deadbyte-mcp 0.8.10 → 0.10.0

package/test/capability-benchmark.test.mjs

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CAPABILITY_BENCHMARK_SCHEMA,
+  normalizeBenchmarkCase,
+  buildCapabilityBenchmark
+} from '../src/capability-benchmark.mjs';
+
+const H=c=>c.repeat(64);
+const base={case_id:'filesystem_bounded_read',fixture_sha256:H('a'),correct:true,round_trips:2,bytes_returned:128,
+  elapsed_ms:12.5,stale_rejected:false,recovery_success:true,duplicate_side_effects:0,evidence_sha256:H('b')};
+
+test('R35 benchmark schema is exact and preserves separate measurable dimensions',()=>{
+  assert.equal(CAPABILITY_BENCHMARK_SCHEMA,'deadbyte.r35-capability-benchmark.v1');
+  const value=normalizeBenchmarkCase(base);
+  assert.deepEqual(Object.keys(value).sort(),[
+    'bytes_returned','case_id','correct','duplicate_side_effects','elapsed_ms','evidence_sha256','fixture_sha256',
+    'recovery_success','round_trips','stale_rejected'
+  ].sort());
+  assert.equal(value.correct,true);assert.equal(value.round_trips,2);assert.equal(value.duplicate_side_effects,0);
+});
+
+test('benchmark rejects missing evidence and invalid measurements instead of manufacturing a score',()=>{
+  assert.throws(()=>normalizeBenchmarkCase({...base,evidence_sha256:undefined}),/evidence/i);
+  assert.throws(()=>normalizeBenchmarkCase({...base,elapsed_ms:-1}),/elapsed/i);
+  assert.throws(()=>normalizeBenchmarkCase({...base,round_trips:0}),/round.?trips/i);
+  assert.throws(()=>normalizeBenchmarkCase({...base,duplicate_side_effects:-1}),/duplicate/i);
+});
+
+test('aggregate identity is deterministic across timing changes while fixture/correctness verdicts remain inspectable',()=>{
+  const cases=[base,{...base,case_id:'remote_replay_dedupe',fixture_sha256:H('c'),evidence_sha256:H('d'),elapsed_ms:22}];
+  const first=buildCapabilityBenchmark({suite_id:'r35-offline-v1',cases});
+  const second=buildCapabilityBenchmark({suite_id:'r35-offline-v1',cases:cases.map(item=>({...item,elapsed_ms:item.elapsed_ms+100}))});
+  assert.equal(first.schema,CAPABILITY_BENCHMARK_SCHEMA);
+  assert.equal(first.fixture_identity_sha256,second.fixture_identity_sha256);
+  assert.deepEqual(first.cases.map(item=>[item.case_id,item.correct,item.fixture_sha256]),
+    second.cases.map(item=>[item.case_id,item.correct,item.fixture_sha256]));
+  assert.notEqual(first.observation_sha256,second.observation_sha256,'observed timings remain evidence, not hidden');
+  assert.equal(first.overall_correct,true);
+  assert.equal('score' in first,false);
+});
+
+test('aggregate fails closed on duplicate case ids or any incorrect case',()=>{
+  assert.throws(()=>buildCapabilityBenchmark({suite_id:'r35-offline-v1',cases:[base,base]}),/duplicate case/i);
+  const result=buildCapabilityBenchmark({suite_id:'r35-offline-v1',cases:[base,{...base,case_id:'broken',correct:false,evidence_sha256:H('e')} ]});
+  assert.equal(result.overall_correct,false);
+});

