cpp'
+    )
+    $releaseManifest = Join-Path $releaseRoot 'MANIFEST.SHA256'
+    $protectedManifest = Join-Path $protectedRoot 'MANIFEST.SHA256'
+    if (-not (Test-Path -LiteralPath $releaseManifest -PathType Leaf) -or
+        -not (Test-Path -LiteralPath $protectedManifest -PathType Leaf) -or
+        (Get-ExecutableHash $releaseManifest) -cne (Get-ExecutableHash $protectedManifest)) {
+        Fail 'R186 protected owner broker release manifest mismatch'
+    }
+    foreach ($relative in $relativeFiles) {
+        $source = Join-Path $releaseRoot $relative
+        $protected = Join-Path $protectedRoot $relative
+        if (-not (Test-Path -LiteralPath $source -PathType Leaf) -or
+            -not (Test-Path -LiteralPath $protected -PathType Leaf) -or
+            (Get-ExecutableHash $source) -cne (Get-ExecutableHash $protected)) {
+            Fail "R186 protected owner broker source mismatch: $relative"
+        }
+    }
+    Assert-ProtectedEpochSourceAcl -Files @($relativeFiles | ForEach-Object { Join-Path $protectedRoot $_ })
+    $cli = Join-Path $protectedRoot 'scripts\r186-owner-grant-cli.mjs'
+    $node = [string]$Cfg.Bridge.FilePath
+    if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'R186 protected owner broker Node unavailable' }
+    $output = @(& $node $cli $RuntimeDir ([string]$Cfg.CodingPolicyFile) ([string]$Cfg.AutonomousPolicyFile))
+    $exit = $LASTEXITCODE
+    if ($exit -ne 0) { Fail "R70_OWNER_ENROLLMENT_REQUIRED: protected owner grant broker rejected (exit=$exit)" }
+    try { return (($output -join [Environment]::NewLine) | ConvertFrom-Json) }
+    catch { Fail 'R186 protected owner grant broker returned invalid JSON' }
+}
+
 function Arm-Autonomous($Cfg) {
     $coding = Get-CodingLeaseStatus $Cfg
     if (-not $coding.Armed) { Fail 'autonomous plane requires an active coding lease; run armcoding first' }
@@ -1403,7 +1458,16 @@ function Arm-Autonomous($Cfg) {
     $legacyOwnerPolicySha256 = '6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5'
     $selectedRoots = @($meta.RootIds)
     if ([string]$meta.Sha256 -cne $legacyOwnerPolicySha256 -or $selectedRoots.Count -ne 1 -or [string]$selectedRoots[0] -cne 'core') {
-        Fail 'R70_OWNER_ENROLLMENT_REQUIRED: project/successor Autonomous grant needs independent owner authorization before arm'
+        $ownerApproval = Join-Path $RuntimeDir 'owner-consent\autonomous-approval.json'
+        if (-not (Test-Path -LiteralPath $ownerApproval -PathType Leaf)) {
+            Fail 'R70_OWNER_ENROLLMENT_REQUIRED: bounded owner approval is absent'
+        }
+        $issued = Invoke-R186ProtectedAutonomousGrant $Cfg $meta
+        if ($null -eq $issued -or [string]$issued.status -cne 'GRANTED' -or $issued.authority_granted -ne $true) {
+            Fail 'R70_OWNER_ENROLLMENT_REQUIRED: protected owner grant broker did not issue authority'
+        }
+        Write-Host 'AUTONOMOUS PLANE ENABLED BY OWNER-SIGNED BOUNDED GRANT'
+        return
     }
     Ensure-Directory $RuntimeDir
     $nonceBytes = New-Object byte[] 32

