deadbyte-mcp 0.15.9 → 0.15.11

package/MANIFEST.SHA256

@@ -52,7 +52,6 @@ e74d45bd9facf03c9a2a0ff52600252924deb804a87e4b5503f48662a2b45a3b  conpty-input-o
 0ed1dfaa324eccadd4f6a07385df73feac8bdfef83a4b3ab3f31139885649841  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
-70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP-local.cmd
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
@@ -1329,7 +1328,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-79a1512703a88bc9d9347f26fa54ce0d0dbf52724bf3695e84dfa687f3c5a390  package.json
+34e5345b9f07fad9e3f7f54c496f3cf0cc4ff07c34c938c35244a9e1f209eeeb  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1389,7 +1388,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-60389fa2a0c7f699292cc731ecb33863ce1d38196195d38e8a48cae50228d8a1  PROVENANCE.json
+c7a11729f77023dd1d741d61b35ea0b75cca061a28f3a4cbe0062ca6a536f4ab  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1397,8 +1396,8 @@ bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.jso
 f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.json
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
-0ae37e1c40dff1a47f08ca5a0e9dcdddb3c8c3a8e478d69429e99a2f951f55ab  README.txt
-0a318974786d7e58185bd531e9f80de5f5681788b80bbf42d5b5329cdd17ebcb  RELEASE.json
+4d8bc9d61d7558a484269cc13263b42bb39417700bb3858069d64a2d1ae190e8  README.txt
+be4640a1d9e47f904e758e0b88b6e2ef7ee8b1921c90a95e404d28d1eb01a69b  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1523,8 +1522,10 @@ cabfa63d5edb83f32b3e6e5ce22e76223644d81a3361d52a28de2dbc07e59a54  scripts/run-r4
 abf8ac3074e8964c9648b5b60069730c255faa5f4169f3aefc7a9eff350a1efc  scripts/run-skill-creator-scaffold.mjs
 caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtime-self-update.mjs
 b0cc75c38e0163dbcf7fb1b0d21f2dc34c71f2d0e2a156a53e570ff84afc64e6  scripts/semantic-preflight.ps1
+bf54d2dfa2a77c2c13cc0b8a9ac2eb926132ecd331ad56ebbf88cc5cc4280a96  scripts/sign-adaptive-skill.mjs
 0a115aa9829576c86cc247f754cae69ae09ba146b637d3a1c9fbc16420d20a5d  scripts/tool-surface-snapshot.mjs
 f8d9c6718cbe20e02e517297e8f35f51c7dcd51b62b8b4a483630a9cd3b1f788  scripts/verify-memory-r41.mjs
+e552634ca1f8673f5daaaf5e45302d2a7fc4b1a1eac256f60bed2c9136bafa05  scripts/verify-package.ps1
 0c22bd0d61e50d35105a146b3b78acbb6889e9821537834892737c7f5aafb75e  scripts/verify-r41-parent.mjs
 e64878a14b5bf1eb22a011abe0ca2d6ff58c5c22b08cf6e01170ce1e1bf8ea91  scripts/verify-r42-parent.mjs
 4896279b3f855ad0f20288fbab36717e4b2040dc0c4fca31232d5b1d5de1c166  scripts/verify-r43-parent.mjs
@@ -1577,13 +1578,14 @@ e5f944a310ed957e3b8f7b1cab54c082acf1b35f8fdd7d9b672ebe1a80dc37ac  src/canonical-
 da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability-benchmark-runner.mjs
 2b62295591f142ca4b3bc5b03e6434f7fc3c51d9502f9a40ef8a03d1f72a8899  src/capability-benchmark.mjs
 160199b25f45bd0490f6b21a9fa8194313e9673c4b2699afce68249d3d249a7b  src/capability-ledger.mjs
+1b0ba08c5d5a75d95953a84a00b551af8ba1ee21cf1995255daa198368017760  src/capability-resolver.mjs
 94e5aeff2453cdc0239aee4d547dbbefee183c71933cb84e5e8a418fa99bc1e8  src/codex-app-server-r44.mjs
 6d0a80daaa2711e67e2597bff3db5bd2802682f559107a492f3cd89b9c6785ed  src/coding-mcp-tools.mjs
 d6fc395575f49abbbf60bf6f6ef5ee9ad51034a7e770a381e6ec34f869788306  src/coding-output-contracts.mjs
 0857a458e9c5101eee94c0596b7699adc34c50687455688fe38d03d241d27935  src/coding-plane.mjs
 38a1b4e9f5aa14cd5fd9058345c3480ae72c4a6a6eeccdc46e71297c68b5b5a6  src/coding-search.mjs
 f87284dc71c167f6a17575b93730c258ed6c433831013c776bf2d14e2b77767f  src/coding-task-runtime.mjs
-bfe4b641b61e4e7da8848c6c39d256a39191639315fb9f3c17a0b11f999ec792  src/compact-gateway-mcp-tools.mjs
+8478ef1f7b3dc89480c4310a20268048f581041bddcc0b7de9298fa2bfc654ca  src/compact-gateway-mcp-tools.mjs
 4218d1d1478d9e9a044d9b61c5ae205cd2ca0651a314900fad03992d0b12d286  src/compact-gateway-output-contracts.mjs
 40ac70ece531de7709d3c51686b36b48e0ae60283d1fb18d0adc037bfe6f9063  src/contained-cli.mjs
 d2bacef2443705e372071d0de3c72d45d57febb1dcbb11e369fce8a78bf0bf3e  src/contained-executor.mjs
@@ -1632,7 +1634,7 @@ ad4ca3635cb228b57b5b98e9518f379380ee1a03ad07ab4d12f8b7f324be2517  src/machine-mc
 e81b3ac2955e5dfafe308c82da24356a14da396230cb9fc47b231ab672d5be48  src/machine-output-contracts.mjs
 ed85d41c494a334117661ddec8191d34974fe28cb2a3378f3c04ee0e4c5d3ccc  src/mcp-contained-smoke-client.mjs
 b705345aa432b6a6ebbf62aabce1f78ba7e392bdfe998e79217eba8289ed0a7e  src/mcp-host-smoke-client.mjs
-02f6f0d456491dbd7687c4c81c7a2c3d9dd9db411d97617fcb9927b766f75a67  src/mcp-server.mjs
+3300d50f8a015bb090d5820dafe42edcc3d16a741e3ff12232ec03aadf115158  src/mcp-server.mjs
 b490c4152b16adae658b3af20a4827847866cec352e1b0c9eb6b36094116b83b  src/mcp-smoke-client.mjs
 cde7c813f5a2e9a69f09849455d1504e766963845a1f4b201ecc84090fa260d5  src/memory-r41.mjs
 9525aee66944023603f6d1ebb0768b8e8ab8bb93582a10dd7f9cd4459ee07454  src/native-diff-v2.mjs
@@ -1649,7 +1651,7 @@ b8e4e38fc38bd8d2efb01b58028944bc8133dcc42de12b1035784c5e01beca35  src/output-con
 974b5e9a5f60c4b2ac8bed629fb39a4e3c06b591995bec3f5f4756da8f3fd2e1  src/process-mcp-tools.mjs
 4c90265628194d989ac78f2b06eadbfffceb9c006d5b6c2e982f5667f7a385ed  src/process-output-contracts.mjs
 f5322664c669bc193214a803f9723e3728053f60bc008530db39a9af7f7bab75  src/process-policy.mjs
-23fb2a9394c6039d4238577eea377679fdd4be7a753e35452799ef9705aad894  src/process-runtime.mjs
+622b984e577932ed0c342a6d7e0e8a17d08e888caa2ca67c5ecc1bbcca16042a  src/process-runtime.mjs
 65d81b6cbdf4f4ce34ccef11793e79cfed6883288288915d077c11674f0873bb  src/process-smoke-client.mjs
 bb4d1532684b8f81a42377c4b0a9d4c61207856edfff496e878ffbb885b52442  src/proof-cli.mjs
 be4a4f7f16e473ac842559a5a18eccb59e3693bded59a1abc71e75ff448cc755  src/proof-worker.mjs
