deadbyte-mcp 0.8.7 → 0.8.8

package/MANIFEST.SHA256

@@ -1,43 +1,43 @@
-0dfa96b3036f26298bda604e9a59e89b425f2da0e7264e31237bfe0c2bb029f1  bin/appcontainer-stage.exe
-f5e11d1bf93aad3a59d163920b61762b797f02abe2f8e6f49a322d83a7351485  bin/appcontainer-stage.obj
-15aa31b7d9a738e2b0eb701478f8fa8074beceea60838076ccd9e507b087a094  bin/bootstrap-advapi32.exe
-5815bbf78a697bc01c19a1026e261ddd89ed1e00eb362032f54648c5d2d7e934  bin/bootstrap-advapi32.obj
-3bcc6e9938b08931ac06574a62c88206e7865b4b77e2603f49371ed89444f0a4  bin/bootstrap-exitcode.exe
-7fb4343afd6b0268d04933a1a291a3c105c20f653ccce701b85ace35a34c532b  bin/bootstrap-exitcode.obj
-a99d367eb45b0ff869db67758658155996f2a7ba98a9e5e73fdc7226c9255cc1  bin/bootstrap-kernel32.exe
-491afe64a7560df9844959ad63cb61edac9acf8df93168a1e37756fe63d7ea12  bin/bootstrap-kernel32.obj
-3cf8830978b5293868eb27b9cb5af9720131c94c20a7d465169edfff58a72e32  bin/child-control-probe.exe
-fd8254fb0da07a15dff0d43e8ac3eadec3223f9bfb669bc726417eef185f026e  bin/child-control-probe.obj
-712322f1de757195cafe9cbc74aba51350b801c0a1f2f3b0cbee6c845b557b1c  bin/child-control-stage.exe
-71d3dade2470fcf497c68da1eff609d161e8392741c82c7513bfce2899067d08  bin/child-control-stage.obj
-0ec64e0fd1ae66de894b9ebf9fec9404066b77abd0f7cadaf9514fb938db679c  bin/contained-reverse-worker.exe
-5dfd529586ffef8ff3ce4aa00d7af530f9c790eefa9f49575d126aa0c59a08e0  bin/contained-reverse-worker.obj
-d51c3cb3ed1f0e4ce4ca066288786f8fe4338588ea6b8e9f0a1a8cb5b5f33a20  bin/contained-transform-worker.exe
-8f57d69e0306715a7d77e317760f9e56ecc17175a692fe2fd0fff5fd5419dd78  bin/contained-transform-worker.obj
-c2dc6da9e435fb5d475850e921eec520378e18b51d8fd1941e5c2a342d2c91f5  bin/containment-probe.exe
-e397b0d517c8aa058db879e9fdc50beae2482a8d09e041393497e33209a0111c  bin/containment-probe.obj
-0e852f17835a767e7b4155b8de23dfef9c7bfa90de7d4ffc8101e964d763a0e5  bin/deadbyte-contain.exe
-9f0045cc69fb73888963e552a7f53bf319065f9cd39202d0a0d82376effb7cb6  bin/deadbyte-contain.obj
-18e8f071deb2ff95028b77e49679a6329121860c6ed61a753d3e1fdd31f69180  bin/deadbyte-exec.exe
-410d62611927601fa6dc6df826e39ab294fae91bae681d88c532a5466936c2b7  bin/deadbyte-exec.obj
-40575aae3f3127f3a5649fa6f142e29ad7e8660a3bff5fad2cdfe03cdfe66816  bin/deadbyte-process-host.exe
-1a46b8ab2cddcf0e28890e56b630c79f0c176d069ac0110ea93568f9682ca1a4  bin/deadbyte-process-host.obj
-acc0f50e78b564ebb0912d4de782557b8dccec02cde58738706edef43e70d183  bin/deadbyte-tunnel-host.exe
-b3b505a400e0373267220c7a99820adc28e694e37d4e25495311f4fdf951ad37  bin/deadbyte-tunnel-host.obj
-58ec5732e7978b01158a605989ab5f4601e06b08406fa3103795a01cdf9330c9  bin/WORKER-REGISTRY.txt
+bde1964535226804e68392837f5ae331fbbc96770ba48119b6ffbab97d6de8c7  bin/appcontainer-stage.exe
+1e45ccca193a855a1459d7652d4868b3beb809dd15b1148ceecd0fa4b10b9262  bin/appcontainer-stage.obj
+6203145a96488d74a0231ec88d88098eaa7299ab86c87baf3fc32c781164effa  bin/bootstrap-advapi32.exe
+998e5eadea269f886522fa81dc94f28d06f25801614c4517d9b9aec5f3104dc0  bin/bootstrap-advapi32.obj
+cc490744c28841b0255468166e9b30be8909fde4b755a403c600348c5adbb7ac  bin/bootstrap-exitcode.exe
+2faf57970b25064b3b9b08a8fd3286925411a40b62544d5f4d83a81d095d0cca  bin/bootstrap-exitcode.obj
+9479a28a2b1d4b852aace47d22797f2e7b3f6033da67bd9704006077fd66249a  bin/bootstrap-kernel32.exe
+24ab7b165be0e1163df344eae310059e536b95989e0be62267485c7d36a8e733  bin/bootstrap-kernel32.obj
+1910d31ae61b93bb819ecd89e59647ffe3daa3756195335d921bc67033140db8  bin/child-control-probe.exe
+4d1ad4fac339be8165f6165765be4f6c53820d3f5d9ebb76d9113e010e5d0cd0  bin/child-control-probe.obj
+04de94357c2624a5c44e07dd0a73af62929b67b71d93659b24c8c89cd353efcf  bin/child-control-stage.exe
+5c43588f4b4be151b213cf85d66d5ceaa896e429080ad50330e2b9545e98417f  bin/child-control-stage.obj
+8d7c3557b65bef05c34205a2602c0a78b4f4ecc3f406b6ff12f7426841ac993f  bin/contained-reverse-worker.exe
+d719ebd54247365782249bfcb5b9c878bd68573c08f20b88a50b807457454a8f  bin/contained-reverse-worker.obj
+516c364213ba55735b2cedb2cd1a55aa4806b384e027b8c2a679c1d5a5245d44  bin/contained-transform-worker.exe
+f1d07cdf627a967f78a060eecfbec67f815fe3c152ea8282238e10d5f5afa7a7  bin/contained-transform-worker.obj
+49d90123ee929888e487fa46dc7ac9419b82e0e01c0fe5266323f3c51f5417ba  bin/containment-probe.exe
+b6e7ba245226d027fb1775517f484479243c097108e6f4cf52be28f6bbc4c83a  bin/containment-probe.obj
+1d1ad5bd3547a9cff3af75fa067a0c96100b53d3dba41224f93618937a51631d  bin/deadbyte-contain.exe
+15d1cf4eb520b2b2eb3d890fd1e9dafc777cce4c1c4cec22638d41e2a85019d4  bin/deadbyte-contain.obj
+6b01347b84461998096fe3f1ffafa7724f3b49b4c02608f828d8eaf73c512c08  bin/deadbyte-exec.exe
+c8076e6d21dc4247ddb086a8cd60572479dd70dd95b16c54d2ea8b2b1570b3d4  bin/deadbyte-exec.obj
+7db33f35d5fc8f9200825121412f78bd6c1286eb7f4d5005d392f728489fc11d  bin/deadbyte-process-host.exe
