deadbyte-mcp 0.8.7

package/test/deferred-slot-operation.test.mjs

@@ -0,0 +1,18 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+test('R33 deferred slot operation exposes only exact activation or signed-receipt rollback',async()=>{
+  const source=await readFile(path.join(root,'scripts','deferred-slot-operation.mjs'),'utf8');
+  assert.match(source,/mode==='activate'/);
+  assert.match(source,/mode==='rollback'/);
+  assert.match(source,/verifySlotUpdateEnvelope/);
+  assert.match(source,/runSlotUpdateCli\(args,\{stateRoot\}\)/);
+  assert.match(source,/detached:true/);
+  assert.match(source,/rdc_operation_count:0/);
+  assert.doesNotMatch(source,/shell:\s*true/);
+  assert.doesNotMatch(source,/exec\(|execFile\(/);
+});

package/test/helpers/coding-crash-child.mjs

@@ -0,0 +1,22 @@
+import { loadCodingPolicy, createCodingRuntime } from '../../src/coding-plane.mjs';
+import { createCodingTaskRuntime } from '../../src/coding-task-runtime.mjs';
+
+const [policyPath, privateKeyPath, publicKeyPath, taskId] = process.argv.slice(2);
+if (!policyPath || !privateKeyPath || !publicKeyPath || !taskId) process.exit(64);
+const policy = await loadCodingPolicy(policyPath);
+const real = createCodingRuntime({ policy, signingKeyPath: privateKeyPath, verifyKeyPath: publicKeyPath });
+let keepAlive = null;
+const proxy = {
+  ...real,
+  policy: real.policy,
+  async fileWrite(args) {
+    const result = await real.fileWrite(args);
+    process.stdout.write('SIDE_EFFECT_RECEIPTED\n');
+    keepAlive = setInterval(() => {}, 1000);
+    await new Promise(() => {});
+    return result;
+  }
+};
+const tasks = createCodingTaskRuntime({ codingRuntime: proxy, signingKeyPath: privateKeyPath, verifyKeyPath: publicKeyPath });
+await tasks.run({ taskId, maxSteps: 1 });
+if (keepAlive) clearInterval(keepAlive);