@@ -1686,14 +1688,14 @@ c8fd6fd3e49e866f2c3be326ab07222b36a44528ee0fc3f7b371c34a60e3c45b  src/remote-ses
 827b156eac01cc9ec6f5ca9a49219612f0da511fde770a9eb1235aa913b5e514  src/request-identity.mjs
 39251ab165bb0a0b8ea9b4c533aa0cd674934c0fa2c7f63145eac680d1d67be9  src/resource-identity.mjs
 ce2223bf6075e96cc02505c1439acce18bb1f204c5e86cf9152bb7194daf3cd2  src/runtime-identity.mjs
-9ea6bbebe732a2925b14807228cf5d74848def69b10216495498ae20f3a919ad  src/runtime-update.mjs
+88fe013cc2474e7e015235df39e54c3c6cd8afb8ac50a97b15a9dee590fed541  src/runtime-update.mjs
 c61335adb38bfc415fe1cdabfe2c0a87e61579dfd1e52cce91c44d6993479457  src/search-cursor.mjs
 fc5407ef8338ebeeede16225b3249166dc4d45e903d873eb46c15c3df07dc9ad  src/semantic-backend-registry.mjs
 686e9b55b9f4352b941579f186a9b9d348d86af53d052cbd5da953e7d15470ff  src/semantic-code.mjs
 17472b07dbfc1f6eff6831d79926a526e668ed0278cacbf9b4c421019174f505  src/semantic-lsp-backend.mjs
 a14cb827602d74f7c9822098815add8bf1ab6b27598d22b44880c8c98e754c1b  src/semantic-lsp-config.mjs
 3fc8d3786b981ec173e7ff634f117c1464e3e80f13cf471bd5e0fa38e4d4ac3b  src/skill-mcp-tools-r44.mjs
-4c3523126e3056ef1f30bc0f162c396868fca96d3ad8df2e7a0f5ae573a6f31d  src/skill-plane-r44.mjs
+3640e91254d3ed000ba32c41d3582de8af492915c6ee23f284e36f3873519616  src/skill-plane-r44.mjs
 3dc2102335cd1e86ee52a11950f80ff6e1771f4291325d4f95a8ea2b849617cc  src/stdio-console-guard.mjs
 6dccdb538be9783276399a5ad2cce54b1f0d8cc305fd58bee9f0f46d6a412af6  src/text-policy.mjs
 144c75f8e8a4c2a182db82642475359459e5c108b2a4cecd80488bea1e6ab3bb  src/tool-audit.mjs
@@ -1704,7 +1706,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-75903ce9e7a221d3f6d163f6a908de58765291347f732ff5e1d2cea9f04010ac  src/version.mjs
+87f3f4370c3e0e8db4ce0816a205836bb7736000b95d6fd24348944bb739bf6a  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
@@ -1745,7 +1747,8 @@ bad448d7bfd0c66b8d0dc0fa601fc22d69ccc3f447140ed0f77b68957984daea  test/capabilit
 c343906ca0878e13c576cd9f615802b1139c693bf6769a780dfb052637cf0d83  test/capability-benchmark.test.mjs
 b9a8faa4b86683ac5aea891fe6bc95f8e425fb31635176aa4603f9d582b52a79  test/capability-claims-r36.test.mjs
 a466a490759d438a8ac68919f79ddcb52253bdbecb5e4448a4fbf62af118184e  test/capability-ledger-r36.test.mjs
-b6f826b1faf13184fd89af4c068a5b93fce3c520cc2f9f6e09ad400edfedcc1c  test/cli-entrypoint.test.mjs
+5cdf20eace97fa87563c6b139390e6bd8ccbe80215f53aacd041579bfbad20d6  test/capability-resolver.test.mjs
+84eefe1a43474927fdc6fb7ef269309c662cefb229d6af2c91d9e2f0b9ba5c23  test/cli-entrypoint.test.mjs
 bec565ffa8550d56a5bb21927177c37d9d05f8353e3bc2541fc156886fe23688  test/codex-app-server-r44.test.mjs
 c43105a78ee4c93417d720ee660cfebc75b17f142a6484568e3cbaa583457f8c  test/codex-autonomous-r44.test.mjs
 350e151dbd8cc2723b141c5cf5f90bdf11289577c9b9347330e3ad815d948e98  test/coding-catalog-consistency.test.mjs
@@ -1773,7 +1776,7 @@ a972bd20fa927427e6d8e4181699a27e792e916b02dcf8a1ac3e2b44afd238c1  test/controlle
 ceba7d1a09ccdcb20f33fe4e6de7667ffe0f0170d1bc9fefadfdba4d7f228090  test/controller-r29.test.mjs
 4d0dc810d9af13907f31c834a13acfb7e01ffbbe65575b69649fe52741e42175  test/controller-r30.test.mjs
 cceba415584a641291ad08814a666c08c902c6614579611a082334cbad2b5b34  test/controller.test.mjs
-110cbc499c0686723988a95d9b384d28176fad0daaf6506997853db35641df43  test/core.test.mjs
+ca977f49ca8096c37e1db1d10066f6526c33f06df6d952d29b0b4958a9d9f9dc  test/core.test.mjs
 7ba4b06a1c4141ba87b5b371157fb59940d15a1016b4c599a13753d63ad0d3d3  test/DEADBYTE-MCP-WRITE-PROBE.txt
 c526724a6d10648fdd5152af917ba2fe51836dc5877daaac554bbd9e52fcd47e  test/deferred-slot-operation-behavior.test.mjs
 69a515b1a36f0620cae4057ea8dc5302751058e290aedaf2f0b637eb3288aba8  test/deferred-slot-operation.test.mjs
@@ -1923,7 +1926,7 @@ d8f544bbcdfff61f7abb7705ad7e5e1f17998f5fde3c114fb33915fc66d1408f  test/r41-final
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs
 7cc69e786bfd9e4a7e70888c4c1b5f756a264bc1a991139c468b63af23f24c38  test/release-slot.test.mjs
 0109c76b480cc600f6ed42be4519df3fa6835012bb9e4ba4ae6be6635468c4a8  test/release-smoke-isolation.test.mjs
-4ceba97216400cf3a1b01fa3353aba8459346e232a565c71024f14485ec141f1  test/release-version.test.mjs
+c4b570fb4c9826cba15998e44a9e01ba0f92d23309251648866fd77fab96b5c2  test/release-version.test.mjs
 c270a4e2d1384071e7c406f4ec8c8c1da56228844bf64362cffa03558be3cc49  test/remote-console-r40.test.mjs
 ba122b4a7a6953b9fc8187a531a3e8b0f5f8519da602c551b32df8c88c85e879  test/remote-device-r44.test.mjs
 3d26a0550a22c69990567d998c28e4ba0978c71429741c10c7c47f261653fbe2  test/remote-live-log-r36.test.mjs
@@ -1946,7 +1949,7 @@ abfbc97af4a3337694f2362c00da24fd2a06b526ba324e04d0d0816197c75595  test/semantic-
 1a3567cd485f127ff66f8e0f39c4a66eeb29d0a8d417173040764ff072907927  test/semantic-runtime-routing.test.mjs
 27e2bf4ffd18c51cd2b62dfca836fb24288a75ff8a7f55ed9d45f5ba0dd1578a  test/semantic-server-config-integration.test.mjs
 7f9b1e4f2f53d20386b721b57490c43268954982cff4522da26b1acdac2cb23a  test/skill-mcp-r44.test.mjs
-b59577750bce1dbff3058716c5107517312eb1b0a1b24220dba6702fed573bf2  test/skill-plane-r44.test.mjs
+ce8c503863544f36d101c079187d5f02ff5868c526c36f05cf5bea4a7ba2c015  test/skill-plane-r44.test.mjs
 a98537d1136988251572f424b29ff8f798356dcfd9a7a1d4238a9c7e943e6a52  test/standing-grants.test.mjs
 2c8ad3d273965fa6f7ba2f3aa1ee50791a28f4dcf6dfc8cd8d73510f2577f9f9  test/task-contract-r42.test.mjs
 6ecc712b7bcb2abdb934e7d40232ed97ac355f3f47665f557c2168b04d113b41  test/tool-audit.test.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.8",
+  "version": "0.15.11",
   "builder": "deadbyte-r46-fileless-powershell",
   "source_model": "development-root -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed final closure",
   "signing": "ed25519",