package/test/capability-claims-r36.test.mjs

@@ -0,0 +1,23 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('../',import.meta.url)));
+
+test('R36 capability evidence distinguishes documented competitor claims from direct observation and avoids blanket superiority',async()=>{
+  const file=await readFile(path.join(root,'docs','R36-CAPABILITY-EVIDENCE.md'),'utf8');
+  assert.match(file,/https:\/\/github\.com\/wonderwhy-er\/DesktopCommanderMCP/i);
+  assert.match(file,/https:\/\/github\.com\/desktop-commander\/remote-desktop-commander/i);
+  assert.match(file,/https:\/\/github\.com\/oraios\/serena/i);
+  assert.match(file,/documented/i);
+  assert.match(file,/direct_observation/i);
+  assert.match(file,/3a1d668fcc0c3c38362d0c642c5247357ed7ec6063d89b544c7a1c090521c66e/);
+  assert.doesNotMatch(file,/\b(?:best|superior|beats? all|winner|dominates?)\b/i);
+});
+
+test('R36 README points to reproducible capability evidence instead of a tool-count victory claim',async()=>{
+  const file=await readFile(path.join(root,'README.txt'),'utf8');
+  assert.match(file,/R36-CAPABILITY-EVIDENCE\.md/);
+  assert.doesNotMatch(file,/\b(?:most tools|tool-count victory|beats? all|best MCP)\b/i);
+});

package/test/capability-ledger-r36.test.mjs

@@ -0,0 +1,102 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CAPABILITY_LEDGER_SCHEMA,
+  capabilityProfileFromEnv,
+  createCapabilityLedger,
+  assertCapabilityClosure
+} from '../src/capability-ledger.mjs';
+
+const entry = overrides => ({
+  id:'coding.search',
+  full_tool:'coding_search',
+  compact_tool:'coding_inspect',
+  compact_op:'search',
+  runtime_flag:'DEADBYTE_CODING_RUNTIME',
+  authority:'coding',
+  mutating:false,
+  receipt_class:'observation',
+  production:true,
+  host_only:false,
+  ...overrides
+});
+
+const snapshot = names => ({
+  schema:'deadbyte.tool-surface.v1',
+  tools:names.map(name=>({name,input_sha256:'0'.repeat(64),output_sha256:'1'.repeat(64)})),
+  surface_sha256:'2'.repeat(64)
+});
+
+test('R36 capability ledger rejects duplicate ids', () => {
+  assert.throws(() => createCapabilityLedger([
+    entry({}),
+    entry({full_tool:'other_tool'})
+  ]), /duplicate capability id/i);
+});
+
+test('R36 capability ledger validates authority and canonicalizes identity', () => {
+  assert.throws(() => createCapabilityLedger([entry({authority:'root'})]), /authority/i);
+  const a=createCapabilityLedger([
+    entry({id:'process.read',full_tool:'process_session_read',compact_tool:'process_session',compact_op:'read',runtime_flag:'DEADBYTE_PROCESS_RUNTIME',authority:'process'}),
+    entry({})
+  ]);
+  const b=createCapabilityLedger([
+    entry({}),
+    entry({id:'process.read',full_tool:'process_session_read',compact_tool:'process_session',compact_op:'read',runtime_flag:'DEADBYTE_PROCESS_RUNTIME',authority:'process'})
+  ]);
+  assert.equal(a.schema,CAPABILITY_LEDGER_SCHEMA);
+  assert.equal(a.ledger_sha256,b.ledger_sha256);
+  assert.deepEqual(a.entries.map(x=>x.id),['coding.search','process.read']);
+  assert.ok(Object.isFrozen(a));
+  assert.ok(Object.isFrozen(a.entries));
+});
+
+test('R36 surface profile defaults full and accepts only full or compact', () => {
+  assert.equal(capabilityProfileFromEnv({}),'full');
+  assert.equal(capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'full'}),'full');
+  assert.equal(capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'compact'}),'compact');
+  assert.throws(() => capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'wide'}), /full or compact/i);
+});
+
+test('R36 compact closure covers every production non-host capability', () => {
+  const ledger=createCapabilityLedger([
+    entry({}),
+    entry({id:'host.exec',full_tool:'host_exec',compact_tool:null,compact_op:null,runtime_flag:'DEADBYTE_PRIVILEGED_POLICY',authority:'host',mutating:true,receipt_class:'host',production:false,host_only:true})
+  ]);
+  assert.equal(assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search','host_exec']),
+    compactToolSnapshot:snapshot(['coding_inspect'])
+  }),true);
+});
+
+test('R36 closure fails when a production route is lost or advertised tool is absent', () => {
+  const missingCompact=createCapabilityLedger([entry({compact_tool:null,compact_op:null})]);
+  assert.throws(() => assertCapabilityClosure({
+    ledger:missingCompact,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot([])
+  }), /compact route/i);
+
+  const ledger=createCapabilityLedger([entry({})]);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot([]),
+    compactToolSnapshot:snapshot(['coding_inspect'])
+  }), /full tool/i);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot([])
+  }), /compact tool/i);
+});
+
+test('R36 compact surface hard-fails above the observed 42-tool ceiling', () => {
+  const ledger=createCapabilityLedger([entry({})]);
+  const tooMany=Array.from({length:43},(_,i)=>i===0?'coding_inspect':`extra_${i}`);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot(tooMany)
+  }), /42/i);
+});

