deadbyte-mcp 0.8.7

package/test/agent-runtime-adversarial.test.mjs

@@ -0,0 +1,228 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { sha256Bytes } from '../src/hash.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-adv-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-adv-trust-'));
+  const workspace = path.join(root, 'alpha');
+  await mkdir(workspace, { recursive: true });
+  await writeFile(path.join(workspace, 'input.txt'), 'agent adversarial\n');
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  return { root, trust, workspace, keys };
+}
+async function connect(f, agent = true) {
+  const client = new Client(
+    { name: 'deadbyte-agent-adversarial', version: '0.8.0' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [serverPath],
+    cwd: repoRoot,
+    env: {
+      ...getDefaultEnvironment(),
+      DEADBYTE_WORKSPACE_ROOT: f.root,
+      DEADBYTE_SIGNING_KEY: f.keys.privateKeyPath,
+      DEADBYTE_VERIFY_KEY: f.keys.publicKeyPath,
+      DEADBYTE_AGENT_RUNTIME: agent ? '1' : '0'
+    },
+    stderr: 'pipe'
+  });
+  await client.connect(transport);
+  return client;
+}
+
+function data(result, label) {
+  assert.equal(result.isError, false, `${label}: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  return result.structuredContent;
+}
+
+async function cleanup(f, client) {
+  await client?.close().catch(() => {});
+  await rm(f.root, { recursive: true, force: true }).catch(() => {});
+  await rm(f.trust, { recursive: true, force: true }).catch(() => {});
+}
+test('agent submit is idempotent and rejects submission-id plan collisions', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const base = {
+      workspace_id: 'alpha', submission_id: 'idem-001', title: 'idem',
+      steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+    };
+    const first = data(await client.callTool({ name: 'agent_task_submit', arguments: base }), 'first');
+    const second = data(await client.callTool({ name: 'agent_task_submit', arguments: base }), 'second');
+    assert.equal(first.status, 'accepted');
+    assert.equal(second.status, 'existing');
+    assert.equal(second.task_id, first.task_id);
+    const collision = await client.callTool({
+      name: 'agent_task_submit',
+      arguments: { ...base, title: 'different-plan' }
+    });
+    assert.equal(collision.isError, true);
+    assert.match(JSON.stringify(collision.structuredContent), /different plan/);
+  } finally { await cleanup(f, client); }
+});
+test('checkpoint pauses until explicit approval and approval never auto-runs the next step', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({
+      name: 'agent_task_submit', arguments: {
+        workspace_id: 'alpha', submission_id: 'checkpoint-001', title: 'checkpoint',
+        steps: [
+          { step_id: 'gate', kind: 'checkpoint', message: 'operator approval required' },
+          { step_id: 'after', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }
+        ]
+      }
+    }), 'submit');
+    const firstRun = data(await client.callTool({
+      name: 'agent_task_run', arguments: { workspace_id: 'alpha', task_id: submitted.task_id, max_steps: 8 }
+    }), 'run');
+    assert.equal(firstRun.state, 'paused');
+    assert.equal(firstRun.reason, 'checkpoint');
+    const approved = data(await client.callTool({
+      name: 'agent_task_approve', arguments: { workspace_id: 'alpha', task_id: submitted.task_id, step_id: 'gate', decision: 'approve' }
+    }), 'approve');
+    assert.equal(approved.status, 'approved');
+    assert.equal(approved.completed_steps, 1);
+    const status = data(await client.callTool({ name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id } }), 'status');
+    assert.equal(status.steps.find(step => step.step_id === 'after').state, 'pending');
+  } finally { await cleanup(f, client); }
+});
+test('cancel request is observed before the next step and transitions terminal', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({
+      name: 'agent_task_submit', arguments: {
+        workspace_id: 'alpha', submission_id: 'cancel-001', title: 'cancel',
+        steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+      }
+    }), 'submit');
+    const requested = data(await client.callTool({
+      name: 'agent_task_cancel', arguments: { workspace_id: 'alpha', task_id: submitted.task_id, reason: 'test_cancel' }
+    }), 'cancel');
+    assert.match(requested.status, /requested|existing/);
+    const run = data(await client.callTool({
