deadbyte-mcp 0.8.7

package/src/machine-identity.mjs

@@ -0,0 +1,275 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomBytes,
+  sign as cryptoSign,
+  verify as cryptoVerify
+} from 'node:crypto';
+import { lstat, mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalJson } from './canonical-json.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+
+export const MACHINE_IDENTITY_SCHEMA = 'deadbyte.machine-identity.v1';
+export const MACHINE_PING_SCHEMA = 'deadbyte.machine-ping.v1';
+const MACHINE_PING_DOMAIN = Buffer.from('DEADBYTE-MACHINE-PING-V1\0', 'utf8');
+const HEX64 = /^[0-9a-f]{64}$/;
+
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const jsonBytes = value => Buffer.from(`${canonicalJson(value)}\n`, 'utf8');
+
+function machineDir(stateRoot) { return path.join(path.resolve(stateRoot), 'machine'); }
+function privatePath(stateRoot) { return path.join(machineDir(stateRoot), 'ed25519-private.pem'); }
+function publicPath(stateRoot) { return path.join(machineDir(stateRoot), 'ed25519-public.pem'); }
+function statePath(stateRoot) { return path.join(machineDir(stateRoot), 'identity.json'); }
+function initLockPath(stateRoot) { return path.join(machineDir(stateRoot), 'identity.init.lock'); }
+
+function publicKeySpki(publicKey) {
+  return Buffer.from(publicKey.export({ type: 'spki', format: 'der' }));
+}
+
+function machineId(publicKey) {
+  return sha256(publicKeySpki(publicKey));
+}
+
+async function assertRegular(file, label) {
+  const info = await lstat(file);
+  if (!info.isFile() || info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);
+  return info;
+}
+
+async function atomicJson(file, value) {
+  await mkdir(path.dirname(file), { recursive: true });
+  const temp = `${file}.tmp-${process.pid}-${randomBytes(6).toString('hex')}`;
+  let handle;
+  try {
+    handle = await open(temp, 'wx', 0o600);
+    await handle.writeFile(jsonBytes(value));
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temp, file);
+  } catch (error) {
+    if (handle) await handle.close().catch(() => {});
+    await rm(temp, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+async function loadIdentity(stateRoot) {
+  const privFile = privatePath(stateRoot);
+  const pubFile = publicPath(stateRoot);
+  const metaFile = statePath(stateRoot);
+  await assertRegular(privFile, 'machine private key');
+  await assertRegular(pubFile, 'machine public key');
+  await assertRegular(metaFile, 'machine identity state');
+  const privateKey = createPrivateKey(await readFile(privFile));
+  const publicKey = createPublicKey(await readFile(pubFile));
+  if (privateKey.asymmetricKeyType !== 'ed25519' || publicKey.asymmetricKeyType !== 'ed25519') throw new Error('machine identity keys must be Ed25519');
+  const derived = createPublicKey(privateKey);
+  const id = machineId(publicKey);
+  if (machineId(derived) !== id) throw new Error('machine private/public key mismatch');
+  const state = JSON.parse(await readFile(metaFile, 'utf8'));
+  if (state?.schema !== MACHINE_IDENTITY_SCHEMA || state.machine_id !== id) throw new Error('machine identity state mismatch');
+  if (!Number.isInteger(state.identity_generation) || state.identity_generation < 1) throw new Error('machine identity generation invalid');
+  return { state, privateKey, publicKey, machine_id: id, private_key_path: privFile, public_key_path: pubFile, state_path: metaFile };
+}
+
+async function acquireInitLock(stateRoot) {
+  const file = initLockPath(stateRoot);
+  for (let attempt = 0; attempt < 250; attempt++) {
+    try {
+      const handle = await open(file, 'wx', 0o600);
+      await handle.writeFile(`${process.pid}:${randomBytes(8).toString('hex')}\n`, 'utf8');
+      await handle.sync();
+      return { file, handle };
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      await new Promise(resolve => setTimeout(resolve, 10));
+    }
+  }
+  throw new Error('machine identity initialization lock remained busy');
