deadbyte-mcp 0.15.74 → 0.15.75

package/src/machine-fs.mjs

@@ -10,6 +10,8 @@ import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { atomicMutation } from './atomic-mutation.mjs';
+import { readRangeFromHandle } from './machine-fs-handle-read-r196.mjs';
+import { boundedNativeReadR198 } from './machine-fs-native-read-r198.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -48,14 +50,7 @@ async function boundedReadInProcess({ file, offset, length, hashFile, timeoutMs
     timer.unref?.();
   });
   try {
-    const operation = (async () => {
-      const buffer = Buffer.alloc(length);
-      const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
-      let fileSha256 = null;
-      if (hashFile) fileSha256 = await sha256File(file, abortController.signal);
-      return { schema: 'deadbyte.machine-fs-read-worker.v1', bytes_read: result.bytesRead,
-        data_base64: buffer.subarray(0, result.bytesRead).toString('base64'), file_sha256: fileSha256 };
-    })();
+    const operation = readRangeFromHandle(handle, { offset, length, hashFile, signal: abortController.signal });
     operation.catch(() => {});
     return await Promise.race([operation, abort]);
   } finally {
@@ -414,22 +409,42 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingReadAllowed(policy, rootId);
+    // Capture the root object before path validation. The native worker must
+    // compare its opened root HANDLE identity before resolving any child.
+    const authorizedRoot = getRoot(policy, rootId, 'read');
+    const rootBefore = await lstat(authorizedRoot.real_path, { bigint: true });
+    if (rootBefore.isSymbolicLink() || !rootBefore.isDirectory() || rootBefore.ino === 0n)
+      throw new Error('R198 root directory identity unavailable');
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
-    const info = await lstat(found.resolved);
+    // Node's numeric ino can round NTFS file IDs above 2^53.
+    // Keep the pre-open identity as BigInt and compare exact strings from the worker's fstat.
+    const info = await lstat(found.resolved, { bigint: true });
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
-    if (!Number.isSafeInteger(info.size)) throw new Error('machine fs read file size exceeds safe integer range');
-    const effectiveOffset = offset < 0 ? Math.max(0, info.size + offset) : offset;
-    if (effectiveOffset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const length = Math.min(maxBytes, info.size - effectiveOffset);
+    if (info.size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('machine fs read file size exceeds safe integer range');
+    if (info.ino === 0n) throw new Error('R196 file object identity unavailable');
+    const fileSize = Number(info.size);
+    const effectiveOffset = offset < 0 ? Math.max(0, fileSize + offset) : offset;
+    if (effectiveOffset > fileSize) throw new Error('machine fs read offset exceeds file size');
+    const length = Math.min(maxBytes, fileSize - effectiveOffset);
     await recheckCodingReadAuthority(policy, grant, rootId);
-    const worker = await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const worker = process.platform === 'win32' && readWorkerPath === machineFsReadWorkerPath
+      ? await boundedNativeReadR198({
+          rootPath: found.root.real_path, relativePath: found.relative,
+          offset: effectiveOffset, length, hashFile, timeoutMs,
+          expectedRootDev: String(rootBefore.dev), expectedRootIno: String(rootBefore.ino)
+        })
+      : await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
     const buffer = Buffer.from(worker.data_base64, 'base64');
     if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    if (!Number.isSafeInteger(worker.file_size) || worker.file_size !== fileSize)
+      throw new Error('R196 opened file size drifted after precheck');
+    if (worker.file_dev !== String(info.dev) || worker.file_ino !== String(info.ino))
+      throw new Error('R196 opened file object identity differs from precheck');
     await recheckCodingReadAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: info.size,
-      eof: effectiveOffset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: fileSize,
+      eof: effectiveOffset + buffer.length >= fileSize, data_base64: buffer.toString('base64'),
       data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
       timeout_ms: timeoutMs
     };

package/src/r195-canonical-owner-observation.mjs

@@ -0,0 +1,15 @@
+import path from 'node:path';
+
+export async function observeCanonicalController({stateRoot,powershell,env,execFileAsync}={}){
+  if(typeof stateRoot!=='string'||!path.win32.isAbsolute(stateRoot))
+    throw new Error('R195 canonical owner observation requires an absolute state root');
+  if(typeof powershell!=='string'||powershell.length<1||typeof execFileAsync!=='function')
+    throw new Error('R195 canonical owner observation dependency invalid');
+  const launcher=path.win32.join(path.win32.resolve(stateRoot),'bin','DEADBYTE-MCP.ps1');
+  const {stdout}=await execFileAsync(powershell,[
+    '-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',
+    launcher,'status','-Json'
+  ],{env,windowsHide:true,shell:false,timeout:20000,maxBuffer:1024*1024,encoding:'utf8'});
+  try{return JSON.parse(stdout);}
+  catch{throw new Error('R195 canonical owner observation returned invalid JSON');}
+}