+1b8aed18a457df2e4fe8008a21871c462a7249ded9fac05c80d31fed6eba8415  bin/deadbyte-process-host.obj
+a2fd532a612837c09d8604dde04f45fea66084f5dadffdafe825741b8b23444b  bin/deadbyte-tunnel-host.exe
+71aa710bd865823cecb034c833308649ffc71bf32d7c8ca18023ce808b86bea8  bin/deadbyte-tunnel-host.obj
+2bb0c509abceb7f4523ed95286897bced769f86e9b850dad11f289356c612445  bin/WORKER-REGISTRY.txt
 e74d45bd9facf03c9a2a0ff52600252924deb804a87e4b5503f48662a2b45a3b  conpty-input-observer.obj
 f8e46c4bd8eaeb804ffa5af87d6543e37eba66d817d8e5555f9d0462a99e4fdb  controller/deadbyte-controller.config.psd1.example
-d46b896dd802a5b029f6ffe7a89ecde4ff0d653194953bf6d21e3b4f4a3fb288  controller/deadbyte-controller.ps1
+755376c8be51daee9039a7e3aae2a29ccc06fb2a6edff6e5f95c12315d658fde  controller/deadbyte-controller.ps1
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-0626d4b02739d4108776678dc7acd114f8d794c394c25b4803deaa8cb5cbcd5c  controller/deadbyte-process-policy.json
-83f5c2e692a563062a80585d5de734bf443af4ebed4239625b1f61ef04eee7df  controller/README.TXT
+44ba8c44a7e6e34b124af7205d5c4e4d9ff82c5d1525e3fb07e4ea6b0e5a15da  controller/deadbyte-process-policy.json
+d4210667ca937abc86a16d8a53a8003fb6f2d9d5f64f7f699d7c913cbd24f115  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
 9aaf6d07e7511a1f0046ee8cc731d4b9660bbbf47dcea785a9c6b6cec95640bc  DEADBYTE-MCP-R27-FINAL/R27-SLOT-UPDATE-RECEIPT.json
 70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP.cmd
-978b566a611d0301cd493868b983ecca6d2e2cc98a9bf09c73ff05876cb9f6ee  docs/ARCHITECTURE.md
+eb02bae01c36411cece8973323ef6d750e0cb30d06b03f483b9aa78de2d05a3e  docs/ARCHITECTURE.md
 3f455f407933d8e044682f3415bdb51e68d7c4b508411dda7d8ed65b6e1d7e79  docs/AUTHORITY.md
 3be291331862ac5bd892345e84d6ce8d9b6d835855235d7c5f28d5cd4b04afdb  docs/CHILD-CONTROL.md
 a9cbd1e2def00aae93569835f2ee17aa5cfd181e5770d7c1185c9c62deb0769e  docs/CONSTRUCTION-LADDER.md
@@ -1159,7 +1159,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-e65d5d76cfed4387ba8055427a66452dd808bdcab4c0f37e81c1aeeed9dfed9e  package.json
+b51eb609159ab9c46bebd04de7dfe23be44327fb6c5f1e00dd91ce02c7bab0e8  package.json
 b3bb2324a0ee2ca81eac1e8e44ff5141fe0cb6434843c6c3325764abdca2a71a  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1217,22 +1217,22 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-0fca451ad8b3c5d5d02fa165c84900a8c3445c24df14d285677168fc17a65c77  README.txt
+09e05d473cdfcd5ca65207fee6c23f023ddcea9ffc9f291f11ffc4ed146bd3dc  README.txt
 1d4e9dee6f0669bd825334a6a72e13ee85ee29ab430dcef21d893ffd744774b5  scripts/autonomous-benchmark.mjs
 06447dea18be1fa0a5e5a1167a6e3dcbd10ddfd28dd18d7bfd17383cf5bfc080  scripts/autonomous-build.ps1
 6ae23099102eb0f0be4969598ba76600d19b00abf534a039d48e63bc7d7fffe3  scripts/autonomous-tests.ps1
 1d987d12c5af6ffbaec1fe2f95aadc4740fe25933c0f0941f362daa2d2d84f48  scripts/build-containment.ps1
 7d3c741de2b1c29f82efa96ab81fc819d8520f97413ce5ab0d4a1b1efd0e8b42  scripts/coding-live-smoke.mjs
-1df3d510d09d2449cb2e2b5a8c382713a6538612533901ce7d71dd32f55d5468  scripts/deferred-slot-operation.mjs
-19086107f649f7462a6001ef6efddbc782ae5cb93903592bf89bfae6053e0628  scripts/final-closure-verify.mjs
-c66e98577c7f72e3244cbce2f87200f1b9bcc00a24a33e46fad2bb0c3b634fc3  scripts/final-closure.mjs
-5406b5a208ef211f5287ab0b3a8e285c11474360c4d63d049e2e3b5c090e726d  scripts/gate-windows.ps1
+61406ebd8669909e01cb677c91deb8383829094dc9f0d14df1c442678714301b  scripts/deferred-slot-operation.mjs
+c9dacb54b67421ce8481b5d31f157c04cff2b348ed918881e48f174a4b253aea  scripts/final-closure-verify.mjs
+4e4e591cc80db547e2be5208b18ea12f5b11e474d14d101676ac0b0e6f8c3b79  scripts/final-closure.mjs
+2b90e787022c1abb85a76be9f57e39943a13a9e706c3218914110d3caa1eafbb  scripts/gate-windows.ps1
 a64ab9a70c26495ac5d94c024a8813d8bd2bc8a708f236b672cb18556396c262  scripts/init-host-policy.ps1
 b655f2f9c63c7e4b651e7182c6461f9ec63d0991f770f24fe5d44b209ad6bdfb  scripts/refresh-process-policy.mjs
 c92b518b7232849d945f0fcd9c428a2366758e5c9410be68104ed50ef869a33e  scripts/release-manifest.mjs
 d5284978c3b82a6eaef0ddd0ded0754467791d441dfe2d2da11dc25289301607  scripts/release-parity.mjs
 caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtime-self-update.mjs
-53b968bab9039a5c3d4aa7224e894bea45427005e8063a2f975340867d9a5e29  scripts/windows-gate-evidence.mjs
+557a79ac42765ad7cf80a3a87875148633466294861bf3196475200f3eba38e2  scripts/windows-gate-evidence.mjs
 5f4a73a1c3dc178c4b5de193b6cfc4774cfc46d5ad95ef0b786d4d386d82323b  src/agent-mcp-tools.mjs
 5cca555943318990ae8dc82481ab0d172e813261c71b541cc99114f411b040fa  src/agent-runtime.mjs
 0e2d1cdcc5e592ffe36e32fa6da68d84e00f992ca3a189b7a3735d8bbac476a6  src/audit-context.mjs