package/test/cli-entrypoint.test.mjs

@@ -27,6 +27,18 @@ test('npx CLI remote path invokes stable PS1 directly and never routes through C
   assert.match(source,/verifyAuditChain/);
 });
 
+test('npx CLI exposes local supervisor lifecycle without any supervisor arm command',async()=>{
+  const source=await readFile(cliPath,'utf8');
+  assert.match(source,/SUPERVISOR_COMMANDS/);
+  assert.match(source,/supervisorstart/);
+  assert.match(source,/supervisorstop/);
+  assert.match(source,/supervisorstatus/);
+  assert.match(source,/supervisorrecover/);
+  const mapping=source.match(/const SUPERVISOR_COMMANDS=.*?;\n/s)?.[0]??'';
+  assert.doesNotMatch(mapping,/arm(?:coding|autonomous|process|host)/i);
+  assert.match(source,/npx deadbyte-mcp@latest supervisor status/);
+});
+
 test('README makes npx the primary operator UX',async()=>{
   const readme=await readFile(path.join(root,'README.txt'),'utf8');
   assert.match(readme,/npx deadbyte-mcp@latest remote/);

package/test/coding-catalog-consistency.test.mjs

@@ -0,0 +1,24 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const expected=[
+  'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
+  'coding_receipt_verify','coding_search','coding_session_status','coding_stat','coding_symbol_definition',
+  'coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace','coding_task_approve','coding_task_cancel',
+  'coding_task_events','coding_task_run','coding_task_status','coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'
+].sort();
+function extract(source){
+  const m=source.match(/const (?:codingTools|coding)\s*=\s*\[([\s\S]*?)\];/);
+  assert.ok(m,'coding catalog array missing');
+  return [...m[1].matchAll(/'([^']+)'/g)].map(x=>x[1]).sort();
+}
+for(const rel of ['src/machine-fs-smoke-client.mjs','src/observation-smoke-client.mjs','src/remote-mcp-coding-smoke-client.mjs','src/remote-mcp-smoke-client.mjs']){
+  test(`${rel} uses the exact R36 25-tool coding catalog`,async()=>{
+    const source=await readFile(path.join(root,...rel.split('/')),'utf8');
+    assert.deepEqual(extract(source),expected);
+  });
+}

package/test/coding-plane.test.mjs

@@ -14,8 +14,8 @@ const repoRoot = path.resolve(here, '..');
 const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
 const workspaceRoot = path.join(repoRoot, 'workspaces');
 const codingTools = [
-  'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write',
-  'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat', 'coding_task_approve', 'coding_task_cancel',
+  'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write', 'coding_files_read',
+  'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat', 'coding_symbol_definition', 'coding_symbol_diagnostics', 'coding_symbol_implementations', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_rename_preview', 'coding_symbol_replace', 'coding_task_approve', 'coding_task_cancel',
   'coding_task_events', 'coding_task_run', 'coding_task_status', 'coding_task_submit',
   'coding_task_verify', 'coding_text_replace', 'coding_tree'
 ];
@@ -69,7 +69,7 @@ async function fixture() {
   return { root, client, transport };
 }
 