package/src/remote-destination-journal-r202.mjs

@@ -0,0 +1,120 @@
+// R202 experimental destination-side storage for already-signed terminal evidence.
+// This does not execute effects, sign new claims, authorize a capability, or retry a request.
+import {createHash,randomBytes} from 'node:crypto';
+import {link,lstat,mkdir,open,realpath,unlink} from 'node:fs/promises';
+import path from 'node:path';
+import {verifySignedRemoteTerminalR200} from './remote-terminal-evidence-r200.mjs';
+import {canonicalJson} from './canonical-json.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const MAX_RECEIPT_BYTES=16*1024;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+function insist(ok,message){if(!ok)throw new Error('R202 destination journal '+message);}
+
+export async function openRemoteDestinationJournalR202({directory,device}={}){
+ insist(typeof directory==='string'&&path.isAbsolute(directory),'directory invalid');
+ insist(device&&HEX64.test(device.device_id??'')&&Number.isSafeInteger(device.epoch)&&
+   device.epoch>=1&&typeof device.public_key_spki_base64==='string','device identity invalid');
+ await mkdir(directory,{recursive:true});
+ const inputRootInfo=await lstat(directory);
+ insist(inputRootInfo.isDirectory()&&!inputRootInfo.isSymbolicLink(),'input root is a reparse point');
+ const dir=await realpath(directory);
+ const rootInfo=await lstat(dir);
+ insist(rootInfo.isDirectory()&&!rootInfo.isSymbolicLink(),'root is not a real directory');
+ const filename=requestId=>{
+  insist(HEX64.test(requestId??''),'request ID invalid');
+  return path.join(dir,requestId+'.json');
+ };
+ // The bytes and identity come from the same opened file object, not a new path lookup.
+ async function checkedRead(file){
+  let before;
+  try{before=await lstat(file,{bigint:true});}
+  catch(error){if(error?.code==='ENOENT')return null;throw error;}
+  insist(before.isFile()&&!before.isSymbolicLink()&&before.size>=1n&&
+    before.size<=BigInt(MAX_RECEIPT_BYTES),'record is not a bounded regular file');
+  const h=await open(file,'r');
+  let bytes;
+  try{
+   const initial=await h.stat({bigint:true});
+   insist(initial.isFile()&&initial.dev===before.dev&&initial.ino===before.ino,
+     'record namespace swapped before handle open');
+   insist(initial.size>=1n&&initial.size<=BigInt(MAX_RECEIPT_BYTES),
+     'record size changed before read');
+   const buffer=Buffer.alloc(MAX_RECEIPT_BYTES+1);
+   const {bytesRead}=await h.read(buffer,0,buffer.length,0);
+   bytes=buffer.subarray(0,bytesRead);
+   const after=await h.stat({bigint:true});
+   insist(after.size===initial.size&&after.mtimeNs===initial.mtimeNs&&
+     after.ctimeNs===initial.ctimeNs&&after.dev===initial.dev&&after.ino===initial.ino&&
+     BigInt(bytesRead)===initial.size,'record mutated during handle read');
+  }finally{await h.close();}
+  const pathAfter=await lstat(file,{bigint:true});
+  insist(pathAfter.isFile()&&!pathAfter.isSymbolicLink()&&
+    pathAfter.ino===before.ino&&pathAfter.dev===before.dev,
+    'record namespace swapped after handle read');
+  let envelope;
+  try{envelope=JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error('R203 destination journal stored terminal is corrupt');}
+  return {envelope,bytes,sha256:digest(bytes)};
+ }
+ function verify(envelope,request){
+  insist(request&&request.device_id===device.device_id&&request.epoch===device.epoch&&
+    HEX64.test(request.request_id??'')&&HEX64.test(request.request_sha256??'')&&
+    typeof request.capability_id==='string','request identity invalid');
+  return verifySignedRemoteTerminalR200(envelope,{request,device});
+ }
+ return Object.freeze({
+  directory:dir,
+  device_id:device.device_id,
+  async commitSignedTerminal({envelope,request}={}){
+   const proof=verify(envelope,request);
+   const body=Buffer.from(canonicalJson(envelope)+'\n','utf8');
+   insist(body.length<=MAX_RECEIPT_BYTES,'signed terminal exceeds bound');
+   const file=filename(request.request_id);
+   // fsync the complete temp before an atomic, create-only hardlink publication.
+   // No direct write to final name: a crash before link cannot poison it.
+   const temp=path.join(dir,'.'+request.request_id+'.'+randomBytes(12).toString('hex')+'.tmp');
+   let tempCreated=false, published=false;
+   try{
+    const h=await open(temp,'wx',0o600);
+    tempCreated=true;
+    try{await h.writeFile(body);await h.sync();}
+    finally{await h.close();}
+    try{
+     await link(temp,file);
+     published=true;
+    }catch(error){
+     if(error?.code!=='EEXIST')throw error;
+     const old=await checkedRead(file);
+     insist(old!==null,'record missing after conflict');
+     verify(old.envelope,request);
+     insist(old.sha256===digest(body),'conflicting signed terminal for one request');
+     return Object.freeze({status:'existing',replayed:true,request_id:request.request_id,
+       terminal_evidence_sha256:proof.terminal_evidence_sha256});
+    }
+   }finally{
+    if(tempCreated)await unlink(temp).catch(error=>{
+     if(error?.code!=='ENOENT' && !published)throw error;
+    });
+   }
+   const written=await checkedRead(file);
+   insist(written!==null&&written.sha256===digest(body),'postcommit bytes mismatch');
+   verify(written.envelope,request);
+   return Object.freeze({status:'stored',replayed:false,request_id:request.request_id,
+     terminal_evidence_sha256:proof.terminal_evidence_sha256});
+  },
+  async lookupTerminal({device_id,epoch,request_id,request_sha256}={}){
+   insist(device_id===device.device_id&&epoch===device.epoch&&
+     HEX64.test(request_id??'')&&HEX64.test(request_sha256??''),
+     'lookup request identity invalid');
+   const stored=await checkedRead(filename(request_id));
+   if(stored===null)return null;
+   const e=stored.envelope?.evidence;
+   insist(e&&e.request_sha256===request_sha256&&e.request_id===request_id,
+     'lookup request hash mismatch');
+   const request={device_id,epoch,request_id,request_sha256,capability_id:e.capability_id};
+   verify(stored.envelope,request);
+   return structuredClone(stored.envelope);
+  }
+ });
+}

