deadbyte-mcp 0.8.7

package/README.txt

@@ -0,0 +1,260 @@
+DEADBYTE MCP V0.8.7 / R33 FINAL MACHINE BASELINE
+=========================
+
+AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
+
+NPX PRIMARY OPERATOR UX
+------------------------
+Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
+
+  npx deadbyte-mcp@latest remote
+  npx deadbyte-mcp@latest remote status
+  npx deadbyte-mcp@latest remote restart
+  npx deadbyte-mcp@latest audit status
+  npx deadbyte-mcp@latest audit verify
+
+The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
+The legacy CMD file remains only as an R33 compatibility artifact until activation/rollback/restore
+proof confirms the npx path; it is not the primary operator interface. Audit data lives under the
+stable mutable state root and never inside immutable release slots.
+
+AUTHORITY MODEL
+---------------
+The original containment core remains five tools:
+
+  workspace_open
+  file_read
+  proof_execute
+  contained_transform
+  evidence_verify
+
+A configured host policy registers three additional tools:
+
+  host_file_read
+  host_file_write
+  host_exec
+
+Host registration does not arm host authority. Host calls require an explicit,
+policy-hash-bound standing grant until operator revocation. The normal final state is DISARMED.
+
+V0.8 adds an independently feature-gated durable agent surface:
+  agent_task_submit
+  agent_task_run
+  agent_task_status
+  agent_task_events
+  agent_task_cancel
+  agent_task_approve
+  agent_task_verify
+
+R23/R30 provide a separately granted 17-tool coding surface for inspect/edit/command/benchmark
+and durable coding tasks. Coding registration is not coding authority; mutating or
+executing calls require an explicit policy-bound standing coding grant.
+
+R24 adds a 12-tool autonomous surface for bounded goal execution, DEADBYTE Native Diff,
+model-driven diagnose/replan cycles, objective release gating, and signed release proof.
+Autonomous registration requires the coding surface, while execution requires both standing
+coding and autonomous grants. The model cannot create, widen, or renew either grant.
+
+R29 adds a four-tool machine identity surface: machine_list, machine_status, machine_ping,
+and machine_revoke. Machine identity is an Ed25519 public-key identity; machine_id is the
+SHA-256 of the exported SPKI bytes. Status/list expose that public SPKI so remote clients can
+verify signed pings without trusting the target machine's local key store. Revoke requires
+local host authority and advances identity generation plus online epoch without changing the key.
+
+The bridge accepts only complete combinations of base plus optional machine, host, agent,
+process, coding, machine-filesystem, observation, and autonomous surfaces. A fully enabled R33
+runtime has exactly 68 tools. Process authority is independently gated. Machine-filesystem and
+observation require the coding policy root set; autonomous requires the complete coding surface.
+Partial, dependency-invalid, unknown, or extra catalogs fail closed.
+
+STRICT OUTPUT CONTRACT
+----------------------
+R22.1 established strict object outputSchema contracts for the original 15 tools.
+R23/R30 apply the same contract to all 17 coding tools, R24 applies it to all
+12 autonomous tools, and R29 applies it to all four machine tools. The core validates structuredContent locally on success
+and error paths, and the HTTP Bridge
+preserves outputSchema at the public MCP edge. Unknown top-level output fields
+and missing required result fields fail closed.
+
+R22 AGENT TRUST
+---------------
+Agent plans are normalized and content-addressed before storage. Durable state is
+kept under .deadbyte-agent/tasks/<task-id> inside the selected workspace.
+
+The Ed25519 trust key authenticates separate domains for receipts, agent plans,
+agent events, and cancel requests. Recomputing SHA-256 or an event hash chain
+without the private key is not sufficient to forge agent state.
+Every event also remains in a canonical SHA-256 previous-hash journal. The
+signature and hash chain serve different purposes: signature authenticity and
+ordered tamper evidence.
+
+A completed task receives a signed task receipt bound to:
+
+  task id + plan SHA-256
+  journal head
+  package/protocol/runtime identity
+  successful underlying step receipts
+  approved checkpoints
+
+Executable R22 agent steps are still only proof_execute or fixed contained_transform
+operations. Agent orchestration does not create generic shell, executable, argv,
+environment, capability, Job-policy, or host-workspace authority.