package/test/host-plane.test.mjs

@@ -0,0 +1,129 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  HOST_ARM_SCHEMA,
+  HOST_POLICY_SCHEMA,
+  assertHostArmed,
+  hostExec,
+  hostFileRead,
+  hostFileWrite,
+  loadHostPolicy
+} from '../src/host-plane.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+
+async function fixture({ expiresMs = 60_000 } = {}) {
+  const dir = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-host-plane-'));
+  const root = path.join(dir, 'root');
+  await mkdir(root);
+  const arm = path.join(dir, 'arm.json');
+  const policyPath = path.join(dir, 'policy.json');
+  const executableSha = sha(await readFile(process.execPath));
+  const policyRaw = {
+    schema: HOST_POLICY_SCHEMA,
+    enabled: true,
+    arm_file: arm,
+    max_read_bytes: 262144,
+    max_write_bytes: 1048576,
+    roots: {
+      core: { path: root, read: true, write: true, exec: true }
+    },
+    commands: {
+      node_script: {
+        kind: 'script',
+        executable: process.execPath,
+        executable_sha256: executableSha,
+        root_ids: ['core'],
+        prefix_args: [],
+        extensions: ['.mjs'],
+        timeout_ms: 5000,
+        max_output_bytes: 65536
+      }
+    }
+  };
+  const policyBytes = Buffer.from(JSON.stringify(policyRaw, null, 2) + '\n');
+  await writeFile(policyPath, policyBytes);
+  const policy = await loadHostPolicy(policyPath);
+  await writeFile(arm, JSON.stringify({
+    schema: HOST_ARM_SCHEMA,
+    policy_sha256: policy.policy_sha256,
+    instance_nonce: randomBytes(32).toString('hex'),
+    armed_at_utc: new Date().toISOString(),
+    expires_at_utc: new Date(Date.now() + expiresMs).toISOString()
+  }, null, 2));
+  return { dir, root, arm, policy };
+}
+
+test('privileged host plane requires a live policy-bound arm lease', async () => {
+  const f = await fixture();
+  const armed = await assertHostArmed(f.policy);
+  assert.ok(armed.remaining_ms > 0);
+  const expired = await fixture({ expiresMs: -1 });
+  await assert.rejects(() => assertHostArmed(expired.policy), /arm expired/);
+});
+
+test('host_file_write is root-scoped hash-precondition and host_file_read returns a verified digest', async () => {
+  const f = await fixture();
+  const first = await hostFileWrite(f.policy, {
+    rootId: 'core', relativePath: 'src/new.mjs', content: 'export const n = 1;\n', encoding: 'utf8', expectedSha256: 'absent'
+  });
+  assert.equal(first.created, true);
+  const read = await hostFileRead(f.policy, { rootId: 'core', relativePath: 'src/new.mjs', encoding: 'utf8' });
+  assert.equal(read.sha256, first.sha256);
+  assert.equal(read.content, 'export const n = 1;\n');
+
+  await assert.rejects(() => hostFileWrite(f.policy, {
+    rootId: 'core', relativePath: 'src/new.mjs', content: 'bad\n', encoding: 'utf8', expectedSha256: '0'.repeat(64)
+  }), /hash precondition mismatch/);
+
+  const second = await hostFileWrite(f.policy, {
+    rootId: 'core', relativePath: 'src/new.mjs', content: 'export const n = 2;\n', encoding: 'utf8', expectedSha256: first.sha256
+  });
+  assert.equal(second.created, false);
+  assert.notEqual(second.sha256, first.sha256);
+});
+
+test('host file plane denies path traversal and symlink escape', async t => {
+  const f = await fixture();
+  await assert.rejects(() => hostFileRead(f.policy, { rootId: 'core', relativePath: '../outside.txt' }), /escapes|path/);
+  const outside = path.join(f.dir, 'outside');
+  await mkdir(outside);
+  await writeFile(path.join(outside, 'x.txt'), 'x\n');
+  const link = path.join(f.root, 'link');
+  try {
+    await symlink(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
+  } catch (error) {
+    if (['EPERM', 'EACCES'].includes(error?.code)) {
+      t.skip('symlink creation is not permitted in this environment');
+      return;
+    }
+    throw error;
+  }
+  await assert.rejects(() => hostFileRead(f.policy, { rootId: 'core', relativePath: 'link/x.txt' }), /symlink escapes|outside/);
+  await assert.rejects(() => hostFileWrite(f.policy, {
+    rootId: 'core', relativePath: 'link/y.txt', content: 'y\n', encoding: 'utf8', expectedSha256: 'absent'
+  }), /symlink escapes|outside/);
+});
+
+test('host_exec runs only a hash-pinned script through a hash-pinned executable with no shell string', async () => {
+  const f = await fixture();
+  const script = 'console.log(JSON.stringify({ok:true,args:process.argv.slice(2)}));\n';
+  await writeFile(path.join(f.root, 'run.mjs'), script);
+  const scriptSha = sha(Buffer.from(script));
+  const result = await hostExec(f.policy, {
+    commandId: 'node_script', rootId: 'core', scriptPath: 'run.mjs', scriptSha256: scriptSha, args: ['A', 'B'], timeoutMs: 2000
+  });
+  assert.equal(result.exit_code, 0);
+  assert.equal(result.timed_out, false);
+  assert.deepEqual(JSON.parse(result.stdout.trim()), { ok: true, args: ['A', 'B'] });
+  await assert.rejects(() => hostExec(f.policy, {
+    commandId: 'node_script', rootId: 'core', scriptPath: 'run.mjs', scriptSha256: 'f'.repeat(64), args: []
+  }), /script hash mismatch/);
+  await assert.rejects(() => hostExec(f.policy, {
+    commandId: 'cmd', rootId: 'core', scriptPath: 'run.mjs', scriptSha256: scriptSha, args: []
+  }), /not allowed/);
+});