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/R184-package-lock.json

@@ -0,0 +1,97 @@
+{
+  "name": "deadbyte-mcp",
+  "version": "0.15.70",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "deadbyte-mcp",
+      "version": "0.15.70",
+      "bundleDependencies": [
+        "@modelcontextprotocol/server",
+        "@modelcontextprotocol/client",
+        "typescript",
+        "zod"
+      ],
+      "dependencies": {
+        "@modelcontextprotocol/client": "2.3.1",
+        "@modelcontextprotocol/server": "2.3.1",
+        "typescript": "5.9.3",
+        "zod": "4.4.3"
+      },
+      "bin": {
+        "deadbyte-mcp": "src/deadbyte-cli.mjs"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/@modelcontextprotocol/client": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.3.1.tgz",
+      "integrity": "sha512-mIGZXpHsjnZ6lD+gD/WCMpR5k8yVQQ8nNFH1N0Srf7AvnwTUMYD6pvTY8ng2+He5FfV7YMZLmrjL7cLa/cc3dQ==",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@modelcontextprotocol/core": "2.3.1",
+        "cross-spawn": "^7.0.5",
+        "eventsource": "^3.0.2",
+        "eventsource-parser": "^3.0.8",
+        "jose": "^6.1.3",
+        "pkce-challenge": "^5.0.0",
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@modelcontextprotocol/core": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.3.1.tgz",
+      "integrity": "sha512-laVmIhPGpWi7rG9q+0UigblRN0Hws/Yjlb6qLFtVqryXVLkc4h+yN8z731POD2LnAGQlFe7/tXhUm7Bi0YB91g==",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@modelcontextprotocol/server": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.3.1.tgz",
+      "integrity": "sha512-e59MfWuSssj6DoQ96JCTqdW1AXT5/XtnTl0WWd6MU1Ka434fFUGGosCLJbGNySDhHGvxQWoRWK137FXYFkYNWw==",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@modelcontextprotocol/core": "2.3.1",
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {"path-key":"^3.1.0","shebang-command":"^2.0.0","which":"^2.0.1"},
+      "engines": {"node":">= 8"}
+    },
+    "node_modules/eventsource": {
+      "version":"3.0.7","inBundle":true,"license":"MIT",
+      "dependencies":{"eventsource-parser":"^3.0.1"},"engines":{"node":">=18.0.0"}
+    },
+    "node_modules/eventsource-parser": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=18.0.0"}},
+    "node_modules/isexe": {"version":"2.0.0","inBundle":true,"license":"ISC"},
+    "node_modules/jose": {"version":"6.2.10","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/panva"}},
+    "node_modules/path-key": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
+    "node_modules/pkce-challenge": {"version":"5.0.1","inBundle":true,"license":"MIT","engines":{"node":">=16.20.0"}},
+    "node_modules/shebang-command": {"version":"2.0.0","inBundle":true,"license":"MIT","dependencies":{"shebang-regex":"^3.0.0"},"engines":{"node":">=8"}},
+    "node_modules/shebang-regex": {"version":"3.0.0","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
+    "node_modules/typescript": {"version":"5.9.3","inBundle":true,"license":"Apache-2.0","bin":{"tsc":"bin/tsc","tsserver":"bin/tsserver"},"engines":{"node":">=14.17"}},
+    "node_modules/which": {"version":"2.0.2","inBundle":true,"license":"ISC","dependencies":{"isexe":"^2.0.0"},"bin":{"node-which":"bin/node-which"},"engines":{"node":">= 8"}},
+    "node_modules/zod": {"version":"4.4.3","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/colinhacks"}}
+  }
+}

