deadbyte-mcp 0.8.7

package/test/named-tunnel-host.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const sourcePath = fileURLToPath(new URL('../native/deadbyte-tunnel-host.cpp', import.meta.url));
+const buildPath = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+const controllerPath = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+
+test('R28 named tunnel host directly launches the pinned cloudflared with an external token file', async () => {
+  const [source, build, controller] = await Promise.all([
+    readFile(sourcePath, 'utf8'), readFile(buildPath, 'utf8'), readFile(controllerPath, 'utf8')
+  ]);
+  assert.match(source, /JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE/);
+  assert.match(source, /--token-file/);
+  assert.match(source, /TUNNEL_URL/);
+  assert.match(source, /http:\/\/127\.0\.0\.1:8787/);
+  assert.doesNotMatch(source, /wrangler|node\.exe|CLOUDFLARED_PATH/i);
+  assert.doesNotMatch(source, /rigos\.site|179b85ef|Users\\\\DEADBYTE/i);
+  assert.match(build, /deadbyte-tunnel-host\.cpp/);
+  assert.match(build, /deadbyte-tunnel-host\.exe/);
+  assert.match(build, /System32\\cmd\.exe/);
+  assert.doesNotMatch(build, /& \$env:ComSpec \/d \/s \/c/);
+  assert.match(controller, /Dependencies/);
+  assert.match(controller, /Assert-ComponentDependencies \$Name \$Spec 'before start'/);
+  assert.match(controller, /Reason='dependency-hash-mismatch'/);
+});

package/test/native-diff.test.mjs

@@ -0,0 +1,102 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { access, mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createCodingRuntime, loadCodingPolicy } from '../src/coding-plane.mjs';
+import { loadAutonomousPolicy } from '../src/autonomous-policy.mjs';
+import { createNativeDiffRuntime } from '../src/native-diff.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const exists = file => access(file).then(() => true, () => false);
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-native-diff-'));
+  const project = path.join(root, 'project'); const trust = path.join(root, 'trust');
+  await mkdir(project); await mkdir(trust);
+  const keys = await generateTrustKeypair({ privateKeyPath:path.join(trust,'private.pem'), publicKeyPath:path.join(trust,'public.pem') });
+  const codingPolicyPath = path.join(root, 'coding-policy.json');
+  await writeFile(codingPolicyPath, JSON.stringify({ schema:'deadbyte.coding-policy.v1', enabled:true,
+    lease_file:path.join(root,'coding-lease.json'), evidence_dir:path.join(root,'coding-evidence'),
+    roots:{ project:{ path:project, read:true, write:true, exec:true, deny_paths:[] } }, commands:{} }, null, 2));
+  const codingPolicy = await loadCodingPolicy(codingPolicyPath);
+  await writeFile(codingPolicy.lease_file, JSON.stringify({ schema:'deadbyte.coding-lease.v1', policy_sha256:codingPolicy.policy_sha256,
+    instance_nonce:randomBytes(32).toString('hex'), root_ids:['project'], armed_at_utc:new Date().toISOString(),
+    expires_at_utc:new Date(Date.now()+3600000).toISOString() }));
+  const autonomousPolicyPath = path.join(root, 'autonomous-policy.json');
+  await writeFile(autonomousPolicyPath, JSON.stringify({ schema:'deadbyte.autonomous-policy.v1', enabled:true,
+    lease_file:path.join(root,'autonomous-lease.json'), evidence_dir:path.join(root,'autonomous-evidence'),
+    root_ids:['project'], coding_policy_sha256:codingPolicy.policy_sha256,
+    planner:{ backend:'client_sampling', max_tokens:2048 }, profiles:{}, limits:{ max_files_per_diff:8 } }, null, 2));
+  const policy = await loadAutonomousPolicy(autonomousPolicyPath, codingPolicy);
+  await writeFile(policy.lease_file, JSON.stringify({ schema:'deadbyte.autonomous-lease.v1', policy_sha256:policy.policy_sha256,
+    instance_nonce:randomBytes(32).toString('hex'), root_ids:['project'], armed_at_utc:new Date().toISOString(),
+    expires_at_utc:new Date(Date.now()+1800000).toISOString() }));
+  const codingRuntime = createCodingRuntime({ policy:codingPolicy, signingKeyPath:keys.privateKeyPath, verifyKeyPath:keys.publicKeyPath });
+  const nativeDiff = createNativeDiffRuntime({ policy, codingRuntime, signingKeyPath:keys.privateKeyPath, verifyKeyPath:keys.publicKeyPath });