@@ -1260,7 +1260,7 @@ dcd4c9784e88e253e91ddad3c24b38cb0b36906ed737f6d7bee7712360f66f7a  src/containmen
 0fd1141a749596e4314a532ad99dabfeac213eef857e400eea1aa0ad09e0383d  src/containment-construction.mjs
 fe1761b98738e1aea1d25ddf3a0ba56ccad95a43d45104a89b8665197c7c9e18  src/containment-result.mjs
 705a89cb12fedb993d55dfed32a5870d33e10db26422c944d1e52223566c096c  src/containment-smoke.mjs
-f5fcdc8fbfd16a5dc6bdfedbe7c951fbb74204eb684300660464ad1672040a69  src/deadbyte-cli.mjs
+2b364866aaffb1da92a8a78ac1c827d20b7ba80c2fa321d7cf92b79fe959d19a  src/deadbyte-cli.mjs
 f5fafd46052b09f71a528594eb230edc5766ee0d006432d744590ec97c9c580d  src/executor.mjs
 264d21a4385a0a04613fe78203e7f5e231a5c06397086cfacc88076e60b89b71  src/hash.mjs
 1cc648f59d739cb3269827a7aff23dc9dc6617a77c4da607ba947ca6e4626548  src/host-plane.mjs
@@ -1300,7 +1300,7 @@ a7a63ea58291e0676c7199633ae234030f46285840cdfc519c879c279ae8bb14  src/release-sl
 efd3f7ae0a3a614485933942ab5e27e874175feb81eb3e5130913c1e6837e7ca  src/remote-mcp-host-smoke-client.mjs
 aeed462a1090611ce04f2d4e453e4a6e9163091d6d99f768233943f1c24b949f  src/remote-mcp-machine-smoke-client.mjs
 510691cf1d5d1f995b835881651da9b2a7bc22c02bc4da12e3a8266713bcc7e5  src/remote-mcp-r24-disarmed-smoke-client.mjs
-3aaaac035742914f37e15441594e01582b84fd5ad301052f9ff5d3f391700b9c  src/remote-mcp-r33-parity-client.mjs
+56ab88d00979ee8f524c364a6548dd37adda99070f80b6c29de49eb3bef7e479  src/remote-mcp-r33-parity-client.mjs
 86a641f0a1c34ad23bc8f50809a37b57d820ea7810ef86cb4315ce75d0406237  src/remote-mcp-smoke-client.mjs
 827b156eac01cc9ec6f5ca9a49219612f0da511fde770a9eb1235aa913b5e514  src/request-identity.mjs
 ce2223bf6075e96cc02505c1439acce18bb1f204c5e86cf9152bb7194daf3cd2  src/runtime-identity.mjs
@@ -1313,7 +1313,7 @@ a765372ee27cf34b3f42ca77e43b839a306a4ca7d8b1c5e2fdd4367ab0c95769  src/tunnel-std
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-9d1efd8ebb9b4ff260e5a1d6f5ba527fc626544d25fe73aca8fa151b67cf74bf  src/version.mjs
+c8b13e6d6cb66949f701f2ef20069de4cb0c3f5f858334e62316207e3bd37766  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -1347,7 +1347,7 @@ a972bd20fa927427e6d8e4181699a27e792e916b02dcf8a1ac3e2b44afd238c1  test/controlle
 ceba7d1a09ccdcb20f33fe4e6de7667ffe0f0170d1bc9fefadfdba4d7f228090  test/controller-r29.test.mjs
 4d0dc810d9af13907f31c834a13acfb7e01ffbbe65575b69649fe52741e42175  test/controller-r30.test.mjs
 b013bb2a100d3e784f0c0a2ef63d9d9d57cadd71a8db4fb845cbedb4a7b2c222  test/controller.test.mjs
-b6c0679db51645f2e6a38171a72782fbe93018e235348cefa0aeb2c902b99bc9  test/core.test.mjs
+7830426cd19d602cae5314d7e7a8d9bcadda152ea6751167ae9b03d882f8ce0e  test/core.test.mjs
 7ba4b06a1c4141ba87b5b371157fb59940d15a1016b4c599a13753d63ad0d3d3  test/DEADBYTE-MCP-WRITE-PROBE.txt
 3d4b0bdef293fa3889dec60e8e321594a67e9f7095d3c541b382c82c33b2642e  test/deferred-slot-operation-behavior.test.mjs
 33eff6932951dd9cfd42d68b3333f8080f1a0b9fdc01b05aef5c96faf44b032e  test/deferred-slot-operation.test.mjs
@@ -1373,14 +1373,15 @@ b84622d07d2ecfe27b55e45f7e89949f29a2d14184d8c6f6f82ed7f1e5fa59be  test/process-n
 a54301192c4cc842cbb6e113db2615a13f448c702273ef0585cc015859716f8a  test/process-release-gate.test.mjs
 e19a477abb83c63a1fb7ab5d5d1e9925113cded95d57084186b6ecd6161780e0  test/process-runtime.test.mjs
 34afc8a01e0c21501ec2647b7b0198b73570bce89eaaa983bd50c5709bb83fb8  test/process-supervision.test.mjs
-f4e98853611403fdc993d2071b72eea6610cf3fb70e927720d736da3683ea915  test/r33-closeout-regression.test.mjs
-a70467549ce775089f1850ee7d22f5074eaddd9cdcfce7eca34ede4902ab79a6  test/r33-finalization.test.mjs
+fa43776151fceb7c6aaace6d83af2bfb1632ebf633c6d24827fea741f6184683  test/r33-closeout-regression.test.mjs
+1274d7d089fc859b2851918967ec82c3edd07bec134036df1e926d5ec140a450  test/r33-finalization.test.mjs
 8776f707a78b29ccf2721b8bcf0ae4038a20022710ef9d6ccfea997c8c6d9d17  test/release-generation.test.mjs
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs
 7cc69e786bfd9e4a7e70888c4c1b5f756a264bc1a991139c468b63af23f24c38  test/release-slot.test.mjs
 0109c76b480cc600f6ed42be4519df3fa6835012bb9e4ba4ae6be6635468c4a8  test/release-smoke-isolation.test.mjs
-14a7fcb184581b75ad4ee5da2d0dd2b5a2ed9b95576f336cb253c2488e31f2cf  test/release-version.test.mjs
+9fcf554d86c4bc0a4d652e32f1a5fffffafcdb0418f6fd98ae792fff12bfc025  test/release-version.test.mjs
 1fdb6cbd3a51476834382086bad2b92029987b6214153576cd803f9da0b06902  test/remote-r24-catalog.test.mjs
+ea016d1a773c702e17152d73135ac5a8591baf6d220e304292758c8c7d4ee586  test/remote-session-cli.test.mjs
 c05c64db73839698fdcdd4faa2bdbd78df861f53495f7a3b68a1fb53abb7d3c2  test/runtime-self-update.test.mjs
 2f421a60ff6baa9cc3de0cbc4804ffe6b2d26805f94d4f57e6c4a1758f464afb  test/standing-grants.test.mjs
 6ecc712b7bcb2abdb934e7d40232ed97ac355f3f47665f557c2168b04d113b41  test/tool-audit.test.mjs

