deadbyte-mcp 0.15.8 → 0.15.10

package/MANIFEST.SHA256

@@ -52,7 +52,6 @@ e74d45bd9facf03c9a2a0ff52600252924deb804a87e4b5503f48662a2b45a3b  conpty-input-o
 0ed1dfaa324eccadd4f6a07385df73feac8bdfef83a4b3ab3f31139885649841  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
-70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP-local.cmd
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
@@ -1329,7 +1328,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-79a1512703a88bc9d9347f26fa54ce0d0dbf52724bf3695e84dfa687f3c5a390  package.json
+fc923c05c542ed4d3eeace06c1f782fe431d877ee0227c24096aeea45af5d03e  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1389,7 +1388,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-60389fa2a0c7f699292cc731ecb33863ce1d38196195d38e8a48cae50228d8a1  PROVENANCE.json
+2a17d078ccbf03b254509985b3cdf51496e8d02958b4f3bc878e5aac7bb15b10  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1397,8 +1396,8 @@ bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.jso
 f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.json
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
-0ae37e1c40dff1a47f08ca5a0e9dcdddb3c8c3a8e478d69429e99a2f951f55ab  README.txt
-0a318974786d7e58185bd531e9f80de5f5681788b80bbf42d5b5329cdd17ebcb  RELEASE.json
+4d8bc9d61d7558a484269cc13263b42bb39417700bb3858069d64a2d1ae190e8  README.txt
+de2c63a505343a61cfbfe4a905d9021ccdc4cce39ccb3e681c2526518bf494c5  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1525,6 +1524,7 @@ caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtim
 b0cc75c38e0163dbcf7fb1b0d21f2dc34c71f2d0e2a156a53e570ff84afc64e6  scripts/semantic-preflight.ps1
 0a115aa9829576c86cc247f754cae69ae09ba146b637d3a1c9fbc16420d20a5d  scripts/tool-surface-snapshot.mjs
 f8d9c6718cbe20e02e517297e8f35f51c7dcd51b62b8b4a483630a9cd3b1f788  scripts/verify-memory-r41.mjs
+e552634ca1f8673f5daaaf5e45302d2a7fc4b1a1eac256f60bed2c9136bafa05  scripts/verify-package.ps1
 0c22bd0d61e50d35105a146b3b78acbb6889e9821537834892737c7f5aafb75e  scripts/verify-r41-parent.mjs
 e64878a14b5bf1eb22a011abe0ca2d6ff58c5c22b08cf6e01170ce1e1bf8ea91  scripts/verify-r42-parent.mjs
 4896279b3f855ad0f20288fbab36717e4b2040dc0c4fca31232d5b1d5de1c166  scripts/verify-r43-parent.mjs
@@ -1693,7 +1693,7 @@ fc5407ef8338ebeeede16225b3249166dc4d45e903d873eb46c15c3df07dc9ad  src/semantic-b
 17472b07dbfc1f6eff6831d79926a526e668ed0278cacbf9b4c421019174f505  src/semantic-lsp-backend.mjs
 a14cb827602d74f7c9822098815add8bf1ab6b27598d22b44880c8c98e754c1b  src/semantic-lsp-config.mjs
 3fc8d3786b981ec173e7ff634f117c1464e3e80f13cf471bd5e0fa38e4d4ac3b  src/skill-mcp-tools-r44.mjs
-4c3523126e3056ef1f30bc0f162c396868fca96d3ad8df2e7a0f5ae573a6f31d  src/skill-plane-r44.mjs
+3640e91254d3ed000ba32c41d3582de8af492915c6ee23f284e36f3873519616  src/skill-plane-r44.mjs
 3dc2102335cd1e86ee52a11950f80ff6e1771f4291325d4f95a8ea2b849617cc  src/stdio-console-guard.mjs
 6dccdb538be9783276399a5ad2cce54b1f0d8cc305fd58bee9f0f46d6a412af6  src/text-policy.mjs
 144c75f8e8a4c2a182db82642475359459e5c108b2a4cecd80488bea1e6ab3bb  src/tool-audit.mjs
@@ -1704,7 +1704,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-75903ce9e7a221d3f6d163f6a908de58765291347f732ff5e1d2cea9f04010ac  src/version.mjs
+afb1d220f824f94a3c1b654213f50e25af380d22e89cba6efb0d58324026e62a  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
@@ -1745,7 +1745,7 @@ bad448d7bfd0c66b8d0dc0fa601fc22d69ccc3f447140ed0f77b68957984daea  test/capabilit
 c343906ca0878e13c576cd9f615802b1139c693bf6769a780dfb052637cf0d83  test/capability-benchmark.test.mjs