+  return { root, project, keys, policy, codingRuntime, nativeDiff };
+}
+
+test('native diff commits exact preconditioned edits and independently verifies coding receipts', async () => {
+  const f = await fixture();
+  try {
+    const a = path.join(f.project,'a.txt'); await writeFile(a,'alpha\n');
+    const before = sha(await readFile(a));
+    const preview = await f.nativeDiff.preview({ rootId:'project', title:'edit+create', operations:[
+      { kind:'replace', path:'a.txt', expected_sha256:before, old_string:'alpha', new_string:'beta', expected_replacements:1 },
+      { kind:'write', path:'b.txt', expected_sha256:'absent', encoding:'utf8', content:'new\n' }
+    ] });
+    assert.equal(preview.operation_count, 2);
+    const applied = await f.nativeDiff.apply({ diffId:preview.diff_id });
+    assert.equal(applied.status, 'committed');
+    assert.equal(await readFile(a,'utf8'), 'beta\n');
+    assert.equal(await readFile(path.join(f.project,'b.txt'),'utf8'), 'new\n');
+    const verified = await f.nativeDiff.verify({ diffId:preview.diff_id });
+    assert.equal(verified.ok, true); assert.equal(verified.coding_receipts_verified, 2);
+    assert.equal(verified.current_state_matches, true);
+    const again = await f.nativeDiff.apply({ diffId:preview.diff_id });
+    assert.equal(again.status, 'existing');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('native diff rolls back earlier operations when a later operation fails', async () => {
+  const f = await fixture();
+  try {
+    const target = path.join(f.project,'target.txt'); await writeFile(target,'before\n');
+    const before = sha(await readFile(target));
+    const preview = await f.nativeDiff.preview({ rootId:'project', title:'rollback', operations:[
+      { kind:'write', path:'created.txt', expected_sha256:'absent', content:'temporary\n', encoding:'utf8' },
+      { kind:'replace', path:'target.txt', expected_sha256:before, old_string:'before', new_string:'after', expected_replacements:1 }
+    ] });
+    const sabotaged = Object.freeze({ ...f.codingRuntime,
+      textReplace: async () => { throw new Error('forced second-op failure'); } });
+    const runtime = createNativeDiffRuntime({ policy:f.policy, codingRuntime:sabotaged,
+      signingKeyPath:f.keys.privateKeyPath, verifyKeyPath:f.keys.publicKeyPath });
+    await assert.rejects(runtime.apply({ diffId:preview.diff_id }), /rolled back/);
+    assert.equal(await exists(path.join(f.project,'created.txt')), false);
+    assert.equal(await readFile(target,'utf8'), 'before\n');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('autonomous application scope isolates repeated identical native diffs across goals', async () => {
+  const f = await fixture();
+  try {
+    const target = path.join(f.project,'repeat.txt'); await writeFile(target,'READY\n');
+    const before = sha(await readFile(target));
+    const operation = { kind:'replace', path:'repeat.txt', expected_sha256:before,
+      old_string:'READY', new_string:'ALMOST', expected_replacements:1 };
+    const first = await f.nativeDiff.preview({ rootId:'project', title:'same patch', operations:[operation],
+      applicationScope:'a'.repeat(64) });
+    assert.equal((await f.nativeDiff.apply({ diffId:first.diff_id })).status, 'committed');
+    const almostSha = sha(Buffer.from('ALMOST\n'));
+    await f.codingRuntime.textReplace({ rootId:'project', relativePath:'repeat.txt', oldString:'ALMOST',
+      newString:'READY', expectedSha256:almostSha, expectedReplacements:1, receiptId:'a1b2c3d4e5f60718293a4b5c' });
+    const second = await f.nativeDiff.preview({ rootId:'project', title:'same patch', operations:[operation],
+      applicationScope:'b'.repeat(64) });
+    assert.notEqual(first.diff_id, second.diff_id);
+    assert.equal((await f.nativeDiff.apply({ diffId:second.diff_id })).status, 'committed');
+    assert.equal(await readFile(target,'utf8'), 'ALMOST\n');
+    assert.equal((await f.nativeDiff.apply({ diffId:second.diff_id })).status, 'existing');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});

