deadbyte-mcp 0.8.7

package/src/remote-mcp-autonomous-smoke-client.mjs

@@ -0,0 +1,138 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { R33_EXPECTED_TOOLS } from './remote-mcp-r33-parity-client.mjs';
+
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-autonomous-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('autonomous remote gate requires HTTPS');
+const here = path.dirname(fileURLToPath(import.meta.url));
+const coreRoot = path.resolve(here, '..');
+const fixtureRelative = 'workspaces/autonomous-live/fixture.txt';
+const fixtureAbsolute = path.join(coreRoot, ...fixtureRelative.split('/'));
+const expectedFinal = 'READY\n';
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+function messageText(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) return content.map(messageText).join('\n');
+  if (content && typeof content === 'object') {
+    if (content.type === 'text' && typeof content.text === 'string') return content.text;
+    if (typeof content.text === 'string') return content.text;
+  }
+  return '';
+}
+function parseState(prompt) {
+  const marker = '\nSTATE=';
+  const start = prompt.indexOf(marker);
+  if (start < 0) throw new Error('planner prompt missing STATE marker');
+  const tail = prompt.slice(start + marker.length);
+  const end = tail.indexOf('\nExample shape:');
+  return JSON.parse(end >= 0 ? tail.slice(0, end) : tail);
+}
+function latestFixtureContext(state) {
+  return [...(state.contexts ?? [])].reverse().find(item => item.path === fixtureRelative) ?? null;
+}
+function latestTestObservation(state) {
+  return [...(state.observations ?? [])].reverse().find(item => item.profile_id === 'quick-test') ?? null;
+}let samplingRounds = 0;
+let sawFailureEvidence = false;
+function plannerDecision(prompt) {
+  const state = parseState(prompt);
+  samplingRounds += 1;
+  const context = latestFixtureContext(state);
+  const testObservation = latestTestObservation(state);
+  if (testObservation?.passed === false) sawFailureEvidence = true;
+  if (!context) return { schema:'deadbyte.autonomous-decision.v1', action:'inspect', summary:'inspect live fixture before mutation',
+    reads:[{ path:fixtureRelative, max_bytes:4096 }] };
+  if (state.mutation_epoch === 0 && context.content === expectedFinal) {
+    return { schema:'deadbyte.autonomous-decision.v1', action:'patch', summary:'deliberately introduce a failing state to prove diagnosis and replanning',
+      operations:[{ kind:'replace', path:fixtureRelative, expected_sha256:context.sha256,
+        old_string:'READY', new_string:'ALMOST', expected_replacements:1 }] };
+  }
+  if (state.mutation_epoch === 1 && context.content !== 'ALMOST\n') {
+    return { schema:'deadbyte.autonomous-decision.v1', action:'inspect', summary:'refresh fixture after observed test failure before corrective patch',
+      reads:[{ path:fixtureRelative, max_bytes:4096 }] };
+  }
+  if (state.mutation_epoch === 1 && context.content === 'ALMOST\n' && sawFailureEvidence) {
+    return { schema:'deadbyte.autonomous-decision.v1', action:'patch', summary:'repair the diagnosed fixture failure using the refreshed SHA precondition',
+      operations:[{ kind:'replace', path:fixtureRelative, expected_sha256:context.sha256,
+        old_string:'ALMOST', new_string:'READY', expected_replacements:1 }] };
+  }
+  if (state.mutation_epoch >= 2 && testObservation?.passed === true) {
+    return { schema:'deadbyte.autonomous-decision.v1', action:'finish', summary:'acceptance restored and current-epoch quick test evidence passes' };
+  }
+  return { schema:'deadbyte.autonomous-decision.v1', action:'inspect', summary:'gather current fixture state before deciding next action',
+    reads:[{ path:fixtureRelative, max_bytes:4096 }] };
+}const client = new Client(
+  { name:'deadbyte-r24-public-autonomous-gate', version:'0.8.0' },
+  { capabilities:{ sampling:{} }, versionNegotiation:{ mode:{ pin:'2026-07-28' } },
+    inputRequired:{ autoFulfill:true, maxRounds:16 } }
+);
+client.setRequestHandler('sampling/createMessage', async request => {
+  const prompt = (request.params.messages ?? []).map(item => messageText(item.content)).join('\n');
+  const decision = plannerDecision(prompt);
+  return { model:'deadbyte-r24-deterministic-live-model', role:'assistant',
+    content:{ type:'text', text:JSON.stringify(decision) } };
+});
+const transport = new StreamableHTTPClientTransport(endpoint);
+const tag = randomBytes(10).toString('hex');
+let goalId = null;
+try {
+  await client.connect(transport);
+  const listed = await client.listTools();
+  const names = listed.tools.map(tool => tool.name).sort();
+  if (JSON.stringify(names) !== JSON.stringify(R33_EXPECTED_TOOLS)) throw new Error(`R33 public catalog mismatch: ${JSON.stringify(names)}`);
+  for (const tool of listed.tools) {
+    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