+      name: 'agent_task_run', arguments: { workspace_id: 'alpha', task_id: submitted.task_id }
+    }), 'run');
+    assert.equal(run.state, 'cancelled');
+    assert.equal(run.completed_steps, 0);
+  } finally { await cleanup(f, client); }
+});
+test('tampered journal is rejected instead of trusted', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({
+      name: 'agent_task_submit', arguments: {
+        workspace_id: 'alpha', submission_id: 'tamper-001', title: 'tamper',
+        steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+      }
+    }), 'submit');
+    const eventPath = path.join(f.workspace, '.deadbyte-agent', 'tasks', submitted.task_id, 'events', '000001.json');
+    const event = JSON.parse(await readFile(eventPath, 'utf8'));
+    event.payload.title = 'tampered';
+    await writeFile(eventPath, JSON.stringify(event));
+    const status = await client.callTool({
+      name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id }
+    });
+    assert.equal(status.isError, true);
+    assert.match(JSON.stringify(status.structuredContent), /agent event signature verification failed/);
+  } finally { await cleanup(f, client); }
+});
+
+test('agent mode off preserves the non-agent catalog', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f, false);
+    const names = (await client.listTools()).tools.map(tool => tool.name);
+    assert.equal(names.some(name => name.startsWith('agent_task_')), false);
+  } finally { await cleanup(f, client); }
+});
+
+test('recomputed plan hash without private key is rejected', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({ name: 'agent_task_submit', arguments: {
+      workspace_id: 'alpha', submission_id: 'forge-plan-001', title: 'signed plan',
+      steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+    } }), 'submit');
+    const planPath = path.join(f.workspace, '.deadbyte-agent', 'tasks', submitted.task_id, 'plan.json');
+    const plan = JSON.parse(await readFile(planPath, 'utf8'));
+    const { task_id, plan_sha256, attestation, ...body } = plan;
+    body.title = 'attacker rewrite';
+    const forged = { ...body, plan_sha256: sha256Bytes(Buffer.from(canonicalJson(body), 'utf8')), task_id, ...(attestation ? { attestation } : {}) };
+    await writeFile(planPath, `${canonicalJson(forged)}\n`);
+    const status = await client.callTool({ name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id } });
+    assert.equal(status.isError, true);
+    assert.match(JSON.stringify(status.structuredContent), /plan signature/i);
+  } finally { await cleanup(f, client); }
+});
+
+test('recomputed event hash-chain without private key is rejected', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({ name: 'agent_task_submit', arguments: {
+      workspace_id: 'alpha', submission_id: 'forge-event-001', title: 'signed journal',
+      steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+    } }), 'submit');
+    const eventPath = path.join(f.workspace, '.deadbyte-agent', 'tasks', submitted.task_id, 'events', '000001.json');
+    const event = JSON.parse(await readFile(eventPath, 'utf8'));
+    const { event_sha256, attestation, ...body } = event;
+    body.payload.title = 'attacker rewrite';
+    const forged = { ...body, event_sha256: sha256Bytes(Buffer.from(canonicalJson(body), 'utf8')), ...(attestation ? { attestation } : {}) };
+    await writeFile(eventPath, `${canonicalJson(forged)}\n`);
+    const status = await client.callTool({ name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id } });
+    assert.equal(status.isError, true);
+    assert.match(JSON.stringify(status.structuredContent), /event signature/i);
+  } finally { await cleanup(f, client); }
+});
+
+test('unsigned forged cancel file cannot drive an authenticated cancellation', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    client = await connect(f);
+    const submitted = data(await client.callTool({ name: 'agent_task_submit', arguments: {
+      workspace_id: 'alpha', submission_id: 'forge-cancel-001', title: 'cancel integrity',
+      steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' } }]
+    } }), 'submit');
+    const cancelPath = path.join(f.workspace, '.deadbyte-agent', 'tasks', submitted.task_id, 'cancel.request.json');
+    await writeFile(cancelPath, `${canonicalJson({
+      schema: 'deadbyte.agent-cancel.v1', task_id: submitted.task_id,
+      requested_at_utc: new Date().toISOString(), reason: 'forged'
+    })}\n`);