package/test/observation-integration.test.mjs

@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+const read = async rel => readFile(fileURLToPath(new URL(rel, import.meta.url)), 'utf8');
+
+test('R32 core registers observation only behind explicit read-only feature flag', async () => {
+  const source = await read('../src/mcp-server.mjs');
+  assert.match(source, /DEADBYTE_OBSERVATION_RUNTIME/);
+  assert.match(source, /createObservationRuntime/);
+  assert.match(source, /registerObservationTools/);
+  assert.match(source, /observationRuntimeMode === '1'/);
+  assert.match(source, /requires DEADBYTE_MACHINE_RUNTIME=1/);
+  assert.match(source, /requires DEADBYTE_CODING_RUNTIME=1/);
+});
+
+test('R32 controller and generation bind observation runtime explicitly', async () => {
+  const controller = await read('../controller/deadbyte-controller.ps1');
+  const example = await read('../controller/deadbyte-controller.config.psd1.example');
+  const generation = await read('../src/release-generation.mjs');
+  assert.match(controller, /ObservationRuntimeEnabled/);
+  assert.match(controller, /DEADBYTE_OBSERVATION_RUNTIME/);
+  assert.match(controller, /Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME/);
+  assert.match(example, /ObservationRuntimeEnabled = \$false/);
+  assert.match(generation, /ObservationRuntimeEnabled/);
+  assert.match(generation, /observation_runtime_enabled/);
+});
+
+test('R32 updater exposes explicit observation enable and threads it into the candidate', async () => {
+  const source = await read('../src/runtime-update.mjs');
+  assert.match(source, /--enable-observation/);
+  assert.match(source, /enableObservation:false/);
+  assert.match(source, /enableObservation=true/);
+  assert.match(source, /ObservationRuntimeEnabled=true/);
+  assert.match(source, /enableObservation:args\.enableObservation/);
+});
+
+test('R32 exact remote catalog adds six observation tools and disarmed gate requires 68 after named action', async () => {
+  const source = await read('../src/remote-mcp-smoke-client.mjs');
+  const disarmed = await read('../src/remote-mcp-r24-disarmed-smoke-client.mjs');
+  assert.match(source, /const observationTools = \[/);
+  for (const name of ['machine_search_start','machine_search_page','machine_search_status','machine_search_cancel','machine_process_list','machine_system_status']) {
+    assert.match(source, new RegExp(`'${name}'`));
+  }
+  assert.match(source, /observation_runtime: observationRuntime/);
+  assert.match(disarmed, /listed\.tools\.length !== 68/);
+  assert.match(disarmed, /tool_count:68/);
+});
+
+test('R32 package and Windows gate include observation live smoke before final manifest verify', async () => {
+  const pkg = JSON.parse(await read('../package.json'));
+  const gate = await read('../scripts/gate-windows.ps1');
+  assert.equal(pkg.scripts['mcp:observation:smoke'], 'node src/observation-smoke-client.mjs');
+  assert.match(gate, /mcp-observation-smoke/);
+  assert.match(gate, /mcp:observation:smoke/);
+});

package/test/observation-mcp-tools.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { registerObservationTools } from '../src/observation-mcp-tools.mjs';
+
+class FakeServer {
+  constructor(){ this.tools=new Map(); }
+  registerTool(name,spec,handler){ this.tools.set(name,{spec,handler}); }
+}
+const hex=ch=>ch.repeat(64);
+const receipt='a'.repeat(24);
+function runtime(){
+  return {
+    searchStart:async()=>({status:'accepted',search_id:hex('a'),state:'pending',request_sha256:hex('b')}),
+    searchPage:async()=>({status:'ok',search_id:hex('a'),state:'completed',results:[],next_cursor:null,result_head_sha256:hex('c'),request_sha256:hex('b'),receipt_id:receipt,receipt_sha256:hex('d')}),
+    searchStatus:async()=>({status:'ok',search_id:hex('a'),state:'completed',result_count:0,files_scanned:0,bytes_scanned:0,truncated:false,request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d'),error:null}),
+    searchCancel:async()=>({status:'ok',search_id:hex('a'),state:'cancelled',cancel_requested:true}),
+    processList:async()=>({status:'ok',snapshot_id:hex('e'),observed_at_utc:new Date(0).toISOString(),processes:[],next_cursor:null,request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')}),