package/docs/R186-OWNER-CONSENT-HANDOFF.txt

@@ -0,0 +1,87 @@
+DEADBYTE MCP / R186 OWNER CONSENT
+2026-10-28
+
+CURRENT STATE
+
+production remains 0.15.68
+R185 exact tarball 0.15.69 is frozen and protected regression was green
+R186 is an isolated development successor and is not published or activated
+
+WHAT R186 ADDS
+
+src/r186-owner-consent-preflight.mjs
+  verifies owner Ed25519 public key against an exact pinned fingerprint
+  verifies the R70 project/policy/artifact/time-bound signature
+  returns verified_readonly and authority_granted=false
+
+scripts/r186-owner-consent-check.mjs
+  loads public owner trust only from these fixed Windows locations
+
+  C:\Program Files\DEADBYTE-OwnerTrust\owner-anchor.json
+  C:\Program Files\DEADBYTE-OwnerTrust\owner-public.pem
+
+  requires the native R89 protected ACL check for the owner files
+  requires protected exact installation for executable verifier source
+  verifies the entire installed release manifest before trusting a proof
+  derives policy SHA256 from the actual policy files
+  derives reviewed_artifact_sha256 from the exact installed MANIFEST.SHA256 bytes
+  refuses to enroll a key or grant any authority
+
+OWNER ACTION REQUIRED OUTSIDE THIS AGENT
+
+the owner must generate and retain the Ed25519 private key on an independently
+controlled device that DEADBYTE MCP and ChatGPT cannot read or execute on
+do not send private key bytes or passwords to ChatGPT or DEADBYTE MCP
+
+the owner must inspect and approve the public key fingerprint before a trusted
+administrator-only installation at the two fixed Program Files paths
+owner-anchor.json must have exactly these fields:
+
+  schema = deadbyte.r186-owner-anchor.v1
+  owner_key_id = lowercase SHA256 of Ed25519 SPKI DER public key
+
+owner-public.pem contains only that public key
+both files and their ancestor paths must pass Windows R89 ACL trust
+
+AFTER A PROTECTED R186 RELEASE EXISTS
+
+prepare an R70 owner subject for the exact installed release manifest
+bind root_id, real project_root, the exact coding and autonomous policy SHA256
+bind issued_at_utc and expires_at_utc to at most 1 hour
+
+the owner signs that exact subject using the independent private key
+the signed R70 approval is submitted as data, not as an owner key
+R186 preflight may then report verified_readonly
+
+STILL REQUIRED BEFORE ARMING OR PUBLISH
+
+a separate protected one-time acceptance broker that consumes the owner approval
+owner proof bound to native signed epoch and no-clobber race/crash recovery
+agent-writable consent receipts must never act as grant issuance authority
+controller Arm-Autonomous must invoke that protected broker on the current
+verified runtime with no fallback to a writable source or caller-supplied key
+the owner must explicitly approve this new authority issuance
+run full protected regression again on exact new tarball
+run real foreground live integration without revoking owner standing grants
+publish only after independent release gate passes
+activation is a separate user-approved step
+
+NO PUBLISH AND NO GRANT HAVE OCCURRED IN R186
+
+LIVE OWNER TRUST INVENTORY / 2026-10-28
+
+old public key: C:\Users\DEADBYTE\.deadbyte-mcp\trust\r70-owner-public.pem
+format: Ed25519 public only
+SPKI DER SHA256: b07c6312673a190af6ac40fe86830dfe8c60e2747405f5151b9ae9bb9a71ad10
+owner: local DEADBYTE account, writable to that account
+R89 result: EPOCH_NATIVE_SLOT_UNTRUSTED
+new protected C:\Program Files\DEADBYTE-OwnerTrust enrollment: NOT PRESENT
+
+this fingerprint is an observation, not independent proof of owner enrollment
+before any migration, the owner must compare it out of band with the key held
+on their independent device and approve exact scope and expiry
+
+R186 FOCUSED RESULT
+29 pass / 0 fail / 0 skip for R70, R174 and R186
+independent trust enrollment: NOT RUN
+one-time protected grant issuance: NOT IMPLEMENTED

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.68",
+  "version": "0.15.70",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/install-r186-owner-trust.ps1

@@ -0,0 +1,59 @@
+#requires -Version 5.1
+#requires -RunAsAdministrator
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$OwnerPublicKeyPath,
+    [Parameter(Mandatory=$true)][string]$NodePath
+)
+$ErrorActionPreference = 'Stop'
+$target = 'C:\Program Files\DEADBYTE-OwnerTrust'
+$packageRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+$programFiles = [System.IO.Path]::GetFullPath($env:ProgramFiles).TrimEnd('\') + '\'
+if (-not ($packageRoot.TrimEnd('\') + '\').StartsWith($programFiles,[System.StringComparison]::OrdinalIgnoreCase)) {
+    throw 'R186 owner enrollment installer must run from a protected Program Files package'
+}
+if (-not (Test-Path -LiteralPath $NodePath -PathType Leaf)) { throw 'R186 Node executable missing' }
+if (-not (Test-Path -LiteralPath $OwnerPublicKeyPath -PathType Leaf)) { throw 'R186 owner public key missing' }
+if (Test-Path -LiteralPath $target) { throw 'R186 owner trust already exists; replacement requires a separate revocation workflow' }
+$inspect = Join-Path $packageRoot 'scripts\r186-owner-anchor-inspect.mjs'
+if (-not (Test-Path -LiteralPath $inspect -PathType Leaf)) { throw 'R186 protected anchor inspector missing' }
+$json = @(& $NodePath $inspect ([System.IO.Path]::GetFullPath($OwnerPublicKeyPath))) -join [Environment]::NewLine
+if ($LASTEXITCODE -ne 0) { throw 'R186 owner public key inspection failed' }
+$material = $json | ConvertFrom-Json
+if ([string]$material.anchor.schema -cne 'deadbyte.r186-owner-anchor.v1' -or
+    [string]$material.anchor.owner_key_id -cnotmatch '^[0-9a-f]{64}$' -or
+    [string]$material.public_key_pem -notmatch 'BEGIN PUBLIC KEY') { throw 'R186 owner anchor material invalid' }
+Write-Host ''
+Write-Host 'DEADBYTE OWNER KEY FINGERPRINT (SHA-256 SPKI):'
+Write-Host ([string]$material.anchor.owner_key_id) -ForegroundColor Yellow
+Write-Host 'Confirm this fingerprint using your independent owner-key display.'
+$typed = Read-Host 'Type the complete 64-character fingerprint to enroll it'
+if ([string]$typed -cne [string]$material.anchor.owner_key_id) { throw 'R186 owner fingerprint confirmation mismatch' }
+
+$admins = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$system = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')
+$users = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+$none = [System.Security.AccessControl.PropagationFlags]::None
+$allow = [System.Security.AccessControl.AccessControlType]::Allow
+New-Item -ItemType Directory -Path $target -ErrorAction Stop | Out-Null
+$dirAcl = New-Object System.Security.AccessControl.DirectorySecurity
+$dirAcl.SetAccessRuleProtection($true,$false)
+$dirAcl.SetOwner($admins)
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($admins,'FullControl',$inherit,$none,$allow)))
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($system,'FullControl',$inherit,$none,$allow)))
+$dirAcl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($users,'ReadAndExecute',$inherit,$none,$allow)))
+Set-Acl -LiteralPath $target -AclObject $dirAcl
+
+$utf8 = New-Object System.Text.UTF8Encoding($false)
+$anchorPath = Join-Path $target 'owner-anchor.json'
+$keyPath = Join-Path $target 'owner-public.pem'
+$anchorText = $material.anchor | ConvertTo-Json -Compress
+foreach ($entry in @(@($anchorPath,$anchorText),@($keyPath,[string]$material.public_key_pem))) {
+    $stream = [System.IO.File]::Open([string]$entry[0],[System.IO.FileMode]::CreateNew,[System.IO.FileAccess]::Write,[System.IO.FileShare]::None)
+    try {
+        $writer = New-Object System.IO.StreamWriter($stream,$utf8)
+        try { $writer.Write([string]$entry[1]); $writer.Flush(); $stream.Flush($true) } finally { $writer.Dispose() }
+    } finally { $stream.Dispose() }
+}
+Write-Host "R186_OWNER_TRUST_ENROLLED owner_key_id=$($material.anchor.owner_key_id)"