+}
+
+async function writeOwnedExclusive(file, bytes, mode, owned) {
+  const handle = await open(file, 'wx', mode);
+  owned.push(file);
+  try {
+    await handle.writeFile(bytes);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+export async function initializeMachineIdentity({ stateRoot = path.join(os.homedir(), '.deadbyte-mcp') } = {}) {
+  const dir = machineDir(stateRoot);
+  await mkdir(dir, { recursive: true });
+  try {
+    const existing = await loadIdentity(stateRoot);
+    return { created: false, machine_id: existing.machine_id, identity_generation: existing.state.identity_generation,
+      public_key_path: existing.public_key_path };
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+
+  const lock = await acquireInitLock(stateRoot);
+  const owned = [];
+  try {
+    try {
+      const existing = await loadIdentity(stateRoot);
+      return { created: false, machine_id: existing.machine_id, identity_generation: existing.state.identity_generation,
+        public_key_path: existing.public_key_path };
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const id = machineId(publicKey);
+    const privateFile = privatePath(stateRoot);
+    const publicFile = publicPath(stateRoot);
+    const metaFile = statePath(stateRoot);
+    const createdAt = new Date().toISOString();
+    try {
+      await writeOwnedExclusive(privateFile, privateKey.export({ type: 'pkcs8', format: 'pem' }), 0o600, owned);
+      await writeOwnedExclusive(publicFile, publicKey.export({ type: 'spki', format: 'pem' }), 0o644, owned);
+      await writeOwnedExclusive(metaFile, jsonBytes({ schema: MACHINE_IDENTITY_SCHEMA, machine_id: id, identity_generation: 1,
+        created_at_utc: createdAt, updated_at_utc: createdAt }), 0o600, owned);
+      const observed = await loadIdentity(stateRoot);
+      return { created: true, machine_id: observed.machine_id, identity_generation: observed.state.identity_generation,
+        public_key_path: observed.public_key_path };
+    } catch (error) {
+      for (const file of owned.reverse()) await rm(file, { force: true }).catch(() => {});
+      throw error;
+    }
+  } finally {
+    await lock.handle.close().catch(() => {});
+    await rm(lock.file, { force: true }).catch(() => {});
+  }
+}
+async function readBinding(activePointerPath) {
+  const pointer = parseActivePointer(await readFile(path.resolve(activePointerPath), 'utf8'));
+  const releaseManifest = await readFile(path.join(pointer.release_root, 'MANIFEST.SHA256'));
+  const generationManifest = await readFile(path.join(pointer.generation_root, 'GENERATION.SHA256'));
+  if (sha256(releaseManifest) !== pointer.manifest_sha256) throw new Error('machine binding release manifest mismatch');
+  if (sha256(generationManifest) !== pointer.generation_manifest_sha256) throw new Error('machine binding generation manifest mismatch');
+  return pointer;
+}
+
+function capabilitySet() {
+  return ['machine_identity', 'machine_ping', 'machine_revoke'];
+}
+
+function statusBody(identity, pointer, onlineEpoch) {
+  return {
+    status: 'ok',
+    machine_id: identity.machine_id,
+    public_key_spki_base64: publicKeySpki(identity.publicKey).toString('base64'),
+    identity_generation: identity.state.identity_generation,
+    online_epoch: onlineEpoch,
+    hostname: os.hostname(),
+    platform: process.platform,
+    architecture: process.arch,
+    release_id: pointer.release_id,
+    release_manifest_sha256: pointer.manifest_sha256,
+    generation_manifest_sha256: pointer.generation_manifest_sha256,
+    capabilities: capabilitySet()
+  };
+}
+
+export async function createMachineRuntime({
+  stateRoot = path.join(os.homedir(), '.deadbyte-mcp'),
+  activePointerPath = path.join(stateRoot, 'active-release.json')
+} = {}) {
+  await initializeMachineIdentity({ stateRoot });
+  let identity = await loadIdentity(stateRoot);
+  let onlineEpoch = randomBytes(32).toString('hex');
+
+  async function status() {