+    systemStatus:async()=>({status:'ok',observed_at_utc:new Date(0).toISOString(),hostname:'x',platform:'win32',architecture:'x64',uptime_seconds:1,total_memory_bytes:2,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0],request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')})
+  };
+}
+
+test('R32 registers exactly six bounded observation tools',()=>{
+  const server=new FakeServer(); registerObservationTools(server,{runtime:runtime()});
+  assert.deepEqual([...server.tools.keys()].sort(),[
+    'machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'
+  ]);
+  for(const [name,tool] of server.tools){ assert.ok(tool.spec.inputSchema,`${name} input`); assert.ok(tool.spec.outputSchema,`${name} output`); }
+});
+test('R32 observation schemas expose only bounded read-only inputs',()=>{
+  const server=new FakeServer(); registerObservationTools(server,{runtime:runtime()});
+  const start=server.tools.get('machine_search_start').spec.inputSchema;
+  const process=server.tools.get('machine_process_list').spec.inputSchema;
+  const system=server.tools.get('machine_system_status').spec.inputSchema;
+  assert.equal(start.safeParse({root_id:'core',path:'.',pattern:'needle',max_results:100,max_files:1000,max_bytes:1048576,max_file_bytes:262144}).success,true);
+  assert.equal(start.safeParse({root_id:'core',path:'C:\\Windows',pattern:'x',command:'cmd.exe'}).success,false);
+  assert.equal(process.safeParse({limit:50,include_external:true}).success,true);
+  assert.equal(process.safeParse({limit:50,pid:1234,kill:true}).success,false);
+  assert.equal(system.safeParse({}).success,true);
+  assert.equal(system.safeParse({refresh:true}).success,false);
+});

package/test/observation-runtime.test.mjs

@@ -0,0 +1,123 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createObservationRuntime, verifyObservationReceiptFile } from '../src/observation-runtime.mjs';
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-observation-'));
+  const project = path.join(root, 'project');
+  await mkdir(project); await mkdir(path.join(project, 'blocked'));
+  const policyPath = path.join(root, 'coding-policy.json');
+  await writeFile(policyPath, JSON.stringify({
+    schema:'deadbyte.coding-policy.v1', enabled:true,
+    lease_file:path.join(root,'coding-grant.json'), evidence_dir:path.join(root,'evidence'),
+    roots:{ project:{ path:project, read:true, write:true, exec:false, deny_paths:['blocked'] } },
+    commands:{}, max_read_bytes:65536, max_write_bytes:65536
+  }));
+  const policy = await loadCodingPolicy(policyPath);
+  const keys = await generateTrustKeypair({ privateKeyPath:path.join(root,'private.pem'), publicKeyPath:path.join(root,'public.pem') });
+  let processCalls = 0;
+  const processSnapshotProvider = async () => {
+    processCalls++;
+    return [
+      { pid:404, parent_pid:1, name:'external.exe', executable_path:'C:/x/external.exe', command_line:'external --secret' },
+      { pid:303, parent_pid:1, name:'owned.exe', executable_path:'C:/x/owned.exe', command_line:'owned --ok' }
+    ];
+  };
+  const systemSnapshotProvider = async () => ({
+    hostname:'TESTBOX', platform:'win32', architecture:'x64', uptime_seconds:123,
+    total_memory_bytes:1024, free_memory_bytes:256, cpu_count:8, load_average:[0,0,0]
+  });
+  const processRuntime = { list: async () => ({ sessions:[{ session_id:'a'.repeat(64), child_pid:303 }] }) };
+  const runtime = createObservationRuntime({
+    policy, signingKeyPath:keys.privateKeyPath, verifyKeyPath:keys.publicKeyPath,
+    processRuntime, stateRoot:root, processSnapshotProvider, systemSnapshotProvider,
+    ownedRuntimePidProvider: async () => new Set([111])
+  });
+  return { root, project, policy, keys, runtime, getProcessCalls:() => processCalls };
+}
+
+async function waitTerminal(runtime, searchId) {
+  const started = Date.now();
+  for (;;) {
+    const status = await runtime.searchStatus({ searchId });
+    if (['completed','cancelled','failed'].includes(status.state)) return status;