package/src/remote-device-r44.mjs

@@ -1,6 +1,8 @@
 import { createHash, createPublicKey, randomBytes } from 'node:crypto';
 import { lstat, mkdir, open, readFile, realpath, rename } from 'node:fs/promises';
 import path from 'node:path';
+import {verifySignedRemoteTerminalR200} from './remote-terminal-evidence-r200.mjs';
+import {normalizeRemotePayloadR201} from './remote-payload-boundary-r201.mjs';
 
 const STATE_SCHEMA='deadbyte.remote-device-state.v1';
 const CREDENTIAL_SCHEMA='deadbyte.remote-credential.v1';
@@ -36,6 +38,9 @@ function validateState(value){
     insist(HEX64.test(id)&&r.request_id===id,'remote request identity invalid');
     insist(HEX64.test(r.request_sha256??''),'remote request hash invalid');
     insist(['accepted','executing','completed','failed'].includes(r.state),'remote request state invalid');
+    if(r.transport_state!==undefined)insist(['prepared','acknowledged','ack_missing','timed_out','transport_error','terminal_received','reconciled'].includes(r.transport_state),'remote transport state invalid');
+    if(r.effect_state!==undefined)insist(['unknown','confirmed','failed'].includes(r.effect_state),'remote effect state invalid');
+    if(r.reconciliation_state!==undefined)insist(['signed_terminal','signed_terminal_effect_unknown'].includes(r.reconciliation_state),'remote reconciliation state invalid');
   }
   return value;
 }
@@ -69,12 +74,13 @@ async function withTimeout(operation,timeoutMs,label){
   try{
     return await Promise.race([
       Promise.resolve().then(operation),
-      new Promise((_,reject)=>{timer=setTimeout(()=>reject(new Error(`${label} timed out after ${timeoutMs}ms`)),timeoutMs);timer.unref?.();})
+      new Promise((_,reject)=>{timer=setTimeout(()=>{const error=new Error(`${label} timed out after ${timeoutMs}ms`);error.code='REMOTE_TIMEOUT';reject(error);},timeoutMs);timer.unref?.();})
     ]);
   }finally{if(timer)clearTimeout(timer);}
 }
 export function payloadHash({deviceId,epoch,capabilityId,payload}){
-  return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload}),'utf8'));
+  const safePayload=normalizeRemotePayloadR201(payload);
+  return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload:safePayload}),'utf8'));
 }
 