+    const run = await client.callTool({ name: 'agent_task_run', arguments: { workspace_id: 'alpha', task_id: submitted.task_id } });
+    assert.equal(run.isError, true);
+    assert.match(JSON.stringify(run.structuredContent), /cancel request signature/i);
+    const status = data(await client.callTool({ name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id } }), 'status');
+    assert.notEqual(status.state, 'cancelled');
+  } finally { await cleanup(f, client); }
+});

package/test/agent-runtime-crash.test.mjs

@@ -0,0 +1,76 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { access, mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createAgentRuntime } from '../src/agent-runtime.mjs';
+import { generateTrustKeypair } from '../src/trust.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const childPath = path.join(here, 'agent-crash-child.mjs');
+
+async function waitExists(file, timeoutMs = 10000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try { await access(file); return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 20));
+  }
+  throw new Error(`timed out waiting for ${file}`);
+}
+
+function waitClose(child) {
+  return new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => resolve({ code, signal }));
+  });
+}
+test('new runtime generation reconciles signed side effect after process death', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-crash-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-crash-trust-'));
+  const workspace = path.join(root, 'alpha');
+  const marker = path.join(root, 'effect-complete.marker');
+  await mkdir(workspace, { recursive: true });
+  await writeFile(path.join(workspace, 'input.txt'), 'crash recovery\n');
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  const runtime = createAgentRuntime({ signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath });
+  let child;
+  try {
+    const submitted = await runtime.submit({
+      workspacePath: workspace, workspaceId: 'alpha', submissionId: 'crash-001', title: 'crash',
+      steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' }, retry_limit: 0 }]
+    });
+    child = spawn(process.execPath, [
+      childPath, workspace, submitted.task_id,
+      keys.privateKeyPath, keys.publicKeyPath, marker
+    ], {
+      cwd: path.resolve(here, '..'),
+      env: { ...process.env, DEADBYTE_WORKSPACE_ROOT: root },
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    const closed = waitClose(child);
+    await waitExists(marker);
+    assert.equal(child.kill(), true);
+    await closed;
+
+    const before = await runtime.status({ workspacePath: workspace, taskId: submitted.task_id });
+    assert.equal(before.active_step_id, 'one');
+    assert.equal(before.steps[0].state, 'running');
+
+    const resumed = await runtime.run({ workspacePath: workspace, taskId: submitted.task_id, maxSteps: 1 });
+    assert.equal(resumed.state, 'succeeded');
+    assert.equal(resumed.completed_steps, 1);
+    assert.equal(resumed.steps[0].result.recovered, true);
+    const verified = await runtime.verify({ workspacePath: workspace, taskId: submitted.task_id });
+    assert.equal(verified.ok, true, JSON.stringify(verified));
+    assert.equal(verified.step_receipts_verified, 1);
+  } finally {
+    if (child?.exitCode === null) child.kill();
+    await rm(root, { recursive: true, force: true }).catch(() => {});
+    await rm(trust, { recursive: true, force: true }).catch(() => {});
+  }
+});

package/test/agent-runtime.test.mjs

@@ -0,0 +1,124 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const AGENT_TOOLS = [
+  'agent_task_approve',
+  'agent_task_cancel',
+  'agent_task_events',
+  'agent_task_run',
+  'agent_task_status',
+  'agent_task_submit',
+  'agent_task_verify'
+];
+const BASE_TOOLS = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open'];
+
+function structured(result, label) {
+  if (result.isError) throw new Error(`${label}: ${JSON.stringify(result.structuredContent ?? result.content)}`);
+  assert.ok(result.structuredContent && typeof result.structuredContent === 'object', `${label} structured result missing`);
+  return result.structuredContent;
+}
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-root-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-trust-'));
+  const workspace = path.join(root, 'alpha');
+  await mkdir(workspace, { recursive: true });
+  await writeFile(path.join(workspace, 'input.txt'), 'agent chain\n');
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });
+  return { root, trust, workspace, keys };