+    if (Date.now() - started > 3000) throw new Error('observation search timeout');
+    await new Promise(resolve => setTimeout(resolve, 10));
+  }
+}
+
+test('R32 search is deterministic, paged, signed and independent from coding mutation grant', async () => {
+  const f = await fixture();
+  await writeFile(path.join(f.project,'b.txt'),'needle b\n');
+  await writeFile(path.join(f.project,'a.txt'),'first\nneedle a\n');
+  await writeFile(path.join(f.project,'blocked','hidden.txt'),'needle hidden\n');
+  const started = await f.runtime.searchStart({ rootId:'project', relativePath:'.', pattern:'needle', maxResults:10, maxFiles:32, maxBytes:65536 });
+  assert.match(started.search_id,/^[0-9a-f]{64}$/);
+  assert.match(started.request_sha256,/^[0-9a-f]{64}$/);
+  const done = await waitTerminal(f.runtime, started.search_id);
+  assert.equal(done.state,'completed');
+  assert.equal(done.result_count,2);
+  assert.match(done.result_head_sha256,/^[0-9a-f]{64}$/);
+  assert.match(done.receipt_id,/^[0-9a-f]{24}$/);
+  const p1 = await f.runtime.searchPage({ searchId:started.search_id, limit:1 });
+  assert.deepEqual(p1.results.map(item => item.path),['a.txt']);
+  assert.equal(typeof p1.next_cursor,'string');
+  const p2 = await f.runtime.searchPage({ searchId:started.search_id, limit:1, cursor:p1.next_cursor });
+  assert.deepEqual(p2.results.map(item => item.path),['b.txt']);
+  assert.equal(p2.next_cursor,null);
+  const verified = await verifyObservationReceiptFile({ policy:f.policy, verifyKeyPath:f.keys.publicKeyPath, receiptId:done.receipt_id });
+  assert.equal(verified.ok,true);
+  assert.equal(verified.signature_valid,true);
+  assert.equal(verified.request_sha256,started.request_sha256);
+  assert.equal(verified.result_head_sha256,done.result_head_sha256);
+});
+
+test('R32 search cancellation is cooperative and receipted', async () => {
+  const f = await fixture();
+  for (let i=0;i<50;i++) await writeFile(path.join(f.project,`${String(i).padStart(3,'0')}.txt`),`needle ${i}\n`);
+  const started = await f.runtime.searchStart({ rootId:'project', relativePath:'.', pattern:'needle', maxResults:100, maxFiles:100, maxBytes:262144 });
+  const cancelled = await f.runtime.searchCancel({ searchId:started.search_id });
+  assert.equal(cancelled.cancel_requested,true);
+  const done = await waitTerminal(f.runtime, started.search_id);
+  assert.equal(done.state,'cancelled');
+  assert.match(done.receipt_id,/^[0-9a-f]{24}$/);
+});
+test('R32 process observation is snapshot-paged and separates owned from external OS processes', async () => {
+  const f = await fixture();
+  const first = await f.runtime.processList({ limit:1, includeExternal:true });
+  assert.equal(first.processes.length,1);
+  assert.equal(first.processes[0].pid,303);
+  assert.equal(first.processes[0].ownership,'deadbyte-session');
+  assert.equal(first.processes[0].command_line,'owned --ok');
+  assert.equal(typeof first.next_cursor,'string');
+  const second = await f.runtime.processList({ limit:1, includeExternal:true, cursor:first.next_cursor });
+  assert.equal(second.processes[0].pid,404);
+  assert.equal(second.processes[0].ownership,'external');
+  assert.equal(second.processes[0].command_line,null);
+  assert.equal(second.processes[0].executable_path,null);
+  assert.equal(second.next_cursor,null);
+  assert.equal(f.getProcessCalls(),1,'cursor must page the same immutable snapshot');
+  assert.match(first.receipt_id,/^[0-9a-f]{24}$/);
+  const verified = await verifyObservationReceiptFile({ policy:f.policy, verifyKeyPath:f.keys.publicKeyPath, receiptId:first.receipt_id });
+  assert.equal(verified.ok,true);
+  assert.equal(verified.signature_valid,true);
+});
+
+test('R32 system observation is timestamped and signed without mutation authority', async () => {
+  const f = await fixture();
+  const status = await f.runtime.systemStatus();
+  assert.equal(status.hostname,'TESTBOX');
+  assert.equal(status.cpu_count,8);
+  assert.equal(status.total_memory_bytes,1024);
+  assert.match(status.observed_at_utc,/Z$/);
+  assert.match(status.request_sha256,/^[0-9a-f]{64}$/);
+  assert.match(status.result_head_sha256,/^[0-9a-f]{64}$/);