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.8.7 / R33 FINAL MACHINE BASELINE
+DEADBYTE MCP V0.8.8 / R33 FINAL MACHINE BASELINE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -14,6 +14,14 @@ Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
   npx deadbyte-mcp@latest audit verify
 
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
+Bare `remote` is a foreground device session: it starts/resumes the verified runtime, arms process,
+coding, autonomous, and host authority in dependency order, independently checks that all four
+planes report ARMED, then streams new audit plus controller-runtime log records until Ctrl+C or the
+foreground input closes. Session shutdown revokes all four planes and parks the Bridge. A small
+runtime owner marker prevents concurrent foreground sessions; if the prior owner died, the next
+session first revokes stale authority and parks before starting cleanly. Explicit subcommands such
+as `remote status` remain one-shot controller operations.
+
 The legacy CMD file remains only as an R33 compatibility artifact until activation/rollback/restore
 proof confirms the npx path; it is not the primary operator interface. Audit data lives under the
 stable mutable state root and never inside immutable release slots.

package/bin/WORKER-REGISTRY.txt

@@ -2,11 +2,11 @@ schema=deadbyte.worker-registry.v1
 version=0.6.0
 policy=compile-time-operation-to-executable
 launcher.executable=deadbyte-exec.exe
-launcher.sha256=18e8f071deb2ff95028b77e49679a6329121860c6ed61a753d3e1fdd31f69180
+launcher.sha256=6b01347b84461998096fe3f1ffafa7724f3b49b4c02608f828d8eaf73c512c08
 operation.lowercase_ascii=contained-transform-v1
 operation.reverse_bytes=contained-reverse-v1
 operation.uppercase_ascii=contained-transform-v1
 worker.contained-reverse-v1.executable=contained-reverse-worker.exe
-worker.contained-reverse-v1.sha256=0ec64e0fd1ae66de894b9ebf9fec9404066b77abd0f7cadaf9514fb938db679c
+worker.contained-reverse-v1.sha256=8d7c3557b65bef05c34205a2602c0a78b4f4ecc3f406b6ff12f7426841ac993f
 worker.contained-transform-v1.executable=contained-transform-worker.exe
-worker.contained-transform-v1.sha256=d51c3cb3ed1f0e4ce4ca066288786f8fe4338588ea6b8e9f0a1a8cb5b5f33a20
+worker.contained-transform-v1.sha256=516c364213ba55735b2cedb2cd1a55aa4806b384e027b8c2a679c1d5a5245d44

package/controller/README.TXT

@@ -1,17 +1,24 @@
-DEADBYTE MCP V0.8.7 / R33 CONTROLLER
+DEADBYTE MCP V0.8.8 / R33 CONTROLLER
 ====================================
 
 ENTRY POINT
 -----------
-Use only:
+Primary operator entry point:
 
-  %USERPROFILE%\Downloads\DEADBYTE-MCP.cmd
+  npx deadbyte-mcp@latest remote
 
-The package and controller launchers forward into the canonical controller root.
-A copied/misbound controller fails closed before creating command runtime state.
+Bare `remote` is a foreground device session. It starts the verified runtime, arms process,
+coding, autonomous, and host authority, verifies all four planes are ARMED, then streams new
+audit/runtime logs. Ctrl+C/SIGTERM or foreground input closure revokes all four planes and parks
+the Bridge. A stale dead-owner session is recovered by revoking authority before the next start.
+`remote status` and the other explicit remote subcommands remain one-shot operations.
 
-CLOSING OR EXITING THE MENU DOES NOT STOP A STARTED RUNTIME.
-Only explicit park/stop/restart lifecycle commands mutate verified owned processes.
+The package/controller CMD launchers remain compatibility-only and forward into the canonical
+controller root. A copied/misbound controller fails closed before creating command runtime state.
+
+CLOSING OR EXITING THE LEGACY MENU DOES NOT STOP A STARTED RUNTIME.
+Only explicit park/stop/restart lifecycle commands mutate verified owned processes outside the
+foreground `remote` session contract.
 
 STATE
 -----

package/controller/deadbyte-controller.ps1

@@ -1026,7 +1026,7 @@ while ($true) {
     Clear-Host
     $cfg = Get-Config
     Assert-ControllerRootBound $cfg
-    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.8.7 / R33'
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.8.8 / R33'
     Write-Host '======================================'
     Show-State $cfg | Out-Null
     Write-Host ''

package/controller/deadbyte-process-policy.json

@@ -5,7 +5,7 @@
   "state_dir": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2\\controller\\runtime\\process-state",
   "native_host": {
     "path": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2\\bin\\deadbyte-process-host.exe",
-    "sha256": "40575aae3f3127f3a5649fa6f142e29ad7e8660a3bff5fad2cdfe03cdfe66816"
+    "sha256": "7db33f35d5fc8f9200825121412f78bd6c1286eb7f4d5005d392f728489fc11d"
   },
   "roots": {
     "core": {