 export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapability,onCredentialSuperseded=null,relayTimeoutMs=15000,probeRetries=1,reachableTtlMs=75000}={}){
@@ -160,9 +166,9 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
   async function dispatch({deviceId,epoch,capabilityId,payload={},requestId}={}){
     insist(HEX64.test(requestId??''),'remote request id invalid');
     insist(typeof capabilityId==='string'&&CAP.test(capabilityId),'remote capability id invalid');
-    insist(payload&&typeof payload==='object','remote payload must be JSON object');
-    let payloadJson;try{payloadJson=canonicalJson(payload);}catch{throw new Error('remote payload is not JSON serializable');}
-    const requestSha=payloadHash({deviceId,epoch,capabilityId,payload});
+    const safePayload=normalizeRemotePayloadR201(payload);
+    const payloadJson=canonicalJson(safePayload);
+    const requestSha=payloadHash({deviceId,epoch,capabilityId,payload:safePayload});
     const existing=state.requests[requestId];
     if(existing){
       insist(existing.request_sha256===requestSha,'remote request id conflict');
@@ -170,43 +176,112 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     }
     const allowed=await authorizeCapability({deviceId,epoch,capabilityId});
     insist(allowed===true,'remote capability denied by local policy');
+    let claimedNew=false;
     await withLock(async()=>{
       const d=getDevice(deviceId,epoch);insist(d.reported_online&&fresh(d),'remote device not reachable or readiness probe is stale');
       const again=state.requests[requestId];
       if(again){insist(again.request_sha256===requestSha,'remote request id conflict');return;}
       state.requests[requestId]={request_id:requestId,request_sha256:requestSha,device_id:deviceId,epoch,capability_id:capabilityId,
-        payload_sha256:sha(Buffer.from(payloadJson,'utf8')),state:'accepted',created_at_utc:now(),updated_at_utc:now()};
-      await persist();
+        payload_sha256:sha(Buffer.from(payloadJson,'utf8')),state:'accepted',transport_state:'prepared',effect_state:'unknown',
+        created_at_utc:now(),updated_at_utc:now()};
+      await persist();claimedNew=true;
     });
-    if(state.requests[requestId].state!=='accepted')return {...structuredClone(state.requests[requestId]),replay:true};
+    if(!claimedNew)return {...structuredClone(state.requests[requestId]),replay:true};
     let response=null;
     try{
       response=await withTimeout(
-        ()=>relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload,request_id:requestId,request_sha256:requestSha}),
+        ()=>relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload:safePayload,request_id:requestId,request_sha256:requestSha}),
         relayTimeoutMs,'remote dispatch'
       );
     }catch(error){
       return withLock(async()=>{
-        const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';rec.error=String(error?.message??error);rec.updated_at_utc=now();
+        const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';
+        rec.transport_state=error?.code==='REMOTE_TIMEOUT'?'timed_out':'transport_error';rec.effect_state='unknown';
+        rec.error=String(error?.message??error);rec.updated_at_utc=now();
         const d=state.devices[deviceId];if(d&&d.epoch===epoch){d.reachable=false;d.updated_at_utc=now();}
         await persist();return structuredClone(rec);
       });
     }
     if(!response||response.ack!=='accepted'||response.request_id!==requestId){
-      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_ack';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
+      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_ack';rec.transport_state='ack_missing';rec.effect_state='unknown';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
     }
-    await withLock(async()=>{const rec=state.requests[requestId];rec.state='executing';rec.acknowledged_at_utc=now();rec.updated_at_utc=now();await persist();});
+    await withLock(async()=>{const rec=state.requests[requestId];rec.state='executing';rec.transport_state='acknowledged';rec.effect_state='unknown';rec.acknowledged_at_utc=now();rec.updated_at_utc=now();await persist();});
     const terminal=response.terminal;
     if(!terminal||!['completed','failed'].includes(terminal.status)){
-      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_terminal';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
+      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_terminal';rec.transport_state='acknowledged';rec.effect_state='unknown';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
     }
     return withLock(async()=>{
       const rec=state.requests[requestId];rec.state=terminal.status;