+  const verified = await verifyObservationReceiptFile({ policy:f.policy, verifyKeyPath:f.keys.publicKeyPath, receiptId:status.receipt_id });
+  assert.equal(verified.ok,true);
+  assert.equal(verified.result_head_sha256,status.result_head_sha256);
+});

package/test/output-schema.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { structuredToolResult, workspaceOpenOutputSchema } from '../src/output-contracts.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const workspaceRoot = path.join(repoRoot, 'workspaces');
+
+const EXPECTED_TOOLS = [
+  'agent_task_approve', 'agent_task_cancel', 'agent_task_events',
+  'agent_task_run', 'agent_task_status', 'agent_task_submit',
+  'agent_task_verify', 'contained_transform', 'evidence_verify',
+  'file_read',
+  'proof_execute', 'workspace_open'
+];
+
+async function fixture() {
+  const trust = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-output-schema-'));
+  const keys = await generateTrustKeypair({
+    privateKeyPath: path.join(trust, 'private.pem'),
+    publicKeyPath: path.join(trust, 'public.pem')
+  });  const client = new Client(
+    { name: 'deadbyte-output-schema-test', version: '0.8.0' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [serverPath],
+    cwd: repoRoot,
+    env: {
+      ...getDefaultEnvironment(),
+      DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+      DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
+      DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+      DEADBYTE_AGENT_RUNTIME: '1'
+    },
+    stderr: 'pipe'
+  });
+  return { trust, client, transport };
+}
+
+test('R27 hermetic base-plus-agent catalog advertises 12 strict output schemas', async () => {
+  const f = await fixture();
+  try {
+    await f.client.connect(f.transport);
+    const listed = await f.client.listTools();
+    const names = listed.tools.map(tool => tool.name).sort();
+    assert.deepEqual(names, EXPECTED_TOOLS);
+    for (const tool of listed.tools) {
+      assert.ok(tool.outputSchema, `${tool.name} missing outputSchema`);
+      assert.equal(tool.outputSchema.type, 'object', `${tool.name} outputSchema root must be object`);
+      assert.equal(tool.outputSchema.additionalProperties, false, `${tool.name} outputSchema must reject unknown top-level fields`);
+      assert.ok(tool.outputSchema.properties && typeof tool.outputSchema.properties === 'object', `${tool.name} outputSchema properties missing`);
+    }
+  } finally {
+    await f.client.close().catch(() => {});
+    await rm(f.trust, { recursive: true, force: true }).catch(() => {});
+  }
+});
+
+test('DEADBYTE validates structured output locally even on isError paths', () => {
+  const validError = structuredToolResult(
+    workspaceOpenOutputSchema,
+    { status: 'denied', error: 'test denial' },
+    true
+  );
+  assert.equal(validError.isError, true);
+  assert.equal(validError.structuredContent.status, 'denied');
+
+  assert.throws(
+    () => structuredToolResult(workspaceOpenOutputSchema, { status: 'ok', workspace_id: 'demo' }),
+    /DEADBYTE output contract violation/
+  );
+  assert.throws(
+    () => structuredToolResult(workspaceOpenOutputSchema, { status: 'denied', error: 'x', extra: true }, true),
+    /DEADBYTE output contract violation/
+  );
+});

package/test/package-boundary.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const expectedWorkspacePayload = [
+  'workspaces/autonomous-live/fixture.txt',
+  'workspaces/demo/input.txt'
+];
+
+function packFiles() {
+  const npmExec = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  const result = spawnSync(process.execPath, [npmExec, 'pack', '--dry-run', '--json', '--ignore-scripts'], {
+    cwd: root, encoding: 'utf8', windowsHide: true, maxBuffer: 8 * 1024 * 1024
+  });
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  const parsed = JSON.parse(result.stdout);
+  const entry = Array.isArray(parsed) ? parsed[0] : Object.values(parsed)[0];
+  assert.equal(entry.name, 'deadbyte-mcp');
+  return entry.files.map(item => item.path.replaceAll('\\', '/')).sort();
+}
+
+test('R28 package boundary contains only immutable workspace seed files', () => {