package/docs/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# DEADBYTE MCP V0.8.7 / R33 ARCHITECTURE
+# DEADBYTE MCP V0.8.8 / R33 ARCHITECTURE
 
 ```mermaid
 flowchart TD
@@ -40,7 +40,12 @@ flowchart TD
 
 The lifecycle controller is not execution authority. It starts, parks, resumes,
 observes, or stops verified owned processes and feature-gates the agent catalog;
-it cannot manufacture arbitrary MCP capabilities.
+it cannot manufacture arbitrary MCP capabilities. The npx foreground `remote` session is an
+operator-side orchestrator over existing controller commands: it acquires the four explicit
+standing grants in dependency order, verifies their observed ARMED state, tails only newly appended
+audit/runtime logs, and revokes all four grants plus parks the Bridge on graceful session exit.
+A PID-bound owner marker prevents concurrent sessions and lets the next invocation fail closed by
+revoking stale authority before recovery when the prior owner process died.
 
 ## Exact capability catalogs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP machine-truth runtime with signed audit chain, immutable release slots, contained execution, coding/autonomous production authority, and npx-first remote control.",

package/scripts/deferred-slot-operation.mjs

@@ -22,7 +22,7 @@ const atomicJson=async(file,value)=>{
 };
 function activationArgs(manifestSha){
   if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
-  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.8.7',
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.8.8',
     '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
     '--process-policy-sha256',null,'--enable-machine-fs','--enable-observation'];
 }

package/scripts/final-closure-verify.mjs

@@ -84,7 +84,7 @@ function verifyPing(ping,status,pointer){
 
 export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
   insist(envelope?.body?.schema==='deadbyte.r33-final-closure.v1','closure schema mismatch');
-  insist(envelope.body.version==='0.8.7','closure version mismatch');
+  insist(envelope.body.version==='0.8.8','closure version mismatch');
   insist(envelope.body.release_label==='R33 FINAL MACHINE BASELINE','closure release label mismatch');
   const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
   const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
@@ -97,7 +97,7 @@ export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.
 
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
   insist(same(pointer,envelope.body.active_pointer),'active pointer drift');
-  insist(pointer.version==='0.8.7','active pointer version mismatch');
+  insist(pointer.version==='0.8.8','active pointer version mismatch');
   insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'release id/content address mismatch');
   const releaseFiles=await verifyTree(pointer.release_root,'MANIFEST.SHA256',pointer.manifest_sha256);
   const generationFiles=await verifyTree(pointer.generation_root,'GENERATION.SHA256',pointer.generation_manifest_sha256);
@@ -129,7 +129,7 @@ export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.
   const windowsGate=JSON.parse(await readFile(evidence.windows_gate.path,'utf8'));
   insist(windowsGate.schema==='deadbyte.r33-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
   insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate manifest binding mismatch');
-  insist(windowsGate.marker==='DEADBYTE V0.8.7 / R33 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.8.8 / R33 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
 
   const machine=envelope.body.machine;
   insist(machine?.status?.release_id===pointer.release_id&&machine.status.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine status binding mismatch');

package/scripts/final-closure.mjs

@@ -22,7 +22,7 @@ function structured(result,label){
 async function publicMachineEvidence(){
   const endpoint=new URL((await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim());
   insist(endpoint.protocol==='https:','final closure requires HTTPS public endpoint');
-  const client=new Client({name:'deadbyte-r33-final-closure',version:'0.8.7'},
+  const client=new Client({name:'deadbyte-r33-final-closure',version:'0.8.8'},
     {versionNegotiation:{mode:{pin:'2026-07-28'}}});
   const transport=new StreamableHTTPClientTransport(endpoint);
   try{
@@ -61,7 +61,7 @@ async function atomicCreate(file,bytes){
 
 export async function writeFinalClosure({parityPath,activationPath,windowsGatePath}){
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
-  insist(pointer.version==='0.8.7','final closure requires V0.8.7 active release');
+  insist(pointer.version==='0.8.8','final closure requires V0.8.8 active release');
   const parity=JSON.parse(await readFile(path.resolve(parityPath),'utf8'));
   insist(parity.schema==='deadbyte.r33-parity.v1'&&parity.status==='passed','parity evidence is not passed');
   insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity/current release mismatch');
@@ -76,7 +76,7 @@ export async function writeFinalClosure({parityPath,activationPath,windowsGatePa
     rollback:await fileEvidence(parity.rollback.receipt_path), restore:await fileEvidence(parity.restore.receipt_path),
     windows_gate:await fileEvidence(windowsGatePath)
   };
-  const body={schema:'deadbyte.r33-final-closure.v1',version:'0.8.7',release_label:'R33 FINAL MACHINE BASELINE',
+  const body={schema:'deadbyte.r33-final-closure.v1',version:'0.8.8',release_label:'R33 FINAL MACHINE BASELINE',
     completed_at_utc:new Date().toISOString(),active_pointer:pointer,evidence,
     public_catalog:{tool_count:machine.tool_count,strict_output_schemas:machine.strict_output_schemas},
     machine:{status:machine.status,ping:machine.ping,nonce:machine.nonce},

package/scripts/gate-windows.ps1

@@ -9,7 +9,7 @@ function Invoke-GateStep {
     Write-Host "==== $Name ===="
     & npm.cmd @NpmArgs
     if ($LASTEXITCODE -ne 0) {
-        throw "DEADBYTE V0.8.7 / R33 gate failed at $Name with exit code $LASTEXITCODE"
+        throw "DEADBYTE V0.8.8 / R33 gate failed at $Name with exit code $LASTEXITCODE"
     }
 }
 
@@ -36,7 +36,7 @@ Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run', 'manifest:verif
 Write-Host '==== windows-gate-evidence ===='
 & node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence.mjs')
 if ($LASTEXITCODE -ne 0) {
-    throw "DEADBYTE V0.8.7 / R33 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
+    throw "DEADBYTE V0.8.8 / R33 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
 }
 
-Write-Host '==== DEADBYTE V0.8.7 / R33 WINDOWS BATCH GATE: PASS ===='
+Write-Host '==== DEADBYTE V0.8.8 / R33 WINDOWS BATCH GATE: PASS ===='

package/scripts/windows-gate-evidence.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 const here=path.dirname(fileURLToPath(import.meta.url));
 const root=path.resolve(here,'..');
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
-const marker='DEADBYTE V0.8.7 / R33 WINDOWS BATCH GATE: PASS';
+const marker='DEADBYTE V0.8.8 / R33 WINDOWS BATCH GATE: PASS';
 function insist(ok,message){if(!ok) throw new Error(message);}
 
 export async function writeWindowsGateEvidence({
@@ -19,11 +19,11 @@ export async function writeWindowsGateEvidence({
   const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
   const manifestSha256=sha256(manifestBytes);
   const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
-  insist(pkg.version==='0.8.7',`Windows gate evidence requires V0.8.7, found ${pkg.version}`);
+  insist(pkg.version==='0.8.8',`Windows gate evidence requires V0.8.8, found ${pkg.version}`);
