deadbyte-mcp 0.8.10 → 0.10.0

package/src/tool-surface-ledger.mjs

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+
+const SURFACE_SCHEMA='deadbyte.tool-surface.v1';
+
+function canonicalValue(value,seen=new Set()){
+  if(value===null||typeof value==='string'||typeof value==='boolean') return value;
+  if(typeof value==='number'){
+    if(!Number.isFinite(value)) throw new Error('schema contains unsupported non-finite JSON number');
+    return Object.is(value,-0)?0:value;
+  }
+  if(typeof value==='undefined') throw new Error('schema contains unsupported undefined JSON value');
+  if(typeof value==='function') throw new Error('schema contains unsupported function JSON value');
+  if(typeof value==='symbol') throw new Error('schema contains unsupported symbol JSON value');
+  if(typeof value==='bigint') throw new Error('schema contains unsupported bigint JSON value');
+  if(typeof value!=='object') throw new Error(`schema contains unsupported JSON value type: ${typeof value}`);
+  if(seen.has(value)) throw new Error('schema contains circular JSON value');
+  seen.add(value);
+  try{
+    if(Array.isArray(value)){
+      const out=[];
+      for(let index=0;index<value.length;index+=1){
+        if(!Object.prototype.hasOwnProperty.call(value,index)) throw new Error('schema contains sparse JSON array');
+        out.push(canonicalValue(value[index],seen));
+      }
+      return out;
+    }
+    const proto=Object.getPrototypeOf(value);
+    if(proto!==Object.prototype&&proto!==null) throw new Error('schema contains unsupported non-plain JSON object');
+    const out={};
+    for(const key of Object.keys(value).sort((a,b)=>a.localeCompare(b,'en'))){
+      out[key]=canonicalValue(value[key],seen);
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+}
+
+function canonicalJson(value){return JSON.stringify(canonicalValue(value));}
+function sha256(value){return createHash('sha256').update(value,'utf8').digest('hex');}
+
+export function canonicalSchemaHash(schema){return sha256(canonicalJson(schema));}
+
+export function snapshotToolSurface(toolDescriptors){
+  if(!Array.isArray(toolDescriptors)) throw new Error('tool descriptors must be an array');
+  const names=new Set();
+  const tools=toolDescriptors.map(descriptor=>{
+    if(!descriptor||typeof descriptor!=='object'||Array.isArray(descriptor)) throw new Error('tool descriptor must be an object');
+    const name=descriptor.name;
+    if(typeof name!=='string'||name.length<1) throw new Error('tool descriptor name must be non-empty');
+    if(names.has(name)) throw new Error(`duplicate tool: ${name}`);
+    names.add(name);
+    return {
+      name,
+      input_sha256:canonicalSchemaHash(descriptor.inputSchema),
+      output_sha256:canonicalSchemaHash(descriptor.outputSchema)
+    };
+  }).sort((a,b)=>a.name.localeCompare(b.name,'en'));
+  const body={schema:SURFACE_SCHEMA,tools};
+  return {...body,surface_sha256:sha256(canonicalJson(body))};
+}
+
+export function snapshotToolsListResult(result){
+  if(!result||typeof result!=='object'||!Array.isArray(result.tools)) throw new Error('MCP tools/list result tools must be an array');
+  return snapshotToolSurface(result.tools.map(tool=>{
+    if(!tool||typeof tool!=='object'||Array.isArray(tool)) throw new Error('MCP tools/list tool must be an object');
+    if(!tool.inputSchema||typeof tool.inputSchema!=='object'||Array.isArray(tool.inputSchema)) throw new Error(`tool ${tool.name??'<unknown>'} missing inputSchema`);
+    if(!tool.outputSchema||typeof tool.outputSchema!=='object'||Array.isArray(tool.outputSchema)) throw new Error(`tool ${tool.name??'<unknown>'} missing outputSchema`);
+    return {name:tool.name,inputSchema:tool.inputSchema,outputSchema:tool.outputSchema};
+  }));
+}
+
+function assertSnapshot(snapshot,label){
+  if(!snapshot||snapshot.schema!==SURFACE_SCHEMA||!Array.isArray(snapshot.tools)) throw new Error(`${label} tool surface snapshot invalid`);
+}
+
+export function diffToolSurface(baseline,current){