package/scripts/r175-focused-runner.mjs

@@ -0,0 +1,38 @@
+// R175 development-only verification runner. Executes fixed local tests, not production.
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const repo=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const groups=Object.freeze({
+  boundary:['r175-foreground-boundary','r175-guardian-owner-boundary','r175-cli-flags',
+    'remote-live-log-recovery-r36','stabilization-guardian',
+    'r58-guardian-channel','r76-pinned-marker-cas'],
+  owner:['r174-owner-webauthn','r70-owner-approval','r70-autonomous-grant-expiry',
+    'r70-autonomous-policy-bootstrap','r70-controller-owner-issue-boundary'],
+  legacy:['r51-runtime-coherence','r72-remote-safe-contract'],
+  logs:['r176-pretty-live-log','r155-default-live-log','remote-live-log-r37','r155-commander-live-log','r67-live-log-secret-canary','r177-windows-absolute-live-path'],
+  foreground:['remote-session-cli']
+});
+const group=process.argv[2]??'boundary';
+if(!Object.hasOwn(groups,group))throw Error('R175 test group invalid');
+for(const p of ['src/deadbyte-cli.mjs','src/remote-session-guardian.mjs','src/r175-foreground-boundary.mjs']){
+ const c=spawnSync(process.execPath,['--check',p],{cwd:repo,encoding:'utf8',windowsHide:true,timeout:20000});
+ if(c.error||c.status!==0)throw Error('R175 syntax '+p+': '+String(c.stderr||c.error));
+}
+const tests=groups[group].map(x=>'test/'+x+'.test.mjs');
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests],{
+ cwd:repo,encoding:'utf8',windowsHide:true,timeout:180000,
+ maxBuffer:12*1024*1024
+});
+const log=(r.stdout??'')+(r.stderr??'');
+const output=log.split(/\r?\n/);
+for(const row of output.filter(x=>/^(ℹ (tests|pass|fail|skipped|duration_ms)|✔|✖)/.test(x)).slice(-40))
+ process.stdout.write(row+'\n');
+process.stdout.write('R175_GROUP='+group+' EXIT='+String(r.status)+'\n');
+if(r.error)process.stderr.write('R175_RUNNER_ERROR='+String(r.error)+'\n');
+if(r.status!==0){
+ const errors=output.filter(x=>/Error:|AssertionError|Missing expected|expected|actual|✖|fail/gi.test(x));
+ for(const line of errors.slice(-25))process.stderr.write(line.slice(0,700)+'\n');
+ process.exitCode=1;
+}