+
+R23 CODING PLANE
+----------------
+The coding plane is explicit host-code authority, not AppContainer containment.
+A separate policy-hash-bound standing grant gates source writes and command execution
+until explicit operator revocation. Edits use absent/SHA-256 preconditions, exact
+replacement counts, atomic rename and post-commit hashing. Commands use policy-selected
+executable paths/hashes, script hashes, bounded argv/output/time, shell=false, and a
+small environment allowlist.
+
+Coding commands execute as the current host user; the child process is not a
+filesystem sandbox. The standing grant is therefore intentional coding authority.
+No coding tool creates or widens that grant. Benchmark observations record median,
+P95 and an explicit regression verdict. Coding actions and durable coding tasks
+are independently Ed25519 authenticated.
+
+R25 AUTONOMOUS PRODUCTION ENGINE
+--------------------------------
+A separate policy-hash-bound standing autonomous grant layers goal authority on top of
+the coding grant until explicit operator revocation. Goals are content-addressed and
+journaled with signed planner requests, decisions, Native Diff commits, profile
+observations, and release completion. Planner actions are limited to inspect, patch,
+run_profile, finish, or pause; commands and benchmarks come only from trusted profiles.
+
+DEADBYTE Native Diff uses exact SHA-256 preconditions, signed preimages, transaction
+rollback, conflict detection, and signed coding receipts without Git metadata.
+Required build/test/benchmark evidence is tied to the current mutation epoch. A
+planner finish request cannot bypass the objective release gate or Native HEAD
+verification. Public client-sampling mode uses authenticated MCP 2026-07-28 MRTR.
+There is no wall-clock goal timeout in the active R25 policy; iteration, mutation,
+context, diff-size, command, benchmark, no-progress, and explicit-cancel bounds remain.
+
+For drop-off operation, an `openai_compatible` policy starts the in-process autonomous
+supervisor at MCP boot and advances durable submitted goals without further client
+`autonomous_goal_run` calls. `client_sampling` instead uses the connected MCP client's
+model and persists every round so interrupted work can resume without losing state.
+R24 does not install or require Ollama or Git/GitHub for planning, diff, rollback, or
+release authority.
+
+R25 adds signed planner-contract rejection/self-repair, deterministic context compaction,
+and optional signed authoritative plan snapshots with completed-prefix invariants. Plan state
+coordinates work but never replaces Native Diff or current-epoch release evidence; hard guards
+block post-plan mutation and premature finish. See docs/V081-R25-MANUS-CONTROL-SEMANTICS.md.
+R27 IMMUTABLE RELEASE SLOTS
+---------------------------
+R27 replaces live-file activation with content-addressed immutable release slots and immutable
+controller/policy generations below %USERPROFILE%\.deadbyte-mcp. The operator-only updater verifies
+the exact package manifest, creates a generation whose coding/host core root is a separate mutable
+development tree, revokes coding/autonomous authority, stops only verified owned processes, then
+atomically commits active-release.json. The stable launcher verifies its own hash, every release
+manifest entry, every generation entry, and package identity before starting the controller.
+Failed activation restores the prior pointer/launcher/workspace state and restarts the known-good
+runtime. Host authority must be DISARMED; standing coding/autonomous grants return only with the
+explicit --restore-standing-grants flag. No MCP tool can invoke this path.
+See docs/V083-R27-IMMUTABLE-RELEASE-SLOTS.md. R26 src-swap behavior remains historical in
+docs/V082-R26-RUNTIME-SELF-UPDATE.md.