package/README.txt

@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.9 mcp
-  npx -y deadbyte-mcp@0.15.9 remote
-  npx -y deadbyte-mcp@0.15.9 remote status
-  npx -y deadbyte-mcp@0.15.9 remote restart
-  npx -y deadbyte-mcp@0.15.9 audit status
-  npx -y deadbyte-mcp@0.15.9 audit verify
+  npx -y deadbyte-mcp@0.15.11 mcp
+  npx -y deadbyte-mcp@0.15.11 remote
+  npx -y deadbyte-mcp@0.15.11 remote status
+  npx -y deadbyte-mcp@0.15.11 remote restart
+  npx -y deadbyte-mcp@0.15.11 audit status
+  npx -y deadbyte-mcp@0.15.11 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.9",
+  "version": "0.15.11",
   "train": "R46",
   "label": "FILELESS POWERSHELL PRODUCT BASELINE",
   "protocol_revision": "2026-07-28",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.9",
+  "version": "0.15.11",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/sign-adaptive-skill.mjs

@@ -0,0 +1,86 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto';
+import { createSkillPlane } from '../src/skill-plane-r44.mjs';
+
+const home = os.homedir();
+const stateDir = path.join(home, '.deadbyte-mcp');
+const skillDir = path.join(stateDir, 'skills', 'deadbyte-adaptive-reverse-engineering');
+const sha = b => createHash('sha256').update(b).digest('hex');
+function canonical(v) {
+  return Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object'
+    ? Object.fromEntries(Object.keys(v).sort((a, b) => a.localeCompare(b, 'en')).map(k => [k, canonical(v[k])])) : v;
+}
+
+const skillBytes = await readFile(path.join(skillDir, 'SKILL.md'));
+const skillText = new TextDecoder('utf-8').decode(skillBytes);
+const skillSha = sha(skillBytes);
+
+const refFiles = ['references/adaptive-routing.md', 'references/evidence-correlation.md'].sort((a, b) => a.localeCompare(b, 'en'));
+const resources = [];
+for (const rel of refFiles) {
+  const bytes = await readFile(path.join(skillDir, ...rel.split('/')));
+  resources.push({
+    path: rel,
+    sha256: sha(bytes),
+    kind: 'reference'
+  });
+}
+
+const body = {
+  schema: 'deadbyte.skill-manifest.v1',
+  name: 'deadbyte-adaptive-reverse-engineering',
+  version: '1.1.0',
+  description: 'Adaptive evidence-driven low-level reverse-engineering workflow that selects the smallest discriminating analysis path, allocates evidence budget by information gain, tracks contradictions, correlates bytes with semantics, and closes every claim with fresh verification.',
+  audience: 'agent',
+  skill_md_sha256: skillSha,
+  resources,
+  required_capabilities: [],
+  authority_planes: ['coding'],
+  provenance: {
+    source: 'skill-creator',
+    origin_url: null,
+    source_revision: 'local-draft-2026-09-24-v1.1'
+  }
+};
+
+const bodyBytes = Buffer.from(JSON.stringify(canonical(body)), 'utf8');
+const bodySha256 = sha(bodyBytes);
+
+const privPem = await readFile(path.join(stateDir, 'trust', 'ed25519-private.pem'));
+const priv = createPrivateKey(privPem);
+const pub = createPublicKey(priv);
+const keyId = sha(pub.export({ type: 'spki', format: 'der' }));
+
+const DOMAIN = Buffer.from('DEADBYTE-SKILL-MANIFEST-V1\0', 'utf8');
+const signature = sign(null, Buffer.concat([DOMAIN, bodyBytes]), priv);
+const attestation = {
+  algorithm: 'ed25519',
+  domain: 'DEADBYTE-SKILL-MANIFEST-V1',
+  key_id: keyId,
+  signature_base64: signature.toString('base64')
+};
+
+const unsigned = { body, body_sha256: bodySha256, attestation };
+const envelope = {
+  ...unsigned,
+  manifest_sha256: sha(Buffer.from(JSON.stringify(canonical(unsigned)), 'utf8'))
+};
+
+await writeFile(path.join(skillDir, 'skill.json'), JSON.stringify(envelope, null, 2), 'utf8');
+console.log('Skill envelope written successfully:', envelope.manifest_sha256);
+
+// Verify with createSkillPlane
+const plane = await createSkillPlane({
+  root: path.join(stateDir, 'skills'),
+  verifyKeyPath: path.join(stateDir, 'trust', 'ed25519-public.pem')
+});
+const list = await plane.list();
+console.log('Skill plane list result: skills=' + list.skills.length + ' invalid=' + list.invalid_skills.length);
+if (list.invalid_skills.length > 0) {
+  console.error('Invalid skills remain:', list.invalid_skills);
+  process.exit(1);
+}
+const loaded = await plane.load({ name: 'deadbyte-adaptive-reverse-engineering' });
+console.log('Skill loaded OK: name=' + loaded.name + ' verified=' + loaded.verified);

package/scripts/verify-package.ps1

@@ -0,0 +1,138 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+Set-Location $RepoRoot
+
+function Parse-NpmJson([string]$text) {
+    $candidates = @()
+    $b = $text.IndexOf('[')
+    $c = $text.IndexOf('{')
+    if ($b -ge 0) { $candidates += $b }
+    if ($c -ge 0) { $candidates += $c }
+    if ($candidates.Count -eq 0) { throw "No JSON found in npm output: $text" }
+    $start = ($candidates | Measure-Object -Minimum).Minimum
+    return ($text.Substring($start) | ConvertFrom-Json)
+}
+
+function Get-PackEntry($parsed) {