+  assertSnapshot(baseline,'baseline'); assertSnapshot(current,'current');
+  const before=new Map(baseline.tools.map(tool=>[tool.name,tool]));
+  const after=new Map(current.tools.map(tool=>[tool.name,tool]));
+  const unchanged=[]; const added=[]; const removed=[]; const schemaChanged=[];
+  for(const name of [...new Set([...before.keys(),...after.keys()])].sort((a,b)=>a.localeCompare(b,'en'))){
+    const left=before.get(name); const right=after.get(name);
+    if(!left){added.push(name);continue;}
+    if(!right){removed.push(name);continue;}
+    if(left.input_sha256===right.input_sha256&&left.output_sha256===right.output_sha256) unchanged.push(name);
+    else schemaChanged.push(name);
+  }
+  return {unchanged,added,removed,schema_changed:schemaChanged};
+}
+
+export const TOOL_SURFACE_SCHEMA=SURFACE_SCHEMA;

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.8.10';
+export const DEADBYTE_VERSION = '0.10.0';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/audit-verify.test.mjs

@@ -19,7 +19,7 @@ async function fixture(){
 }
 async function lines(file){return (await readFile(file,'utf8')).trim().split(/\r?\n/);}
 
-test('independent verifier accepts a clean signed multi-segment audit chain',async()=>{const f=await fixture();try{const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,true);assert.equal(result.event_count,4);assert.equal(result.request_count,2);assert.equal(result.result_count,2);assert.equal(result.segment_count,2);assert.equal(result.checkpoint_count,2);assert.equal(result.last_seq,4);assert.match(result.head_sha256,/^[0-9a-f]{64}$/);}finally{await rm(f.root,{recursive:true,force:true});}});
+test('independent verifier accepts a clean signed multi-segment audit chain',async()=>{const f=await fixture();try{const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,true);assert.equal(result.event_count,4);assert.equal(result.request_count,2);assert.equal(result.result_count,2);assert.equal(result.segment_count,2);assert.equal(result.checkpoint_count,2);assert.equal(result.last_seq,4);assert.match(result.head_sha256,/^[0-9a-f]{64}$/);assert.deepEqual(result.tool_usage,[{tool:'one',requests:1,results:1,errors:0},{tool:'two',requests:1,results:1,errors:0}]);}finally{await rm(f.root,{recursive:true,force:true});}});
 
 test('verifier detects an edited event line',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','segment-00000001.jsonl');const row=await lines(file);const first=JSON.parse(row[0]);first.tool='tampered';row[0]=JSON.stringify(first);await writeFile(file,row.join('\n')+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/event hash mismatch/i);}finally{await rm(f.root,{recursive:true,force:true});}});
 

package/test/autonomous-action-reconcile.test.mjs

@@ -0,0 +1,106 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { actionIdentity, reconcileStartedAction } from '../src/autonomous-action-reconcile.mjs';
+
+const H = c => c.repeat(64);
+
+const identityInput = {
+  goalId:H('1'),
+  planId:H('2'),
+  planVersion:3,
+  stepId:'fix',
+  mutationEpoch:4,
+  decisionEventSha:H('5'),
+  action:{kind:'patch',operations:[{kind:'replace',path:'x.txt',expected_sha256:H('6'),old_string:'x',new_string:'y',expected_replacements:1}]}
+};
+
+test('action identity is deterministic and changes when plan version changes', () => {
+  const a = actionIdentity(identityInput);
+  const b = actionIdentity(structuredClone(identityInput));
+  assert.deepEqual(a,b);
+  assert.match(a.action_id,/^[0-9a-f]{64}$/);
+  assert.match(a.request_sha256,/^[0-9a-f]{64}$/);
+  const changed = actionIdentity({...identityInput,planVersion:4});
+  assert.notEqual(changed.action_id,a.action_id);
+  assert.notEqual(changed.request_sha256,a.request_sha256);
+});
+
+function patchStarted() {
+  return {
+    type:'action_started',event_sha256:H('7'),payload:{
+      action_id:H('8'),request_sha256:H('9'),
+      action:{kind:'patch',diff_id:H('a')}
+    }
+  };
+}
+