+
+R28 PERSISTENT NAMED TUNNEL
+---------------------------
+R28 removes Quick Tunnel hostname drift from the production path. The immutable release ships a
+small native tunnel host; the generated controller configuration pins the native host, exact
+cloudflared bytes, the external tunnel-token file, and one stable MCP URL file by SHA-256. The
+operator supplies a persistent HTTPS origin during v2 activation; the updater derives the full
+MCP URL from that origin plus the external MCP path token, writes it outside immutable release
+bytes, and binds its hash into the generation identity. The controller re-verifies that URL file
+before use and rejects trycloudflare for v2. The native host binds descendants to a kill-on-close
+Windows Job and fixes the local origin at 127.0.0.1:8787. Changing external transport inputs is a
+generation change; changing the native host is a release change. See
+`docs/V084-R28-PERSISTENT-NAMED-TUNNEL.md`.
+
+R29 MACHINE IDENTITY
+--------------------
+R29 gives each state root one persistent Ed25519 machine identity. The private key stays under
+%USERPROFILE%\.deadbyte-mcp\machine and is never returned by MCP. machine_status and machine_list
+publish the SPKI public key plus machine_id, identity generation, online epoch, release manifest,
+and generation manifest. machine_ping signs a caller nonce together with those bindings using a
+domain-separated Ed25519 message. A remote verifier derives SHA-256(SPKI) and verifies the ping
+without reading target-local identity files.
+
+machine_revoke is not a remote reset button: it is gated by the separately armed host authority.
+A successful revoke increments identity_generation and rotates online_epoch while preserving the
+public-key machine_id. Old signatures remain cryptographically valid evidence of the old epoch;
+they are stale relative to current status rather than retroactively invalid. Controller command
+`machinetest` performs a non-mutating public status/list/ping verification through HTTPS.
+See `docs/V085-R29-MACHINE-IDENTITY.md`.
+
+RECOVERY
+--------
+A task lock prevents concurrent runners. After an interrupted runtime, R22 does
+not infer success from an output file alone. It adopts a completed side effect
+only when the expected signed underlying receipt independently verifies and is
+bound to the expected operation/output. Otherwise it retries, pauses, or fails
+closed according to the observed evidence.
+
+Checkpoint approval never automatically executes the following step.
+CONTROLLER
+----------
+Primary operator entry point:
+
+  npx deadbyte-mcp@latest remote
+
+The legacy CMD entry remains compatibility-only for R33 rollback safety.
+
+AgentRuntimeEnabled, CodingRuntimeEnabled, and AutonomousRuntimeEnabled are trusted
+boolean controller settings. The controller injects feature flags/policies only into
+the Bridge child and restores its own environment after spawn. Coding and autonomous
+authority use separate standing grants: `armcoding` and `armautonomous` enable them until
+explicit revoke; `disarmcoding` also revokes autonomous authority immediately. No timer
+maintenance is required.
+
+Closing the menu is not STOP. Lifecycle state is derived from verified process
+identity plus readiness and remains OFFLINE, PARKED, ONLINE, or DEGRADED.
+
+TARGET GATE
+-----------
+On the Windows target machine:
+
+  npm ci
+  npm run gate:windows
+
+The Windows gate runs source tests, core MCP smoke, dedicated agent/coding/autonomous
+smokes, tunnel startup-probe compatibility, host-plane fail-closed smoke, native MSVC
+build, authority checks, AppContainer containment, active network denial,
+fixed contained operations, replay/challenge checks, and independent signed evidence
+verification.
+PUBLIC FULL GATE
+----------------
+The controller fulltest uses the public modern MCP path and verifies proof,
+contained AppContainer execution, and—when enabled—a two-step durable agent task
+plus its signed task receipt. The local canonical three-operation contained gate
+runs afterward against the same native build.
+
+TRUST BOUNDARY
+--------------
+The private Ed25519 key must remain outside task workspaces. Signed evidence does
+not prove which physical machine executed the operation and does not survive a
+fully compromised trusted host. Workspace write access can still cause local
+availability loss; signatures prevent unauthenticated state from being promoted
+into authenticated task history, not arbitrary local file deletion.