+    identity = await loadIdentity(stateRoot);
+    const pointer = await readBinding(activePointerPath);
+    return statusBody(identity, pointer, onlineEpoch);
+  }
+
+  async function list() {
+    return { status: 'ok', machines: [await status()] };
+  }
+
+  async function ping({ nonce }) {
+    if (typeof nonce !== 'string' || nonce.length < 1 || nonce.length > 256 || nonce.includes('\0')) throw new Error('machine ping nonce must be 1-256 non-NUL characters');
+    const current = await status();
+    const body = {
+      schema: MACHINE_PING_SCHEMA,
+      machine_id: current.machine_id,
+      identity_generation: current.identity_generation,
+      online_epoch: current.online_epoch,
+      release_id: current.release_id,
+      release_manifest_sha256: current.release_manifest_sha256,
+      generation_manifest_sha256: current.generation_manifest_sha256,
+      nonce,
+      observed_at_utc: new Date().toISOString()
+    };
+    const bytes = Buffer.from(canonicalJson(body), 'utf8');
+    const signature = cryptoSign(null, Buffer.concat([MACHINE_PING_DOMAIN, bytes]), identity.privateKey);
+    return {
+      status: 'ok',
+      ...body,
+      attestation: { algorithm: 'ed25519', key_id: identity.machine_id, signature_base64: signature.toString('base64') }
+    };
+  }
+
+  async function revoke({ reason }) {
+    if (typeof reason !== 'string' || reason.length < 1 || reason.length > 256 || reason.includes('\0')) throw new Error('machine revoke reason must be 1-256 non-NUL characters');
+    identity = await loadIdentity(stateRoot);
+    const previous = identity.state.identity_generation;
+    const next = {
+      ...identity.state,
+      identity_generation: previous + 1,
+      updated_at_utc: new Date().toISOString(),
+      last_revoke_reason: reason
+    };
+    await atomicJson(identity.state_path, next);
+    identity = await loadIdentity(stateRoot);
+    onlineEpoch = randomBytes(32).toString('hex');
+    return { status: 'revoked', machine_id: identity.machine_id, previous_identity_generation: previous,
+      identity_generation: identity.state.identity_generation, online_epoch: onlineEpoch };
+  }
+
+  return Object.freeze({ list, status, ping, revoke });
+}
+
+export async function verifyMachinePingPublic({ ping, publicKeySpkiBase64 }) {
+  try {
+    if (!ping || ping.status !== 'ok' || ping.schema !== MACHINE_PING_SCHEMA) return false;
+    if (!HEX64.test(ping.machine_id ?? '') || !HEX64.test(ping.online_epoch ?? '') || !HEX64.test(ping.release_manifest_sha256 ?? '') || !HEX64.test(ping.generation_manifest_sha256 ?? '')) return false;
+    if (!Number.isInteger(ping.identity_generation) || ping.identity_generation < 1) return false;
+    if (typeof publicKeySpkiBase64 !== 'string' || publicKeySpkiBase64.length < 1 || publicKeySpkiBase64.length > 256) return false;
+    const publicKeyBytes = Buffer.from(publicKeySpkiBase64, 'base64');
+    if (publicKeyBytes.length < 1 || publicKeyBytes.toString('base64') !== publicKeySpkiBase64) return false;
+    const publicKey = createPublicKey({ key: publicKeyBytes, format: 'der', type: 'spki' });
+    if (publicKey.asymmetricKeyType !== 'ed25519' || machineId(publicKey) !== ping.machine_id) return false;
+    if (ping.attestation?.algorithm !== 'ed25519' || ping.attestation.key_id !== ping.machine_id || typeof ping.attestation.signature_base64 !== 'string') return false;
+    const signature = Buffer.from(ping.attestation.signature_base64, 'base64');
+    if (signature.length !== 64 || signature.toString('base64') !== ping.attestation.signature_base64) return false;
+    const { status: _status, attestation: _attestation, ...body } = ping;
+    const bytes = Buffer.from(canonicalJson(body), 'utf8');
+    return cryptoVerify(null, Buffer.concat([MACHINE_PING_DOMAIN, bytes]), publicKey, signature);
+  } catch {
+    return false;
+  }
+}
+
+export async function verifyMachinePing({ stateRoot = path.join(os.homedir(), '.deadbyte-mcp'), ping }) {