+      throw new Error(`tool ${tool.name} missing strict output schema`);
+    }
+  }
+  const session = structured(await client.callTool({ name:'autonomous_session_status', arguments:{} }), 'autonomous_session_status');
+  if (session.status !== 'ok' || session.autonomous_armed !== true || session.coding_armed !== true) {
+    throw new Error(`autonomous session not armed: ${JSON.stringify(session)}`);
+  }  const submitted = structured(await client.callTool({ name:'autonomous_goal_submit', arguments:{
+    submission_id:`public-live-${tag}`, root_id:'core', title:'R24 public autonomous production live gate',
+    goal:'Prove autonomous failure diagnosis and recovery on the live fixture, then release only after required build, test, benchmark, and Windows gates pass.',
+    acceptance:'The fixture must end as READY, at least one quick-test failure must be observed before corrective replanning, and the signed R24 release receipt must verify.',
+    max_iterations:12
+  } }), 'autonomous_goal_submit');
+  goalId = submitted.goal_id;
+  if (!goalId || submitted.state !== 'pending') throw new Error(`autonomous submit failed: ${JSON.stringify(submitted)}`);
+  const ran = structured(await client.callTool(
+    { name:'autonomous_goal_run', arguments:{ goal_id:goalId, max_cycles:32 } },
+    { timeout:900000, maxTotalTimeout:900000 }
+  ), 'autonomous_goal_run');
+  if (ran.status !== 'completed' || ran.state !== 'succeeded' || ran.release?.ready !== true) {
+    throw new Error(`autonomous goal did not release: ${JSON.stringify(ran)}`);
+  }
+  if (!sawFailureEvidence || samplingRounds < 5) throw new Error(`autonomous replanning proof missing: failure=${sawFailureEvidence} rounds=${samplingRounds}`);
+  const verified = structured(await client.callTool({ name:'autonomous_goal_verify', arguments:{ goal_id:goalId } }), 'autonomous_goal_verify');
+  if (verified.ok !== true || verified.signature_valid !== true || verified.native_diffs_verified < 2 || verified.required_profiles_verified < 4) {
+    throw new Error(`autonomous release verification failed: ${JSON.stringify(verified)}`);
+  }
+  const gate = structured(await client.callTool({ name:'autonomous_release_gate', arguments:{ goal_id:goalId } }), 'autonomous_release_gate');
+  if (!['passed','existing'].includes(gate.status) || gate.ready !== true) throw new Error(`autonomous release gate replay failed: ${JSON.stringify(gate)}`);
+  const events = structured(await client.callTool({ name:'autonomous_goal_events', arguments:{ goal_id:goalId, from_seq:1, limit:200 } }), 'autonomous_goal_events');
+  const committed = events.events.filter(event => event.type === 'native_diff_committed').length;
+  const failedProfiles = events.events.filter(event => event.type === 'profile_completed' && event.payload?.passed === false).length;
+  if (committed < 2 || failedProfiles < 1) throw new Error(`autonomous evidence chain incomplete: diffs=${committed} failedProfiles=${failedProfiles}`);
+  const readback = structured(await client.callTool({ name:'coding_file_read', arguments:{ root_id:'core', path:fixtureRelative, encoding:'utf8' } }), 'coding_file_read');
+  if (readback.content !== expectedFinal) throw new Error(`live fixture was not restored: ${JSON.stringify(readback)}`);  const finalBytes = await readFile(fixtureAbsolute);
+  if (finalBytes.toString('utf8') !== expectedFinal) throw new Error('local fixture bytes do not match public readback');
+  console.log(JSON.stringify({
+    status:'passed', protocol_revision:client.getNegotiatedProtocolVersion(), tool_count:names.length,
+    output_schemas_strict:true, sampling_mrtr:true, sampling_rounds:samplingRounds,
+    observed_failure_before_replan:true, native_diffs_verified:verified.native_diffs_verified,
+    required_profiles_verified:verified.required_profiles_verified, final_fixture_sha256:createHash('sha256').update(finalBytes).digest('hex'),
+    signed_release_verified:true
+  }));
+} finally {
+  await client.close().catch(() => {});
+}

package/src/remote-mcp-coding-smoke-client.mjs

@@ -0,0 +1,111 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-coding-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('coding remote gate requires HTTPS');
+const here = path.dirname(fileURLToPath(import.meta.url));
+const coreRoot = path.resolve(here, '..');
+const workerRelative = 'scripts/coding-live-smoke.mjs';
+const workerAbsolute = path.join(coreRoot, ...workerRelative.split('/'));
+const workerSha256 = createHash('sha256').update(await readFile(workerAbsolute)).digest('hex');
+const tag = randomBytes(8).toString('hex');
+const editPath = `workspaces/demo/.deadbyte-coding-smoke-${tag}.txt`;
+const taskPath = `workspaces/demo/.deadbyte-coding-task-${tag}.txt`;
+const codingTools = [
+  'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write',
+  'coding_receipt_verify', 'coding_session_status', 'coding_task_approve', 'coding_task_cancel',