+test('verified mutation receipt classifies as executed without replay', async () => {
+  const result = await reconcileStartedAction({
+    startedEvent:patchStarted(),journal:[],
+    runtimes:{nativeDiffRuntime:{async verify({diffId}){
+      assert.equal(diffId,H('a'));
+      return {ok:true,current_state_matches:true,receipt_sha256:H('b'),journal_head_sha256:H('c')};
+    }}}
+  });
+  assert.equal(result.classification,'executed_verified');
+  assert.equal(result.replay_allowed,false);
+  assert.equal(result.evidence.receipt_sha256,H('b'));
+});
+
+test('missing mutation evidence is not executed and may retry with the same identity', async () => {
+  const result = await reconcileStartedAction({
+    startedEvent:patchStarted(),journal:[],
+    runtimes:{nativeDiffRuntime:{async verify(){return {ok:false,reason:'native diff receipt missing'};}}}
+  });
+  assert.equal(result.classification,'not_executed');
+  assert.equal(result.replay_allowed,true);
+});
+
+test('conflicting or unverifiable mutation evidence is ambiguous and never replayed', async () => {
+  const badSignature = await reconcileStartedAction({
+    startedEvent:patchStarted(),journal:[],
+    runtimes:{nativeDiffRuntime:{async verify(){return {ok:false,reason:'receipt signature mismatch'};}}}
+  });
+  assert.equal(badSignature.classification,'ambiguous');
+  assert.equal(badSignature.replay_allowed,false);
+
+  const staleState = await reconcileStartedAction({
+    startedEvent:patchStarted(),journal:[],
+    runtimes:{nativeDiffRuntime:{async verify(){return {ok:true,current_state_matches:false,receipt_sha256:H('b')};}}}
+  });
+  assert.equal(staleState.classification,'ambiguous');
+  assert.equal(staleState.replay_allowed,false);
+});
+
+test('verified profile failure is recovered as executed_failed_verified', async () => {
+  const started = {type:'action_started',event_sha256:H('1'),payload:{
+    action_id:H('2'),request_sha256:H('3'),
+    action:{kind:'profile',receipt_id:'a'.repeat(24),expect_exit_code:0}
+  }};
+  const result = await reconcileStartedAction({
+    startedEvent:started,journal:[],
+    runtimes:{codingRuntime:{async verifyReceiptDetailed(receiptId){
+      assert.equal(receiptId,'a'.repeat(24));
+      return {ok:true,request_sha256:H('3'),receipt_sha256:H('4'),receipt:{receipt_id:receiptId,operation:'coding_command_run',exit_code:1,timed_out:false}};
+    }}}
+  });
+  assert.equal(result.classification,'executed_failed_verified');
+  assert.equal(result.replay_allowed,false);
+  assert.equal(result.evidence.receipt_sha256,H('4'));
+});
+
+test('receipt substitution or stale request identity is ambiguous', async () => {
+  const started = {type:'action_started',event_sha256:H('1'),payload:{
+    action_id:H('2'),request_sha256:H('3'),
+    action:{kind:'profile',receipt_id:'a'.repeat(24),expect_exit_code:0}
+  }};
+  const result = await reconcileStartedAction({
+    startedEvent:started,journal:[],
+    runtimes:{codingRuntime:{async verifyReceiptDetailed(){
+      return {ok:true,request_sha256:H('f'),receipt_sha256:H('4'),receipt:{receipt_id:'a'.repeat(24),operation:'coding_command_run',exit_code:0,timed_out:false}};
+    }}}
+  });
+  assert.equal(result.classification,'ambiguous');
+  assert.match(result.reason,/request/i);
+  assert.equal(result.replay_allowed,false);
+});

package/test/autonomous-adversarial.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -9,7 +9,7 @@ import { createCodingRuntime, loadCodingPolicy } from '../src/coding-plane.mjs';
 import { loadAutonomousPolicy } from '../src/autonomous-policy.mjs';
 import { createNativeDiffRuntime } from '../src/native-diff.mjs';
 import { createAutonomousRuntime } from '../src/autonomous-runtime.mjs';
-import { buildPlannerPrompt, parsePlannerDecision } from '../src/autonomous-planner.mjs';
+import { buildPlannerPrompt, parsePlannerDecision, parseR34PlannerDecision, requestR34ProviderDecision } from '../src/autonomous-planner.mjs';
 