+  try {
+    const identity = await loadIdentity(stateRoot);
+    return verifyMachinePingPublic({
+      ping,
+      publicKeySpkiBase64: publicKeySpki(identity.publicKey).toString('base64')
+    });
+  } catch {
+    return false;
+  }
+}

package/src/machine-mcp-tools.mjs

@@ -0,0 +1,43 @@
+import * as z from 'zod/v4';
+import {
+  machineListOutputSchema,
+  machinePingOutputSchema,
+  machineRevokeOutputSchema,
+  machineStatusOutputSchema,
+  machineStructuredResult
+} from './machine-output-contracts.mjs';
+
+function ok(schema, value) { return machineStructuredResult(schema, value, false); }
+function fail(schema, status, error) { return machineStructuredResult(schema, { status, error: String(error) }, true); }
+
+export function registerMachineTools(server, { runtime, assertRevokeAuthority }) {
+  if (!server || !runtime) throw new Error('machine tool registration requires server/runtime');
+  if (typeof assertRevokeAuthority !== 'function') throw new Error('machine revoke authority callback required');
+
+  server.registerTool('machine_list', {
+    description: 'List DEADBYTE machine identities visible to this runtime. Identity is public-key based; hostname is informational.',
+    inputSchema: z.strictObject({}), outputSchema: machineListOutputSchema
+  }, async () => { try { return ok(machineListOutputSchema, await runtime.list()); } catch (error) { return fail(machineListOutputSchema, 'failed', error); } });
+
+  server.registerTool('machine_status', {
+    description: 'Read this machine identity, online epoch, active release/generation binding, and capability set.',
+    inputSchema: z.strictObject({}), outputSchema: machineStatusOutputSchema
+  }, async () => { try { return ok(machineStatusOutputSchema, await runtime.status()); } catch (error) { return fail(machineStatusOutputSchema, 'failed', error); } });
+
+  server.registerTool('machine_ping', {
+    description: 'Return an Ed25519-signed nonce echo bound to machine identity, online epoch, release, and generation.',
+    inputSchema: z.strictObject({ nonce: z.string().min(1).max(256) }), outputSchema: machinePingOutputSchema
+  }, async ({ nonce }) => { try { return ok(machinePingOutputSchema, await runtime.ping({ nonce })); } catch (error) { return fail(machinePingOutputSchema, 'failed', error); } });
+
+  server.registerTool('machine_revoke', {
+    description: 'Invalidate the current machine online epoch/generation. Requires independently armed local host authority and never expands authority.',
+    inputSchema: z.strictObject({ reason: z.string().min(1).max(256) }), outputSchema: machineRevokeOutputSchema
+  }, async ({ reason }) => {
+    try {
+      await assertRevokeAuthority();
+      return ok(machineRevokeOutputSchema, await runtime.revoke({ reason }));
+    } catch (error) {
+      return fail(machineRevokeOutputSchema, 'denied', error);
+    }
+  });
+}

package/src/machine-output-contracts.mjs

@@ -0,0 +1,58 @@
+import * as z from 'zod/v4';
+import { structuredToolResult } from './output-contracts.mjs';
+
+const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
+const machineStatusFields = {
+  machine_id: hex64.optional(), public_key_spki_base64: z.string().min(1).max(256).optional(),
+  identity_generation: z.number().int().min(1).optional(), online_epoch: hex64.optional(),
+  hostname: z.string().min(1).max(255).optional(), platform: z.string().min(1).max(32).optional(),
+  architecture: z.string().min(1).max(32).optional(), release_id: z.string().min(1).max(128).optional(),
+  release_manifest_sha256: hex64.optional(), generation_manifest_sha256: hex64.optional(),
+  capabilities: z.array(z.string().min(1).max(64)).max(64).optional()
+};
+const statusRequired = Object.keys(machineStatusFields);
+
+function requireFields(value, ctx, fields) {
+  for (const field of fields) if (value[field] === undefined) ctx.addIssue({ code: 'custom', path: [field], message: `${field} required` });