+  'coding_task_events', 'coding_task_run', 'coding_task_status', 'coding_task_submit',
+  'coding_task_verify', 'coding_text_replace', 'coding_tree'
+];
+const client = new Client(
+  { name: 'deadbyte-coding-remote-gate', version: '0.8.0' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StreamableHTTPClientTransport(endpoint);
+function structured(toolResult, label) {
+  if (toolResult.isError) throw new Error(`${label} returned error: ${JSON.stringify(toolResult.structuredContent ?? toolResult.content)}`);
+  if (!toolResult.structuredContent || typeof toolResult.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return toolResult.structuredContent;
+}
+try {
+  await client.connect(transport);
+  const listed = await client.listTools();
+  const names = listed.tools.map(tool => tool.name).sort();
+  if (!codingTools.every(name => names.includes(name))) throw new Error(`coding catalog missing tools: ${JSON.stringify(names)}`);
+  for (const tool of listed.tools.filter(item => codingTools.includes(item.name))) {
+    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
+      throw new Error(`coding tool ${tool.name} missing strict output schema`);
+    }
+  }
+  const session = structured(await client.callTool({ name: 'coding_session_status', arguments: {} }), 'coding_session_status');
+  if (session.status !== 'ok' || session.armed !== true || !session.root_ids.includes('core')) {
+    throw new Error(`coding session not armed for core: ${JSON.stringify(session)}`);
+  }
+
+  const write = structured(await client.callTool({ name: 'coding_file_write', arguments: {
+    root_id: 'core', path: editPath, content: 'alpha\n', encoding: 'utf8', expected_sha256: 'absent'
+  } }), 'coding_file_write');
+  if (write.status !== 'committed') throw new Error(`coding write failed: ${JSON.stringify(write)}`);
+  const writeVerify = structured(await client.callTool({ name: 'coding_receipt_verify', arguments: { receipt_id: write.receipt_id } }), 'coding_receipt_verify write');
+  if (writeVerify.ok !== true || writeVerify.signature_valid !== true) throw new Error('coding write receipt verify failed');
+  const replace = structured(await client.callTool({ name: 'coding_text_replace', arguments: {
+    root_id: 'core', path: editPath, old_string: 'alpha', new_string: 'beta', expected_sha256: write.sha256, expected_replacements: 1
+  } }), 'coding_text_replace');
+  if (replace.status !== 'committed') throw new Error(`coding replace failed: ${JSON.stringify(replace)}`);
+  const read = structured(await client.callTool({ name: 'coding_file_read', arguments: { root_id: 'core', path: editPath, encoding: 'utf8' } }), 'coding_file_read');
+  if (read.status !== 'ok' || read.content !== 'beta\n' || read.sha256 !== replace.sha256) throw new Error('coding readback mismatch');
+
+  const command = structured(await client.callTool({ name: 'coding_command_run', arguments: {
+    root_id: 'core', command_id: 'node_script', script_path: workerRelative, script_sha256: workerSha256,
+    args: ['20000'], cwd: '.', timeout_ms: 30000
+  } }), 'coding_command_run');
+  if (command.status !== 'passed' || command.exit_code !== 0) throw new Error(`coding command failed: ${JSON.stringify(command)}`);
+  const commandVerify = structured(await client.callTool({ name: 'coding_receipt_verify', arguments: { receipt_id: command.receipt_id } }), 'coding_receipt_verify command');
+  if (commandVerify.ok !== true) throw new Error('coding command receipt verify failed');
+  const bench = structured(await client.callTool({ name: 'coding_benchmark_run', arguments: {
+    root_id: 'core', command_id: 'node_script', script_path: workerRelative, script_sha256: workerSha256,
+    args: ['25000'], cwd: '.', timeout_ms: 30000, warmups: 0, iterations: 3,
+    baseline_median_ms: null, max_regression_pct: 5
+  } }), 'coding_benchmark_run');
+  if (bench.status !== 'passed' || bench.verdict !== 'pass' || bench.samples_ms.length !== 3) throw new Error(`coding benchmark failed: ${JSON.stringify(bench)}`);
+
+  const submitted = structured(await client.callTool({ name: 'coding_task_submit', arguments: {
+    submission_id: `live-${tag}`, title: 'public coding task gate', steps: [
+      { step_id: 'write', kind: 'write', root_id: 'core', path: taskPath, content: 'task\n', encoding: 'utf8', expected_sha256: 'absent', retry_limit: 0 },
+      { step_id: 'command', kind: 'command', root_id: 'core', command_id: 'node_script', script_path: workerRelative,
+        script_sha256: workerSha256, args: ['15000'], cwd: '.', timeout_ms: 30000, expect_exit_code: 0, retry_limit: 0 },
+      { step_id: 'bench', kind: 'benchmark', root_id: 'core', command_id: 'node_script', script_path: workerRelative,
+        script_sha256: workerSha256, args: ['15000'], cwd: '.', timeout_ms: 30000, warmups: 0, iterations: 2,
+        baseline_median_ms: null, max_regression_pct: 5, retry_limit: 0 }
+    ]