-test('R27 hermetic coding fixture exposes the exact 29-tool no-host catalog', async () => {
+test('R36 hermetic coding fixture exposes the exact 37-tool no-host catalog', async () => {
   const f = await fixture();
   try {
     await f.client.connect(f.transport);

package/test/coding-runtime.test.mjs

@@ -56,6 +56,22 @@ test('coding plane edits files under lease and verifies signed action receipts',
   } finally { await rm(f.root, { recursive: true, force: true }); }
 });
 
+test('R36 coding stat exposes mutation-relevant observation identity', async () => {
+  const f = await fixture();
+  try {
+    await writeFile(path.join(f.project,'stat.txt'),'stat-body\n');
+    const value=await f.runtime.stat({rootId:'project',relativePath:'stat.txt',hash:true});
+    assert.equal(value.status,'ok');
+    assert.equal(value.normalized_path,'stat.txt');
+    assert.equal(value.type,'file');
+    assert.equal(value.reparse_state,'none');
+    assert.match(value.sha256,/^[0-9a-f]{64}$/);
+    assert.match(value.object_identity_sha256,/^[0-9a-f]{64}$/);
+    assert.match(value.observation_sha256,/^[0-9a-f]{64}$/);
+    assert.equal(value.policy_root_id,'project');
+  } finally { await rm(f.root, { recursive: true, force: true }); }
+});
+
 test('coding plane rejects mutation when lease is absent or precondition is stale', async () => {
   const f = await fixture({ armed: false });
   try {