+
+See:
+
+  docs/ARCHITECTURE.md
+  docs/TRUST.md
+  docs/V080-AGENT-RUNTIME.md
+  docs/V080-R23-CODING-AGENT.md
+  docs/V080-R24-AUTONOMOUS-PRODUCTION.md
+  docs/V081-R25-MANUS-CONTROL-SEMANTICS.md
+  docs/V082-R26-RUNTIME-SELF-UPDATE.md
+  docs/V083-R27-IMMUTABLE-RELEASE-SLOTS.md
+  docs/V084-R28-PERSISTENT-NAMED-TUNNEL.md
+  docs/V085-R29-MACHINE-IDENTITY.md
+  docs/R221-STRICT-OUTPUT-CONTRACT.md
+  docs/V071-HOST-PLANE.md
+  docs/V073-TUNNEL-STDIO-COMPAT.md
+
+NO RAW SHELL COMMAND STRING. NO CALLER-SELECTED EXECUTABLE. CODING AND AUTONOMOUS
+EXECUTION REQUIRE EXPLICIT LOCAL STANDING GRANTS. REPORTS ARE CLAIMS; VERIFIED
+OBSERVATIONS AND SIGNED EVIDENCE ARE AUTHORITY.

package/bin/WORKER-REGISTRY.txt

@@ -0,0 +1,12 @@
+schema=deadbyte.worker-registry.v1
+version=0.6.0
+policy=compile-time-operation-to-executable
+launcher.executable=deadbyte-exec.exe
+launcher.sha256=18e8f071deb2ff95028b77e49679a6329121860c6ed61a753d3e1fdd31f69180
+operation.lowercase_ascii=contained-transform-v1
+operation.reverse_bytes=contained-reverse-v1
+operation.uppercase_ascii=contained-transform-v1
+worker.contained-reverse-v1.executable=contained-reverse-worker.exe
+worker.contained-reverse-v1.sha256=0ec64e0fd1ae66de894b9ebf9fec9404066b77abd0f7cadaf9514fb938db679c
+worker.contained-transform-v1.executable=contained-transform-worker.exe
+worker.contained-transform-v1.sha256=d51c3cb3ed1f0e4ce4ca066288786f8fe4338588ea6b8e9f0a1a8cb5b5f33a20

package/controller/DEADBYTE-MCP.cmd

@@ -0,0 +1,5 @@
+@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+set "HERE=%~dp0"
+powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%HERE%deadbyte-controller.ps1" %*
+exit /b %ERRORLEVEL%

package/controller/README.TXT

@@ -0,0 +1,127 @@
+DEADBYTE MCP V0.8.7 / R33 CONTROLLER
+====================================
+
+ENTRY POINT
+-----------
+Use only:
+
+  %USERPROFILE%\Downloads\DEADBYTE-MCP.cmd
+
+The package and controller launchers forward into the canonical controller root.
+A copied/misbound controller fails closed before creating command runtime state.
+
+CLOSING OR EXITING THE MENU DOES NOT STOP A STARTED RUNTIME.
+Only explicit park/stop/restart lifecycle commands mutate verified owned processes.
+
+STATE
+-----
+OFFLINE  bridge absent, cloud absent
+PARKED   bridge absent, cloud verified alive
+ONLINE   bridge verified alive, cloud verified alive, local readiness passes
+DEGRADED contradictory or unverified partial state
+
+State is derived from process identity + readiness. PID alone is never authority.
+OWNERSHIP
+---------
+runtime/*.instance.json binds each owned process to:
+
+  schema + component
+  256-bit instance nonce
+  PID
+  UTC creation time
+  executable path
+  executable SHA-256
+
+Stale, reused, mismatched, corrupt, or unobservable identities are never adopted
+or blindly killed.
+
+MACHINE IDENTITY
+----------------
+MachineRuntimeEnabled defaults to True. One persistent Ed25519 identity lives below the canonical
+DEADBYTE state root and survives release/generation activation. The controller forwards
+DEADBYTE_MACHINE_RUNTIME only to the Bridge child. Public `machine_status`/`machine_list` expose
+the identity public key and active release/generation binding; `machine_ping` returns a signed
+nonce proof. `machinetest` verifies the public SPKI-derived machine_id and Ed25519 signature over
+HTTPS without mutating authority. `machine_revoke` remains host-authority gated.