 b9a8faa4b86683ac5aea891fe6bc95f8e425fb31635176aa4603f9d582b52a79  test/capability-claims-r36.test.mjs
 a466a490759d438a8ac68919f79ddcb52253bdbecb5e4448a4fbf62af118184e  test/capability-ledger-r36.test.mjs
-b6f826b1faf13184fd89af4c068a5b93fce3c520cc2f9f6e09ad400edfedcc1c  test/cli-entrypoint.test.mjs
+84eefe1a43474927fdc6fb7ef269309c662cefb229d6af2c91d9e2f0b9ba5c23  test/cli-entrypoint.test.mjs
 bec565ffa8550d56a5bb21927177c37d9d05f8353e3bc2541fc156886fe23688  test/codex-app-server-r44.test.mjs
 c43105a78ee4c93417d720ee660cfebc75b17f142a6484568e3cbaa583457f8c  test/codex-autonomous-r44.test.mjs
 350e151dbd8cc2723b141c5cf5f90bdf11289577c9b9347330e3ad815d948e98  test/coding-catalog-consistency.test.mjs
@@ -1773,7 +1773,7 @@ a972bd20fa927427e6d8e4181699a27e792e916b02dcf8a1ac3e2b44afd238c1  test/controlle
 ceba7d1a09ccdcb20f33fe4e6de7667ffe0f0170d1bc9fefadfdba4d7f228090  test/controller-r29.test.mjs
 4d0dc810d9af13907f31c834a13acfb7e01ffbbe65575b69649fe52741e42175  test/controller-r30.test.mjs
 cceba415584a641291ad08814a666c08c902c6614579611a082334cbad2b5b34  test/controller.test.mjs
-110cbc499c0686723988a95d9b384d28176fad0daaf6506997853db35641df43  test/core.test.mjs
+ca977f49ca8096c37e1db1d10066f6526c33f06df6d952d29b0b4958a9d9f9dc  test/core.test.mjs
 7ba4b06a1c4141ba87b5b371157fb59940d15a1016b4c599a13753d63ad0d3d3  test/DEADBYTE-MCP-WRITE-PROBE.txt
 c526724a6d10648fdd5152af917ba2fe51836dc5877daaac554bbd9e52fcd47e  test/deferred-slot-operation-behavior.test.mjs
 69a515b1a36f0620cae4057ea8dc5302751058e290aedaf2f0b637eb3288aba8  test/deferred-slot-operation.test.mjs
@@ -1923,7 +1923,7 @@ d8f544bbcdfff61f7abb7705ad7e5e1f17998f5fde3c114fb33915fc66d1408f  test/r41-final
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs
 7cc69e786bfd9e4a7e70888c4c1b5f756a264bc1a991139c468b63af23f24c38  test/release-slot.test.mjs
 0109c76b480cc600f6ed42be4519df3fa6835012bb9e4ba4ae6be6635468c4a8  test/release-smoke-isolation.test.mjs
-4ceba97216400cf3a1b01fa3353aba8459346e232a565c71024f14485ec141f1  test/release-version.test.mjs
+c4b570fb4c9826cba15998e44a9e01ba0f92d23309251648866fd77fab96b5c2  test/release-version.test.mjs
 c270a4e2d1384071e7c406f4ec8c8c1da56228844bf64362cffa03558be3cc49  test/remote-console-r40.test.mjs
 ba122b4a7a6953b9fc8187a531a3e8b0f5f8519da602c551b32df8c88c85e879  test/remote-device-r44.test.mjs
 3d26a0550a22c69990567d998c28e4ba0978c71429741c10c7c47f261653fbe2  test/remote-live-log-r36.test.mjs
@@ -1946,7 +1946,7 @@ abfbc97af4a3337694f2362c00da24fd2a06b526ba324e04d0d0816197c75595  test/semantic-
 1a3567cd485f127ff66f8e0f39c4a66eeb29d0a8d417173040764ff072907927  test/semantic-runtime-routing.test.mjs
 27e2bf4ffd18c51cd2b62dfca836fb24288a75ff8a7f55ed9d45f5ba0dd1578a  test/semantic-server-config-integration.test.mjs
 7f9b1e4f2f53d20386b721b57490c43268954982cff4522da26b1acdac2cb23a  test/skill-mcp-r44.test.mjs
-b59577750bce1dbff3058716c5107517312eb1b0a1b24220dba6702fed573bf2  test/skill-plane-r44.test.mjs
+ce8c503863544f36d101c079187d5f02ff5868c526c36f05cf5bea4a7ba2c015  test/skill-plane-r44.test.mjs
 a98537d1136988251572f424b29ff8f798356dcfd9a7a1d4238a9c7e943e6a52  test/standing-grants.test.mjs
 2c8ad3d273965fa6f7ba2f3aa1ee50791a28f4dcf6dfc8cd8d73510f2577f9f9  test/task-contract-r42.test.mjs
 6ecc712b7bcb2abdb934e7d40232ed97ac355f3f47665f557c2168b04d113b41  test/tool-audit.test.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.8",
+  "version": "0.15.10",
   "builder": "deadbyte-r46-fileless-powershell",
   "source_model": "development-root -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed final closure",
   "signing": "ed25519",