+    if ($parsed -is [System.Array]) {
+        return $parsed[0]
+    }
+    if ($parsed.PSObject.Properties['deadbyte-mcp']) {
+        return $parsed.'deadbyte-mcp'
+    }
+    if ($parsed.PSObject.Properties['files'] -or $parsed.PSObject.Properties['filename']) {
+        return $parsed
+    }
+    $props = @($parsed.PSObject.Properties)
+    if ($props.Count -gt 0) {
+        return $props[0].Value
+    }
+    return $parsed
+}
+
+Write-Host "=== [1/6] Checking package.json and bin entry ==="
+if (-not (Test-Path "package.json" -PathType Leaf)) {
+    throw "package.json not found in $RepoRoot"
+}
+$pkg = Get-Content "package.json" -Raw | ConvertFrom-Json
+$binPath = $pkg.bin.'deadbyte-mcp'
+if ([string]::IsNullOrWhiteSpace($binPath) -or $binPath -ne 'src/deadbyte-cli.mjs') {
+    throw "package.json bin['deadbyte-mcp'] must be 'src/deadbyte-cli.mjs', found: $binPath"
+}
+if (-not (Test-Path $binPath -PathType Leaf)) {
+    throw "CLI entrypoint '$binPath' does not exist"
+}
+Write-Host "  PASS: package.json bin['deadbyte-mcp'] -> $binPath"
+
+Write-Host "`n=== [2/6] Checking npm pack --dry-run for Windows command collisions ==="
+$dryRunJson = (& npm.cmd pack --dry-run --json 2>&1 | Out-String)
+if ($LASTEXITCODE -ne 0) {
+    throw "npm pack --dry-run failed with exit code $($LASTEXITCODE)"
+}
+$parsedDry = Parse-NpmJson $dryRunJson
+$dryEntry = Get-PackEntry $parsedDry
+$files = $dryEntry.files
+
+$collisionFiles = @($files | Where-Object {
+    $p = [string]$_.path
+    $p -match '^(?:package/)?DEADBYTE-MCP.*\.cmd$'
+})
+
+if ($collisionFiles.Count -gt 0) {
+    $found = ($collisionFiles | ForEach-Object { $_.path }) -join ', '
+    throw "Found forbidden root .cmd executable in package surface: $found"
+}
+Write-Host "  PASS: Zero root DEADBYTE-MCP*.cmd collisions detected in pack dry-run"
+
+Write-Host "`n=== [3/6] Generating test tarball in temp directory ==="
+$testDir = Join-Path $env:TEMP ("deadbyte-pkg-verify-" + [System.Guid]::NewGuid().ToString('N').Substring(0, 8))
+New-Item -ItemType Directory -Path $testDir -Force | Out-Null
+try {
+    $packOut = (& npm.cmd pack --pack-destination $testDir --json 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) {
+        throw "npm pack failed with exit code $($LASTEXITCODE)"
+    }
+    $packParsed = Parse-NpmJson $packOut
+    $packEntry = Get-PackEntry $packParsed
+    $tarballName = [string]$packEntry.filename
+    $tarballPath = Join-Path $testDir $tarballName
+
+    if (-not (Test-Path $tarballPath -PathType Leaf)) {
+        throw "Tarball not found at $tarballPath"
+    }
+    Write-Host "  PASS: Generated tarball: $tarballName"
+
+    Write-Host "`n=== [4/6] Inspecting tarball contents ==="
+    $listing = (& tar -tf $tarballPath 2>&1)
+    $tarCollisions = @($listing | Where-Object { $_ -match '^package/DEADBYTE-MCP.*\.cmd$' })
+    if ($tarCollisions.Count -gt 0) {
+        throw "Tarball contains root .cmd files: $($tarCollisions -join ', ')"
+    }
+    $hasCli = @($listing | Where-Object { $_ -eq 'package/src/deadbyte-cli.mjs' })
+    if ($hasCli.Count -eq 0) {
+        throw "Tarball missing package/src/deadbyte-cli.mjs"
+    }
+    Write-Host "  PASS: Tarball contains src/deadbyte-cli.mjs and no root collision .cmd files"
+
+    Write-Host "`n=== [5/6] Testing local direct node CLI invocation ==="
+    $verOut = (& node (Join-Path $RepoRoot "src/deadbyte-cli.mjs") --version 2>&1 | Out-String).Trim()
+    if ($verOut -ne [string]$pkg.version) {
+        throw "Direct node CLI version mismatch: expected $($pkg.version), got $verOut"
+    }
+    Write-Host "  PASS: Direct node CLI version matches $($pkg.version)"
+
+    Write-Host "`n=== [6/6] Testing clean-directory external npx execution ==="
+    Push-Location $testDir
+    try {
+        $origEap = $ErrorActionPreference
+        $ErrorActionPreference = 'SilentlyContinue'
+        $rawOut = (cmd.exe /c "npx.cmd --yes --package `"$tarballPath`" deadbyte-mcp --version 2>nul")
+        $exitCode = $LASTEXITCODE
+        $ErrorActionPreference = $origEap
+
+        if ($exitCode -ne 0) {
+            throw "npx execution failed with exit code $exitCode"
+        }
+        $npxVer = ($rawOut | Out-String).Trim()
+        $lastLine = ($npxVer -split '\r?\n')[-1].Trim()
+        if ($lastLine -ne [string]$pkg.version) {
+            throw "npx local tarball version mismatch: expected $($pkg.version), got $lastLine"
+        }
+        Write-Host "  PASS: npx local tarball returned $($pkg.version) in isolated directory"
+    } finally {
+        Pop-Location
+    }
+
+    Write-Host "`n========================================================"
+    Write-Host "PACKAGE_VERIFICATION_PASS: All package hygiene and execution checks passed!"
+    Write-Host "========================================================"
+
+} finally {
+    Remove-Item -LiteralPath $testDir -Recurse -Force -ErrorAction SilentlyContinue
+}