+}
+
+export const machineStatusRecordSchema = z.strictObject({ status: z.literal('ok'), ...Object.fromEntries(Object.entries(machineStatusFields).map(([k,v]) => [k, v.unwrap ? v.unwrap() : v])) });
+
+export const machineStatusOutputSchema = z.strictObject({ status: z.enum(['ok', 'failed']), error: z.string().optional(), ...machineStatusFields })
+  .superRefine((value, ctx) => {
+    if (value.status === 'failed') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
+    if (value.error !== undefined) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error invalid for ok' });
+    requireFields(value, ctx, statusRequired);
+  });
+
+export const machineListOutputSchema = z.strictObject({
+  status: z.enum(['ok', 'failed']), error: z.string().optional(), machines: z.array(machineStatusRecordSchema).min(1).max(64).optional()
+}).superRefine((value, ctx) => {
+  if (value.status === 'failed') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
+  if (value.error !== undefined) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error invalid for ok' });
+  requireFields(value, ctx, ['machines']);
+});
+
+const attestation = z.strictObject({ algorithm: z.literal('ed25519'), key_id: hex64, signature_base64: z.string().min(1) });
+export const machinePingOutputSchema = z.strictObject({
+  status: z.enum(['ok','failed']), error: z.string().optional(), schema: z.literal('deadbyte.machine-ping.v1').optional(),
+  machine_id: hex64.optional(), identity_generation: z.number().int().min(1).optional(), online_epoch: hex64.optional(),
+  release_id: z.string().min(1).max(128).optional(), release_manifest_sha256: hex64.optional(),
+  generation_manifest_sha256: hex64.optional(), nonce: z.string().min(1).max(256).optional(),
+  observed_at_utc: z.string().min(1).max(64).optional(), attestation: attestation.optional()
+}).superRefine((value, ctx) => {
+  if (value.status === 'failed') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
+  if (value.error !== undefined) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error invalid for ok' });
+  requireFields(value, ctx, ['schema','machine_id','identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256','nonce','observed_at_utc','attestation']);
+});
+
+export const machineRevokeOutputSchema = z.strictObject({
+  status: z.enum(['revoked','denied']), error: z.string().optional(), machine_id: hex64.optional(),
+  previous_identity_generation: z.number().int().min(1).optional(), identity_generation: z.number().int().min(2).optional(), online_epoch: hex64.optional()
+}).superRefine((value, ctx) => {
+  if (value.status === 'denied') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
+  if (value.error !== undefined) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error invalid for revoked' });
+  requireFields(value, ctx, ['machine_id','previous_identity_generation','identity_generation','online_epoch']);
+});
+
+export function machineStructuredResult(schema, value, isError = false) { return structuredToolResult(schema, value, isError); }

package/src/mcp-contained-smoke-client.mjs

@@ -0,0 +1,139 @@
+import { copyFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from './trust.mjs';
+
+const repoRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const workspaceRoot = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-mcp-contained-workspaces-'));
+try {
+  const demoRoot = path.join(workspaceRoot, 'demo');
+  await mkdir(demoRoot, { recursive: true });
+  await copyFile(path.join(repoRoot, 'workspaces', 'demo', 'input.txt'), path.join(demoRoot, 'input.txt'));
+} catch (error) {
+  await rm(workspaceRoot, { recursive: true, force: true }).catch(() => {});
+  throw error;
+}
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-v04-mcp-contained-trust-'));
+const keys = await generateTrustKeypair({
+  privateKeyPath: path.join(trust, 'private.pem'),
+  publicKeyPath: path.join(trust, 'public.pem')