package/README.txt

@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.5 mcp
-  npx -y deadbyte-mcp@0.15.5 remote
-  npx -y deadbyte-mcp@0.15.5 remote status
-  npx -y deadbyte-mcp@0.15.5 remote restart
-  npx -y deadbyte-mcp@0.15.5 audit status
-  npx -y deadbyte-mcp@0.15.5 audit verify
+  npx -y deadbyte-mcp@0.15.9 mcp
+  npx -y deadbyte-mcp@0.15.9 remote
+  npx -y deadbyte-mcp@0.15.9 remote status
+  npx -y deadbyte-mcp@0.15.9 remote restart
+  npx -y deadbyte-mcp@0.15.9 audit status
+  npx -y deadbyte-mcp@0.15.9 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.8",
+  "version": "0.15.10",
   "train": "R46",
   "label": "FILELESS POWERSHELL PRODUCT BASELINE",
   "protocol_revision": "2026-07-28",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.8",
+  "version": "0.15.10",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/verify-package.ps1

@@ -0,0 +1,138 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+Set-Location $RepoRoot
+
+function Parse-NpmJson([string]$text) {
+    $candidates = @()
+    $b = $text.IndexOf('[')
+    $c = $text.IndexOf('{')
+    if ($b -ge 0) { $candidates += $b }
+    if ($c -ge 0) { $candidates += $c }
+    if ($candidates.Count -eq 0) { throw "No JSON found in npm output: $text" }
+    $start = ($candidates | Measure-Object -Minimum).Minimum
+    return ($text.Substring($start) | ConvertFrom-Json)
+}
+
+function Get-PackEntry($parsed) {
+    if ($parsed -is [System.Array]) {
+        return $parsed[0]
+    }
+    if ($parsed.PSObject.Properties['deadbyte-mcp']) {
+        return $parsed.'deadbyte-mcp'
+    }
+    if ($parsed.PSObject.Properties['files'] -or $parsed.PSObject.Properties['filename']) {
+        return $parsed
+    }
+    $props = @($parsed.PSObject.Properties)
+    if ($props.Count -gt 0) {
+        return $props[0].Value
+    }
+    return $parsed
+}
+
+Write-Host "=== [1/6] Checking package.json and bin entry ==="
+if (-not (Test-Path "package.json" -PathType Leaf)) {
+    throw "package.json not found in $RepoRoot"
+}
+$pkg = Get-Content "package.json" -Raw | ConvertFrom-Json
+$binPath = $pkg.bin.'deadbyte-mcp'
+if ([string]::IsNullOrWhiteSpace($binPath) -or $binPath -ne 'src/deadbyte-cli.mjs') {
+    throw "package.json bin['deadbyte-mcp'] must be 'src/deadbyte-cli.mjs', found: $binPath"
+}
+if (-not (Test-Path $binPath -PathType Leaf)) {
+    throw "CLI entrypoint '$binPath' does not exist"
+}
+Write-Host "  PASS: package.json bin['deadbyte-mcp'] -> $binPath"
+
+Write-Host "`n=== [2/6] Checking npm pack --dry-run for Windows command collisions ==="
+$dryRunJson = (& npm.cmd pack --dry-run --json 2>&1 | Out-String)
+if ($LASTEXITCODE -ne 0) {
+    throw "npm pack --dry-run failed with exit code $($LASTEXITCODE)"
+}
+$parsedDry = Parse-NpmJson $dryRunJson
+$dryEntry = Get-PackEntry $parsedDry
+$files = $dryEntry.files
+
+$collisionFiles = @($files | Where-Object {
+    $p = [string]$_.path
+    $p -match '^(?:package/)?DEADBYTE-MCP.*\.cmd$'
+})
+
+if ($collisionFiles.Count -gt 0) {
+    $found = ($collisionFiles | ForEach-Object { $_.path }) -join ', '
+    throw "Found forbidden root .cmd executable in package surface: $found"
+}