package/test/machine-fs-mcp-tools.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { registerMachineFsTools } from '../src/machine-fs-mcp-tools.mjs';
+
+class FakeServer {
+  constructor() { this.tools = new Map(); }
+  registerTool(name, spec, handler) { this.tools.set(name, { spec, handler }); }
+}
+const hex = ch => ch.repeat(64);
+function runtime() {
+  return {
+    stat: async () => ({ status:'ok', root_id:'core', path:'a.txt', kind:'file', bytes:1, mtime_utc:new Date(0).toISOString(), sha256:hex('a'), identity_sha256:hex('b') }),
+    list: async () => ({ status:'ok', root_id:'core', path:'.', entries:[], next_cursor:null }),
+    read: async () => ({ status:'ok', root_id:'core', path:'a.txt', offset:0, next_offset:1, file_size:1, eof:true, data_base64:'YQ==', data_sha256:hex('a'), file_sha256:hex('a') }),
+    write: async () => ({ status:'committed', root_id:'core', path:'a.txt', previous_sha256:null, sha256:hex('a'), bytes:1, created:true, receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
+    editExact: async () => ({ status:'committed', root_id:'core', path:'a.txt', previous_sha256:hex('a'), sha256:hex('b'), bytes:1, replacements:1, receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
+    mkdir: async () => ({ status:'committed', root_id:'core', path:'d', identity_sha256:hex('a'), receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
+    move: async () => ({ status:'committed', root_id:'core', source_path:'a', destination_path:'b', identity_sha256:hex('a'), receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
+    delete: async () => ({ status:'committed', root_id:'core', path:'a', identity_sha256:hex('a'), recovery_key:hex('b'), receipt_id:'a'.repeat(24), receipt_sha256:hex('c'), request_sha256:hex('d') })
+  };
+}
+test('R31 registers exactly eight bounded machine filesystem tools', () => {
+  const server = new FakeServer();
+  registerMachineFsTools(server, { runtime: runtime() });
+  assert.deepEqual([...server.tools.keys()].sort(), [
+    'machine_fs_delete','machine_fs_edit_exact','machine_fs_list','machine_fs_mkdir',
+    'machine_fs_move','machine_fs_read','machine_fs_stat','machine_fs_write'
+  ]);
+  for (const [name, tool] of server.tools) {
+    assert.ok(tool.spec.inputSchema, `${name} input schema missing`);
+    assert.ok(tool.spec.outputSchema, `${name} output schema missing`);
+  }
+});
+
+test('R31 machine filesystem schemas expose root-relative IDs/preconditions only', () => {
+  const server = new FakeServer();
+  registerMachineFsTools(server, { runtime: runtime() });
+  const write = server.tools.get('machine_fs_write').spec.inputSchema;
+  const move = server.tools.get('machine_fs_move').spec.inputSchema;
+  const del = server.tools.get('machine_fs_delete').spec.inputSchema;
+  assert.equal(write.safeParse({ root_id:'core', path:'a.txt', content:'x', encoding:'utf8', expected_sha256:'absent' }).success, true);
+  assert.equal(write.safeParse({ root_id:'core', path:'C:\\Windows\\x', content:'x', executable:'cmd.exe', expected_sha256:'absent' }).success, false);
+  assert.equal(move.safeParse({ root_id:'core', source_path:'a', destination_path:'b', expected_source_identity:hex('a') }).success, true);
+  assert.equal(move.safeParse({ root_id:'core', source_path:'a', destination_path:'b', pid:1234, expected_source_identity:hex('a') }).success, false);
+  assert.equal(del.safeParse({ root_id:'core', path:'a', expected_source_identity:hex('a') }).success, true);
+});