+});
+
+const client = new Client(
+  { name: 'deadbyte-mcp-contained-smoke', version: '0.8.0' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [serverPath],
+  cwd: repoRoot,
+  env: {
+    ...getDefaultEnvironment(),
+    DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+    DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY: keys.publicKeyPath
+  },
+  stderr: 'pipe'
+});
+const cases = [
+  ['uppercase_ascii', '3e740f6fcf2c6659bc5f99e0706b09f3c127407bbabe74d05285d2e3276946c2'],
+  ['lowercase_ascii', '8f3be3d122218dc1663c2fd4ea72e6634a7bd624b3ce18f178312cbe78aae78c'],
+  ['reverse_bytes', 'dbba1e2133ea799e500f5b3056734e6db3712e63b277835999c9cd6c5cf5d520']
+];
+const serverStderr = [];
+transport.stderr?.on('data', chunk => serverStderr.push(Buffer.from(chunk)));
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+
+try {
+  await client.connect(transport);
+  if (client.getProtocolEra() !== 'modern') throw new Error('expected modern MCP protocol era');
+
+  const results = [];
+  const invocationChallenges = new Set();
+  for (const [operation, expectedOutputSha256] of cases) {
+    const output = `mcp-contained.${operation}.${randomBytes(8).toString('hex')}.txt`;
+    const execution = structured(await client.callTool({
+      name: 'contained_transform',
+      arguments: { workspace_id: 'demo', input: 'input.txt', output, operation }
+    }), 'contained_transform');
+    if (execution.status !== 'passed' || execution.operation !== operation ||
+        execution.containment?.job_assignment !== 'atomic-attribute') {
+      throw new Error(`${operation} malformed result: ${JSON.stringify(execution)}`);
+    }
+    if (execution.output_sha256 !== expectedOutputSha256) {
+      throw new Error(`${operation} output hash mismatch: ${execution.output_sha256}`);
+    }
+    const verify = structured(await client.callTool({
+      name: 'evidence_verify',
+      arguments: { workspace_id: 'demo', receipt_path: execution.receipt_path }
+    }), 'evidence_verify');
+    if (verify.ok !== true || verify.signature_valid !== true || verify.containment_verified !== true || verify.active_network_denial_verified !== true ||
+        verify.receipt_schema !== 'deadbyte.receipt.v2' || verify.request_sha256 !== execution.request_sha256 ||
+        !/^[0-9a-f]{64}$/.test(verify.runtime_instance_nonce)) {
+      throw new Error(`${operation} receipt verification failed: ${JSON.stringify(verify)}`);
+    }
+    if (execution.containment?.network_policy !== 'zero-capabilities-plus-active-loopback-denial' ||
+        execution.containment?.network_probe_host_control_ok !== true ||
+        execution.containment?.active_network_denial_ok !== true ||
+        execution.containment?.proof?.network_connect_succeeded !== false ||
+        !(execution.containment?.proof?.network_connect_error > 0)) {
+      throw new Error(`${operation} active network-denial evidence missing`);
+    }
+    if (execution.containment?.invocation_schema !== 'deadbyte.invocation.v1' ||
+        !/^[0-9a-f]{64}$/.test(execution.containment?.invocation_challenge) ||
+        !/^[0-9a-f]{64}$/.test(execution.containment?.invocation_request_sha256)) {
+      throw new Error(`${operation} invocation evidence missing`);
+    }
+    if (invocationChallenges.has(execution.containment.invocation_challenge)) throw new Error('invocation challenge replay/collision observed');
+    invocationChallenges.add(execution.containment.invocation_challenge);
+    results.push({ operation, output, receipt_path: execution.receipt_path,
+      receipt_sha256: execution.receipt_sha256, request_sha256: execution.request_sha256, worker_id: execution.worker_id,
+      worker_sha256: execution.worker_sha256, output_sha256: execution.output_sha256,
+      containment: execution.containment, independent_verify: true });
+  }
+
+  const firstUpper = results.find(item => item.operation === 'uppercase_ascii');