package/test/coding-search-r36.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createSearchCursorCodec } from '../src/search-cursor.mjs';
+import { createCodingSearch } from '../src/coding-search.mjs';
+
+async function fixture(){
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r36-search-'));
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(temp,'private.pem'),publicKeyPath:path.join(temp,'public.pem')});
+  const state=new Map([
+    ['src/a.txt',Buffer.from('foo1 foo2\nbar foo3\n','utf8')],
+    ['src/b.txt',Buffer.from('other FOO4 and foo5\n','utf8')],
+    ['src/foo-file.js',Buffer.from('nothing here\n','utf8')],
+    ['src/binary.bin',Buffer.from([0xff,0xfe,0x00,0x61])]
+  ]);
+  let reads=0;
+  const tree=async()=>({status:'ok',root_id:'core',path:'.',truncated:false,entries:[...state].map(([p,b])=>({path:p,type:'file',bytes:b.length}))});
+  const fileRead=async({relativePath,encoding})=>{
+    reads+=1;
+    const bytes=state.get(relativePath);
+    if(!bytes) throw new Error('missing');
+    return {status:'ok',root_id:'core',path:relativePath,encoding,bytes:bytes.length,sha256:(await import('node:crypto')).createHash('sha256').update(bytes).digest('hex'),content:encoding==='base64'?bytes.toString('base64'):bytes.toString('utf8')};
+  };
+  const cursorCodec=createSearchCursorCodec({signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const search=createCodingSearch({tree,fileRead,cursorCodec});
+  return {temp,state,search,get reads(){return reads;},cleanup:()=>rm(temp,{recursive:true,force:true})};
+}
+
+test('R36 regex search returns multiple matches per file with deterministic signed paging',async()=>{
+  const f=await fixture();
+  try{
+    const first=await f.search({rootId:'core',path:'.',target:'content',mode:'regex',pattern:'foo\\d',caseSensitive:false,pageSize:2,maxResults:20});
+    assert.equal(first.matches.length,2);
+    assert.deepEqual(first.matches.map(x=>[x.path,x.line,x.column]),[['src/a.txt',1,1],['src/a.txt',1,6]]);
+    assert.match(first.query_sha256,/^[0-9a-f]{64}$/);
+    assert.match(first.snapshot_sha256,/^[0-9a-f]{64}$/);
+    assert.match(first.page_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(first.next_cursor);
+    const second=await f.search({rootId:'core',path:'.',target:'content',mode:'regex',pattern:'foo\\d',caseSensitive:false,pageSize:2,maxResults:20,cursor:first.next_cursor});
+    assert.equal(second.matches.length,2);
+    assert.deepEqual(second.matches.map(x=>x.path),['src/a.txt','src/b.txt']);
+    assert.notEqual(second.page_sha256,first.page_sha256);
+  } finally {await f.cleanup();}
+});
+
+test('R36 path search does not decode file content and is deterministic',async()=>{
+  const f=await fixture();
+  try{
+    const result=await f.search({rootId:'core',target:'path',mode:'literal',pattern:'foo-file',pageSize:10,maxResults:20});
+    assert.equal(result.matches.length,1);
+    assert.equal(result.matches[0].path,'src/foo-file.js');
+    assert.equal(result.matches[0].line,null);
+    assert.equal(result.bytes_scanned,0);
+    assert.equal(f.reads,0);
+  } finally {await f.cleanup();}
+});
+
+test('R36 search cursor is query-bound and stale snapshot fails closed',async()=>{
+  const f=await fixture();
+  try{
+    const first=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:1,maxResults:20});
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'literal',pattern:'bar',pageSize:1,maxResults:20,cursor:first.next_cursor}),/cursor.*query/i);
+    f.state.set('src/a.txt',Buffer.from('foo1 changed same workflow\n','utf8'));
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:1,maxResults:20,cursor:first.next_cursor}),/cursor.*stale|snapshot/i);
+  } finally {await f.cleanup();}
+});
+
+test('R36 invalid regex fails before repository file reads and binary is classified',async()=>{
+  const f=await fixture();
+  try{
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'regex',pattern:'[unterminated'}),/regex/i);
+    assert.equal(f.reads,0);
+    const result=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:20,maxResults:20});
+    assert.equal(result.binary_files_skipped,1);
+    assert.ok(result.matches.length>=5);
+  } finally {await f.cleanup();}
+});
+
+test('R36 scan-byte bound truncates deterministically',async()=>{
+  const f=await fixture();
+  try{
+    const result=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',maxScanBytes:10,pageSize:20,maxResults:20});
+    assert.equal(result.truncated,true);
+    assert.equal(result.truncation_reason,'scan_byte_limit');
+    assert.ok(result.bytes_scanned<=10);
+  } finally {await f.cleanup();}
+});

package/test/compact-catalog-r36.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const gatewayNames=['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'];
+
+test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
+  const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    assert.ok(names.length<=42,`compact tool count ${names.length} exceeds 42`);
+    for(const name of gatewayNames) assert.ok(names.includes(name),`missing ${name}`);
+    for(const legacy of ['workspace_open','file_read','proof_execute','contained_transform']) assert.equal(names.includes(legacy),false,`legacy full-only tool leaked: ${legacy}`);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    assert.equal(manifest.structuredContent.status,'ok');
+    assert.equal(manifest.structuredContent.result.profile,'compact');
+    assert.match(manifest.structuredContent.result.ledger_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(manifest.structuredContent.result.capabilities.length>40);
+  } finally {await client.close().catch(()=>{});}
+});