+  } }), 'coding_task_submit');
+  if (!submitted.task_id || submitted.state !== 'pending') throw new Error(`coding task submit failed: ${JSON.stringify(submitted)}`);
+  const ran = structured(await client.callTool({ name: 'coding_task_run', arguments: {
+    task_id: submitted.task_id, max_steps: 8
+  } }), 'coding_task_run');
+  if (ran.status !== 'completed' || ran.state !== 'succeeded' || ran.completed_steps !== 3) {
+    throw new Error(`coding task did not complete: ${JSON.stringify(ran)}`);
+  }
+  const verified = structured(await client.callTool({ name: 'coding_task_verify', arguments: {
+    task_id: submitted.task_id
+  } }), 'coding_task_verify');
+  if (verified.ok !== true || verified.signature_valid !== true || verified.action_receipts_verified !== 3) {
+    throw new Error(`coding task verification failed: ${JSON.stringify(verified)}`);
+  }
+
+  console.log(JSON.stringify({
+    status: 'passed', protocol_revision: client.getNegotiatedProtocolVersion(), tool_count: names.length,
+    coding_tools: codingTools.length, output_schemas_strict: true,
+    direct_edit_verified: true, command_verified: true, benchmark_verified: true,
+    durable_coding_task_verified: true, action_receipts_verified: verified.action_receipts_verified
+  }));
+} finally {
+  await client.close().catch(() => {});
+  await rm(path.join(coreRoot, ...editPath.split('/')), { force: true }).catch(() => {});
+  await rm(path.join(coreRoot, ...taskPath.split('/')), { force: true }).catch(() => {});
+}

package/src/remote-mcp-host-smoke-client.mjs

@@ -0,0 +1,84 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-host-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('remote host gate requires HTTPS');
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const client = new Client(
+  { name: 'deadbyte-mcp-remote-host-gate', version: '0.8.0' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StreamableHTTPClientTransport(endpoint);
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+
+try {
+  await client.connect(transport);
+  const names = (await client.listTools()).tools.map(t => t.name).sort();
+  for (const required of ['host_file_read', 'host_file_write', 'host_exec']) {
+    if (!names.includes(required)) throw new Error(`privileged tool missing: ${required}`);
+  }
+
+  const nonce = randomBytes(8).toString('hex');
+  const dataPath = `proof/host-plane-live.${nonce}.txt`;
+  const scriptPath = `proof/host-plane-live.${nonce}.mjs`;
+  const data = `DEADBYTE HOST PLANE LIVE ${nonce}\n`;
+  const dataSha = sha256(Buffer.from(data, 'utf8'));
+
+  const writeData = structured(await client.callTool({
+    name: 'host_file_write',
+    arguments: { root_id: 'core', path: dataPath, content: data, encoding: 'utf8', expected_sha256: 'absent' }
+  }), 'host_file_write data');
+  if (writeData.sha256 !== dataSha) throw new Error('live host write digest mismatch');
+
+  const readData = structured(await client.callTool({
+    name: 'host_file_read', arguments: { root_id: 'core', path: dataPath, encoding: 'utf8' }
+  }), 'host_file_read data');
+  if (readData.sha256 !== dataSha || readData.content !== data) throw new Error('live host read mismatch');
+
+  const script = [
+    "import { readFileSync, unlinkSync } from 'node:fs';",
+    "import path from 'node:path';",
+    "import { fileURLToPath } from 'node:url';",
+    "const target = path.resolve(process.cwd(), process.argv[2]);",
+    "const bytes = readFileSync(target);",
+    "unlinkSync(target);",
+    "unlinkSync(fileURLToPath(import.meta.url));",
+    "process.stdout.write('HOST_EXEC_LIVE_OK:' + bytes.length + '\\n');",
+    ''
+  ].join('\n');
+  const scriptSha = sha256(Buffer.from(script, 'utf8'));
+  const writeScript = structured(await client.callTool({
+    name: 'host_file_write',
+    arguments: { root_id: 'core', path: scriptPath, content: script, encoding: 'utf8', expected_sha256: 'absent' }
+  }), 'host_file_write script');
+  if (writeScript.sha256 !== scriptSha) throw new Error('live host script digest mismatch');
+
+  const exec = structured(await client.callTool({
+    name: 'host_exec',
+    arguments: { command_id: 'node_script', root_id: 'core', script_path: scriptPath, script_sha256: scriptSha, args: [dataPath], cwd: '.', timeout_ms: 5000 }
+  }), 'host_exec');
+  if (exec.status !== 'passed' || exec.exit_code !== 0 || exec.stdout.trim() !== `HOST_EXEC_LIVE_OK:${Buffer.byteLength(data)}`) {
+    throw new Error(`live host exec mismatch: ${JSON.stringify(exec)}`);
+  }
+
+  console.log(JSON.stringify({
+    status: 'passed',
+    endpoint_origin: endpoint.origin,
+    protocol_revision: '2026-07-28',
+    privileged_tools: ['host_file_read', 'host_file_write', 'host_exec'],
+    write_sha256: dataSha,
+    read_verified: true,
+    exec_script_sha256: scriptSha,
+    exec_exit_code: exec.exit_code,
+    cleanup_by_executed_script: true
+  }, null, 2));
+} finally {