package/src/capability-resolver.mjs

@@ -0,0 +1,303 @@
+export const CAPABILITY_STATES = Object.freeze({
+  AVAILABLE: 'AVAILABLE',
+  DEGRADED: 'DEGRADED',
+  DISABLED: 'DISABLED',
+  DENIED: 'DENIED',
+  UNAVAILABLE: 'UNAVAILABLE'
+});
+
+const CAPABILITY_OPERATIONS = Object.freeze({
+  'skill.catalog': ['list', 'load', 'resource'],
+  'machine.list': ['machine_list'],
+  'machine.status': ['machine_status'],
+  'machine.ping': ['machine_ping'],
+  'machine.revoke': ['machine_revoke'],
+  'process.start': ['start'],
+  'process.read': ['read'],
+  'process.write': ['write'],
+  'process.status': ['status'],
+  'process.list': ['list'],
+  'process.action': ['action'],
+  'process.terminate': ['terminate'],
+  'coding.session_status': ['coding_session_status'],
+  'coding.tree': ['coding_tree'],
+  'coding.stat': ['stat'],
+  'coding.search': ['search'],
+  'coding.files_read': ['files_read'],
+  'coding.file_read': ['coding_file_read'],
+  'coding.file_write': ['coding_file_write'],
+  'coding.text_replace': ['coding_text_replace'],
+  'coding.command_run': ['coding_command_run'],
+  'coding.benchmark_run': ['coding_benchmark_run'],
+  'coding.receipt_verify': ['coding_receipt_verify'],
+  'coding.task_submit': ['coding_task_submit'],
+  'coding.task_run': ['coding_task_run'],
+  'coding.task_status': ['coding_task_status'],
+  'coding.task_events': ['coding_task_events'],
+  'coding.task_cancel': ['coding_task_cancel'],
+  'coding.task_approve': ['coding_task_approve'],
+  'coding.task_verify': ['coding_task_verify'],
+  'semantic.outline': ['symbol_outline'],
+  'semantic.definition': ['symbol_definition'],
+  'semantic.references': ['symbol_references'],
+  'semantic.diagnostics': ['symbol_diagnostics'],
+  'semantic.implementations': ['symbol_implementations'],
+  'semantic.rename_preview': ['symbol_rename_preview'],
+  'semantic.replace': ['coding_symbol_replace'],
+  'machine_fs.stat': ['stat'],
+  'machine_fs.list': ['list'],
+  'machine_fs.read': ['read'],
+  'machine_fs.write': ['write'],
+  'machine_fs.edit_exact': ['edit_exact'],
+  'machine_fs.mkdir': ['mkdir'],
+  'machine_fs.move': ['move'],
+  'machine_fs.delete': ['delete'],
+  'observation.search_start': ['search_start'],
+  'observation.search_page': ['search_page'],
+  'observation.search_status': ['search_status'],
+  'observation.search_cancel': ['search_cancel'],
+  'observation.process_list': ['process_list'],
+  'observation.system_status': ['system_status'],
+  'observation.hardware_query': ['hardware_query'],
+  'desktop.status': ['status'],
+  'desktop.observe': ['observe'],
+  'desktop.target': ['target'],
+  'desktop.action': ['action'],
+  'autonomous.session_status': ['autonomous_session_status'],
+  'native_diff.preview': ['native_diff_preview'],
+  'native_diff.apply': ['native_diff_apply'],
+  'native_diff.verify': ['native_diff_verify'],
+  'autonomous.goal_submit': ['autonomous_goal_submit'],
+  'autonomous.goal_run': ['autonomous_goal_run'],
+  'autonomous.goal_status': ['autonomous_goal_status'],
+  'autonomous.goal_events': ['autonomous_goal_events'],
+  'autonomous.goal_cancel': ['autonomous_goal_cancel'],
+  'autonomous.goal_approve': ['autonomous_goal_approve'],
+  'autonomous.goal_verify': ['autonomous_goal_verify'],
+  'autonomous.release_gate': ['autonomous_release_gate'],
+  'host.file_read': ['host_file_read'],
+  'host.file_write': ['host_file_write'],
+  'host.exec': ['host_exec'],
+  'evidence.verify': ['evidence_verify']
+});
+
+export function deriveCapabilityRequirements(capability) {
+  const reqs = [];
+  if (capability.runtime_flag) reqs.push(capability.runtime_flag);
+  if (capability.id === 'skill.catalog') {
+    reqs.push('skill_plane.valid');
+    return reqs;
+  }
+  if (capability.authority === 'coding') {
+    if (capability.mutating) {
+      reqs.push('coding_session.armed', 'policy.write');
+    } else {
+      reqs.push('coding_runtime.ready');
+    }
+  } else if (capability.authority === 'process') {
+    if (capability.mutating) {
+      reqs.push('process_session.armed');
+    } else {
+      reqs.push('process_runtime.ready');
+    }
+  } else if (capability.authority === 'autonomous') {
+    if (capability.mutating) {
+      reqs.push('autonomous_session.armed');
+    } else {
+      reqs.push('autonomous_runtime.ready');
+    }
+  } else if (capability.authority === 'desktop') {
+    if (capability.mutating) {
+      reqs.push('desktop_control.armed', 'policy.desktop');
+    } else {
+      reqs.push('desktop_runtime.ready');
+    }
+  } else if (capability.authority === 'host' || capability.host_only) {
+    if (capability.mutating) {
+      reqs.push('host_policy.armed');
+    } else {
+      reqs.push('host_policy.configured');
+    }
+  }
+  return reqs;
+}
+
+export async function resolveCapabilityStates({
+  ledger,
+  toolCatalog = [],
+  profile = 'full',
+  env = process.env,
+  codingRuntime = null,
+  processRuntime = null,
+  processPolicy = null,
+  machineFsRuntime = null,
+  observationRuntime = null,
+  desktopRuntime = null,
+  desktopPolicy = null,
+  autonomousRuntime = null,
+  skillRuntime = null,
+  hostPolicy = null
+} = {}) {
+  const capabilities = ledger?.entries ?? [];
+  const resolved = [];
+  const catalogSet = new Set(toolCatalog);
+