+}
+
+async function connectAgent(f) {
+  const client = new Client(
+    { name: 'deadbyte-agent-test', version: '0.8.0' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [serverPath],
+    cwd: repoRoot,
+    env: {
+      ...getDefaultEnvironment(),
+      DEADBYTE_WORKSPACE_ROOT: f.root,
+      DEADBYTE_SIGNING_KEY: f.keys.privateKeyPath,
+      DEADBYTE_VERIFY_KEY: f.keys.publicKeyPath,
+      DEADBYTE_AGENT_RUNTIME: '1'
+    },
+    stderr: 'pipe'
+  });
+  await client.connect(transport);
+  return { client, transport };
+}
+
+async function cleanup(f, client) {
+  await client?.close().catch(() => {});
+  await rm(f.root, { recursive: true, force: true }).catch(() => {});
+  await rm(f.trust, { recursive: true, force: true }).catch(() => {});
+}
+
+test('agent runtime without an explicit host policy exposes only base plus durable task tools', async () => {
+  const f = await fixture();
+  let client;
+  try {
+    ({ client } = await connectAgent(f));
+    const names = (await client.listTools()).tools.map(t => t.name).sort();
+    assert.deepEqual(names, [...BASE_TOOLS, ...AGENT_TOOLS].sort());
+
+    const submitted = structured(await client.callTool({
+      name: 'agent_task_submit',
+      arguments: {
+        workspace_id: 'alpha',
+        submission_id: 'integration-chain-001',
+        title: 'two step proof chain',
+        steps: [
+          { step_id: 'first', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' }, retry_limit: 1 },
+          { step_id: 'second', kind: 'proof_execute', input: { kind: 'step_output', step_id: 'first' }, retry_limit: 1 }
+        ]
+      }
+    }), 'agent_task_submit');
+    assert.equal(submitted.status, 'accepted');
+    assert.match(submitted.task_id, /^[0-9a-f]{64}$/);
+    assert.match(submitted.plan_sha256, /^[0-9a-f]{64}$/);
+
+    const run = structured(await client.callTool({
+      name: 'agent_task_run',
+      arguments: { workspace_id: 'alpha', task_id: submitted.task_id, max_steps: 8 }
+    }), 'agent_task_run');
+    assert.equal(run.state, 'succeeded');
+    assert.equal(run.completed_steps, 2);
+
+    const status = structured(await client.callTool({
+      name: 'agent_task_status', arguments: { workspace_id: 'alpha', task_id: submitted.task_id }
+    }), 'agent_task_status');
+    assert.equal(status.state, 'succeeded');
+    assert.equal(status.steps.filter(step => step.state === 'succeeded').length, 2);
+    assert.equal(status.journal_verified, true);
+
+    const events = structured(await client.callTool({
+      name: 'agent_task_events', arguments: { workspace_id: 'alpha', task_id: submitted.task_id, from_seq: 1, limit: 100 }
+    }), 'agent_task_events');
+    assert.equal(events.journal_verified, true);
+    assert.ok(events.events.length >= 6);
+
+    const verified = structured(await client.callTool({
+      name: 'agent_task_verify', arguments: { workspace_id: 'alpha', task_id: submitted.task_id }
+    }), 'agent_task_verify');
+    assert.equal(verified.ok, true, JSON.stringify(verified));
+    assert.equal(verified.step_receipts_verified, 2);
+  } finally {
+    await cleanup(f, client);
+  }
+});
+

package/test/agent-task-receipt.test.mjs

@@ -0,0 +1,73 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createAgentRuntime } from '../src/agent-runtime.mjs';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { verifyReceipt } from '../src/verifier.mjs';
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-final-'));
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-agent-final-key-'));
+  const workspace = path.join(root, 'alpha');
+  await mkdir(workspace, { recursive: true });
+  await writeFile(path.join(workspace, 'input.txt'), 'final receipt\n');
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'), publicKeyPath: path.join(trust, 'public.pem')
+  });
+  const runtime = createAgentRuntime({ signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath, verifyReceiptFn: verifyReceipt });
+  return { root, trust, workspace, runtime };
+}
+async function complete(f, submissionId) {
+  const task = await f.runtime.submit({
+    workspacePath: f.workspace,
+    workspaceId: 'alpha',
+    submissionId,
+    title: submissionId,
+    steps: [{ step_id: 'one', kind: 'proof_execute', input: { kind: 'workspace', path: 'input.txt' }, retry_limit: 0 }]
+  });
+  const run = await f.runtime.run({ workspacePath: f.workspace, taskId: task.task_id, maxSteps: 8 });
+  assert.equal(run.state, 'succeeded');
+  return task;
+}
+