 const nonce = () => randomBytes(32).toString('hex');
 async function fixture(delegates = {}) {
@@ -32,13 +32,17 @@ async function fixture(delegates = {}) {
   await writeFile(policy.lease_file, JSON.stringify({ schema:'deadbyte.autonomous-lease.v1', policy_sha256:policy.policy_sha256,
     instance_nonce:nonce(), root_ids:['project'], armed_at_utc:new Date().toISOString(), expires_at_utc:new Date(Date.now()+1800000).toISOString() }));
   const codingRuntime = createCodingRuntime({ policy:codingPolicy, signingKeyPath:keys.privateKeyPath, verifyKeyPath:keys.publicKeyPath });
-  const nativeDiffRuntime = createNativeDiffRuntime({ policy,codingRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath });
-  const { codingRuntimeFactory, observationRuntimeFactory, ...runtimeDelegates } = delegates;
+  const baseNativeDiffRuntime = createNativeDiffRuntime({ policy,codingRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath });
+  const { codingRuntimeFactory, nativeDiffRuntimeFactory, observationRuntimeFactory, ...runtimeDelegates } = delegates;
   const autonomousCodingRuntime = codingRuntimeFactory ? codingRuntimeFactory(codingRuntime) : codingRuntime;
+  const autonomousNativeDiffRuntime = nativeDiffRuntimeFactory ? nativeDiffRuntimeFactory(baseNativeDiffRuntime) : baseNativeDiffRuntime;
   if (observationRuntimeFactory) runtimeDelegates.observationRuntime = observationRuntimeFactory({ codingPolicy,keys });
-  const runtime = createAutonomousRuntime({ policy,codingRuntime:autonomousCodingRuntime,nativeDiffRuntime,...runtimeDelegates,
+  const createRuntime = (overrides = {}) => createAutonomousRuntime({ policy,codingRuntime:autonomousCodingRuntime,
+    nativeDiffRuntime:autonomousNativeDiffRuntime,...runtimeDelegates,...overrides,
     signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath });
-  return { root,project,keys,codingPolicy,policy,runtime };
+  const runtime = createRuntime();
+  return { root,project,keys,codingPolicy,policy,codingRuntime:autonomousCodingRuntime,
+    nativeDiffRuntime:autonomousNativeDiffRuntime,baseNativeDiffRuntime,createRuntime,runtime };
 }
 async function submit(runtime,id='adv') {
   return runtime.submit({ submissionId:id, rootId:'project', title:'adversarial', goal:'Inspect x.txt safely.', acceptance:'Do not claim release without evidence.' });
@@ -122,6 +126,66 @@ test('planner parser rejects malformed JSON and unknown top-level fields', async
   } finally { await rm(f.root,{recursive:true,force:true}); }
 });
 
+test('R34 decision parser rejects prose-wrapped JSON and authority arming actions', async () => {
+  const f = await fixture();
+  try {
+    assert.throws(() => parseR34PlannerDecision('Here is JSON: {"schema":"deadbyte.autonomous-decision.v2","kind":"finish"}',f.policy),/structured|JSON|contract/i);
+    assert.throws(() => parseR34PlannerDecision(JSON.stringify({
+      schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'armcoding'}
+    }),f.policy),/unsupported|authority|contract/i);
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('R34 replan carries only a bounded mutable suffix proposal', async () => {
+  const f = await fixture();
+  try {
+    const decision = parseR34PlannerDecision(JSON.stringify({
+      schema:'deadbyte.autonomous-decision.v2',kind:'replan',reason:'test failed',
+      steps:[
+        {step_id:'diagnose',intent:'Inspect failing evidence'},
+        {step_id:'fix',intent:'Apply corrected patch'}
+      ]
+    }),f.policy);
+    assert.equal(decision.schema,'deadbyte.autonomous-decision.v2');
+    assert.equal(decision.kind,'replan');
+    assert.equal(decision.steps.length,2);
+    assert.equal(decision.steps[0].step_id,'diagnose');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('R34 act accepts one bounded existing patch action with exact SHA precondition', async () => {
+  const f = await fixture();
+  try {
+    const decision = parseR34PlannerDecision(JSON.stringify({
+      schema:'deadbyte.autonomous-decision.v2',kind:'act',