+  // Probe session authorities asynchronously
+  let codingStatus = null;
+  if (codingRuntime?.sessionStatus) {
+    try { codingStatus = await codingRuntime.sessionStatus(); } catch {}
+  }
+
+  let autonomousStatus = null;
+  if (autonomousRuntime?.sessionStatus) {
+    try { autonomousStatus = await autonomousRuntime.sessionStatus(); } catch {}
+  }
+
+  let skillListResult = null;
+  if (skillRuntime?.list) {
+    try { skillListResult = await skillRuntime.list(); } catch (err) {
+      skillListResult = { invalid_skills: [{ name: '*', error: String(err) }] };
+    }
+  }
+
+  for (const cap of capabilities) {
+    const activeTool = profile === 'compact' ? (cap.compact_tool || cap.full_tool) : cap.full_tool;
+    const activeOp = profile === 'compact' ? (cap.compact_op || 'direct') : 'direct';
+    const ops = CAPABILITY_OPERATIONS[cap.id] ?? [activeOp];
+    const requires = deriveCapabilityRequirements(cap);
+
+    let state = CAPABILITY_STATES.AVAILABLE;
+    let ready = true;
+    let diagnostic = null;
+
+    // 1. Runtime Flag Disabled check
+    if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
+      state = CAPABILITY_STATES.DISABLED;
+      ready = false;
+      diagnostic = {
+        code: 'RUNTIME_FLAG_DISABLED',
+        reason: `Runtime flag ${cap.runtime_flag}=0 is disarmed`,
+        recoverable: false
+      };
+    }
+    // 2. Tool presence check
+    else if (!catalogSet.has(activeTool)) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'TOOL_NOT_REGISTERED',
+        reason: `Tool '${activeTool}' is not registered in the active tool catalog`,
+        recoverable: false
+      };
+    }
+    // 3. Subsystem runtime instantiation check
+    else if (cap.id.startsWith('machine_fs.') && !machineFsRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'MACHINE_FS_NOT_INSTANTIATED',
+        reason: 'Machine filesystem runtime is uninitialized',
+        recoverable: false
+      };
+    } else if (cap.id.startsWith('observation.') && !observationRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'OBSERVATION_NOT_INSTANTIATED',
+        reason: 'Observation runtime is uninitialized',
+        recoverable: false
+      };
+    } else if (cap.id.startsWith('desktop.') && !desktopRuntime) {
+      state = CAPABILITY_STATES.UNAVAILABLE;
+      ready = false;
+      diagnostic = {
+        code: 'DESKTOP_NOT_INSTANTIATED',
+        reason: 'Desktop runtime is uninitialized',
+        recoverable: false
+      };
+    } else if ((cap.authority === 'host' || cap.host_only) && !hostPolicy) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'HOST_POLICY_DISARMED',
+        reason: 'Privileged host policy is not configured or disarmed',
+        recoverable: true
+      };
+    }
+    // 4. Session Authority Checks
+    else if (cap.authority === 'coding' && cap.mutating && codingStatus && !codingStatus.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'CODING_SESSION_DISARMED',
+        reason: codingStatus.reason || 'Coding session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (cap.authority === 'autonomous' && cap.mutating && autonomousStatus && !autonomousStatus.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'AUTONOMOUS_SESSION_DISARMED',
+        reason: autonomousStatus.reason || 'Autonomous session is not armed for mutation',
+        recoverable: true
+      };
+    }
+    // 5. Subsystem Health Probes (e.g. Skill Plane envelope verification)
+    else if (cap.id === 'skill.catalog') {
+      if (skillListResult?.invalid_skills && skillListResult.invalid_skills.length > 0) {
+        state = CAPABILITY_STATES.DEGRADED;
+        ready = false;
+        diagnostic = {
+          code: 'SKILL_ENVELOPE_MISMATCH',
+          reason: `Skill registry rejected envelope for: ${skillListResult.invalid_skills.map(s => s.name).join(', ')}`,
+          recoverable: true
+        };
+      }
+    }
+
+    resolved.push(Object.freeze({
+      id: cap.id,
+      tool: activeTool,
+      compact_tool: cap.compact_tool,
+      compact_op: cap.compact_op,
+      operations: ops,
+      authority: cap.authority,
+      mutating: cap.mutating,
+      production: cap.production,
+      runtime_flag: cap.runtime_flag,
+      requires,
+      state,
+      ready,
+      diagnostic
+    }));
+  }
+
+  const effectiveCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.AVAILABLE)
+    .map(c => c.id);
+
+  const unavailableCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.UNAVAILABLE || c.state === CAPABILITY_STATES.DISABLED || c.state === CAPABILITY_STATES.DENIED)
+    .map(c => ({
+      id: c.id,
+      state: c.state,
+      reason_code: c.diagnostic?.code ?? 'UNAVAILABLE',
+      reason: c.diagnostic?.reason ?? 'Capability not available'
+    }));
+
+  const degradedCapabilities = resolved
+    .filter(c => c.state === CAPABILITY_STATES.DEGRADED)
+    .map(c => ({
+      id: c.id,
+      state: c.state,
+      reason_code: c.diagnostic?.code ?? 'DEGRADED',
+      reason: c.diagnostic?.reason ?? 'Capability operating in degraded mode'
+    }));
+
+  return Object.freeze({
+    capabilities: resolved,
+    effective_capabilities: effectiveCapabilities,
+    unavailable_capabilities: unavailableCapabilities,
+    degraded_capabilities: degradedCapabilities
+  });
+}