+async function cleanup(f) {
+  await rm(f.root, { recursive: true, force: true }).catch(() => {});
+  await rm(f.trust, { recursive: true, force: true }).catch(() => {});
+}
+
+test('existing signed task receipt is verified and adopted after crash before task_completed event', async () => {
+  const f = await fixture();
+  try {
+    const task = await complete(f, 'final-receipt-adopt');
+    const taskDir = path.join(f.workspace, '.deadbyte-agent', 'tasks', task.task_id);
+    const eventsDir = path.join(taskDir, 'events');
+    const names = (await readdir(eventsDir)).filter(name => /^\d{6}\.json$/.test(name)).sort();
+    const lastPath = path.join(eventsDir, names.at(-1));
+    const last = JSON.parse(await readFile(lastPath, 'utf8'));
+    assert.equal(last.type, 'task_completed');
+    await rm(lastPath);
+
+    const before = await f.runtime.status({ workspacePath: f.workspace, taskId: task.task_id });
+    assert.notEqual(before.state, 'succeeded');
+    const recovered = await f.runtime.run({ workspacePath: f.workspace, taskId: task.task_id, maxSteps: 1 });
+    assert.equal(recovered.state, 'succeeded');
+    const verified = await f.runtime.verify({ workspacePath: f.workspace, taskId: task.task_id });
+    assert.equal(verified.ok, true, JSON.stringify(verified));
+  } finally { await cleanup(f); }
+});
+
+test('task receipt tamper is rejected even when journal remains intact', async () => {
+  const f = await fixture();
+  try {
+    const task = await complete(f, 'final-receipt-tamper');
+    const receiptPath = path.join(f.workspace, '.deadbyte-agent', 'tasks', task.task_id, 'task-receipt.json');
+    const receipt = JSON.parse(await readFile(receiptPath, 'utf8'));
+    receipt.completed_at_utc = '2000-01-01T00:00:00.000Z';
+    await writeFile(receiptPath, `${JSON.stringify(receipt)}\n`);
+    const verified = await f.runtime.verify({ workspacePath: f.workspace, taskId: task.task_id });
+    assert.equal(verified.ok, false);
+    assert.match(verified.reason, /task receipt hash mismatch|signature mismatch/);
+  } finally { await cleanup(f); }
+});

package/test/audit-context.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { releaseId } from '../src/release-slot.mjs';
+import { createAuditContextProvider } from '../src/audit-context.mjs';
+
+const H=x=>x.repeat(64);
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const temp=()=>mkdtemp(path.join(os.tmpdir(),'deadbyte-audit-context-'));
+
+test('audit context binds verified active release, generation, machine and all authority planes',async()=>{
+  const root=await temp();
+  try{
+    const pkg=path.join(root,'release');await mkdir(pkg,{recursive:true});
+    const manifest=Buffer.from('abc  file\n','utf8');await writeFile(path.join(pkg,'MANIFEST.SHA256'),manifest);
+    const manifestSha=sha(manifest);const generationRoot=path.join(root,'generations','g-test');await mkdir(generationRoot,{recursive:true});
+    const generationSha=H('2');const rid=releaseId('0.8.7',manifestSha);
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify({schema:'deadbyte.active-release.v1',release_id:rid,version:'0.8.7',manifest_sha256:manifestSha,release_root:pkg,generation_root:generationRoot,generation_manifest_sha256:generationSha,launcher_sha256:H('3'),config_path:path.join(generationRoot,'controller-config.psd1')}));
+    const processPolicy={grant_file:path.join(root,'process-grant.json'),policy_sha256:H('4'),roots:{core:{}},profiles:{dev:{}}};
+    await writeFile(processPolicy.grant_file,JSON.stringify({schema:'deadbyte.process-grant.v1',policy_sha256:processPolicy.policy_sha256,instance_nonce:H('5'),profile_ids:['dev'],root_ids:['core']}));
+    const hostPolicy={arm_file:path.join(root,'host-grant.json'),policy_sha256:H('6')};
+    await writeFile(hostPolicy.arm_file,JSON.stringify({schema:'deadbyte.host-grant.v2',policy_sha256:hostPolicy.policy_sha256,instance_nonce:H('7')}));
+    const machineRuntime={status:async()=>({status:'ok',release_id:rid,release_manifest_sha256:manifestSha,generation_manifest_sha256:generationSha,machine_id:H('8'),identity_generation:9,online_epoch:H('9')})};
+    const codingRuntime={sessionStatus:async()=>({status:'ok',configured:true,armed:true,reason:'standing-grant'})};
+    const autonomousRuntime={sessionStatus:async()=>({status:'ok',configured:true,armed:true,autonomous_armed:true,autonomous_reason:'standing-grant'})};
+    const provider=createAuditContextProvider({stateRoot:root,packageRoot:pkg,machineRuntime,processPolicy,codingRuntime,autonomousRuntime,hostPolicy});