+      action:{kind:'patch',operations:[{
+        kind:'replace',path:'x.txt',expected_sha256:'0'.repeat(64),old_string:'x',new_string:'y',expected_replacements:1
+      }]}
+    }),f.policy);
+    assert.equal(decision.kind,'act');
+    assert.equal(decision.action.kind,'patch');
+    assert.equal(decision.action.operations[0].expected_sha256,'0'.repeat(64));
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('R34 provider adapter returns only normalized decision plus raw response hash', async () => {
+  const rawDecision = JSON.stringify({schema:'deadbyte.autonomous-decision.v2',kind:'finish',summary:'verified'});
+  const policy = {
+    planner:{backend:'openai_compatible',endpoint:'https://planner.invalid/v1/chat/completions',model:'fake-r34',api_key_env:null,max_tokens:2048,timeout_ms:30000,max_response_bytes:262144},
+    limits:{max_context_bytes:262144,max_files_per_diff:4},
+    profiles:{}
+  };
+  const fakeFetch = async () => new Response(JSON.stringify({model:'fake-r34',choices:[{message:{content:rawDecision}}]}),{
+    status:200,headers:{'content-type':'application/json'}
+  });
+  const result = await requestR34ProviderDecision(policy,'PROMPT',fakeFetch);
+  assert.equal(result.backend,'openai_compatible');
+  assert.equal(result.model,'fake-r34');
+  assert.equal(result.decision.kind,'finish');
+  assert.match(result.raw_response_sha256,/^[0-9a-f]{64}$/);
+  assert.equal(Object.hasOwn(result,'raw_text'),false);
+});
+
 test('R33 private delegate routes bounded machine reads and records signed evidence', async () => {
   const calls=[];
   const f = await fixture({ machineFsRuntime:{ async stat(args){ calls.push(args); return {status:'ok',root_id:args.rootId,path:args.relativePath,kind:'file',bytes:2}; } } });
@@ -327,3 +391,82 @@ test('signed autonomous journal tamper is rejected before state is trusted', asy
     await assert.rejects(f.runtime.status({ goalId:goal.goal_id }), /signature verification failed|hash-chain mismatch/);
   } finally { await rm(f.root,{recursive:true,force:true}); }
 });
+
+test('R34 event deletion/reorder/signature tamper fails before state trust', async () => {
+  async function prepared(id) {
+    const f=await fixture();
+    const goal=await submit(f.runtime,id);
+    const first=await f.runtime.run({goalId:goal.goal_id,maxCycles:1});
+    assert.equal(first.status,'input_required');
+    const dir=path.join(f.policy.evidence_dir,'goals',goal.goal_id,'events');
+    return {f,goal,dir};
+  }
+  for (const mode of ['delete','reorder','signature']) {
+    const {f,goal,dir}=await prepared(`journal-${mode}`);
+    try {
+      const one=path.join(dir,'000001.json');
+      const two=path.join(dir,'000002.json');
+      if(mode==='delete') {
+        await rm(two,{force:true});
+      } else if(mode==='reorder') {
+        const a=await readFile(one); const b=await readFile(two);
+        await writeFile(one,b); await writeFile(two,a);
+      } else {
+        const event=JSON.parse(await readFile(one,'utf8'));
+        event.payload.submission_id='forged-submission';
+        await writeFile(one,JSON.stringify(event));
+      }
+      await assert.rejects(f.runtime.status({goalId:goal.goal_id}),/event gap|signature verification failed|hash-chain mismatch/);
+    } finally { await rm(f.root,{recursive:true,force:true}); }
+  }
+});
+
+test('R34 restart reconciles a committed Native Diff after crash without invoking apply twice', async () => {
+  let applyCalls = 0;
+  let crashOnce = true;
+  const f = await fixture({
+    nativeDiffRuntimeFactory(base) {
+      return {
+        preview: args => base.preview(args),
+        verify: args => base.verify(args),
+        async apply(args) {
+          applyCalls += 1;
+          const result = await base.apply(args);
+          if (crashOnce) {
+            crashOnce = false;
+            throw new Error('simulated crash after native diff apply');
+          }
+          return result;
+        }