package/test/machine-fs-runtime.test.mjs

@@ -0,0 +1,105 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createMachineFsRuntime, verifyMachineFsReceiptFile } from '../src/machine-fs.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-machine-fs-'));
+  const project = path.join(root, 'project');
+  await mkdir(project);
+  const policyPath = path.join(root, 'coding-policy.json');
+  const grantPath = path.join(root, 'coding-grant.json');
+  await writeFile(policyPath, JSON.stringify({
+    schema: 'deadbyte.coding-policy.v1', enabled: true,
+    lease_file: grantPath, evidence_dir: path.join(root, 'evidence'),
+    roots: { project: { path: project, read: true, write: true, exec: false, deny_paths: ['blocked'] } },
+    commands: {}, max_read_bytes: 65536, max_write_bytes: 65536
+  }));  const policy = await loadCodingPolicy(policyPath);
+  await writeFile(grantPath, JSON.stringify({
+    schema: 'deadbyte.coding-grant.v2', policy_sha256: policy.policy_sha256,
+    instance_nonce: 'b'.repeat(64), root_ids: ['project'], granted_at_utc: new Date().toISOString()
+  }));
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(root, 'private.pem'), publicKeyPath: path.join(root, 'public.pem')
+  });
+  const runtime = createMachineFsRuntime({
+    policy, signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath
+  });
+  return { root, project, policy, keys, runtime };
+}
+
+test('R31 machine fs supports exact mkdir/write/stat/list/range-read/edit/move/delete lifecycle', async () => {
+  const f = await fixture();
+  const made = await f.runtime.mkdir({ rootId: 'project', relativePath: 'dir' });
+  assert.equal(made.status, 'committed');
+  const written = await f.runtime.write({
+    rootId: 'project', relativePath: 'dir/a.txt', encoding: 'utf8', content: 'alpha beta gamma', expectedSha256: 'absent'
+  });
+  assert.equal(written.status, 'committed');
+  const stat = await f.runtime.stat({ rootId: 'project', relativePath: 'dir/a.txt', hash: true });
+  assert.equal(stat.sha256, sha(Buffer.from('alpha beta gamma')));
+  assert.match(stat.identity_sha256, /^[0-9a-f]{64}$/);  const page1 = await f.runtime.list({ rootId: 'project', relativePath: 'dir', limit: 1 });
+  assert.equal(page1.entries.length, 1);
+  assert.equal(page1.entries[0].path, 'dir/a.txt');
+  assert.equal(page1.next_cursor, null);
+  const read = await f.runtime.read({ rootId: 'project', relativePath: 'dir/a.txt', offset: 6, maxBytes: 4 });
+  assert.equal(Buffer.from(read.data_base64, 'base64').toString('utf8'), 'beta');
+  assert.equal(read.next_offset, 10);
+  const edited = await f.runtime.editExact({
+    rootId: 'project', relativePath: 'dir/a.txt', expectedSha256: written.sha256,
+    oldString: 'beta', newString: 'BETA', expectedReplacements: 1
+  });
+  assert.equal(edited.replacements, 1);
+  const beforeMove = await f.runtime.stat({ rootId: 'project', relativePath: 'dir/a.txt', hash: true });
+  const moved = await f.runtime.move({
+    rootId: 'project', sourcePath: 'dir/a.txt', destinationPath: 'dir/b.txt',
+    expectedSourceIdentity: beforeMove.identity_sha256
+  });
+  assert.equal(moved.status, 'committed');
+  const beforeDelete = await f.runtime.stat({ rootId: 'project', relativePath: 'dir/b.txt', hash: true });
+  const deleted = await f.runtime.delete({ rootId: 'project', relativePath: 'dir/b.txt', expectedSourceIdentity: beforeDelete.identity_sha256 });
+  assert.equal(deleted.status, 'committed');
+  const dirStat = await f.runtime.stat({ rootId: 'project', relativePath: 'dir' });
+  const removedDir = await f.runtime.delete({ rootId: 'project', relativePath: 'dir', expectedSourceIdentity: dirStat.identity_sha256 });
+  assert.equal(removedDir.status, 'committed');
+});test('R31 machine fs listing is deterministic and cursor-paged', async () => {
+  const f = await fixture();
+  for (const name of ['c.txt', 'a.txt', 'b.txt']) await writeFile(path.join(f.project, name), name);
+  const first = await f.runtime.list({ rootId: 'project', relativePath: '.', limit: 2 });
+  assert.deepEqual(first.entries.map(item => item.path), ['a.txt', 'b.txt']);
+  assert.equal(typeof first.next_cursor, 'string');
+  const second = await f.runtime.list({ rootId: 'project', relativePath: '.', limit: 2, cursor: first.next_cursor });
+  assert.deepEqual(second.entries.map(item => item.path), ['c.txt']);
+  assert.equal(second.next_cursor, null);
+});
+
+test('R31 machine fs fails closed on traversal, denied paths and stale source identity', async () => {
+  const f = await fixture();
+  await mkdir(path.join(f.project, 'blocked'));
+  await writeFile(path.join(f.project, 'x.txt'), 'one');
+  await assert.rejects(() => f.runtime.stat({ rootId: 'project', relativePath: '../escape' }), /relative|traversal|path/i);
+  await assert.rejects(() => f.runtime.stat({ rootId: 'project', relativePath: 'blocked' }), /denied/i);
+  const before = await f.runtime.stat({ rootId: 'project', relativePath: 'x.txt', hash: true });
+  await writeFile(path.join(f.project, 'x.txt'), 'two');
+  await assert.rejects(() => f.runtime.move({
+    rootId: 'project', sourcePath: 'x.txt', destinationPath: 'y.txt', expectedSourceIdentity: before.identity_sha256
+  }), /identity.*mismatch/i);
+});test('R31 machine fs mutation receipt verifies independently', async () => {
+  const f = await fixture();
+  const made = await f.runtime.mkdir({ rootId: 'project', relativePath: 'proofdir' });
+  assert.match(made.receipt_id, /^[0-9a-f]{24}$/);
+  assert.match(made.receipt_sha256, /^[0-9a-f]{64}$/);
+  const verified = await verifyMachineFsReceiptFile({
+    policy: f.policy, verifyKeyPath: f.keys.publicKeyPath, receiptId: made.receipt_id
+  });
+  assert.equal(verified.ok, true);
+  assert.equal(verified.signature_valid, true);
+  assert.equal(verified.operation, 'machine_fs_mkdir');
+});