+      rec.transport_state='terminal_received';rec.effect_state=terminal.status==='completed'?'confirmed':'failed';
       if(terminal.status==='completed'){insist(HEX64.test(terminal.result_sha256??''),'remote terminal result hash invalid');rec.result_sha256=terminal.result_sha256;}
       else {rec.error_code=typeof terminal.error_code==='string'?terminal.error_code:'remote_failed';}
       rec.updated_at_utc=now();rec.completed_at_utc=now();await persist();return structuredClone(rec);
     });
   }
+  // Read-only lookup: never calls relay.request, never creates a new request ID,
+  // and never turns a transport timeout into a claim that the mutation failed.
+  async function reconcile({requestId}={}){
+    insist(HEX64.test(requestId??''),'R200 reconciliation request id invalid');
+    insist(typeof relay.lookupTerminal==='function','R200 signed terminal lookup unavailable');
+    const snapshot=await withLock(async()=>{
+      const rec=state.requests[requestId];
+      insist(rec,'R200 reconciliation request unknown');
+      const device=getDevice(rec.device_id,rec.epoch);
+      return {request:structuredClone(rec),device:{
+        device_id:device.device_id,epoch:device.epoch,
+        public_key_spki_base64:device.public_key_spki_base64
+      }};
+    });
+    if(snapshot.request.effect_state!=='unknown')
+      return {...snapshot.request,replay:true,reconciliation:'already_terminal'};
+    let answer=null;
+    try{
+      answer=await withTimeout(()=>relay.lookupTerminal({
+        device_id:snapshot.request.device_id,epoch:snapshot.request.epoch,
+        request_id:requestId,request_sha256:snapshot.request.request_sha256
+      }),relayTimeoutMs,'remote terminal reconciliation');
+    }catch(error){
+      return {...snapshot.request,reconciliation:'unresolved',
+        reconciliation_error_code:error?.code==='REMOTE_TIMEOUT'?'lookup_timeout':'lookup_transport_error'};
+    }
+    if(answer===null||answer===undefined)
+      return {...snapshot.request,reconciliation:'unresolved'};
+    const proof=verifySignedRemoteTerminalR200(answer,snapshot);
+    return withLock(async()=>{
+      const record=state.requests[requestId];
+      insist(record?.request_sha256===snapshot.request.request_sha256,
+        'R200 reconciliation record changed before commit');
+      const current=getDevice(record.device_id,record.epoch);
+      insist(current.public_key_spki_base64===snapshot.device.public_key_spki_base64,
+        'R200 reconciliation pairing changed before commit');
+      if(record.effect_state!=='unknown')
+        return {...structuredClone(record),replay:true,reconciliation:'already_terminal'};
+      record.transport_state='reconciled';
+      record.terminal_evidence_sha256=proof.terminal_evidence_sha256;
+      record.terminal_status=proof.terminal.status;
+      record.signed_by_device_id=proof.signed_by_device_id;
+      record.reconciled_at_utc=now();
+      record.updated_at_utc=now();
+      record.reconciliation_state=proof.effective_state==='unknown'
+        ?'signed_terminal_effect_unknown':'signed_terminal';
+      if(proof.effective_state==='confirmed'){
+        record.state='completed';record.effect_state='confirmed';
+        record.result_sha256=proof.terminal.result_sha256;
+        record.completed_at_utc=now();
+      }else if(proof.effective_state==='failed'){
+        record.state='failed';record.effect_state='failed';
+        record.error_code=proof.terminal.error_code;
+        record.completed_at_utc=now();
+      }else{
+        record.state='failed';record.effect_state='unknown';
+        record.error_code=proof.terminal.error_code;
+      }
+      await persist();
+      return {...structuredClone(record),reconciliation:
+        proof.effective_state==='unknown'?'effect_unknown':'signed_terminal'};
+    });
+  }
+
   async function revoke({deviceId,epoch}={}){
     return withLock(async()=>{
       const d=getDevice(deviceId,epoch);d.revoked=true;d.reported_online=false;d.reachable=false;d.connection_id=null;d.updated_at_utc=now();await persist();
@@ -239,5 +314,5 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     return {status:'committed',device_id:deviceId,epoch,credential_sha256:credentialSha,previous_credential_sha256:previous?.credential_sha256??null};
   }
   async function list(){return {status:'ok',devices:Object.values(state.devices).map(pub).sort((a,b)=>a.device_id.localeCompare(b.device_id)),requests:structuredClone(state.requests)};}
-  return Object.freeze({pair,status,reportOnline,probe,dispatch,revoke,rotateCredential,list,state_file:stateFile});
+  return Object.freeze({pair,status,reportOnline,probe,dispatch,reconcile,revoke,rotateCredential,list,state_file:stateFile});
 }