   const completed=clock();
   insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'Windows gate evidence clock invalid');
   const evidence={
-    schema:'deadbyte.r33-windows-gate.v1',status:'passed',exit_code:0,version:'0.8.7',
+    schema:'deadbyte.r33-windows-gate.v1',status:'passed',exit_code:0,version:'0.8.8',
     marker,completed_at_utc:completed.toISOString(),manifest_sha256:manifestSha256
   };
   const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
@@ -39,7 +39,7 @@ export async function writeWindowsGateEvidence({
     const existingBytes=await readFile(file);
     const existing=JSON.parse(existingBytes.toString('utf8'));
     insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing Windows gate evidence invalid');
-    insist(existing.version==='0.8.7'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing Windows gate evidence binding mismatch');
+    insist(existing.version==='0.8.8'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing Windows gate evidence binding mismatch');
     return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256};
   }
 }

package/src/deadbyte-cli.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { lstat } from 'node:fs/promises';
+import { lstat, mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
 import { defaultPublicKeyPath } from './trust.mjs';
 import { verifyAuditChain } from './audit-verify.mjs';
 
@@ -11,30 +12,178 @@ const REMOTE_COMMANDS=new Set([
   'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
   'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
 ]);
+const SESSION_START=['start','armprocess','armcoding','armautonomous','armhost'];
+const SESSION_STATUS=[
+  ['processstatus',/^Process plane\s*:\s*ARMED\b/m],
+  ['codingstatus',/^Coding plane\s*:\s*ARMED\b/m],
+  ['autonomousstatus',/^Autonomous\s*:\s*ARMED\b/m],
+  ['hoststatus',/^Host plane\s*:\s*ARMED\b/m]
+];
+const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmhost','park'];
 
 function stateRoot(){return path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));}
 async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
 function printHelp(){
   process.stdout.write([
     'DEADBYTE MCP CLI','',
-    '  npx deadbyte-mcp@latest remote',
+    '  npx deadbyte-mcp@latest remote              # foreground device session',
     '  npx deadbyte-mcp@latest remote status',
     '  npx deadbyte-mcp@latest remote restart',
     '  npx deadbyte-mcp@latest audit verify',
     '  npx deadbyte-mcp@latest audit status',''
   ].join('\n'));
 }
-async function runRemote(args){
+async function remoteContext(){
   if(process.platform!=='win32') throw new Error('remote controller is currently Windows-only');
-  if(args.length>1) throw new Error('remote accepts at most one controller command');
-  const command=args[0]||'start';if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
   const root=stateRoot();
   const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
   const systemRoot=process.env.SystemRoot||process.env.WINDIR;if(!systemRoot) throw new Error('SystemRoot/WINDIR missing');
   const powershell=await requireRegular(path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
-  const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{stdio:'inherit',windowsHide:false,shell:false});
+  return {root,launcher,powershell};
+}
+function invokeController(ctx,command,{capture=false,allowFailure=false}={}){
+  const result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command],{
+    stdio:capture?['ignore','pipe','pipe']:'inherit',encoding:capture?'utf8':undefined,windowsHide:false,shell:false
+  });
   if(result.error) throw result.error;
-  process.exitCode=Number.isInteger(result.status)?result.status:1;
+  const status=Number.isInteger(result.status)?result.status:1;
+  const stdout=capture?String(result.stdout||''):'';
+  const stderr=capture?String(result.stderr||''):'';
+  if(capture){if(stdout) process.stdout.write(stdout);if(stderr) process.stderr.write(stderr);}
+  if(status!==0&&!allowFailure) throw new Error(`remote controller '${command}' failed exit=${status}`);
+  return {status,stdout,stderr};
+}
+async function listLogFiles(root){
+  const files=[];
+  const audit=path.join(root,'audit');
+  const runtimeLogs=path.join(root,'runtime','logs');
+  for(const [dir,accept] of [
+    [audit,name=>/^segment-\d{8}\.jsonl$/.test(name)],
+    [runtimeLogs,name=>/\.log$/i.test(name)]
+  ]){
+    let names=[];try{names=await readdir(dir);}catch(error){if(error?.code==='ENOENT') continue;throw error;}
+    for(const name of names.sort()) if(accept(name)) files.push(path.join(dir,name));
+  }
+  return files;
+}
+function formatLogLine(file,line){
+  if(!line) return null;
+  if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))){
+    try{
+      const event=JSON.parse(line);
+      const seq=Number.isInteger(event.seq)?`#${event.seq}`:'#?';
+      const request=typeof event.request_id==='string'?` ${event.request_id.slice(0,8)}`:'';
+      const tool=typeof event.tool==='string'?` ${event.tool}`:'';
+      return `[AUDIT ${seq}] ${event.event_type||'event'}${tool}${request}`;
+    }catch{return `[AUDIT] ${line}`;}
+  }
+  const label=path.basename(file).replace(/\.log$/i,'').toUpperCase();
+  return `[${label}] ${line}`;
+}
+async function readAppend(file,offset){
+  let info;try{info=await stat(file);}catch(error){if(error?.code==='ENOENT') return {offset:0,text:''};throw error;}
+  let start=offset;
+  if(info.size<start) start=0;
+  if(info.size===start) return {offset:start,text:''};
+  const length=info.size-start;
+  const buffer=Buffer.alloc(length);
+  const handle=await open(file,'r');
+  try{await handle.read(buffer,0,length,start);}finally{await handle.close();}
+  return {offset:info.size,text:buffer.toString('utf8')};
+}
+async function tailRemoteLogs(root,signal){
+  const offsets=new Map();
+  for(const file of await listLogFiles(root)){
+    try{offsets.set(file,(await stat(file)).size);}catch{}
+  }
+  process.stdout.write('[LOG] Live logs active. Press Ctrl+C to disconnect and revoke authority.\n');
+  while(!signal.aborted){
+    for(const file of await listLogFiles(root)){
+      const prior=offsets.has(file)?offsets.get(file):0;
+      const next=await readAppend(file,prior);
+      offsets.set(file,next.offset);
+      for(const line of next.text.split(/\r?\n/)){
+        const formatted=formatLogLine(file,line);
+        if(formatted) process.stdout.write(`${formatted}\n`);
+      }
+    }
+    try{await sleep(250,null,{signal});}catch(error){if(error?.name!=='AbortError') throw error;}
+  }
+}
+async function cleanupRemoteSession(ctx){
+  for(const command of SESSION_CLEANUP){
+    try{invokeController(ctx,command,{allowFailure:true});}
+    catch(error){process.stderr.write(`[WARN] cleanup ${command}: ${String(error?.message||error)}\n`);}
+  }
+}
+function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
+function pidAlive(pid){
+  try{process.kill(pid,0);return true;}
+  catch(error){return error?.code!=='ESRCH';}
+}
+async function readRemoteSessionMarker(root){
+  const file=remoteSessionMarker(root);
+  let text;try{text=await readFile(file,'utf8');}catch(error){if(error?.code==='ENOENT') return null;throw error;}
+  let value;try{value=JSON.parse(text);}catch{throw new Error('remote session marker is invalid JSON');}
+  if(value?.schema!=='deadbyte.remote-session.v1'||!Number.isInteger(value?.pid)||value.pid<1) throw new Error('remote session marker schema invalid');
+  return value;
+}