+    const ctx=await provider();
+    assert.equal(ctx.release_id,rid);assert.equal(ctx.release_manifest_sha256,manifestSha);assert.equal(ctx.generation_id,'g-test');assert.equal(ctx.generation_manifest_sha256,generationSha);
+    assert.equal(ctx.machine_id,H('8'));assert.equal(ctx.identity_generation,9);assert.equal(ctx.online_epoch,H('9'));
+    assert.deepEqual(ctx.authority.process,{configured:true,armed:true,reason:'standing-grant'});
+    assert.deepEqual(ctx.authority.coding,{configured:true,armed:true,reason:'standing-grant'});
+    assert.deepEqual(ctx.authority.autonomous,{configured:true,armed:true,reason:'standing-grant'});
+    assert.deepEqual(ctx.authority.host,{configured:true,armed:true,reason:'standing-grant'});
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('audit context fails closed when active machine binding disagrees with executing package manifest',async()=>{
+  const root=await temp();
+  try{
+    const pkg=path.join(root,'release');await mkdir(pkg,{recursive:true});const manifest=Buffer.from('manifest\n');await writeFile(path.join(pkg,'MANIFEST.SHA256'),manifest);
+    const manifestSha=sha(manifest);const generationRoot=path.join(root,'generations','g-test');await mkdir(generationRoot,{recursive:true});const generationSha=H('2');const rid=releaseId('0.8.7',manifestSha);
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify({schema:'deadbyte.active-release.v1',release_id:rid,version:'0.8.7',manifest_sha256:manifestSha,release_root:pkg,generation_root:generationRoot,generation_manifest_sha256:generationSha,launcher_sha256:H('3'),config_path:path.join(generationRoot,'controller-config.psd1')}));
+    const machineRuntime={status:async()=>({status:'ok',release_id:rid,release_manifest_sha256:H('f'),generation_manifest_sha256:generationSha,machine_id:H('8'),identity_generation:1,online_epoch:H('9')})};
+    const provider=createAuditContextProvider({stateRoot:root,packageRoot:pkg,machineRuntime});
+    await assert.rejects(provider(),/release manifest binding mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/audit-server-integration.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { releaseId } from '../src/release-slot.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));const repoRoot=path.resolve(here,'..');const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('real stdio MCP audits request/result with active machine binding',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-audit-server-'));
+  const workspaceRoot=path.join(root,'workspaces');await mkdir(path.join(workspaceRoot,'demo'),{recursive:true});
+  const trust=await generateTrustKeypair({privateKeyPath:path.join(root,'trust','private.pem'),publicKeyPath:path.join(root,'trust','public.pem')});
+  const manifestBytes=await readFile(path.join(repoRoot,'MANIFEST.SHA256'));const manifestSha=sha(manifestBytes);const version='0.8.7';const rid=releaseId(version,manifestSha);
+  const generationRoot=path.join(root,'generations',`${rid}-gtest`);await mkdir(generationRoot,{recursive:true});const generationBytes=Buffer.from('1'.repeat(64)+'  controller-config.psd1\n');await writeFile(path.join(generationRoot,'GENERATION.SHA256'),generationBytes);const generationSha=sha(generationBytes);
+  await writeFile(path.join(root,'active-release.json'),JSON.stringify({schema:'deadbyte.active-release.v1',release_id:rid,version,manifest_sha256:manifestSha,release_root:repoRoot,generation_root:generationRoot,generation_manifest_sha256:generationSha,launcher_sha256:'2'.repeat(64),config_path:path.join(generationRoot,'controller-config.psd1')}));
+  const client=new Client({name:'deadbyte-audit-integration',version},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env:{...getDefaultEnvironment(),DEADBYTE_WORKSPACE_ROOT:workspaceRoot,DEADBYTE_STATE_ROOT:root,DEADBYTE_SIGNING_KEY:trust.privateKeyPath,DEADBYTE_VERIFY_KEY:trust.publicKeyPath,DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_AUDIT_RUNTIME:'1'},stderr:'pipe'});
+  try{
+    await client.connect(transport);const result=await client.callTool({name:'workspace_open',arguments:{workspace_id:'demo'}});assert.equal(result.isError,false);
+    const text=await readFile(path.join(root,'audit','segment-00000001.jsonl'),'utf8');const rows=text.trim().split(/\r?\n/).map(JSON.parse);assert.equal(rows.length,2);