package/src/remote-payload-boundary-r201.mjs

@@ -0,0 +1,71 @@
+// R201: a remote capability may only receive a detached, bounded JSON value.
+// Never use JSON.stringify on caller-owned objects: getters and toJSON can execute.
+import {types as utilTypes} from 'node:util';
+
+const MAX_BYTES=1024*1024;
+const MAX_DEPTH=32;
+const MAX_NODES=4096;
+const MAX_KEYS=256;
+const FORBIDDEN_KEYS=new Set(['__proto__','prototype','constructor','toJSON']);
+function reject(message){throw new Error('remote payload '+message);}
+function checkString(value,label){
+ if(Buffer.byteLength(value,'utf8')>MAX_BYTES)reject(label+' too large');
+ return value;
+}
+export function normalizeRemotePayloadR201(input){
+ let nodes=0;
+ const ancestors=new WeakSet();
+ function visit(value,depth){
+  if(depth>MAX_DEPTH)reject('depth exceeded');
+  if(++nodes>MAX_NODES)reject('node budget exceeded');
+  if(value===null||typeof value==='boolean')return value;
+  if(typeof value==='string')return checkString(value,'string');
+  if(typeof value==='number'){
+   if(!Number.isFinite(value)||Object.is(value,-0)||
+      (Number.isInteger(value)&&!Number.isSafeInteger(value)))reject('number must be finite, safe and unambiguous');
+   return value;
+  }
+  if(typeof value!=='object')reject('non-JSON value');
+  if(utilTypes.isProxy(value))reject('proxy object not allowed');
+  if(ancestors.has(value))reject('cycle detected');
+  const isArray=Array.isArray(value);
+  if(!isArray && ![null,Object.prototype].includes(Object.getPrototypeOf(value)))
+   reject('non-plain object not allowed');
+  ancestors.add(value);
+  try{
+   const descriptors=Object.getOwnPropertyDescriptors(value);
+   const names=Object.keys(descriptors);
+   if(Reflect.ownKeys(value).length!==names.length)reject('symbol property not allowed');
+   if(names.length>MAX_NODES)reject('property budget exceeded');
+   const result=isArray?[]:Object.create(null);
+   if(isArray){
+    const length=descriptors.length?.value;
+    if(!Number.isSafeInteger(length)||length<0||length>MAX_NODES)
+     reject('array length invalid');
+    if(names.length!==length+1)reject('sparse or decorated array not allowed');
+    for(let i=0;i<length;i++){
+     const desc=descriptors[String(i)];
+     if(!desc||!('value' in desc)||!desc.enumerable)reject('sparse or accessor array not allowed');
+     result.push(visit(desc.value,depth+1));
+    }
+   }else{
+    if(names.length>MAX_KEYS)reject('object key budget exceeded');
+    for(const key of names.sort()){
+     if(FORBIDDEN_KEYS.has(key))reject('unsafe key');
+     checkString(key,'key');
+     const desc=descriptors[key];
+     if(!desc?.enumerable||!('value' in desc))reject('accessor or hidden property not allowed');
+     result[key]=visit(desc.value,depth+1);
+    }
+   }
+   return Object.freeze(result);
+  }finally{
+   ancestors.delete(value);
+  }
+ }
+ const safe=visit(input,0);
+ if(!safe||Array.isArray(safe)||typeof safe!=='object')reject('top-level object required');
+ const encoded=JSON.stringify(safe);
+ if(Buffer.byteLength(encoded,'utf8')>MAX_BYTES)reject('encoded byte budget exceeded');
+ return safe;
+}