package/src/compact-gateway-mcp-tools.mjs

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import * as z from 'zod/v4';
 import { compactGatewayOutputSchema, compactGatewayResult } from './compact-gateway-output-contracts.mjs';
 import { desktopControlInputSchema,invokeDesktopOperation } from './desktop-mcp-tools-r40.mjs';
+import { resolveCapabilityStates } from './capability-resolver.mjs';
 
 const id=z.string().regex(/^[A-Za-z0-9._-]{1,64}$/);
 const rel=z.string().min(1).max(2048);
@@ -123,17 +124,26 @@ async function machineObserve(args,machineRuntime,observationRuntime){
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }
 
-export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider}){
+export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider}){
   if(!server) throw new Error('compact gateway registration requires server');
   if(profile!=='compact') return;
   if(typeof catalogProvider!=='function') throw new Error('compact gateway requires catalogProvider');
-  server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
+  server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog with runtime-aware resolution.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
     const toolCatalog=[...catalogProvider()].map(String).sort();
     if(toolCatalog.length<1||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('compact catalog provider returned invalid catalog');
     const catalogSha256=createHash('sha256').update(JSON.stringify(toolCatalog),'utf8').digest('hex');
+    const dynamicResolution = await resolveCapabilityStates({
+      ledger, toolCatalog, profile, env,
+      codingRuntime, processRuntime, machineFsRuntime, observationRuntime, desktopRuntime,
+      autonomousRuntime, skillRuntime, hostPolicy
+    });
     return compactGatewayResult({status:'ok',op:'manifest',result:{
       schema:'deadbyte.capability-manifest.v2',profile,ledger_sha256:ledger?.ledger_sha256??null,
-      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,capabilities:ledger?.entries??[]
+      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,
+      capabilities:dynamicResolution.capabilities,
+      effective_capabilities:dynamicResolution.effective_capabilities,
+      unavailable_capabilities:dynamicResolution.unavailable_capabilities,
+      degraded_capabilities:dynamicResolution.degraded_capabilities
     }},false);
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));

package/src/mcp-server.mjs

@@ -459,7 +459,8 @@ serveStdio(() => {
 
   registerCompactGatewayTools(toolServer,{
     profile:surfaceProfile,ledger:R36_CAPABILITY_LEDGER,codingRuntime,semanticRuntime,machineFsRuntime,
-    processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider:()=>[...registeredToolNames]
+    processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,
+    catalogProvider:()=>[...registeredToolNames]
   });
 
   if (hostPolicy) {

package/src/process-runtime.mjs

@@ -20,12 +20,27 @@ const TERMINAL_RECOVERY_SCHEMA = 'deadbyte.process-terminal.v1';
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 const nowUtc = () => new Date().toISOString();
 
+const STANDARD_PATHEXT = '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC';
+
+export function getRepairedPathExt() {
+  const current = process.env.PATHEXT;
+  if (!current) return STANDARD_PATHEXT;
+  const exts = current.split(';').map(e => e.trim().toUpperCase()).filter(Boolean);
+  if (!exts.includes('.EXE')) {
+    return [...new Set([...STANDARD_PATHEXT.split(';'), ...exts])].join(';');
+  }
+  return current;
+}
+
 function processEnvironment(profile) {
   const allow = new Set(profile.env_allow.map(name => name.toLowerCase()));
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (allow.has(key.toLowerCase()) && typeof value === 'string') env[key] = value;
   }
+  if (process.platform === 'win32') {
+    env.PATHEXT = getRepairedPathExt();
+  }
   return env;
 }
 async function resolveCwd(policy, grant, profile, rootId, cwd) {

package/src/runtime-update.mjs

@@ -1157,15 +1157,15 @@ async function resumeSlotUpdate({handoffPath}){
   const stableMcpUrl=body.stable_mcp_url?{...body.stable_mcp_url}:releaseState.stable_mcp_url?{...releaseState.stable_mcp_url}:null;
   const mcpUrlSnapshot=body.mcp_url_snapshot?decodeSnapshot(body.mcp_url_snapshot,'MCP URL'):{exists:false,bytes:null,sha256:null};
   const cleanup=await acquireSupervisorLease(absoluteHandoff);
+  const journal=releaseState;
+  let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
+  let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
   try{
-    const journal=releaseState;
     if(phaseRank(phase)<phaseRank('supervisor_spawned')){
       await writeState(statePath,journal,'supervisor_spawned',{supervisor_pid:process.pid,supervisor_script:body.supervisor_script,supervisor_script_sha256:body.supervisor_script_sha256});
       phase='supervisor_spawned';
     }
     let revoked=phaseRank(phase)>=phaseRank('authority_revoked')||journal.revoked_before_switch===true;
-    let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
-    let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
     let newRuntime=null,stabilization=null;
 
     if(phaseRank(phase)<phaseRank('authority_revoked')){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.9';
+export const DEADBYTE_VERSION = '0.15.11';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/capability-resolver.test.mjs