+async function recoverRemoteSession(ctx){
+  const prior=await readRemoteSessionMarker(ctx.root);
+  if(!prior) return;
+  if(pidAlive(prior.pid)) throw new Error(`remote session already active pid=${prior.pid}`);
+  process.stdout.write(`[RECOVERY] Stale remote session pid=${prior.pid}; revoking authority before restart.\n`);
+  await cleanupRemoteSession(ctx);
+  await rm(remoteSessionMarker(ctx.root),{force:true});
+}
+async function claimRemoteSession(ctx){
+  const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
+  const marker={schema:'deadbyte.remote-session.v1',pid:process.pid,started_at_utc:new Date().toISOString()};
+  try{await writeFile(remoteSessionMarker(ctx.root),`${JSON.stringify(marker)}\n`,{encoding:'utf8',flag:'wx'});}
+  catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
+  return marker;
+}
+async function releaseRemoteSession(ctx,marker){
+  let current=null;try{current=await readRemoteSessionMarker(ctx.root);}catch(error){process.stderr.write(`[WARN] remote session marker cleanup: ${String(error?.message||error)}\n`);return;}
+  if(current&&current.pid===marker.pid) await rm(remoteSessionMarker(ctx.root),{force:true});
+}
+async function runRemoteSession(){
+  const ctx=await remoteContext();
+  await recoverRemoteSession(ctx);
+  const marker=await claimRemoteSession(ctx);
+  const aborter=new AbortController();
+  const abort=()=>aborter.abort();
+  const watchStdin=!process.stdin.isTTY;
+  process.once('SIGINT',abort);process.once('SIGTERM',abort);
+  if(watchStdin){process.stdin.once('end',abort);process.stdin.once('close',abort);process.stdin.resume();}
+  let ready=false;
+  try{
+    process.stdout.write('DEADBYTE MCP DEVICE SESSION\n');
+    process.stdout.write('[INFO] Starting local + remote runtime...\n');
+    for(const command of SESSION_START) invokeController(ctx,command);
+    process.stdout.write('[AUTHORITY] Verifying runtime planes...\n');
+    for(const [command,pattern] of SESSION_STATUS){
+      const result=invokeController(ctx,command,{capture:true});
+      if(!pattern.test(result.stdout)) throw new Error(`remote session authority verification failed: ${command} did not report ARMED`);
+    }
+    ready=true;
+    process.stdout.write('[DEVICE] DEADBYTE MCP online; all authority planes ARMED.\n');
+    await tailRemoteLogs(ctx.root,aborter.signal);
+  }finally{
+    process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
+    if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
+    if(ready||!aborter.signal.aborted) process.stdout.write('[INFO] Closing remote device session and revoking authority...\n');
+    await cleanupRemoteSession(ctx);
+    await releaseRemoteSession(ctx,marker);
+  }
+}
+async function runRemote(args){
+  if(args.length===0){await runRemoteSession();return;}
+  if(args.length>1) throw new Error('remote accepts at most one controller command');
+  const command=args[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
+  const ctx=await remoteContext();
+  const result=invokeController(ctx,command,{allowFailure:true});
+  process.exitCode=result.status;
 }
 async function runAudit(args){
   const command=args[0]||'status';if(args.length>1) throw new Error('audit accepts one command');

package/src/remote-mcp-r33-parity-client.mjs

@@ -67,7 +67,7 @@ export async function runR33Parity(endpointText) {
   if (endpoint.protocol !== 'https:') throw new Error('R33 parity requires HTTPS');
   const pointer = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
   const policy = await loadCodingPolicy(path.join(pointer.generation_root, 'coding-policy.json'));
-  const client = new Client({ name:'deadbyte-r33-parity', version:'0.8.7' },
+  const client = new Client({ name:'deadbyte-r33-parity', version:'0.8.8' },
     { versionNegotiation:{ mode:{ pin:'2026-07-28' } } });
   const transport = new StreamableHTTPClientTransport(endpoint);
   const tag = randomBytes(8).toString('hex');

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.8.7';
+export const DEADBYTE_VERSION = '0.8.8';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.8.7');
+  assert.equal(result.receipt.runtime.package_version, '0.8.8');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/r33-closeout-regression.test.mjs

@@ -103,7 +103,7 @@ test('Windows R33 gate emits manifest-bound machine-readable evidence outside th
     assert.equal(evidence.status,'passed');
     assert.equal(evidence.exit_code,0);
     assert.equal(evidence.manifest_sha256,manifestSha);
-    assert.equal(evidence.marker,'DEADBYTE V0.8.7 / R33 WINDOWS BATCH GATE: PASS');
+    assert.equal(evidence.marker,'DEADBYTE V0.8.8 / R33 WINDOWS BATCH GATE: PASS');
     assert.ok(summary.path.startsWith(path.join(stateRoot,'evidence','release')));
   }finally{await rm(stateRoot,{recursive:true,force:true});}
 });

package/test/r33-finalization.test.mjs

@@ -30,8 +30,8 @@ test('final closure verifier is implementation-independent from production helpe
   assert.match(verifier, /DEADBYTE-R27-SLOT-UPDATE-V1/);
   assert.match(verifier, /DEADBYTE-MACHINE-PING-V1/);
   assert.match(verifier, /DEADBYTE-R33-FINAL-CLOSURE-V1/);
-  assert.match(writer, /pointer\.version==='0\.8\.7'/);
-  assert.match(verifier, /envelope\.body\.version==='0\.8\.7'/);
+  assert.match(writer, /pointer\.version==='0\.8\.8'/);
+  assert.match(verifier, /envelope\.body\.version==='0\.8\.8'/);
   assert.match(verifier, /release_label==='R33 FINAL MACHINE BASELINE'/);
 });
 

package/test/release-version.test.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 const root = new URL('../', import.meta.url);
 const text = rel => readFile(new URL(rel, root), 'utf8');
 
-test('R33 final release authority agrees on V0.8.7 / R33 identity', async () => {
+test('R33 patch successor release authority agrees on V0.8.8 / R33 identity', async () => {
   const pkg = JSON.parse(await text('package.json'));
   const [version, controller, gate, readme, architecture, controllerReadme, deferred, parity, closure, closureVerify] = await Promise.all([
     text('src/version.mjs'),
@@ -20,16 +20,16 @@ test('R33 final release authority agrees on V0.8.7 / R33 identity', async () =>
     text('scripts/final-closure.mjs'),
     text('scripts/final-closure-verify.mjs')
   ]);
-  assert.equal(pkg.version, '0.8.7');
-  assert.match(version, /DEADBYTE_VERSION = '0\.8\.7'/);
-  assert.match(controller, /CONTROLLER V0\.8\.7 \/ R33/);
-  assert.match(gate, /DEADBYTE V0\.8\.7 \/ R33 WINDOWS BATCH GATE: PASS/);
-  assert.match(readme, /^DEADBYTE MCP V0\.8\.7 \/ R33 FINAL MACHINE BASELINE$/m);
-  assert.match(architecture, /^# DEADBYTE MCP V0\.8\.7 \/ R33 ARCHITECTURE$/m);
-  assert.match(controllerReadme, /^DEADBYTE MCP V0\.8\.7 \/ R33 CONTROLLER$/m);
+  assert.equal(pkg.version, '0.8.8');
+  assert.match(version, /DEADBYTE_VERSION = '0\.8\.8'/);
+  assert.match(controller, /CONTROLLER V0\.8\.8 \/ R33/);
+  assert.match(gate, /DEADBYTE V0\.8\.8 \/ R33 WINDOWS BATCH GATE: PASS/);
+  assert.match(readme, /^DEADBYTE MCP V0\.8\.8 \/ R33 FINAL MACHINE BASELINE$/m);
+  assert.match(architecture, /^# DEADBYTE MCP V0\.8\.8 \/ R33 ARCHITECTURE$/m);
+  assert.match(controllerReadme, /^DEADBYTE MCP V0\.8\.8 \/ R33 CONTROLLER$/m);
   assert.match(controllerReadme, /68-tool public catalog/);
-  assert.match(deferred, /--expected-version','0\.8\.7'/);
-  assert.match(parity, /version:'0\.8\.7'/);
-  assert.match(closure, /version:'0\.8\.7'/);
-  assert.match(closureVerify, /DEADBYTE V0\.8\.7 \/ R33 WINDOWS BATCH GATE: PASS/);
+  assert.match(deferred, /--expected-version','0\.8\.8'/);