+  const replayOutput = `mcp-contained.replay-probe.${randomBytes(8).toString('hex')}.txt`;
+  const replayExecution = structured(await client.callTool({
+    name: 'contained_transform',
+    arguments: { workspace_id: 'demo', input: 'input.txt', output: replayOutput, operation: 'uppercase_ascii' }
+  }), 'contained_transform replay probe');
+  const replayVerify = structured(await client.callTool({
+    name: 'evidence_verify', arguments: { workspace_id: 'demo', receipt_path: replayExecution.receipt_path }
+  }), 'evidence_verify replay probe');
+  if (replayVerify.ok !== true || replayVerify.signature_valid !== true || replayVerify.containment_verified !== true || replayVerify.active_network_denial_verified !== true) throw new Error('MCP same-operation replay probe verification failed');
+  if (replayExecution.output_sha256 !== cases[0][1]) throw new Error('MCP same-operation replay probe output hash mismatch');
+  if (replayExecution.containment?.invocation_challenge === firstUpper?.containment?.invocation_challenge) throw new Error('MCP same-operation invocation challenge was reused');
+  if (replayExecution.containment?.invocation_request_sha256 === firstUpper?.containment?.invocation_request_sha256) throw new Error('MCP same-operation invocation request digest was reused');
+  if (replayExecution.request_sha256 === firstUpper?.request_sha256) throw new Error('MCP same-operation signed request identity was reused');
+
+  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28',
+    protocol_era: 'modern', tool: 'contained_transform', operations: results, replay_probe: {
+      operation: 'uppercase_ascii', same_input: true, same_output_sha256: true,
+      first_challenge: firstUpper?.containment?.invocation_challenge,
+      second_challenge: replayExecution.containment?.invocation_challenge,
+      first_request_sha256: firstUpper?.containment?.invocation_request_sha256,
+      second_request_sha256: replayExecution.containment?.invocation_request_sha256,
+      first_receipt_request_sha256: firstUpper?.request_sha256, second_receipt_request_sha256: replayExecution.request_sha256,
+      distinct_challenge: true, distinct_request_sha256: true, distinct_receipt_request_sha256: true, independent_verify: true
+    } }, null, 2));
+} catch (error) {
+  const stderr = Buffer.concat(serverStderr).toString('utf8').trim();
+  if (stderr) console.error(`server stderr:\n${stderr}`);
+  console.error(error instanceof Error ? error.stack : String(error));
+  process.exitCode = 1;
+} finally {
+  await client.close().catch(() => {});
+  await rm(trust, { recursive: true, force: true }).catch(() => {});
+  await rm(workspaceRoot, { recursive: true, force: true }).catch(() => {});
+}

package/src/mcp-host-smoke-client.mjs

@@ -0,0 +1,136 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from './trust.mjs';
+
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const temp = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-mcp-host-smoke-'));
+const hostRoot = path.join(temp, 'host-root');
+const armFile = path.join(temp, 'host-arm.json');
+const policyPath = path.join(temp, 'host-policy.json');
+const trustDir = path.join(temp, 'trust');
+await mkdir(hostRoot, { recursive: true });
+await mkdir(trustDir, { recursive: true });
+const keys = await generateTrustKeypair({
+  privateKeyPath: path.join(trustDir, 'private.pem'),
+  publicKeyPath: path.join(trustDir, 'public.pem')
+});
+
+const executableSha256 = sha256(await readFile(process.execPath));
+const policy = {
+  schema: 'deadbyte.host-policy.v1',
+  enabled: true,
+  arm_file: armFile,
+  max_read_bytes: 262144,
+  max_write_bytes: 1048576,
+  roots: { smoke: { path: hostRoot, read: true, write: true, exec: true } },
+  commands: {
+    node_script: {
+      kind: 'script',
+      executable: process.execPath,
+      executable_sha256: executableSha256,
+      root_ids: ['smoke'],
+      prefix_args: [],
+      extensions: ['.mjs'],