package/test/machine-identity.test.mjs

@@ -0,0 +1,131 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  createMachineRuntime,
+  initializeMachineIdentity,
+  verifyMachinePing
+} from '../src/machine-identity.mjs';
+import * as machineIdentity from '../src/machine-identity.mjs';
+
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+async function writeActiveBinding(stateRoot, marker) {
+  const releaseRoot = path.join(stateRoot, 'releases', `release-${marker}`);
+  const generationRoot = path.join(stateRoot, 'generations', `generation-${marker}`);
+  await mkdir(releaseRoot, { recursive: true });
+  await mkdir(generationRoot, { recursive: true });
+  const manifestBytes = Buffer.from(`${marker}-release\n`, 'utf8');
+  const generationBytes = Buffer.from(`${marker}-generation\n`, 'utf8');
+  await writeFile(path.join(releaseRoot, 'MANIFEST.SHA256'), manifestBytes);
+  await writeFile(path.join(generationRoot, 'GENERATION.SHA256'), generationBytes);
+  const manifest = sha256(manifestBytes);
+  const generationManifest = sha256(generationBytes);
+  const pointer = {
+    schema: 'deadbyte.active-release.v1',
+    release_id: `v0.8.5-${manifest.slice(0, 16)}`,
+    version: '0.8.5',
+    manifest_sha256: manifest,
+    release_root: releaseRoot,
+    generation_root: generationRoot,
+    generation_manifest_sha256: generationManifest,
+    launcher_sha256: '1'.repeat(64),
+    config_path: path.join(generationRoot, 'controller-config.psd1')
+  };
+  const pointerPath = path.join(stateRoot, 'active-release.json');
+  await writeFile(pointerPath, `${JSON.stringify(pointer, null, 2)}\n`);
+  return { pointerPath, pointer, generationManifest };
+}
+
+test('R29 machine identity is stable across generations and signs generation-bound pings', async () => {
+  const stateRoot = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r29-machine-'));
+  try {
+    const first = await initializeMachineIdentity({ stateRoot });
+    const second = await initializeMachineIdentity({ stateRoot });
+    assert.equal(first.created, true);
+    assert.equal(second.created, false);
+    assert.equal(first.machine_id, second.machine_id);
+    assert.match(first.machine_id, /^[0-9a-f]{64}$/);
+
+    const bindingA = await writeActiveBinding(stateRoot, 'a');
+    const runtimeA = await createMachineRuntime({ stateRoot, activePointerPath: bindingA.pointerPath });
+    const statusA = await runtimeA.status();
+    assert.equal(statusA.status, 'ok');
+    assert.equal(statusA.machine_id, first.machine_id);
+    assert.equal(sha256(Buffer.from(statusA.public_key_spki_base64, 'base64')), first.machine_id);
+    assert.equal(statusA.release_id, bindingA.pointer.release_id);
+    assert.equal(statusA.generation_manifest_sha256, bindingA.generationManifest);
+    assert.ok(Array.isArray(statusA.capabilities));
+    assert.ok(statusA.capabilities.includes('machine_identity'));
+
+    const pingA = await runtimeA.ping({ nonce: 'abc123' });
+    assert.equal(pingA.status, 'ok');
+    assert.equal(pingA.machine_id, first.machine_id);
+    assert.equal(pingA.nonce, 'abc123');
+    assert.equal(pingA.generation_manifest_sha256, bindingA.generationManifest);