package/test/compact-gateway-r36.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  codingInspectInputSchema,
+  machineFsGatewayInputSchema,
+  processSessionGatewayInputSchema,
+  machineObserveInputSchema,
+  registerCompactGatewayTools
+} from '../src/compact-gateway-mcp-tools.mjs';
+
+const fakeServer=()=>{
+  const tools=new Map();
+  return {
+    tools,
+    registerTool(name,definition,handler){
+      if(tools.has(name)) throw new Error(`duplicate ${name}`);
+      tools.set(name,{definition,handler});
+    }
+  };
+};
+
+test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
+  assert.equal(codingInspectInputSchema.safeParse({op:'call',tool_name:'host_exec',args:{}}).success,false);
+  assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
+});
+
+test('R36 compact schemas preserve representative preconditions',()=>{
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:'a'.repeat(64)
+  }).success,true);
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt'
+  }).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
+});
+
+test('R36 registers exactly five compact gateway names',()=>{
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  assert.deepEqual([...server.tools.keys()].sort(),[
+    'capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'
+  ]);
+});
+
+test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',async()=>{
+  const calls=[];
+  const codingRuntime={
+    stat:async args=>{calls.push(['stat',args]);return {status:'ok',root_id:args.rootId,path:args.relativePath,type:'file'};}
+  };
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  const tool=server.tools.get('coding_inspect');
+  const result=await tool.handler({op:'stat',root_id:'core',path:'src/a.mjs',hash:false});
+  assert.deepEqual(calls,[['stat',{rootId:'core',relativePath:'src/a.mjs',hash:false}]]);
+  assert.equal(result.structuredContent.status,'ok');
+  assert.equal(result.structuredContent.op,'stat');
+  assert.equal(result.structuredContent.result.path,'src/a.mjs');
+});

package/test/contained.test.mjs

@@ -364,7 +364,7 @@ test('contained execution source has a compile-time worker registry and no user
   assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
   assert.doesNotMatch(server, /executable:\s*z\./);
   assert.doesNotMatch(executor, /--worker/);
-  assert.doesNotMatch(server, /command_run|shell_execute|powershell_run/);
+  assert.doesNotMatch(server, /registerTool\(\s*['"](?:command_run|shell_execute|powershell_run)['"]/);
 });
 
 test('contained launcher imports by stdin/profile copy and never mounts a host workspace', async () => {

package/test/context-provenance.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { provenanceFor, dedupeEvidence } from '../src/context-provenance.mjs';
+
+const sha256=value=>createHash('sha256').update(value).digest('hex');
+
+function provenance(overrides={}){
+  return provenanceFor({
+    sourceKind:'file',sourceId:'src/main.ts',bytes:'export const x = 1;\n',