+      };
+    }
+  });
+  try {
+    const goal = await submit(f.runtime,'r34-crash-after-apply');
+    const first = await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    assert.equal(first.status,'input_required');
+    const before = await readFile(path.join(f.project,'x.txt'));
+    const beforeSha = createHash('sha256').update(before).digest('hex');
+    const patch = JSON.stringify({
+      schema:'deadbyte.autonomous-decision.v1',action:'patch',summary:'mutate once',
+      operations:[{kind:'replace',path:'x.txt',expected_sha256:beforeSha,old_string:'x',new_string:'y',expected_replacements:1}]
+    });
+    await assert.rejects(f.runtime.run({goalId:goal.goal_id,maxCycles:2,
+      plannerResponse:{request_id:first.planner_request.request_id,model:'fake',raw_text:patch}}),/simulated crash after native diff apply/);
+    assert.equal(await readFile(path.join(f.project,'x.txt'),'utf8'),'y\n');
+    assert.equal(applyCalls,1);
+
+    const restarted = f.createRuntime();
+    const resumed = await restarted.run({goalId:goal.goal_id,maxCycles:1});
+    assert.notEqual(resumed.status,'paused');
+    assert.equal(applyCalls,1,'restart must reconcile durable mutation evidence instead of invoking apply again');
+    assert.equal(await readFile(path.join(f.project,'x.txt'),'utf8'),'y\n');
+    const journal = await restarted.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    assert.equal(journal.events.filter(event=>event.type==='native_diff_committed').length,1);
+    assert.equal(journal.events.filter(event=>event.type==='action_started').length,1);
+    assert.equal(journal.events.filter(event=>event.type==='action_reconciled').length,1);
+    assert.equal(journal.events.filter(event=>event.type==='action_completed').length,1);
+    const reconciled = journal.events.find(event=>event.type==='action_reconciled');
+    assert.equal(reconciled.payload.classification,'executed_verified');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});

package/test/autonomous-capability-r36.test.mjs

@@ -0,0 +1,151 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseR34PlannerDecision, buildPlannerPrompt } from '../src/autonomous-planner.mjs';
+import { judgeProgress } from '../src/autonomous-progress.mjs';
+import { createR34Fixture, sendPlannerDecision, planCreateDecision, inspectDecision } from './helpers/autonomous-r34-fixture.mjs';
+
+const H='a'.repeat(64);
+const policy={
+  profiles:{},
+  limits:{max_context_bytes:262144,max_files_per_diff:32,max_stalled_cycles:2,max_post_replan_stalls:2,max_replans:8}
+};
+const wrap=action=>JSON.stringify({schema:'deadbyte.autonomous-decision.v2',kind:'act',action});
+
+const typedCases=[
+  ['search',{kind:'search',path:'.',target:'content',mode:'regex',pattern:'foo\\d+',case_sensitive:false,max_results:50,max_file_bytes:262144,max_scan_bytes:1048576,page_size:25,cursor:null}],
+  ['stat',{kind:'stat',path:'src/a.mjs',hash:true}],
+  ['multi_read',{kind:'multi_read',files:[{path:'src/a.mjs',encoding:'utf8'},{path:'src/b.mjs',encoding:'utf8'}],max_total_bytes:131072}],
+  ['semantic_references',{kind:'semantic_references',path:'src/a.mjs',line:1,column:2,max_results:100}],
+  ['semantic_rename_preview',{kind:'semantic_rename_preview',path:'src/a.mjs',line:1,column:2,new_name:'renamed'}],
+  ['native_diff_apply',{kind:'native_diff_apply',diff_id:H,expected_operation_count:1}],
+  ['native_diff_verify',{kind:'native_diff_verify',diff_id:H}],
+  ['process_start',{kind:'process_start',profile_id:'test',cwd:'.',args:[]}],
+  ['process_read',{kind:'process_read',session_id:H,offset:0,max_bytes:65536}],
+  ['process_status',{kind:'process_status',session_id:H}],
+  ['process_action',{kind:'process_action',session_id:H,action_id:'ping'}],
+  ['process_terminate',{kind:'process_terminate',session_id:H}],
+  ['machine_fs_stat',{kind:'machine_fs_stat',path:'src',hash:true}],
+  ['machine_fs_list',{kind:'machine_fs_list',path:'.',cursor:null,limit:100,hash_files:false}],