+  const files = packFiles();
+  const workspacePayload = files.filter(rel => rel.startsWith('workspaces/'));
+  assert.deepEqual(workspacePayload, expectedWorkspacePayload);
+  assert.equal(workspacePayload.some(rel => rel.includes('/evidence/')), false);
+  assert.equal(workspacePayload.some(rel => /contained-smoke|mcp-output/.test(rel)), false);
+});
+
+
+test('publish boundary excludes live state, private keys, grants and non-example controller secrets',()=>{
+  const files=packFiles();
+  const forbidden=files.filter(rel=>/(^|\/)(active-release\.json|runtime\/|audit\/|evidence\/)|\.pem$|(^|\/)deadbyte-controller\.config\.psd1$|(^|\/)deadbyte-host-policy\.json$|(^|\/)[^/]*(?:grant|arm)\.json$/i.test(rel));
+  assert.deepEqual(forbidden,[]);
+});

package/test/process-mcp-tools.test.mjs

@@ -0,0 +1,71 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { registerProcessTools } from '../src/process-mcp-tools.mjs';
+
+class FakeServer {
+  constructor() { this.tools = new Map(); }
+  registerTool(name, spec, handler) { this.tools.set(name, { spec, handler }); }
+}
+
+const hex = ch => ch.repeat(64);
+function session(state = 'running') {
+  return {
+    session_id: hex('a'), profile_id: 'hold', root_id: 'core', cwd: '.', child_pid: 1234,
+    creation_filetime: '133700000000000000', state, exit_code: state === 'running' ? null : 0,
+    earliest_offset: 0, stream_head: 4, stream_sha256: hex('b'), journal_head_sha256: hex('c')
+  };
+}
+
+function runtime() {
+  return {
+    start: async () => session(), read: async () => ({
+      session_id: hex('a'), offset: 0, next_offset: 4, earliest_offset: 0, stream_head: 4,
+      stream_sha256: hex('b'), truncated: false, data_base64: 'VEVTVA==', state: 'running', exit_code: null
+    }),
+    status: async () => session(), list: async () => ({ sessions: [session()] }),
+    action: async ({ actionId }) => ({ action_id: actionId, logical_bytes: 4, logical_sha256: hex('d'), session: session() }),
+    terminate: async () => session('terminated')
+  };
+}
+test('R32 registers exactly six bounded process supervision tools', () => {
+  const server = new FakeServer();
+  registerProcessTools(server, { runtime: runtime() });
+  assert.deepEqual([...server.tools.keys()].sort(), [
+    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'
+  ]);
+  for (const [name, tool] of server.tools) {
+    assert.ok(tool.spec.inputSchema, `${name} input schema missing`);
+    assert.ok(tool.spec.outputSchema, `${name} output schema missing`);
+    const text = String(tool.spec.description ?? '').toLowerCase();
+    assert.doesNotMatch(text, /arbitrary shell|raw stdin/);
+  }
+});
+
+test('R32 process tool inputs expose IDs and bounds but no executable or raw input field', () => {
+  const server = new FakeServer();
+  registerProcessTools(server, { runtime: runtime() });
+  const start = server.tools.get('process_session_start').spec.inputSchema;
+  const terminate = server.tools.get('process_session_terminate').spec.inputSchema;
+  const action = server.tools.get('process_session_action').spec.inputSchema;
+  assert.equal(start.safeParse({ profile_id: 'hold', root_id: 'core', cwd: '.', args: [] }).success, true);
+  assert.equal(start.safeParse({ profile_id: 'hold', root_id: 'core', executable: 'cmd.exe' }).success, false);
+  assert.equal(start.safeParse({ profile_id: 'hold', root_id: 'core', input: 'whoami' }).success, false);
+  assert.equal(terminate.safeParse({ session_id: hex('a') }).success, true);
+  assert.equal(terminate.safeParse({ pid: 1234 }).success, false);
+  assert.equal(action.safeParse({ session_id: hex('a'), action_id: 'ping' }).success, true);
+  for (const forbidden of ['input','command','executable','environment','pid']) {
+    assert.equal(action.safeParse({ session_id: hex('a'), action_id: 'ping', [forbidden]: 'forbidden' }).success, false);
+  }
+});
+
+test('R32 process action handler returns only strict logical identity and updated session state', async () => {
+  const server = new FakeServer();
+  registerProcessTools(server, { runtime: runtime() });
+  const tool = server.tools.get('process_session_action');