+Write-Host "  PASS: Zero root DEADBYTE-MCP*.cmd collisions detected in pack dry-run"
+
+Write-Host "`n=== [3/6] Generating test tarball in temp directory ==="
+$testDir = Join-Path $env:TEMP ("deadbyte-pkg-verify-" + [System.Guid]::NewGuid().ToString('N').Substring(0, 8))
+New-Item -ItemType Directory -Path $testDir -Force | Out-Null
+try {
+    $packOut = (& npm.cmd pack --pack-destination $testDir --json 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) {
+        throw "npm pack failed with exit code $($LASTEXITCODE)"
+    }
+    $packParsed = Parse-NpmJson $packOut
+    $packEntry = Get-PackEntry $packParsed
+    $tarballName = [string]$packEntry.filename
+    $tarballPath = Join-Path $testDir $tarballName
+
+    if (-not (Test-Path $tarballPath -PathType Leaf)) {
+        throw "Tarball not found at $tarballPath"
+    }
+    Write-Host "  PASS: Generated tarball: $tarballName"
+
+    Write-Host "`n=== [4/6] Inspecting tarball contents ==="
+    $listing = (& tar -tf $tarballPath 2>&1)
+    $tarCollisions = @($listing | Where-Object { $_ -match '^package/DEADBYTE-MCP.*\.cmd$' })
+    if ($tarCollisions.Count -gt 0) {
+        throw "Tarball contains root .cmd files: $($tarCollisions -join ', ')"
+    }
+    $hasCli = @($listing | Where-Object { $_ -eq 'package/src/deadbyte-cli.mjs' })
+    if ($hasCli.Count -eq 0) {
+        throw "Tarball missing package/src/deadbyte-cli.mjs"
+    }
+    Write-Host "  PASS: Tarball contains src/deadbyte-cli.mjs and no root collision .cmd files"
+
+    Write-Host "`n=== [5/6] Testing local direct node CLI invocation ==="
+    $verOut = (& node (Join-Path $RepoRoot "src/deadbyte-cli.mjs") --version 2>&1 | Out-String).Trim()
+    if ($verOut -ne [string]$pkg.version) {
+        throw "Direct node CLI version mismatch: expected $($pkg.version), got $verOut"
+    }
+    Write-Host "  PASS: Direct node CLI version matches $($pkg.version)"
+
+    Write-Host "`n=== [6/6] Testing clean-directory external npx execution ==="
+    Push-Location $testDir
+    try {
+        $origEap = $ErrorActionPreference
+        $ErrorActionPreference = 'SilentlyContinue'
+        $rawOut = (cmd.exe /c "npx.cmd --yes --package `"$tarballPath`" deadbyte-mcp --version 2>nul")
+        $exitCode = $LASTEXITCODE
+        $ErrorActionPreference = $origEap
+
+        if ($exitCode -ne 0) {
+            throw "npx execution failed with exit code $exitCode"
+        }
+        $npxVer = ($rawOut | Out-String).Trim()
+        $lastLine = ($npxVer -split '\r?\n')[-1].Trim()
+        if ($lastLine -ne [string]$pkg.version) {
+            throw "npx local tarball version mismatch: expected $($pkg.version), got $lastLine"
+        }
+        Write-Host "  PASS: npx local tarball returned $($pkg.version) in isolated directory"
+    } finally {
+        Pop-Location
+    }
+
+    Write-Host "`n========================================================"
+    Write-Host "PACKAGE_VERIFICATION_PASS: All package hygiene and execution checks passed!"
+    Write-Host "========================================================"
+
+} finally {
+    Remove-Item -LiteralPath $testDir -Recurse -Force -ErrorAction SilentlyContinue
+}