package/scripts/r176-log-preview.mjs

@@ -0,0 +1,18 @@
+// R176 presentation preview with fixed synthetic events. No runtime access.
+import {createLiveTimelineTracker,defaultForegroundTimelineOptions} from '../src/remote-live-log.mjs';
+const base=Date.parse('2026-10-27T12:25:56.000Z');let offset=0;
+const tracker=createLiveTimelineTracker({clock:()=>base+offset,rootPaths:{projects:String.raw`D:\Projects`},...defaultForegroundTimelineOptions({verbose:false})});
+let seq=0;
+function send(e){const lines=tracker.observe(e,{sequence:++seq});for(const l of (Array.isArray(lines)?lines:[lines]))if(l)process.stdout.write(l+'\n');}
+function call(requestId,tool,args,ms,status='ok',reason=null){
+ offset+=ms;send({event_type:'tool.request',tool,request_id:requestId,args});
+ offset+=ms;send({event_type:'tool.result',tool,request_id:requestId,
+   outcome:{status,is_error:status==='denied',duration_ms:ms, ...(reason?{reason}:{})}});
+}
+call('r176-write-preview','coding_file_write',{root_id:'projects',path:'deadbyte-mcp/development/deadbyte-mcp-0.15.69-r174-owner-consent/src/alpha.mjs',content:'example-only'},17);
+for(let i=0;i<5;i++)call('poll-'+i,'machine_status',{},2);
+call('r176-denied','host_file_read',{root_id:'core',path:'secret-file'},1,'denied','arm file missing');
+offset+=1;send({event_type:'tool.request',tool:'coding_file_write',request_id:'r176-unknown',args:{root_id:'core',path:'output.bin'}});
+offset+=1;send({event_type:'tool.result',tool:'coding_file_write',request_id:'r176-unknown',outcome:{status:'interrupted',side_effect_state:'unknown',reason:'result unavailable after dispatch'}});
+for(const l of tracker.reconcileInterrupted())process.stdout.write(l+'\n');
+process.stdout.write(tracker.summary()+'\n');

package/scripts/r177-owner-trust-inventory.ps1

@@ -0,0 +1,36 @@
+$ErrorActionPreference='Stop'
+$state=Join-Path $HOME '.deadbyte-mcp'
+$trust=Join-Path $state 'trust'
+$pub=Join-Path $trust 'r70-owner-public.pem'
+Write-Output ('R177_TRUST_DIR_EXISTS='+(Test-Path -LiteralPath $trust -PathType Container))
+Write-Output ('R177_OWNER_PUBLIC_KEY_EXISTS='+(Test-Path -LiteralPath $pub -PathType Leaf))
+if(Test-Path -LiteralPath $pub -PathType Leaf){
+ $entry=Get-Item -LiteralPath $pub
+ $acl=Get-Acl -LiteralPath $pub
+ Write-Output ('R177_PUBLIC_KEY_BYTES='+$entry.Length)
+ Write-Output ('R177_PUBLIC_KEY_SHA256='+(Get-FileHash -LiteralPath $pub -Algorithm SHA256).Hash.ToLowerInvariant())
+ Write-Output ('R177_PUBLIC_KEY_OWNER='+$acl.Owner)
+ Write-Output ('R177_PUBLIC_KEY_READONLY='+$entry.IsReadOnly)
+}
+$activePath=Join-Path $state 'active-release.json'
+if(Test-Path $activePath){
+ $a=Get-Content -LiteralPath $activePath -Raw|ConvertFrom-Json
+ Write-Output ('R177_ACTIVE_VERSION='+$a.version)
+ Write-Output ('R177_ACTIVE_RELEASE='+$a.release_id)
+ $codingFile=Join-Path $a.generation_root 'coding-policy.json'
+ if(Test-Path $codingFile){
+  $policy=Get-Content -LiteralPath $codingFile -Raw|ConvertFrom-Json
+  foreach($root in $policy.roots.PSObject.Properties){
+   Write-Output ('R177_CODING_ROOT='+$root.Name+' exec='+[bool]$root.Value.exec+' write='+[bool]$root.Value.write)
+  }
+ }
+}
+$evidence=Join-Path $state 'evidence'
+if(Test-Path -LiteralPath $evidence){
+ Get-ChildItem -LiteralPath $evidence -Recurse -File -ErrorAction SilentlyContinue|
+  Where-Object { $_.Name -match 'owner|approval|enrollment' }|
+  Sort-Object LastWriteTimeUtc -Descending|
+  Select-Object -First 12 |
+  ForEach-Object{Write-Output ('R177_OWNER_EVIDENCE_NAME='+$_.Name+' size='+$_.Length+' utc='+$_.LastWriteTimeUtc.ToString('o'))}
+}
+Write-Output 'R177_READ_ONLY_COMPLETE=true'