+  const result = await tool.handler({ session_id: hex('a'), action_id: 'ping' });
+  assert.equal(result.isError, false);
+  assert.deepEqual(Object.keys(result.structuredContent).sort(), ['action_id','logical_bytes','logical_sha256','session','status']);
+  assert.equal(result.structuredContent.action_id, 'ping');
+  assert.equal(result.structuredContent.session.state, 'running');
+  assert.equal(tool.spec.outputSchema.safeParse({ ...result.structuredContent, raw_input: 'forbidden' }).success, false);
+});

package/test/process-native.test.mjs

@@ -0,0 +1,78 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { randomBytes } from 'node:crypto';
+import { access } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const host = path.join(root, 'bin', 'deadbyte-process-host.exe');
+const cmd = 'C:\\Windows\\System32\\cmd.exe';
+
+test('R30 native process host supervises one fixed child and captures output', { skip: process.platform !== 'win32' }, async () => {
+  await access(host);
+  const jobId = randomBytes(32).toString('hex');
+  const child = spawn(host, [cmd, root, jobId, '/d', '/c', 'echo DBR30NATIVE:42'], {
+    cwd: root, windowsHide: true, shell: false, stdio: ['ignore', 'pipe', 'pipe']
+  });
+  let stdout = '';
+  let stderr = '';
+  child.stdout.on('data', chunk => { stdout += chunk.toString('utf8'); });
+  child.stderr.on('data', chunk => { stderr += chunk.toString('utf8'); });
+  const exit = await new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => resolve({ code, signal }));
+  });
+  const firstLine = stdout.split(/\r?\n/, 1)[0];
+  assert.match(firstLine, /^DEADBYTE_PROCESS_HOST_READY /);
+  const ready = JSON.parse(firstLine.slice('DEADBYTE_PROCESS_HOST_READY '.length));
+  assert.equal(ready.job_id, jobId);
+  assert.ok(Number.isInteger(ready.child_pid) && ready.child_pid > 0);
+  assert.match(String(ready.creation_filetime), /^[0-9]+$/);
+  assert.match(stdout, /DBR30NATIVE:42/);
+  assert.match(stdout, /DEADBYTE_PROCESS_HOST_EXIT /);
+  assert.equal(exit.signal, null, stderr);
+  assert.equal(exit.code, 0, stderr);
+});
+test('R31 native process host pipe transport preserves an interactive owned session', { skip: process.platform !== 'win32' }, async () => {
+  await access(host);
+  const jobId = randomBytes(32).toString('hex');
+  const child = spawn(host, [cmd, root, jobId, '--deadbyte-transport=pipe', '/d', '/q'], {
+    cwd: root, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe']
+  });
+  let stdout = '', stderr = '';
+  child.stdout.on('data', chunk => { stdout += chunk.toString('utf8'); });
+  child.stderr.on('data', chunk => { stderr += chunk.toString('utf8'); });
+  const closed = new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => resolve({ code, signal }));
+  });
+  const waitFor = async marker => {
+    const end = Date.now() + 5000;
+    while (!stdout.includes(marker) && Date.now() < end) await new Promise(r => setTimeout(r, 25));
+    assert.match(stdout, new RegExp(marker), stderr);
+  };
+  try {
+    await waitFor('DEADBYTE_PROCESS_HOST_READY ');
+    const readyLine = stdout.split(/\r?\n/).find(line => line.startsWith('DEADBYTE_PROCESS_HOST_READY '));
+    const ready = JSON.parse(readyLine.slice('DEADBYTE_PROCESS_HOST_READY '.length));
+    child.stdin.write('set DBPIPE_NATIVE_STATE=42\r\n');
+    child.stdin.write('echo DBPIPE_STATE:%DBPIPE_NATIVE_STATE%\r\n');
+    child.stdin.write('echo DBPIPE_CWD:%CD%\r\n');
+    await waitFor('DBPIPE_STATE:42');
+    await waitFor('DBPIPE_CWD:');
+    assert.ok(stdout.indexOf('DBPIPE_STATE:42') < stdout.indexOf('DBPIPE_CWD:'), 'pipe output order changed');
+    assert.match(stdout.toLowerCase(), new RegExp(`dbpipe_cwd:${root.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&').toLowerCase()}`));
+    child.stdin.write('exit\r\n');
+    const exit = await closed;
+    assert.equal(exit.signal, null, stderr);
+    assert.equal(exit.code, 0, stderr);
+    assert.throws(() => process.kill(ready.child_pid, 0), /ESRCH|not found|no such process/i);
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill();
+      await closed.catch(() => {});
+    }
+  }
+});