+    assert.equal(pingA.attestation.algorithm, 'ed25519');
+    assert.equal(await verifyMachinePing({ stateRoot, ping: pingA }), true);
+    assert.equal(typeof machineIdentity.verifyMachinePingPublic, 'function');
+    assert.equal(await machineIdentity.verifyMachinePingPublic({ ping: pingA, publicKeySpkiBase64: statusA.public_key_spki_base64 }), true);
+
+    const bindingB = await writeActiveBinding(stateRoot, 'b');
+    const runtimeB = await createMachineRuntime({ stateRoot, activePointerPath: bindingB.pointerPath });
+    const statusB = await runtimeB.status();
+    assert.equal(statusB.machine_id, first.machine_id);
+    assert.equal(statusB.generation_manifest_sha256, bindingB.generationManifest);
+    assert.notEqual(statusB.generation_manifest_sha256, statusA.generation_manifest_sha256);
+
+    const pingB = await runtimeB.ping({ nonce: 'xyz789' });
+    assert.equal(await verifyMachinePing({ stateRoot, ping: pingB }), true);
+    assert.equal(pingB.machine_id, pingA.machine_id);
+    assert.notEqual(pingB.generation_manifest_sha256, pingA.generation_manifest_sha256);
+
+    const tampered = structuredClone(pingB);
+    tampered.nonce = 'tampered';
+    assert.equal(await verifyMachinePing({ stateRoot, ping: tampered }), false);
+  } finally {
+    await rm(stateRoot, { recursive: true, force: true });
+  }
+});
+
+test('R29 revoke increments generation and invalidates previous machine-runtime epoch', async () => {
+  const stateRoot = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r29-revoke-'));
+  try {
+    const binding = await writeActiveBinding(stateRoot, 'revoke');
+    const runtime = await createMachineRuntime({ stateRoot, activePointerPath: binding.pointerPath });
+    const before = await runtime.status();
+    const revoked = await runtime.revoke({ reason: 'operator_test' });
+    assert.equal(revoked.status, 'revoked');
+    assert.equal(revoked.machine_id, before.machine_id);
+    assert.equal(revoked.previous_identity_generation, before.identity_generation);
+    assert.equal(revoked.identity_generation, before.identity_generation + 1);
+    const after = await runtime.status();
+    assert.equal(after.identity_generation, revoked.identity_generation);
+    assert.notEqual(after.online_epoch, before.online_epoch);
+  } finally {
+    await rm(stateRoot, { recursive: true, force: true });
+  }
+});
+
+test('R29 concurrent identity initialization converges on one key without destructive cleanup', async () => {
+  const stateRoot = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r29-race-'));
+  try {
+    const results = await Promise.allSettled([
+      initializeMachineIdentity({ stateRoot }),
+      initializeMachineIdentity({ stateRoot }),
+      initializeMachineIdentity({ stateRoot })
+    ]);
+    assert.equal(results.filter(item => item.status === 'rejected').length, 0);
+    const ids = new Set(results.map(item => item.value.machine_id));
+    assert.equal(ids.size, 1);
+    const observed = await initializeMachineIdentity({ stateRoot });
+    assert.equal(observed.created, false);
+    assert.equal(observed.machine_id, [...ids][0]);
+  } finally {
+    await rm(stateRoot, { recursive: true, force: true });
+  }
+});