package/src/skill-plane-r44.mjs

@@ -170,19 +170,24 @@ export async function createSkillPlane({root,verifyKeyPath}={}){
   async function list(){
     const names=(await readdir(rootReal)).sort((a,b)=>a.localeCompare(b,'en'));
     const skills=[];
+    const invalid_skills=[];
     for(const name of names){
       const full=path.join(rootReal,name);
       const st=await lstat(full);
       insist(st.isDirectory()&&!st.isSymbolicLink(),`skill registry contains non-directory entry: ${name}`);
-      const item=await verified(name);
-      skills.push({
-        name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
-        manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
-        authority_planes:item.authorityPlanes,resource_count:item.resources.length,provenance:item.body.provenance,verified:true
-      });
+      try{
+        const item=await verified(name);
+        skills.push({
+          name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
+          manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
+          authority_planes:item.authorityPlanes,resource_count:item.resources.length,provenance:item.body.provenance,verified:true
+        });
+      }catch(error){
+        invalid_skills.push({name,error:String(error),verified:false});
+      }
     }
     const registrySha=sha(Buffer.from(canonicalJson(skills.map(item=>({name:item.name,manifest_sha256:item.manifest_sha256}))),'utf8'));
-    return {status:'ok',skills,registry_sha256:registrySha,verify_key_id:keyId};
+    return {status:'ok',skills,invalid_skills,registry_sha256:registrySha,verify_key_id:keyId};
   }
   async function load({name}={}){
     const item=await verified(name);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.8';
+export const DEADBYTE_VERSION = '0.15.10';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/cli-entrypoint.test.mjs

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const packagePath=path.join(root,'package.json');
@@ -21,7 +22,7 @@ test('npx CLI reports the canonical package version through --version, -v and ve
   for(const arg of ['--version','-v','version']){
     const result=spawnSync(process.execPath,[cliPath,arg],{cwd:root,encoding:'utf8',windowsHide:true});
     assert.equal(result.status,0,result.stderr);
-    assert.equal(result.stdout.trim(),'0.15.5');
+    assert.equal(result.stdout.trim(),DEADBYTE_VERSION);
   }
 });
 
@@ -50,6 +51,6 @@ test('npx CLI exposes local supervisor lifecycle without any supervisor arm comm
 
 test('README makes npx the primary operator UX',async()=>{
   const readme=await readFile(path.join(root,'README.txt'),'utf8');
-  assert.match(readme,/npx -y deadbyte-mcp@0\.15\.5 remote/);
-  assert.match(readme,/npx -y deadbyte-mcp@0\.15\.5 audit verify/);
+  assert.match(readme,new RegExp(`npx -y deadbyte-mcp@${DEADBYTE_VERSION.replace(/\./g,'\\.')} remote`));
+  assert.match(readme,new RegExp(`npx -y deadbyte-mcp@${DEADBYTE_VERSION.replace(/\./g,'\\.')} audit verify`));
 });

package/test/core.test.mjs

@@ -14,6 +14,7 @@ import { PROOF_EXECUTION_POLICY } from '../src/operation-policy.mjs';
 import { createRequestIdentity, validateRequestIdentity } from '../src/request-identity.mjs';
 import { generateTrustKeypair } from '../src/trust.mjs';
 import { verifyReceipt } from '../src/verifier.mjs';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const verifierCli = fileURLToPath(new URL('../src/verifier-cli.mjs', import.meta.url));
 