package/src/remote-terminal-evidence-r200.mjs

@@ -0,0 +1,60 @@
+import {createHash,createPublicKey,verify as edVerify} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+
+export const REMOTE_TERMINAL_EVIDENCE_SCHEMA='deadbyte.remote-terminal-evidence-r200.v1';
+export const REMOTE_TERMINAL_DOMAIN=Buffer.from('DEADBYTE-REMOTE-TERMINAL-R200\0','utf8');
+const HEX64=/^[0-9a-f]{64}$/;
+const CODE=/^[A-Za-z0-9._-]{1,128}$/;
+function insist(ok,message){if(!ok)throw new Error(message);}
+function exactKeys(value,keys,label){
+ insist(value&&typeof value==='object'&&!Array.isArray(value),label+' invalid');
+ insist(Object.keys(value).sort().join('|')===keys.sort().join('|'),label+' contains unexpected or missing fields');
+}
+function canonicalBase64(value,label){
+ insist(typeof value==='string'&&value.length<=8192&&value.length>0,label+' invalid');
+ const decoded=Buffer.from(value,'base64');
+ insist(decoded.length>0&&decoded.toString('base64')===value,label+' noncanonical');
+ return decoded;
+}
+export function verifySignedRemoteTerminalR200(response,{request,device}={}){
+ exactKeys(response,['evidence','attestation'],'R200 remote terminal envelope');
+ const body=response.evidence,signature=response.attestation;
+ exactKeys(body,['schema','device_id','epoch','request_id','request_sha256','capability_id','terminal'],'R200 remote terminal body');
+ insist(body.schema===REMOTE_TERMINAL_EVIDENCE_SCHEMA,'R200 terminal schema mismatch');
+ insist(HEX64.test(body.device_id??'')&&body.device_id===request?.device_id&&body.device_id===device?.device_id,
+   'R200 terminal device identity mismatch');
+ insist(Number.isSafeInteger(body.epoch)&&body.epoch===request?.epoch&&body.epoch===device?.epoch,
+   'R200 terminal epoch mismatch');
+ insist(HEX64.test(body.request_id??'')&&body.request_id===request?.request_id,
+   'R200 terminal request identity mismatch');
+ insist(HEX64.test(body.request_sha256??'')&&body.request_sha256===request?.request_sha256,
+   'R200 terminal request hash mismatch');
+ insist(body.capability_id===request?.capability_id,'R200 terminal capability mismatch');
+ const terminal=body.terminal;
+ insist(terminal&&typeof terminal==='object'&&!Array.isArray(terminal),'R200 terminal result missing');
+ if(terminal.status==='completed'){
+   exactKeys(terminal,['status','result_sha256'],'R200 completed terminal');
+   insist(HEX64.test(terminal.result_sha256??''),'R200 terminal result digest invalid');
+ }else if(terminal.status==='failed'){
+   exactKeys(terminal,['status','error_code','effect_state'],'R200 failed terminal');
+   insist(CODE.test(terminal.error_code??''),'R200 terminal error code invalid');
+   insist(['unknown','not_started'].includes(terminal.effect_state),
+     'R200 failure effect state must be unknown or not_started');
+ }else throw new Error('R200 terminal status invalid');
+ exactKeys(signature,['algorithm','key_id','signature_base64'],'R200 remote attestation');
+ insist(signature.algorithm==='ed25519'&&signature.key_id===device.device_id,'R200 signer identity mismatch');
+ const sig=canonicalBase64(signature.signature_base64,'R200 Ed25519 signature');
+ insist(sig.length===64,'R200 Ed25519 signature size invalid');
+ const der=canonicalBase64(device.public_key_spki_base64,'R200 paired device public key');
+ insist(createHash('sha256').update(der).digest('hex')===device.device_id,'R200 paired device key mismatch');
+ const key=createPublicKey({key:der,format:'der',type:'spki'});
+ insist(key.asymmetricKeyType==='ed25519','R200 paired device is not Ed25519');
+ const bytes=Buffer.concat([REMOTE_TERMINAL_DOMAIN,Buffer.from(canonicalJson(body),'utf8')]);
+ insist(edVerify(null,bytes,key,sig),'R200 remote terminal signature invalid');
+ return Object.freeze({
+   terminal:Object.freeze({...terminal}),
+   terminal_evidence_sha256:createHash('sha256').update(bytes).digest('hex'),
+   signed_by_device_id:device.device_id,
+   effective_state:terminal.status==='completed'?'confirmed':terminal.effect_state==='not_started'?'failed':'unknown'
+ });
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.74';
+export const DEADBYTE_VERSION = '0.15.75';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';