+
+AGENT RUNTIME
+-------------
+AgentRuntimeEnabled is a trusted boolean configuration field. Default in the
+example configuration is False. When True, the controller injects:
+
+  DEADBYTE_AGENT_RUNTIME=1
+
+only while spawning the Bridge child, then restores/removes the parent variable.
+Status and menu show Agent runtime : ENABLED or DISABLED.
+
+CODING PLANE
+------------
+CodingRuntimeEnabled is a separate trusted feature flag. CodingPolicyFile defines
+allowed project roots, denied paths, executable hashes and command budgets.
+Registration does not authorize mutation/execution.
+
+  armcoding      enable a policy-hash-bound standing coding grant
+  disarmcoding   revoke coding authority immediately
+  codingstatus   report configured/standing-grant/disarmed state
+  codingtest     run public edit + command + benchmark + durable task proof
+
+Coding commands are explicit host-code authority and are not AppContainer sandboxed.
+The standing grant remains active until explicit revoke; no timer maintenance is required.
+
+AUTONOMOUS PRODUCTION PLANE
+---------------------------
+AutonomousRuntimeEnabled requires CodingRuntimeEnabled. AutonomousPolicyFile binds the
+coding policy SHA-256, allowed roots, planner backend, iteration/mutation/resource
+budgets, and trusted build/test/benchmark/release profiles. The R27 generation rebinds
+policy digests and profile hashes to the explicit mutable development root; the release slot stays immutable.
+
+  armautonomous      require coding authority, then enable a standing autonomous grant
+  disarmautonomous   revoke autonomous authority immediately
+  autonomousstatus   report configured/standing-grant/coding-disarmed state
+  autonomoustest     run the 68-tool public catalog sampling MRTR production gate
+
+disarmcoding also revokes autonomous authority. No MCP tool creates or widens either
+grant. With an openai_compatible planner the MCP server starts a background supervisor;
+client_sampling uses the connected MCP client's model with durable resume state.
+
+R27 IMMUTABLE SLOT UPDATE
+-------------------------
+Use npm run self-update:runtime with exact --stage, --development-root, --expected-version, and
+--expected-manifest bindings. The updater is operator-only machinery, never an MCP capability.
+Release bytes are copied once into a content-addressed immutable slot; mutable workspace/runtime
+state and coding/host development authority live outside that slot. Coding/autonomous grants are
+revoked before verified stop and restored only with --restore-standing-grants. Activation is one
+atomic active-release.json replacement after the release, generation and launcher are verified.
+Rollback restores the prior pointer, launchers and workspace placement before restarting known-good.
+
+R28 PERSISTENT TRANSPORT
+------------------------
+The production Cloud component is the release-owned `deadbyte-tunnel-host.exe`, not a Quick Tunnel
+wrapper. The generation pins the exact cloudflared executable and external tunnel-token file by
+SHA-256 and pins one stable full MCP URL file. Controller start/status re-hash those dependencies
+and reject `*.trycloudflare.com` for the v2 transport. The native host launches cloudflared directly
+with `--token-file`, fixes the local origin at 127.0.0.1:8787, and owns descendants in a kill-on-close
+Windows Job. Transport updates do not arm host authority or widen coding/autonomous grants.
+
+HOST PLANE
+----------
+HostPolicyFile optionally configures registration of host_file_read,
+host_file_write, and host_exec. Registration is not authorization.
+
+  armhost      enable a policy-hash-bound standing host grant
+  disarmhost   revoke host authority immediately
+  hoststatus   report configured/standing-grant/disarmed state
+  hosttest     require active host authority and run the public host smoke
+
+The normal final state is DISARMED. host_exec accepts no raw shell command; local
+policy pins executable path/hash, root, script extension, timeout, and output budget.
+
+TEST VS FULLTEST
+----------------
+test uses the public modern MCP endpoint for proof + independent receipt verify.
+machinetest performs a non-mutating public machine status/list/ping gate and verifies
+SHA-256(SPKI) plus the Ed25519 ping signature. fulltest additionally runs public
+contained execution, and when agent mode is present it submits/runs/verifies a two-step
+durable agent task. It then runs the local canonical three-operation AppContainer/replay/evidence gate.