package/test/machine-mcp-integration.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { releaseId } from '../src/release-slot.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+
+async function activeState(root) {
+  const releaseRoot = path.join(root, 'releases', 'fixture');
+  const generationRoot = path.join(root, 'generations', 'fixture');
+  await mkdir(releaseRoot, { recursive: true });
+  await mkdir(generationRoot, { recursive: true });
+  const releaseBytes = Buffer.from('release fixture\n');
+  const generationBytes = Buffer.from('generation fixture\n');
+  await writeFile(path.join(releaseRoot, 'MANIFEST.SHA256'), releaseBytes);
+  await writeFile(path.join(generationRoot, 'GENERATION.SHA256'), generationBytes);
+  const manifest = sha(releaseBytes);
+  const pointer = {
+    schema: 'deadbyte.active-release.v1', release_id: releaseId('0.8.5', manifest), version: '0.8.5',
+    manifest_sha256: manifest, release_root: releaseRoot, generation_root: generationRoot,
+    generation_manifest_sha256: sha(generationBytes), launcher_sha256: '1'.repeat(64),
+    config_path: path.join(generationRoot, 'controller-config.psd1')
+  };
+  await writeFile(path.join(root, 'active-release.json'), `${JSON.stringify(pointer, null, 2)}\n`);
+}
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r29-mcp-'));
+  const trust = path.join(root, 'trust');
+  await mkdir(trust, { recursive: true });
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'), publicKeyPath: path.join(trust, 'public.pem')
+  });
+  await activeState(root);
+  const client = new Client(
+    { name: 'deadbyte-r29-machine-test', version: '0.8.5' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath, args: [serverPath], cwd: repoRoot,
+    env: {
+      ...getDefaultEnvironment(), DEADBYTE_STATE_ROOT: root, DEADBYTE_MACHINE_RUNTIME: '1',
+      DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+      DEADBYTE_AGENT_RUNTIME: '0', DEADBYTE_CODING_RUNTIME: '0', DEADBYTE_AUTONOMOUS_RUNTIME: '0'
+    }, stderr: 'pipe'
+  });
+  return { root, client, transport };
+}
+test('R29 stdio catalog exposes strict machine identity tools and signed generation-bound ping', async () => {
+  const f = await fixture();
+  try {
+    await f.client.connect(f.transport);
+    const listed = await f.client.listTools();
+    const machineNames = listed.tools.map(tool => tool.name).filter(name => name.startsWith('machine_')).sort();
+    assert.deepEqual(machineNames, ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status']);
+    for (const name of machineNames) {
+      const tool = listed.tools.find(item => item.name === name);
+      assert.equal(tool.outputSchema?.type, 'object');
+      assert.equal(tool.outputSchema?.additionalProperties, false);
+    }
+    const status = await f.client.callTool({ name: 'machine_status', arguments: {} });
+    assert.equal(status.structuredContent.status, 'ok');
+    assert.match(status.structuredContent.machine_id, /^[0-9a-f]{64}$/);
+    assert.equal(status.structuredContent.release_id.startsWith('v0.8.5-'), true);
+    const ping = await f.client.callTool({ name: 'machine_ping', arguments: { nonce: 'live-proof' } });
+    assert.equal(ping.structuredContent.status, 'ok');
+    assert.equal(ping.structuredContent.nonce, 'live-proof');
+    assert.equal(ping.structuredContent.machine_id, status.structuredContent.machine_id);
+    assert.equal(ping.structuredContent.attestation.algorithm, 'ed25519');
+    const denied = await f.client.callTool({ name: 'machine_revoke', arguments: { reason: 'remote-denied' } });
+    assert.equal(denied.isError, true);
+    assert.equal(denied.structuredContent.status, 'denied');
+    assert.match(denied.structuredContent.error, /host plane is not configured/);
+  } finally {
+    await f.client.close().catch(() => {});
+    await rm(f.root, { recursive: true, force: true }).catch(() => {});
+  }
+});