+  await client.close().catch(() => {});
+}

package/src/remote-mcp-machine-smoke-client.mjs

@@ -0,0 +1,66 @@
+import { randomBytes } from 'node:crypto';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { verifyMachinePingPublic } from './machine-identity.mjs';
+
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-machine-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('machine live gate requires HTTPS');
+
+const machineTools = ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status'];
+const client = new Client(
+  { name: 'deadbyte-r29-machine-gate', version: '0.8.5' },
+  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+);
+const transport = new StreamableHTTPClientTransport(endpoint);
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned tool error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} returned no structured object`);
+  return result.structuredContent;
+}
+
+try {
+  await client.connect(transport);
+  const listed = await client.listTools();
+  const names = listed.tools.map(tool => tool.name).sort();
+  for (const name of machineTools) if (!names.includes(name)) throw new Error(`machine tool missing: ${name}`);
+  for (const tool of listed.tools.filter(tool => machineTools.includes(tool.name))) {
+    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
+      throw new Error(`machine tool ${tool.name} missing strict output schema`);
+    }
+  }
+
+  const status = structured(await client.callTool({ name: 'machine_status', arguments: {} }), 'machine_status');
+  if (status.status !== 'ok') throw new Error(`machine_status status=${String(status.status)}`);
+  const machines = structured(await client.callTool({ name: 'machine_list', arguments: {} }), 'machine_list');
+  if (machines.status !== 'ok' || !Array.isArray(machines.machines)) throw new Error('machine_list invalid');
+  const self = machines.machines.find(item => item.machine_id === status.machine_id);
+  if (!self) throw new Error('machine_list does not contain current machine');
+  for (const field of ['public_key_spki_base64','identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
+    if (self[field] !== status[field]) throw new Error(`machine_list/status mismatch: ${field}`);
+  }
+
+  const nonce = randomBytes(32).toString('hex');
+  const ping = structured(await client.callTool({ name: 'machine_ping', arguments: { nonce } }), 'machine_ping');
+  if (ping.status !== 'ok' || ping.nonce !== nonce || ping.machine_id !== status.machine_id) throw new Error('machine_ping identity/nonce mismatch');
+  for (const field of ['identity_generation','online_epoch','release_id','release_manifest_sha256','generation_manifest_sha256']) {
+    if (ping[field] !== status[field]) throw new Error(`machine_ping/status mismatch: ${field}`);
+  }
+  const signatureVerified = await verifyMachinePingPublic({ ping, publicKeySpkiBase64: status.public_key_spki_base64 });
+  if (!signatureVerified) throw new Error('machine ping public Ed25519 verification failed');
+
+  console.log(JSON.stringify({
+    status: 'passed',
+    protocol_revision: client.getNegotiatedProtocolVersion(),
+    tool_count: names.length,
+    machine_id: status.machine_id,
+    identity_generation: status.identity_generation,
+    release_id: status.release_id,
+    release_manifest_sha256: status.release_manifest_sha256,
+    generation_manifest_sha256: status.generation_manifest_sha256,
+    signature_verified: true
+  }));
+} finally {
+  await client.close().catch(() => {});
+}

package/src/remote-mcp-r24-disarmed-smoke-client.mjs

@@ -0,0 +1,38 @@
+import { randomBytes } from 'node:crypto';
+import { stat } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+const endpointText = process.argv[2];
+if (!endpointText) throw new Error('usage: node src/remote-mcp-r24-disarmed-smoke-client.mjs https://host/mcp/path');
+const endpoint = new URL(endpointText);
+if (endpoint.protocol !== 'https:') throw new Error('R24 disarmed gate requires HTTPS');
+const coreRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const tag = randomBytes(8).toString('hex');
+const target = `workspaces/autonomous-live/.disarmed-${tag}.txt`;
+const targetAbsolute = path.join(coreRoot, ...target.split('/'));
+const client = new Client({ name:'deadbyte-r24-disarmed-gate', version:'0.8.0' },
+  { versionNegotiation:{ mode:{ pin:'2026-07-28' } } });
+const transport = new StreamableHTTPClientTransport(endpoint);
+let exists = false;
+try {
+  await client.connect(transport);
+  const listed = await client.listTools();
+  if (listed.tools.length !== 68) throw new Error(`expected 68 tools, got ${listed.tools.length}`);
+  const session = await client.callTool({ name:'autonomous_session_status', arguments:{} });
+  const status = session.structuredContent;
+  if (!status || status.coding_armed !== false || status.autonomous_armed !== false) throw new Error(`authority still armed: ${JSON.stringify(status)}`);  const deniedWrite = await client.callTool({ name:'coding_file_write', arguments:{