+    observedAtUtc:'2026-09-17T09:00:00.000Z',trustClass:'workspace',relevanceEpoch:4,
+    ...overrides
+  });
+}
+
+test('R35 provenance identity is deterministic and observation time is not part of stable identity',()=>{
+  const a=provenance();
+  const b=provenance({observedAtUtc:'2026-09-17T09:00:05.000Z'});
+  assert.equal(a.schema,'deadbyte.context-provenance.v1');
+  assert.equal(a.source_kind,'file');
+  assert.equal(a.source_id,'src/main.ts');
+  assert.equal(a.byte_count,Buffer.byteLength('export const x = 1;\n','utf8'));
+  assert.equal(a.source_sha256,sha256(Buffer.from('export const x = 1;\n','utf8')));
+  assert.match(a.provenance_id,/^[0-9a-f]{64}$/);
+  assert.equal(a.provenance_id,b.provenance_id);
+  assert.notEqual(a.observed_at_utc,b.observed_at_utc);
+});
+
+test('R35 structured secret evidence never exposes a secret-derived digest oracle',()=>{
+  const a=provenance({sourceKind:'provider_response',sourceId:'planner',bytes:{status:'failed',api_token:'alpha-secret'}});
+  const b=provenance({sourceKind:'provider_response',sourceId:'planner',bytes:{status:'failed',api_token:'different-secret'}});
+  assert.equal(a.source_sha256,undefined);
+  assert.equal(b.source_sha256,undefined);
+  assert.equal(a.digest_withheld,'secret');
+  assert.equal(b.digest_withheld,'secret');
+  assert.equal(a.provenance_id,b.provenance_id,'stable identity must not become a secret oracle');
+  assert.equal(a.byte_count,Buffer.byteLength(canonicalJson({status:'failed',api_token:'alpha-secret'}),'utf8'));
+});
+
+test('R35 dedupeEvidence keeps the newest item for identical provenance while preserving stable identity order',()=>{
+  const p1=provenance({sourceId:'a.ts',observedAtUtc:'2026-09-17T09:00:00.000Z'});
+  const p1New=provenance({sourceId:'a.ts',observedAtUtc:'2026-09-17T09:01:00.000Z'});
+  const p2=provenance({sourceId:'b.ts',observedAtUtc:'2026-09-17T09:00:30.000Z'});
+  const out=dedupeEvidence([
+    {provenance:p1,content:'old'},
+    {provenance:p2,content:'other'},
+    {provenance:p1New,content:'new'}
+  ]);
+  assert.equal(out.length,2);
+  assert.equal(out[0].content,'new');
+  assert.equal(out[0].provenance.provenance_id,p1.provenance_id);
+  assert.equal(out[1].content,'other');
+});
+
+test('R35 provenance validates bounded identity, trust and relevance inputs',()=>{
+  assert.throws(()=>provenanceFor({sourceKind:'',sourceId:'x',bytes:'x',observedAtUtc:'2026-09-17T09:00:00.000Z',trustClass:'workspace',relevanceEpoch:0}),/sourceKind/i);
+  assert.throws(()=>provenanceFor({sourceKind:'file',sourceId:'x',bytes:'x',observedAtUtc:'not-time',trustClass:'workspace',relevanceEpoch:0}),/observedAtUtc/i);
+  assert.throws(()=>provenanceFor({sourceKind:'file',sourceId:'x',bytes:'x',observedAtUtc:'2026-09-17T09:00:00.000Z',trustClass:'',relevanceEpoch:0}),/trustClass/i);
+  assert.throws(()=>provenanceFor({sourceKind:'file',sourceId:'x',bytes:'x',observedAtUtc:'2026-09-17T09:00:00.000Z',trustClass:'workspace',relevanceEpoch:-1}),/relevanceEpoch/i);
+});