+  ['machine_fs_read',{kind:'machine_fs_read',path:'src/a.mjs',offset:0,max_bytes:65536,hash_file:true}],
+  ['machine_fs_mkdir',{kind:'machine_fs_mkdir',path:'generated'}],
+  ['machine_fs_move',{kind:'machine_fs_move',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:H}],
+  ['machine_fs_delete',{kind:'machine_fs_delete',path:'empty',expected_source_identity:H}],
+  ['observation_search_start',{kind:'observation_search_start',path:'.',pattern:'FAIL',case_sensitive:false,max_results:100,max_files:1000,max_bytes:1048576,max_file_bytes:262144}],
+  ['observation_search_page',{kind:'observation_search_page',search_id:H,cursor:null,limit:50}],
+  ['observation_system_status',{kind:'observation_system_status'}]
+];
+
+test('R36 planner parses first-class capability actions without delegate wrapper',()=>{
+  for(const [label,action] of typedCases){
+    const parsed=parseR34PlannerDecision(wrap(action),policy);
+    assert.equal(parsed.kind,'act',label);
+    assert.equal(parsed.action.kind,action.kind,label);
+    assert.notEqual(parsed.action.kind,'delegate',label);
+  }
+});
+
+test('R36 legacy delegate is accepted only for a known operation and normalized into typed action',()=>{
+  const parsed=parseR34PlannerDecision(wrap({kind:'delegate',operation:{kind:'process_status',session_id:H}}),policy);
+  assert.equal(parsed.action.kind,'process_status');
+  assert.equal(parsed.action.session_id,H);
+  assert.equal('operation' in parsed.action,false);
+  assert.throws(()=>parseR34PlannerDecision(wrap({kind:'delegate',operation:{kind:'arbitrary_tool',tool_name:'host_exec',args:{}}}),policy),/contract|delegated|unsupported|authority/i);
+});
+
+test('R36 planner prompt exposes configured capability manifest and never advertises Host',()=>{
+  const prompt=buildPlannerPrompt({goal:{title:'x',goal:'fix',acceptance:'tests pass'},policy,view:{mutation_epoch:0,planner_round:0,tree:[],contexts:[],observations:[],recent_decisions:[],active_plan:null,capabilities:{schema:'deadbyte.capability-manifest.v1',ledger_sha256:H,entries:[
+    {id:'coding.search',authority:'coding',mutating:false},
+    {id:'process.start',authority:'process',mutating:true}
+  ]}}});
+  assert.match(prompt,/coding\.search/);
+  assert.match(prompt,/process\.start/);
+  assert.doesNotMatch(prompt,/host\.exec|host_file|host authority/i);
+});
+
+test('R36 progress fingerprint ignores rationale but binds capability, evidence, session and cursor identity',()=>{
+  const base={before:{mutation_epoch:2},after:{mutation_epoch:2},decision:{kind:'process_read',rationale:'first'},evidence:{capability_id:'process.read',session_id:H,cursor:10,observation_sha256:'b'.repeat(64),receipt_sha256:'c'.repeat(64)}};
+  const a=judgeProgress(base);
+  const prose=judgeProgress({...base,decision:{...base.decision,rationale:'completely different prose'}});
+  assert.equal(a.fingerprint,prose.fingerprint);
+  const cap=judgeProgress({...base,evidence:{...base.evidence,capability_id:'process.status'}});
+  const cursor=judgeProgress({...base,evidence:{...base.evidence,cursor:11}});
+  const session=judgeProgress({...base,evidence:{...base.evidence,session_id:'d'.repeat(64)}});
+  const receipt=judgeProgress({...base,evidence:{...base.evidence,receipt_sha256:'e'.repeat(64)}});
+  assert.notEqual(a.fingerprint,cap.fingerprint);
+  assert.notEqual(a.fingerprint,cursor.fingerprint);
+  assert.notEqual(a.fingerprint,session.fingerprint);
+  assert.notEqual(a.fingerprint,receipt.fingerprint);
+});
+
+test('R36 typed stat executes through the autonomous loop and records capability-bound evidence',async()=>{
+  const f=await createR34Fixture();
+  try{
+    const goal=await f.runtime.submit({submissionId:'r36-typed-stat',rootId:'project',title:'typed stat',goal:'inspect x.txt identity',acceptance:'stat evidence is journaled'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:4});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,planCreateDecision());