+    root_id:'core', path:target, content:'must-not-exist\n', encoding:'utf8', expected_sha256:'absent'
+  } });
+  if (deniedWrite.isError !== true) throw new Error(`coding mutation unexpectedly allowed: ${JSON.stringify(deniedWrite.structuredContent)}`);
+  const deniedGoal = await client.callTool({ name:'autonomous_goal_submit', arguments:{
+    submission_id:`disarmed-${tag}`, root_id:'core', title:'must deny', goal:'must not run while disarmed', acceptance:'deny', max_iterations:2
+  } });
+  if (deniedGoal.isError !== true) throw new Error(`autonomous submit unexpectedly allowed: ${JSON.stringify(deniedGoal.structuredContent)}`);
+  try { await stat(targetAbsolute); exists = true; } catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  if (exists) throw new Error('disarmed coding mutation created a file');
+  console.log(JSON.stringify({ status:'passed', protocol_revision:client.getNegotiatedProtocolVersion(), tool_count:68,
+    coding_armed:false, autonomous_armed:false, coding_mutation_denied:true, autonomous_submit_denied:true, target_absent:true }));
+} finally {
+  await client.close().catch(() => {});
+}

package/src/remote-mcp-r33-parity-client.mjs

@@ -0,0 +1,177 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { loadCodingPolicy } from './coding-plane.mjs';
+import { verifyMachineFsReceiptFile } from './machine-fs.mjs';
+import { verifyObservationReceiptFile } from './observation-runtime.mjs';
+
+const groups = [
+  ['contained_transform','evidence_verify','file_read','proof_execute','workspace_open'],
+  ['machine_list','machine_ping','machine_revoke','machine_status'],
+  ['host_exec','host_file_read','host_file_write'],
+  ['agent_task_approve','agent_task_cancel','agent_task_events','agent_task_run','agent_task_status','agent_task_submit','agent_task_verify'],
+  ['process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'],
+  ['machine_fs_delete','machine_fs_edit_exact','machine_fs_list','machine_fs_mkdir','machine_fs_move','machine_fs_read','machine_fs_stat','machine_fs_write'],
+  ['machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_process_list','machine_system_status'],
+  ['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_receipt_verify','coding_search','coding_session_status','coding_stat','coding_task_approve','coding_task_cancel','coding_task_events','coding_task_run','coding_task_status','coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'],
+  ['autonomous_goal_approve','autonomous_goal_cancel','autonomous_goal_events','autonomous_goal_run','autonomous_goal_status','autonomous_goal_submit','autonomous_goal_verify','autonomous_release_gate','autonomous_session_status','native_diff_apply','native_diff_preview','native_diff_verify']
+];
+export const R33_EXPECTED_TOOLS = groups.flat().sort();const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const stateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(), '.deadbyte-mcp'));
+const verifyKeyPath = path.join(stateRoot, 'trust', 'ed25519-public.pem');
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label} returned error: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  if (!result.structuredContent || typeof result.structuredContent !== 'object') throw new Error(`${label} missing structured output`);
+  return result.structuredContent;
+}
+async function verifyMachineReceipt(policy, receiptId, operation) {
+  const verified = await verifyMachineFsReceiptFile({ policy, verifyKeyPath, receiptId });
+  if (!verified.ok || verified.signature_valid !== true || verified.operation !== operation) {
+    throw new Error(`machine-fs receipt verification failed for ${operation}`);
+  }
+  return verified;
+}
+async function verifyObservationReceipt(policy, receiptId) {
+  const verified = await verifyObservationReceiptFile({ policy, verifyKeyPath, receiptId });
+  if (!verified.ok || verified.signature_valid !== true) throw new Error('observation receipt verification failed');
+  return verified;
+}
+async function fileSha(relative) {
+  return sha256(await readFile(path.join(repoRoot, ...relative.split('/'))));
+}async function waitSearch(client, searchId) {
+  for (let attempt = 0; attempt < 200; attempt++) {
+    const status = structured(await client.callTool({ name:'machine_search_status', arguments:{ search_id:searchId } }), 'machine_search_status');
+    if (['completed','cancelled','failed'].includes(status.state)) return status;
+    await sleep(25);
+  }
+  throw new Error('machine search timeout');
+}
+async function waitProcessOutput(client, sessionId) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const read = structured(await client.callTool({ name:'process_session_read', arguments:{ session_id:sessionId, offset:0, max_bytes:65536 } }), 'process_session_read');