+    assert.deepEqual(rows.map(x=>x.event_type),['tool.request','tool.result']);assert.equal(rows[0].request_id,rows[1].request_id);assert.equal(rows[0].context.release_id,rid);assert.equal(rows[0].context.release_manifest_sha256,manifestSha);assert.match(rows[0].context.machine_id,/^[0-9a-f]{64}$/);
+  }finally{await client.close().catch(()=>{});await rm(root,{recursive:true,force:true});}
+});

package/test/audit-verify.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createToolAudit } from '../src/tool-audit.mjs';
+import { verifyAuditChain } from '../src/audit-verify.mjs';
+
+const H=x=>x.repeat(64);const sha=v=>createHash('sha256').update(Buffer.from(canonicalJson(v),'utf8')).digest('hex');
+const context=()=>({release_id:'v0.8.7-test',release_manifest_sha256:H('1'),generation_id:'g-test',generation_manifest_sha256:H('2'),machine_id:H('3'),identity_generation:1,online_epoch:H('4'),authority:{process:{configured:true,armed:false,reason:'disarmed'},coding:{configured:true,armed:false,reason:'disarmed'},autonomous:{configured:true,armed:false,reason:'disarmed'},host:{configured:true,armed:false,reason:'disarmed'}}});
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-audit-verify-'));const key=await generateTrustKeypair({privateKeyPath:path.join(root,'trust','private.pem'),publicKeyPath:path.join(root,'trust','public.pem')});
+  const audit=await createToolAudit({stateRoot:root,signingKeyPath:key.privateKeyPath,contextProvider:async()=>context(),maxSegmentRecords:2});
+  for(const tool of ['one','two']){const token=await audit.recordRequest(tool,{path:`${tool}.txt`});await audit.recordResult(token,{isError:false,structuredContent:{status:'ok',receipt_sha256:H(tool==='one'?'5':'6')}},null,1);}
+  return {root,key};
+}
+async function lines(file){return (await readFile(file,'utf8')).trim().split(/\r?\n/);}
+
+test('independent verifier accepts a clean signed multi-segment audit chain',async()=>{const f=await fixture();try{const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,true);assert.equal(result.event_count,4);assert.equal(result.request_count,2);assert.equal(result.result_count,2);assert.equal(result.segment_count,2);assert.equal(result.checkpoint_count,2);assert.equal(result.last_seq,4);assert.match(result.head_sha256,/^[0-9a-f]{64}$/);}finally{await rm(f.root,{recursive:true,force:true});}});
+
+test('verifier detects an edited event line',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','segment-00000001.jsonl');const row=await lines(file);const first=JSON.parse(row[0]);first.tool='tampered';row[0]=JSON.stringify(first);await writeFile(file,row.join('\n')+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/event hash mismatch/i);}finally{await rm(f.root,{recursive:true,force:true});}});
+
+test('verifier detects a deleted line',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','segment-00000001.jsonl');const row=await lines(file);await writeFile(file,row.slice(1).join('\n')+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/seq mismatch|prev hash mismatch|checkpoint/i);}finally{await rm(f.root,{recursive:true,force:true});}});
+
+test('verifier detects reordered lines',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','segment-00000001.jsonl');const row=await lines(file);await writeFile(file,[row[1],row[0]].join('\n')+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/seq mismatch|prev hash mismatch/i);}finally{await rm(f.root,{recursive:true,force:true});}});
+
+test('verifier detects a forged checkpoint signature',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','checkpoint-00000001.json');const cp=JSON.parse(await readFile(file,'utf8'));const sig=Buffer.from(cp.attestation.signature_base64,'base64');sig[0]^=0xff;cp.attestation.signature_base64=sig.toString('base64');await writeFile(file,JSON.stringify(cp)+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/signature invalid/i);}finally{await rm(f.root,{recursive:true,force:true});}});
+
+test('verifier detects broken cross-segment continuity even if the edited event self-hash is recomputed',async()=>{const f=await fixture();try{const file=path.join(f.root,'audit','segment-00000002.jsonl');const row=await lines(file);const first=JSON.parse(row[0]);first.prev_sha256=H('f');const {event_sha256:_old,...body}=first;first.event_sha256=sha(body);row[0]=JSON.stringify(first);await writeFile(file,row.join('\n')+'\n');const result=await verifyAuditChain({stateRoot:f.root,verifyKeyPath:f.key.publicKeyPath});assert.equal(result.ok,false);assert.match(result.reason,/prev hash mismatch/i);}finally{await rm(f.root,{recursive:true,force:true});}});