package/test/machine-mcp-tools.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { registerMachineTools } from '../src/machine-mcp-tools.mjs';
+
+function fakeServer() {
+  const tools = new Map();
+  return {
+    tools,
+    registerTool(name, spec, handler) { tools.set(name, { spec, handler }); }
+  };
+}
+
+const MACHINE_ID = 'a'.repeat(64);
+const GEN = 'b'.repeat(64);
+const REL = 'c'.repeat(64);
+const EPOCH = 'd'.repeat(64);
+
+function status() {
+  return {
+    status: 'ok', machine_id: MACHINE_ID, public_key_spki_base64: Buffer.from('spki').toString('base64'),
+    identity_generation: 3, online_epoch: EPOCH, hostname: 'TESTBOX', platform: 'win32', architecture: 'x64', release_id: 'v0.8.5-aaaaaaaaaaaaaaaa',
+    release_manifest_sha256: REL, generation_manifest_sha256: GEN,
+    capabilities: ['machine_identity', 'machine_ping', 'machine_revoke']
+  };
+}
+
+function pingValue(nonce, fill) {
+  return {
+    status: 'ok', schema: 'deadbyte.machine-ping.v1', machine_id: MACHINE_ID,
+    identity_generation: 3, online_epoch: EPOCH, release_id: 'v0.8.5-aaaaaaaaaaaaaaaa',
+    release_manifest_sha256: REL, generation_manifest_sha256: GEN, nonce,
+    observed_at_utc: new Date().toISOString(),
+    attestation: { algorithm: 'ed25519', key_id: MACHINE_ID, signature_base64: Buffer.alloc(64, fill).toString('base64') }
+  };
+}
+test('R29 machine MCP catalog registers four strict tools and protects revoke with local host authority', async () => {
+  const server = fakeServer();
+  let revokeCalls = 0;
+  let authorityChecks = 0;
+  const runtime = {
+    async list() { return { status: 'ok', machines: [status()] }; },
+    async status() { return status(); },
+    async ping({ nonce }) { return pingValue(nonce, 7); },
+    async revoke() { revokeCalls += 1; return { status: 'revoked', machine_id: MACHINE_ID, previous_identity_generation: 3, identity_generation: 4, online_epoch: 'e'.repeat(64) }; }
+  };
+  registerMachineTools(server, { runtime, assertRevokeAuthority: async () => { authorityChecks += 1; } });
+  assert.deepEqual([...server.tools.keys()].sort(), ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status']);
+  for (const { spec } of server.tools.values()) {
+    assert.equal(spec.outputSchema.type, 'object');
+  }
+  const machineStatus = await server.tools.get('machine_status').handler({});
+  assert.equal(machineStatus.structuredContent.public_key_spki_base64, Buffer.from('spki').toString('base64'));
+  const ping = await server.tools.get('machine_ping').handler({ nonce: 'proof-1' });
+  assert.equal(ping.structuredContent.status, 'ok');
+  assert.equal(ping.structuredContent.nonce, 'proof-1');
+  const revoked = await server.tools.get('machine_revoke').handler({ reason: 'operator' });
+  assert.equal(revoked.structuredContent.status, 'revoked');
+  assert.equal(authorityChecks, 1);
+  assert.equal(revokeCalls, 1);
+});
+
+test('R29 machine revoke fails closed before runtime mutation when host authority denies', async () => {
+  const server = fakeServer();
+  let revokeCalls = 0;
+  registerMachineTools(server, {
+    runtime: { async list() { return { status: 'ok', machines: [status()] }; }, async status() { return status(); },
+      async ping({ nonce }) { return pingValue(nonce, 1); },
+      async revoke() { revokeCalls += 1; throw new Error('should not run'); } },
+    assertRevokeAuthority: async () => { throw new Error('host plane disarmed'); }
+  });
+  const denied = await server.tools.get('machine_revoke').handler({ reason: 'remote' });
+  assert.equal(denied.isError, true);
+  assert.equal(denied.structuredContent.status, 'denied');
+  assert.match(denied.structuredContent.error, /host plane disarmed/);
+  assert.equal(revokeCalls, 0);
+});

package/test/mcp-contained-smoke-isolation.test.mjs

@@ -0,0 +1,14 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const smoke = fileURLToPath(new URL('../src/mcp-contained-smoke-client.mjs', import.meta.url));
+
+test('contained smoke uses an isolated temporary workspace and cleans it', async () => {
+  const source = await readFile(smoke, 'utf8');
+  assert.doesNotMatch(source, /const workspaceRoot = path\.join\(repoRoot, 'workspaces'\)/);
+  assert.match(source, /deadbyte-mcp-contained-workspaces-/);
+  assert.match(source, /copyFile\(/);
+  assert.match(source, /await rm\(workspaceRoot, \{ recursive: true, force: true \}\)/);
+});