@@ -0,0 +1,133 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CAPABILITY_STATES,
+  deriveCapabilityRequirements,
+  resolveCapabilityStates
+} from '../src/capability-resolver.mjs';
+import { R36_CAPABILITY_LEDGER } from '../src/capability-ledger.mjs';
+
+test('capability resolver enforces 5 canonical states', () => {
+  assert.equal(CAPABILITY_STATES.AVAILABLE, 'AVAILABLE');
+  assert.equal(CAPABILITY_STATES.DEGRADED, 'DEGRADED');
+  assert.equal(CAPABILITY_STATES.DISABLED, 'DISABLED');
+  assert.equal(CAPABILITY_STATES.DENIED, 'DENIED');
+  assert.equal(CAPABILITY_STATES.UNAVAILABLE, 'UNAVAILABLE');
+});
+
+test('deriveCapabilityRequirements maps dependencies accurately', () => {
+  const reqCodingRead = deriveCapabilityRequirements({
+    id: 'coding.search',
+    authority: 'coding',
+    mutating: false,
+    runtime_flag: 'DEADBYTE_CODING_RUNTIME'
+  });
+  assert.deepEqual(reqCodingRead, ['DEADBYTE_CODING_RUNTIME', 'coding_runtime.ready']);
+
+  const reqCodingWrite = deriveCapabilityRequirements({
+    id: 'coding.file_write',
+    authority: 'coding',
+    mutating: true,
+    runtime_flag: 'DEADBYTE_CODING_RUNTIME'
+  });
+  assert.deepEqual(reqCodingWrite, ['DEADBYTE_CODING_RUNTIME', 'coding_session.armed', 'policy.write']);
+
+  const reqSkill = deriveCapabilityRequirements({
+    id: 'skill.catalog',
+    authority: 'operator',
+    mutating: false
+  });
+  assert.deepEqual(reqSkill, ['skill_plane.valid']);
+});
+
+test('resolveCapabilityStates resolves all 5 states correctly', async () => {
+  const allCompactTools = [
+    'capability_manifest',
+    'coding_inspect',
+    'machine_fs',
+    'process_session',
+    'machine_observe',
+    'desktop_control',
+    'skill_catalog'
+  ];
+
+  // 1. Fully available & armed state
+  const armedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    processRuntime: {},
+    machineFsRuntime: {},
+    observationRuntime: {},
+    desktopRuntime: {},
+    autonomousRuntime: { sessionStatus: async () => ({ armed: true }) },
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) },
+    hostPolicy: {}
+  });
+
+  assert.ok(armedRes.capabilities.length > 0);
+  assert.ok(armedRes.effective_capabilities.includes('coding.search'));
+  assert.ok(armedRes.effective_capabilities.includes('skill.catalog'));
+
+  // 2. Disabled by runtime flag
+  const disabledRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: { DEADBYTE_CODING_RUNTIME: '0' },
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    processRuntime: {},
+    machineFsRuntime: {},
+    observationRuntime: {},
+    desktopRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) }
+  });
+
+  const codingSearch = disabledRes.capabilities.find(c => c.id === 'coding.search');
+  assert.equal(codingSearch.state, CAPABILITY_STATES.DISABLED);
+  assert.equal(codingSearch.diagnostic.code, 'RUNTIME_FLAG_DISABLED');
+  assert.ok(disabledRes.unavailable_capabilities.some(u => u.id === 'coding.search' && u.state === CAPABILITY_STATES.DISABLED));
+
+  // 3. Unavailable due to uninstantiated subsystem
+  const uninstantiatedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    machineFsRuntime: null
+  });
+  const fsStat = uninstantiatedRes.capabilities.find(c => c.id === 'machine_fs.stat');
+  assert.equal(fsStat.state, CAPABILITY_STATES.UNAVAILABLE);
+  assert.equal(fsStat.diagnostic.code, 'MACHINE_FS_NOT_INSTANTIATED');
+
+  // 4. Denied when coding session is disarmed for mutating operations in full profile
+  const disarmedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: ['coding_file_write', 'coding_search'],
+    profile: 'full',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: false, reason: 'policy grant not confirmed' }) },
+    machineFsRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [] }) }
+  });
+  const fileWrite = disarmedRes.capabilities.find(c => c.id === 'coding.file_write');
+  assert.equal(fileWrite.state, CAPABILITY_STATES.DENIED);
+  assert.equal(fileWrite.diagnostic.code, 'CODING_SESSION_DISARMED');
+
+  // 5. Degraded when skill plane reports envelope mismatch
+  const degradedRes = await resolveCapabilityStates({
+    ledger: R36_CAPABILITY_LEDGER,
+    toolCatalog: allCompactTools,
+    profile: 'compact',
+    env: {},
+    codingRuntime: { sessionStatus: async () => ({ armed: true }) },
+    machineFsRuntime: {},
+    skillRuntime: { list: async () => ({ invalid_skills: [{ name: 'test-broken', error: 'envelope mismatch' }] }) }
+  });
+  const skillCap = degradedRes.capabilities.find(c => c.id === 'skill.catalog');
+  assert.equal(skillCap.state, CAPABILITY_STATES.DEGRADED);
+  assert.equal(skillCap.diagnostic.code, 'SKILL_ENVELOPE_MISMATCH');
+  assert.ok(degradedRes.degraded_capabilities.some(d => d.id === 'skill.catalog'));
+});

package/DEADBYTE-MCP-local.cmd

@@ -1,4 +0,0 @@
-@echo off
-setlocal EnableExtensions DisableDelayedExpansion
-call "%~dp0controller\DEADBYTE-MCP.cmd" %*
-exit /b %ERRORLEVEL%

package/DEADBYTE-MCP.cmd

@@ -1,5 +0,0 @@
-@echo off
-setlocal EnableExtensions DisableDelayedExpansion
-set "HERE=%~dp0"
-"%HERE%controller\DEADBYTE-MCP.cmd" %*
-exit /b %ERRORLEVEL%