+
+The Windows native binaries must first pass npm run gate:windows.

package/controller/deadbyte-controller.config.psd1.example

@@ -0,0 +1,60 @@
+@{
+    Schema = 'deadbyte.controller.v1'
+    # Leave blank when controller/ is inside the package. Set explicitly when copied beside a bridge.
+    CoreRoot = ''
+    # Mutable workspace data may live outside an immutable release slot.
+    WorkspaceRoot = ''
+    # R29 machine identity/status/ping plane is enabled by default; revoke still requires host authority.
+    MachineRuntimeEnabled = $true
+    # Durable agent task surface is explicit opt-in. False preserves the legacy capability catalog.
+    AgentRuntimeEnabled = $false
+    # Interactive process plane is explicit opt-in with its own policy-bound standing grant.
+    ProcessRuntimeEnabled = $false
+    ProcessPolicyFile = ''
+    # Coding plane is a separate explicit opt-in with its own local lease and root/command policy.
+    CodingRuntimeEnabled = $false
+    # R31 machine filesystem reuses the coding policy and standing grant; no separate authority exists.
+    MachineFsRuntimeEnabled = $false
+    # R32 observation is read-only over registered roots/local runtime and never arms coding mutation authority.
+    ObservationRuntimeEnabled = $false
+    CodingPolicyFile = ''
+    # Autonomous production loop is another explicit opt-in and requires the coding plane.
+    AutonomousRuntimeEnabled = $false
+    AutonomousPolicyFile = ''
+    # Optional privileged host plane policy. Empty keeps host read/write/exec unregistered.
+    HostPolicyFile = ''
+
+    # These are TRUSTED LOCAL launch specifications, never MCP-callable input.
+    # Point each spec at the actual long-lived executable. Avoid npm.cmd/cmd.exe wrappers.
+    Bridge = @{
+        FilePath = 'C:\Program Files\nodejs\node.exe'
+        FileSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+        Arguments = 'src\bridge.mjs'
+        WorkingDirectory = 'C:\REPLACE\deadbyte-chatgpt-bridge'
+        # R27 pins the external bridge source as part of runtime identity.
+        ScriptPath = 'C:\REPLACE\deadbyte-chatgpt-bridge\src\bridge.mjs'
+        ScriptSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+    }
+    Cloud = @{
+        # R28 v2 launches this release-bound native host, not cloudflared directly.
+        FilePath = 'C:\REPLACE\release\bin\deadbyte-tunnel-host.exe'
+        FileSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+        Arguments = '"C:\REPLACE\cloudflared.exe" "C:\REPLACE\.deadbyte-mcp\secrets\cloudflare-tunnel.token" "C:\REPLACE\.deadbyte-mcp\bridge"'
+        WorkingDirectory = 'C:\REPLACE\release'
+        Transport = 'deadbyte.named-tunnel.v2'
+        Dependencies = @(
+            @{ Name = 'cloudflared'; Path = 'C:\REPLACE\cloudflared.exe'; Sha256 = '0000000000000000000000000000000000000000000000000000000000000000' }
+            @{ Name = 'tunnel-token'; Path = 'C:\REPLACE\.deadbyte-mcp\secrets\cloudflare-tunnel.token'; Sha256 = '0000000000000000000000000000000000000000000000000000000000000000' }
+        )
+    }
+
+    LocalReadyUri = 'http://127.0.0.1:8787/healthz'
+    # UrlRegex is legacy Quick-Tunnel discovery only; R28 v2 must not use it.
+    UrlRegex = ''
+    # R28 v2 uses a protected full endpoint file and binds its exact hash into the generation.
+    McpUrlFile = 'C:\REPLACE\.deadbyte-mcp\bridge\mcp-url.txt'
+    McpUrlFileSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+    McpPathFile = 'C:\REPLACE\.deadbyte-mcp\bridge\mcp-path.txt'
+    StartTimeoutSeconds = 30
+    ProbeTimeoutSeconds = 3
+}