+    if (Buffer.from(read.data_base64 ?? '', 'base64').toString('utf8').includes('DEADBYTE_ACTION_PING')) return read;
+    await sleep(50);
+  }
+  throw new Error('process action output timeout');
+}
+
+export async function runR33Parity(endpointText) {
+  const endpoint = new URL(endpointText);
+  if (endpoint.protocol !== 'https:') throw new Error('R33 parity requires HTTPS');
+  const pointer = JSON.parse(await readFile(path.join(stateRoot, 'active-release.json'), 'utf8'));
+  const policy = await loadCodingPolicy(path.join(pointer.generation_root, 'coding-policy.json'));
+  const client = new Client({ name:'deadbyte-r33-parity', version:'0.8.7' },
+    { versionNegotiation:{ mode:{ pin:'2026-07-28' } } });
+  const transport = new StreamableHTTPClientTransport(endpoint);
+  const tag = randomBytes(8).toString('hex');
+  const scratchRoot = 'parity_scratch';
+  const target = `.deadbyte-r33-parity-${tag}.txt`;
+  let processSession = null;
+  let targetPresent = false;
+  const machineReceipts = [];
+  const observationReceipts = [];
+  try {    await client.connect(transport);
+    const listed = await client.listTools();
+    const names = listed.tools.map(tool => tool.name).sort();
+    if (JSON.stringify(names) !== JSON.stringify(R33_EXPECTED_TOOLS)) throw new Error(`R33 catalog mismatch: ${JSON.stringify(names)}`);
+    for (const tool of listed.tools) {
+      if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
+        throw new Error(`tool ${tool.name} missing strict output schema`);
+      }
+    }
+    const coding = structured(await client.callTool({ name:'coding_session_status', arguments:{} }), 'coding_session_status');
+    const autonomous = structured(await client.callTool({ name:'autonomous_session_status', arguments:{} }), 'autonomous_session_status');
+    if (coding.armed !== true || autonomous.coding_armed !== true || autonomous.autonomous_armed !== true) {
+      throw new Error('R33 parity requires coding and autonomous standing grants');
+    }
+    const tree = structured(await client.callTool({ name:'coding_tree', arguments:{ root_id:'core', path:'workspaces/demo', max_depth:2, max_entries:128 } }), 'coding_tree');
+    if (tree.status !== 'ok' || !Array.isArray(tree.entries)) throw new Error('coding_tree malformed');
+
+    const buildScript = 'scripts/autonomous-build.ps1';
+    const testScript = 'scripts/autonomous-tests.ps1';
+    const build = structured(await client.callTool({ name:'coding_command_run', arguments:{ root_id:'core', command_id:'powershell_script', script_path:buildScript, script_sha256:await fileSha(buildScript), args:[], cwd:'.', timeout_ms:120000 } }, { timeout:180000, maxTotalTimeout:180000 }), 'coding build');
+    if (build.status !== 'passed' || build.exit_code !== 0) throw new Error('coding build failed');
+    const buildVerify = structured(await client.callTool({ name:'coding_receipt_verify', arguments:{ receipt_id:build.receipt_id } }), 'coding build receipt');
+    if (buildVerify.ok !== true || buildVerify.signature_valid !== true) throw new Error('coding build receipt invalid');
+    const tests = structured(await client.callTool({ name:'coding_command_run', arguments:{ root_id:'core', command_id:'powershell_script', script_path:testScript, script_sha256:await fileSha(testScript), args:[], cwd:'.', timeout_ms:300000 } }, { timeout:360000, maxTotalTimeout:360000 }), 'coding tests');
+    if (tests.status !== 'passed' || tests.exit_code !== 0) throw new Error('coding tests failed');
+    const testVerify = structured(await client.callTool({ name:'coding_receipt_verify', arguments:{ receipt_id:tests.receipt_id } }), 'coding test receipt');
+    if (testVerify.ok !== true || testVerify.signature_valid !== true) throw new Error('coding test receipt invalid');
+
+    const initial = `needle-${tag}\n`;
+    const write = structured(await client.callTool({ name:'machine_fs_write', arguments:{ root_id:scratchRoot, path:target, content:initial, encoding:'utf8', expected_sha256:'absent' } }), 'machine_fs_write');
+    targetPresent = true;
+    machineReceipts.push(write.receipt_id);
+    await verifyMachineReceipt(policy, write.receipt_id, 'machine_fs_write');
+    const bounded = structured(await client.callTool({ name:'machine_fs_read', arguments:{ root_id:scratchRoot, path:target, offset:0, max_bytes:128, hash_file:true } }), 'machine_fs_read');
+    if (Buffer.from(bounded.data_base64, 'base64').toString('utf8') !== initial || bounded.file_sha256 !== write.sha256) throw new Error('bounded read mismatch');
+    const edit = structured(await client.callTool({ name:'machine_fs_edit_exact', arguments:{ root_id:scratchRoot, path:target, expected_sha256:write.sha256, old_string:'needle', new_string:'beta', expected_replacements:1 } }), 'machine_fs_edit_exact');
+    machineReceipts.push(edit.receipt_id);