@@ -105,7 +106,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.15.5');
+  assert.equal(result.receipt.runtime.package_version, DEADBYTE_VERSION);
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/release-version.test.mjs

@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root=new URL('../',import.meta.url);
 const text=rel=>readFile(new URL(rel,root),'utf8');
@@ -9,7 +10,7 @@ const PARENT_RELEASE='v0.15.2-0fb46542f6a4345f';
 const PARENT_MANIFEST='0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34';
 const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
 
-test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent identity',async()=>{
+test('R46 current authority agrees on the package release version and preserves exact V0.15.2 parent identity',async()=>{
   const pkg=JSON.parse(await text('package.json'));
   const release=JSON.parse(await text('RELEASE.json'));
   const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,processPolicy]=await Promise.all([
@@ -27,7 +28,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
     text('controller/deadbyte-process-policy.json')
   ]);
 
-  assert.equal(pkg.version,'0.15.5');
+  assert.equal(pkg.version,DEADBYTE_VERSION);
   assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1');
   assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r46.mjs');
   assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r46.mjs');
@@ -36,7 +37,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
   assert.equal(pkg.scripts['r46:fileless:test'],"node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs");
   assert.equal(pkg.scripts['r46:full:test'],'node scripts/full-regression-r46.mjs');
 
-  assert.match(version,/DEADBYTE_VERSION = '0\.15\.5'/);
+  assert.match(version,new RegExp(`DEADBYTE_VERSION = '${DEADBYTE_VERSION.replace(/\./g,'\\.')}'`));
   assert.match(controller,/CONTROLLER V0\.15\.5 \/ R46/);
   assert.match(gate,/DEADBYTE V0\.15\.5 \/ R46 FILELESS POWERSHELL WINDOWS BATCH GATE: PASS/);
   assert.match(readme,/^DEADBYTE MCP V0\.15\.5 \/ R46 FILELESS POWERSHELL PRODUCT BASELINE$/m);
@@ -59,7 +60,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
   assert.match(closureVerify,/DEADBYTE-R46-FINAL-CLOSURE-V1/);
   assert.match(windowsGate,/deadbyte\.r46-windows-gate\.v1/);
 
-  assert.equal(release.version,'0.15.5');
+  assert.equal(release.version,DEADBYTE_VERSION);
   assert.equal(release.train,'R46');
   assert.equal(release.label,'FILELESS POWERSHELL PRODUCT BASELINE');
   assert.equal(release.parent.release_id,PARENT_RELEASE);

package/test/skill-plane-r44.test.mjs

@@ -61,6 +61,26 @@ test('R44 skill catalog is metadata-only and load is signature/content bound',as
   }finally{await rm(f.root,{recursive:true,force:true});}
 });
 
+test('R44 skill plane reports malformed registry entries without hiding valid skills',async()=>{
+  const f=await fixture();
+  try{
+    await installSkill(f,{name:'good-skill'});
+    await installSkill(f,{name:'broken-skill'});
+    const broken=path.join(f.registry,'broken-skill','skill.json');
+    const envelope=JSON.parse(await readFile(broken,'utf8'));
+    envelope.body.description='tampered without resigning';
+    await writeFile(broken,JSON.stringify(envelope,null,2)+'\n','utf8');
+    const plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    const listed=await plane.list();
+    assert.equal(listed.status,'ok');
+    assert.deepEqual(listed.skills.map(item=>item.name),['good-skill']);
+    assert.equal(listed.invalid_skills.length,1);
+    assert.equal(listed.invalid_skills[0].name,'broken-skill');
+    assert.match(listed.invalid_skills[0].error,/body hash mismatch/);
+    assert.equal(listed.invalid_skills[0].verified,false);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
 test('R44 skill plane fails closed on SKILL.md and resource tampering',async()=>{
   const f=await fixture();
   try{

package/DEADBYTE-MCP-local.cmd

@@ -1,4 +0,0 @@
-@echo off
-setlocal EnableExtensions DisableDelayedExpansion
-call "%~dp0controller\DEADBYTE-MCP.cmd" %*
-exit /b %ERRORLEVEL%