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,inspectDecision());
+    assert.equal(result.loop.phase,'ACTING');
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'stat',path:'x.txt',hash:true}});
+    assert.equal(result.status,'input_required');
+    assert.equal(result.loop.phase,'VERIFYING');
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const event=journal.events.find(item=>item.type==='delegated_action_completed'&&item.payload?.operation?.kind==='stat');
+    assert.ok(event);
+    assert.equal(event.payload.capability_id,'coding.stat');
+    assert.match(event.payload.result.observation_sha256,/^[0-9a-f]{64}$/);
+  } finally {await f.cleanup();}
+});
+
+test('R36 typed native_diff_apply binds expected operation count and advances mutation epoch only after verified apply',async()=>{
+  const f=await createR34Fixture();
+  try{
+    const preview=await f.nativeDiffRuntime.preview({rootId:'project',title:'typed apply',operations:[{
+      kind:'replace',path:'x.txt',expected_sha256:f.initial_sha256,old_string:'x',new_string:'y',expected_replacements:1
+    }]});
+    assert.equal(preview.operation_count,1);
+    const goal=await f.runtime.submit({submissionId:'r36-typed-apply',rootId:'project',title:'typed apply',goal:'apply the prepared native diff',acceptance:'mutation is verified and journaled'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:4});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,planCreateDecision());
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,inspectDecision());
+    assert.equal(result.loop.phase,'ACTING');
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'native_diff_apply',diff_id:preview.diff_id,expected_operation_count:1}});
+    assert.equal(result.status,'input_required');
+    assert.equal(result.loop.phase,'VERIFYING');
+    const state=await f.runtime.status({goalId:goal.goal_id});
+    assert.equal(state.mutation_epoch,1);
+    assert.equal(state.mutation_count,1);
+    const read=await f.baseCodingRuntime.fileRead({rootId:'project',relativePath:'x.txt',encoding:'utf8'});
+    assert.equal(read.content,'y\n');
+    const verified=await f.nativeDiffRuntime.verify({diffId:preview.diff_id});
+    assert.equal(verified.ok,true);
+    assert.equal(verified.current_state_matches,true);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const committed=journal.events.find(item=>item.type==='native_diff_committed'&&item.payload?.diff_id===preview.diff_id);
+    assert.ok(committed);
+    assert.equal(committed.payload.mutation_count,1);
+    assert.deepEqual(committed.payload.paths,['x.txt']);
+  } finally {await f.cleanup();}
+});
+
+test('R36 typed machine_fs_mkdir is promoted to Native Diff V2 and advances mutation epoch',async()=>{
+  const f=await createR34Fixture();
+  try{
+    const goal=await f.runtime.submit({submissionId:'r36-typed-mkdir',rootId:'project',title:'typed mkdir',goal:'create generated directory transactionally',acceptance:'directory creation is native-diff verified'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:4});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,planCreateDecision());
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,inspectDecision());
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'machine_fs_mkdir',path:'generated'}});
+    assert.equal(result.status,'input_required');
+    assert.equal(result.loop.phase,'VERIFYING');
+    const state=await f.runtime.status({goalId:goal.goal_id});
+    assert.equal(state.mutation_epoch,1);
+    assert.equal(state.mutation_count,1);
+    const dir=await f.machineFsRuntime.state({rootId:'project',relativePath:'generated'});
+    assert.equal(dir.exists,true);
+    assert.equal(dir.kind,'directory');
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const committed=journal.events.find(item=>item.type==='native_diff_committed');
+    assert.ok(committed);
+    assert.deepEqual(committed.payload.paths,['generated']);
+  } finally {await f.cleanup();}
+});