+      timeout_ms: 5000,
+      max_output_bytes: 65536
+    }
+  }
+};
+const policyBytes = Buffer.from(`${JSON.stringify(policy, null, 2)}\n`, 'utf8');
+await writeFile(policyPath, policyBytes);
+const policySha256 = sha256(policyBytes);
+await writeFile(armFile, `${JSON.stringify({
+  schema: 'deadbyte.host-arm.v1',
+  policy_sha256: policySha256,
+  instance_nonce: randomBytes(32).toString('hex'),
+  armed_at_utc: new Date().toISOString(),
+  expires_at_utc: new Date(Date.now() + 60_000).toISOString()
+}, null, 2)}\n`, 'utf8');
+
+const client = new Client(
+  { name: 'deadbyte-mcp-host-smoke', version: '0.8.0' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [serverPath],
+  cwd: repoRoot,
+  env: {
+    ...getDefaultEnvironment(),
+    DEADBYTE_WORKSPACE_ROOT: path.join(repoRoot, 'workspaces'),
+    DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY: policyPath
+  },
+  stderr: 'pipe'
+});
+const stderr = [];
+transport.stderr?.on('data', chunk => stderr.push(Buffer.from(chunk)));
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+
+try {
+  await client.connect(transport);
+  const names = (await client.listTools()).tools.map(t => t.name).sort();
+  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'workspace_open'];
+  if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`privileged catalog mismatch: ${JSON.stringify(names)}`);
+
+  const writeText = structured(await client.callTool({
+    name: 'host_file_write',
+    arguments: { root_id: 'smoke', path: 'hello.txt', content: 'HOST PLANE\n', encoding: 'utf8', expected_sha256: 'absent' }
+  }), 'host_file_write text');
+  if (writeText.status !== 'committed' || !/^[0-9a-f]{64}$/.test(writeText.sha256)) throw new Error('host_file_write result malformed');
+
+  const readText = structured(await client.callTool({
+    name: 'host_file_read', arguments: { root_id: 'smoke', path: 'hello.txt', encoding: 'utf8' }
+  }), 'host_file_read');
+  if (readText.text !== undefined) throw new Error('host_file_read leaked legacy text field');
+  if (readText.content !== 'HOST PLANE\n' || readText.sha256 !== writeText.sha256) throw new Error('host_file_read result mismatch');
+
+  const script = 'console.log("HOST_EXEC_OK:" + process.argv.slice(2).join(","));\n';
+  const scriptHash = sha256(Buffer.from(script, 'utf8'));
+  const writeScript = structured(await client.callTool({
+    name: 'host_file_write',
+    arguments: { root_id: 'smoke', path: 'run.mjs', content: script, encoding: 'utf8', expected_sha256: 'absent' }
+  }), 'host_file_write script');
+  if (writeScript.sha256 !== scriptHash) throw new Error('script write digest mismatch');
+
+  const exec = structured(await client.callTool({
+    name: 'host_exec',
+    arguments: { command_id: 'node_script', root_id: 'smoke', script_path: 'run.mjs', script_sha256: scriptHash, args: ['A', 'B'], cwd: '.', timeout_ms: 3000 }
+  }), 'host_exec');
+  if (exec.status !== 'passed' || exec.exit_code !== 0 || exec.stdout.trim() !== 'HOST_EXEC_OK:A,B') throw new Error(`host_exec mismatch: ${JSON.stringify(exec)}`);
+
+  await rm(armFile, { force: true });
+  const denied = await client.callTool({ name: 'host_file_read', arguments: { root_id: 'smoke', path: 'hello.txt', encoding: 'utf8' } });
+  if (denied.isError !== true || denied.structuredContent?.status !== 'denied') throw new Error('disarmed host plane unexpectedly accepted a request');
+
+  console.log(JSON.stringify({
+    status: 'passed',
+    protocol_revision: '2026-07-28',
+    tools: names,
+    policy_sha256: policySha256,
+    write_sha256: writeText.sha256,
+    exec_script_sha256: scriptHash,
+    disarm_fail_closed: true
+  }, null, 2));
+} catch (error) {
+  const text = Buffer.concat(stderr).toString('utf8').trim();
+  if (text) console.error(`server stderr:\n${text}`);
+  throw error;
+} finally {
+  await client.close().catch(() => {});
+  await rm(temp, { recursive: true, force: true }).catch(() => {});
+}