+  assert.match(parity, /version:'0\.8\.8'/);
+  assert.match(closure, /version:'0\.8\.8'/);
+  assert.match(closureVerify, /DEADBYTE V0\.8\.8 \/ R33 WINDOWS BATCH GATE: PASS/);
 });

package/test/remote-session-cli.test.mjs

@@ -0,0 +1,151 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const cliPath=path.join(root,'src','deadbyte-cli.mjs');
+const isWindows=process.platform==='win32';
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+async function fixture({failCommand=''}={}){
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-remote-session-'));
+  const state=path.join(dir,'state');
+  const bin=path.join(state,'bin');
+  const trace=path.join(dir,'trace.txt');
+  await mkdir(bin,{recursive:true});
+  const launcher=path.join(bin,'DEADBYTE-MCP.ps1');
+  const ps1=`param([string]$Command)\nAdd-Content -LiteralPath $env:DEADBYTE_REMOTE_TEST_TRACE -Value $Command -Encoding UTF8\nif ($env:DEADBYTE_REMOTE_TEST_FAIL -and $Command -eq $env:DEADBYTE_REMOTE_TEST_FAIL) { Write-Error \"forced $Command failure\"; exit 9 }\nswitch ($Command) {\n  'start' { Write-Host 'DEADBYTE MCP = ONLINE' }\n  'processstatus' { Write-Host 'Process plane  : ARMED [standing-grant]' }\n  'codingstatus' { Write-Host 'Coding plane  : ARMED [standing-grant]' }\n  'autonomousstatus' { Write-Host 'Autonomous     : ARMED [standing-grant]' }\n  'hoststatus' { Write-Host 'Host plane    : ARMED [standing-grant]' }\n  'park' { Write-Host 'DEADBYTE MCP = PARKED' }\n  default { Write-Host \"$Command OK\" }\n}\nexit 0\n`;
+  await writeFile(launcher,ps1,'utf8');
+  return {dir,state,trace,env:{...process.env,DEADBYTE_STATE_ROOT:state,DEADBYTE_REMOTE_TEST_TRACE:trace,DEADBYTE_REMOTE_TEST_FAIL:failCommand}};
+}
+
+async function traceCommands(file){
+  try{return (await readFile(file,'utf8')).split(/\r?\n/).map(x=>x.trim()).filter(Boolean);}catch(error){if(error?.code==='ENOENT') return [];throw error;}
+}
+async function waitFor(file,predicate,{timeoutMs=6000}={}){
+  const deadline=Date.now()+timeoutMs;
+  while(Date.now()<deadline){
+    const commands=await traceCommands(file);
+    if(predicate(commands)) return commands;
+    await sleep(50);
+  }
+  return traceCommands(file);
+}
+async function collect(child){
+  let stdout='',stderr='';
+  child.stdout?.on('data',chunk=>{stdout+=chunk;});
+  child.stderr?.on('data',chunk=>{stderr+=chunk;});
+  const closed=new Promise(resolve=>child.once('close',(code,signal)=>resolve({code,signal})));
+  return {closed,get stdout(){return stdout;},get stderr(){return stderr;}};
+}
+
+const winTest=isWindows?test:test.skip;
+
+winTest('bare remote arms every authority plane, verifies ARMED state, streams logs, then disarms and parks when the foreground session ends',async()=>{
+  const fx=await fixture();
+  let child=null;
+  try{
+    child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    const ready=await waitFor(fx.trace,commands=>commands.includes('hoststatus'));
+    assert.deepEqual(ready.slice(0,9),[
+      'start','armprocess','armcoding','armautonomous','armhost',
+      'processstatus','codingstatus','autonomousstatus','hoststatus'
+    ]);
+    assert.equal(child.exitCode,null,'remote session must remain foreground after becoming ready');
+    const tailDeadline=Date.now()+3000;
+    while(Date.now()<tailDeadline&&!/\[LOG\] Live logs active/.test(output.stdout)) await sleep(50);
+    assert.match(output.stdout,/\[LOG\] Live logs active/);
+    const auditDir=path.join(fx.state,'audit');
+    await mkdir(auditDir,{recursive:true});
+    await writeFile(path.join(auditDir,'segment-00000001.jsonl'),`${JSON.stringify({seq:1,event_type:'tool.request',tool:'coding_tree',request_id:'abcdef1234567890'})}\n`,'utf8');
+    const logDeadline=Date.now()+3000;
+    while(Date.now()<logDeadline&&!/\[AUDIT #1\] tool\.request coding_tree abcdef12/.test(output.stdout)) await sleep(50);
+    assert.match(output.stdout,/\[AUDIT #1\] tool\.request coding_tree abcdef12/);
+    child.stdin.end();
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined,'remote session did not exit after foreground input closed');
+    const commands=await traceCommands(fx.trace);
+    assert.deepEqual(commands.slice(-5),['disarmautonomous','disarmcoding','disarmprocess','disarmhost','park']);
+    assert.match(output.stdout,/DEADBYTE MCP DEVICE SESSION/i);
+    assert.match(output.stdout,/Live logs/i);
+  }finally{
+    if(child?.exitCode===null) child.kill();
+    await rm(fx.dir,{recursive:true,force:true});
+  }
+});
+
+winTest('bare remote rolls back authority and parks if one plane fails to arm',async()=>{
+  const fx=await fixture({failCommand:'armhost'});
+  try{
+    const child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['ignore','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined,'failed startup did not terminate');
+    assert.notEqual(ended.code,0);
+    const commands=await traceCommands(fx.trace);
+    assert.deepEqual(commands.slice(0,5),['start','armprocess','armcoding','armautonomous','armhost']);
+    assert.deepEqual(commands.slice(-5),['disarmautonomous','disarmcoding','disarmprocess','disarmhost','park']);
+    assert.doesNotMatch(output.stdout,/Live logs/i);
+  }finally{await rm(fx.dir,{recursive:true,force:true});}
+});
+
+winTest('bare remote recovers a stale crashed session before arming a new one',async()=>{
+  const fx=await fixture();
+  let child=null;
+  try{
+    const runtime=path.join(fx.state,'runtime');
+    await mkdir(runtime,{recursive:true});
+    await writeFile(path.join(runtime,'remote-session.json'),JSON.stringify({schema:'deadbyte.remote-session.v1',pid:2147483000,started_at_utc:'2026-01-01T00:00:00.000Z'}),'utf8');
+    child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    const ready=await waitFor(fx.trace,commands=>commands.includes('hoststatus'));
+    assert.deepEqual(ready.slice(0,5),['disarmautonomous','disarmcoding','disarmprocess','disarmhost','park']);
+    assert.equal(ready[5],'start');
+    child.stdin.end();
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined);
+    assert.equal(ended.code,0,output.stderr);
+  }finally{
+    if(child?.exitCode===null) child.kill();
+    await rm(fx.dir,{recursive:true,force:true});
+  }
+});
+
+winTest('bare remote refuses a second live foreground session without touching authority',async()=>{
+  const fx=await fixture();
+  let child=null;
+  try{
+    const runtime=path.join(fx.state,'runtime');
+    await mkdir(runtime,{recursive:true});
+    await writeFile(path.join(runtime,'remote-session.json'),JSON.stringify({schema:'deadbyte.remote-session.v1',pid:process.pid,started_at_utc:new Date().toISOString()}),'utf8');
+    child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    await sleep(500);
+    if(child.exitCode===null) child.stdin.end();
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined);
+    assert.notEqual(ended.code,0);
+    assert.deepEqual(await traceCommands(fx.trace),[]);
+    assert.match(output.stderr,/remote session already active/i);
+  }finally{
+    if(child?.exitCode===null) child.kill();
+    await rm(fx.dir,{recursive:true,force:true});
+  }
+});
+
+winTest('explicit remote status remains a one-shot controller command',async()=>{
+  const fx=await fixture();
+  try{
+    const child=spawn(process.execPath,[cliPath,'remote','status'],{env:fx.env,stdio:['ignore','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined);
+    assert.equal(ended.code,0,output.stderr);
+    assert.deepEqual(await traceCommands(fx.trace),['status']);
+  }finally{await rm(fx.dir,{recursive:true,force:true});}
+});