package/test/controller-r27.test.mjs

@@ -31,9 +31,10 @@ test('R27 controller supports a trusted stable WorkspaceRoot independent of rele
 
 test('R27 controller pins external Bridge script bytes into owned runtime identity', async () => {
   const text = await source();
-  assert.match(text,/Bridge ScriptPath missing/);
-  assert.match(text,/Bridge ScriptSha256 invalid/);
-  assert.match(text,/bridge script hash mismatch/i);
+  assert.match(text,/\$name -in @\('Bridge','Supervisor'\)/);
+  assert.match(text,/Fail "\$name ScriptPath missing"/);
+  assert.match(text,/Fail "\$name ScriptSha256 invalid"/);
+  assert.match(text,/Fail "\$name script hash mismatch:/);
   assert.match(text,/\$body\['script_path'\] = \[string\]\$Spec\.ScriptPath/);
   assert.match(text,/\$body\['script_sha256'\] = \[string\]\$Spec\.ScriptSha256/);
   assert.match(text,/script-hash-mismatch/);

package/test/controller.test.mjs

@@ -134,6 +134,22 @@ test('controller feature-gates coding runtime and policy only into the Bridge ch
   assert.match(example, /CodingRuntimeEnabled = \$false/);
 });
 
+test('R35 controller binds semantic LSP config path and SHA only into the Bridge child environment', async () => {
+  const source = await readFile(controller, 'utf8');
+  const example = await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)), 'utf8');
+  assert.match(source, /SemanticLspConfigFile/);
+  assert.match(source, /SemanticLspConfigSha256/);
+  assert.match(source, /DEADBYTE_SEMANTIC_LSP_CONFIG/);
+  assert.match(source, /DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256/);
+  assert.match(source, /semantic LSP config SHA-256 mismatch/i);
+  assert.match(source, /Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG/);
+  assert.match(source, /Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256/);
+  assert.match(source, /\$env:DEADBYTE_SEMANTIC_LSP_CONFIG = \$previousSemanticLspConfigEnv/);
+  assert.match(source, /\$env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 = \$previousSemanticLspConfigShaEnv/);
+  assert.match(example, /SemanticLspConfigFile = ''/);
+  assert.match(example, /SemanticLspConfigSha256 = ''/);
+});
+
 test('R31 controller feature-gates machine filesystem only into the Bridge child and requires coding runtime', async () => {
   const source = await readFile(controller, 'utf8');
   const example = await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)), 'utf8');
@@ -163,3 +179,39 @@ test('R29 controller exposes a non-mutating public machine identity live gate',
   assert.match(source, /remote-mcp-machine-smoke-client\.mjs/);
   assert.match(source, /MACHINE IDENTITY LIVE GATE PASS/);
 });
+
+test('R34 controller owns a separate local autonomous supervisor lifecycle with pinned host identity', async () => {
+  const source=await readFile(controller,'utf8');
+  const example=await readFile(fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example', import.meta.url)),'utf8');
+  for(const command of ['supervisorstart','supervisorstop','supervisorstatus','supervisorrecover']) assert.match(source,new RegExp(command));
+  assert.match(source,/AutonomousSupervisorEnabled/);
+  assert.match(source,/Start-OwnedComponent 'Supervisor'/);
+  assert.match(source,/Stop-OwnedComponent 'Supervisor'/);
+  assert.match(source,/Test-OwnedInstance 'Supervisor'/);
+  assert.match(source,/autonomous-supervisor-host\.mjs/);
+  assert.match(source,/ScriptSha256/);
+  assert.match(example,/AutonomousSupervisorEnabled = \$false/);
+  assert.match(example,/Supervisor\s*=\s*@\{/);
+  assert.match(example,/autonomous-supervisor-host\.mjs/);
+});
+
+test('R34 controller assigns external supervisor ownership to Bridge when local supervisor is enabled', async () => {
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE/);
+  assert.match(source,/AutonomousSupervisorEnabled\) \{ 'external' \} else \{ 'in_process' \}/);
+  assert.match(source,/Remove-Item Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE/);
+  assert.match(source,/\$env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE = \$previousAutonomousSupervisorModeEnv/);
+});
+
+test('R34 supervisor lifecycle never arms privileged planes', async () => {
+  const source=await readFile(controller,'utf8');
+  const start=source.indexOf('function Start-AutonomousSupervisor');
+  const end=source.indexOf('function Show-State',start);
+  assert.ok(start>=0&&end>start,'supervisor lifecycle block missing');
+  const block=source.slice(start,end);
+  assert.doesNotMatch(block,/Arm-(?:Process|Coding|Autonomous|Host)/);
+  assert.match(block,/Disarm-Autonomous/);
+  assert.match(block,/Disarm-Coding/);
+  assert.match(block,/Disarm-Process/);
+  assert.match(block,/Disarm-Host/);
+});

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.8.10');
+  assert.equal(result.receipt.runtime.package_version, '0.10.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/deferred-slot-operation-behavior.test.mjs

@@ -22,7 +22,11 @@ test('R33 deferred worker survives scheduler exit and stays bound to explicit st
       assert.equal(scheduled.status,'scheduled');
       assert.ok(path.resolve(scheduled.state_path).startsWith(path.resolve(state)+path.sep));
       let record;
-      for(let i=0;i<20;i++){ await sleep(300); record=JSON.parse(await readFile(scheduled.state_path,'utf8')); if(record.state!=='scheduled') break; }
+      for(let i=0;i<30;i++){
+        await sleep(300);
+        record=JSON.parse(await readFile(scheduled.state_path,'utf8'));
+        if(record.state==='failed'||record.state==='passed') break;
+      }
       assert.equal(record?.state,'failed');
       assert.match(record.error,/trust|ENOENT|ed25519/i);
     } finally { await rm(state,{recursive:true,force:true}); }