+    await verifyMachineReceipt(policy, edit.receipt_id, 'machine_fs_edit_exact');    const stale = await client.callTool({ name:'machine_fs_edit_exact', arguments:{ root_id:scratchRoot, path:target, expected_sha256:write.sha256, old_string:'beta', new_string:'bad', expected_replacements:1 } });
+    if (stale.isError !== true) throw new Error('stale machine-fs precondition was not denied');
+
+    const searchStart = structured(await client.callTool({ name:'machine_search_start', arguments:{ root_id:scratchRoot, path:'.', pattern:tag, case_sensitive:true, max_results:20, max_files:200, max_bytes:262144, max_file_bytes:16384 } }), 'machine_search_start');
+    const searchStatus = await waitSearch(client, searchStart.search_id);
+    if (searchStatus.state !== 'completed' || !searchStatus.receipt_id) throw new Error(`search failed: ${JSON.stringify(searchStatus)}`);
+    observationReceipts.push(searchStatus.receipt_id);
+    await verifyObservationReceipt(policy, searchStatus.receipt_id);
+    const page = structured(await client.callTool({ name:'machine_search_page', arguments:{ search_id:searchStart.search_id, limit:20, cursor:null } }), 'machine_search_page');
+    if (!page.results.some(item => item.path === target)) throw new Error('search did not return parity file');
+    const system = structured(await client.callTool({ name:'machine_system_status', arguments:{} }), 'machine_system_status');
+    observationReceipts.push(system.receipt_id);
+    await verifyObservationReceipt(policy, system.receipt_id);
+    const processes = structured(await client.callTool({ name:'machine_process_list', arguments:{ limit:32, include_external:false, cursor:null } }), 'machine_process_list');
+    observationReceipts.push(processes.receipt_id);
+    await verifyObservationReceipt(policy, processes.receipt_id);
+
+    const started = structured(await client.callTool({ name:'process_session_start', arguments:{ profile_id:'ping_hold', root_id:'core', cwd:'.', args:[] } }), 'process_session_start');
+    processSession = started.session.session_id;
+    const action = structured(await client.callTool({ name:'process_session_action', arguments:{ session_id:processSession, action_id:'ping' } }), 'process_session_action');
+    const processRead = await waitProcessOutput(client, processSession);
+    const terminated = structured(await client.callTool({ name:'process_session_terminate', arguments:{ session_id:processSession } }), 'process_session_terminate');
+    if (action.action_id !== 'ping' || terminated.session.state !== 'terminated') throw new Error('owned process lifecycle failed');
+
+    const stat = structured(await client.callTool({ name:'machine_fs_stat', arguments:{ root_id:scratchRoot, path:target, hash:true } }), 'machine_fs_stat');
+    const deleted = structured(await client.callTool({ name:'machine_fs_delete', arguments:{ root_id:scratchRoot, path:target, expected_source_identity:stat.identity_sha256 } }), 'machine_fs_delete');
+    machineReceipts.push(deleted.receipt_id);
+    await verifyMachineReceipt(policy, deleted.receipt_id, 'machine_fs_delete');
+    targetPresent = false;
+
+    return {
+      status:'passed', protocol_revision:client.getNegotiatedProtocolVersion(), tool_count:names.length,
+      strict_output_schemas:true, rdc_operation_count:0, execution_provider:'deadbyte_mcp',
+      tree_entries:tree.entries.length, bounded_read_verified:true, stale_precondition_denied:true,
+      machine_fs_receipts_verified:machineReceipts.length, observation_receipts_verified:observationReceipts.length,
+      search_result_count:page.results.length, process_session_id:processSession,
+      process_output_bytes:processRead.stream_head, process_journal_head_sha256:terminated.session.journal_head_sha256,
+      build_receipt_id:build.receipt_id, test_receipt_id:tests.receipt_id, coding_receipts_verified:2
+    };  } finally {
+    if (processSession) {
+      await client.callTool({ name:'process_session_terminate', arguments:{ session_id:processSession } }).catch(() => {});
+    }
+    if (targetPresent) {
+      try {
+        const stat = structured(await client.callTool({ name:'machine_fs_stat', arguments:{ root_id:scratchRoot, path:target, hash:false } }), 'cleanup stat');
+        if (stat.kind === 'file' && stat.identity_sha256) {
+          await client.callTool({ name:'machine_fs_delete', arguments:{ root_id:scratchRoot, path:target, expected_source_identity:stat.identity_sha256 } }).catch(() => {});
+        }
+      } catch {}
+    }
+    await client.close().catch(() => {});
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const endpoint = process.argv[2];
+  if (!endpoint) throw new Error('usage: node src/remote-mcp-r33-parity-client.mjs https://host/mcp/path');
+  runR33Parity(endpoint)
+    .then(result => console.log(JSON.stringify(result, null, 2)))
+    .catch(error => { console.error(error instanceof Error ? error.stack : String(error)); process.exitCode = 1; });
+}