deadbyte-mcp 0.8.7

package/controller/deadbyte-controller.ps1

@@ -0,0 +1,1090 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [Parameter(Position=0)]
+    [ValidateSet('menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest','armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest','armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest')]
+    [string]$Command = 'menu'
+)
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+$ControllerSchema = 'deadbyte.controller.v1'
+$Root = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RuntimeDir = if ($env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) { [System.IO.Path]::GetFullPath([string]$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) } else { Join-Path $Root 'runtime' }
+$LogDir = Join-Path $RuntimeDir 'logs'
+$ConfigPath = if ($env:DEADBYTE_CONTROLLER_CONFIG) { $env:DEADBYTE_CONTROLLER_CONFIG } else { Join-Path $Root 'deadbyte-controller.config.psd1' }
+
+function Fail([string]$Message) { throw "DEADBYTE controller: $Message" }
+function Ensure-Directory([string]$Path) { if (-not (Test-Path -LiteralPath $Path -PathType Container)) { New-Item -ItemType Directory -Path $Path -Force | Out-Null } }
+function Ledger-Path([string]$Name) { Join-Path $RuntimeDir ("{0}.instance.json" -f $Name.ToLowerInvariant()) }
+function Log-Path([string]$Name, [string]$Kind) { Join-Path $LogDir ("{0}.{1}.log" -f $Name.ToLowerInvariant(), $Kind) }
+
+
+function Read-TextFileSafe([string]$Path) {
+    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
+    $text = Get-Content -LiteralPath $Path -Raw -Encoding UTF8
+    if ($null -eq $text) { return '' }
+    return [string]$text
+}
+
+function Get-Config {
+    if (-not (Test-Path -LiteralPath $ConfigPath -PathType Leaf)) {
+        Fail "missing trusted config '$ConfigPath'; copy deadbyte-controller.config.psd1.example and set exact long-lived executable paths"
+    }
+    $cfg = Import-PowerShellDataFile -LiteralPath $ConfigPath
+    if ($cfg.Schema -ne $ControllerSchema) { Fail 'controller config schema mismatch' }
+    $coreRoot = if ($cfg.ContainsKey('CoreRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CoreRoot)) { [string]$cfg.CoreRoot } else { Split-Path -Parent $Root }
+    $coreRoot = [System.IO.Path]::GetFullPath($coreRoot)
+    if (-not (Test-Path -LiteralPath (Join-Path $coreRoot 'package.json') -PathType Leaf) -or -not (Test-Path -LiteralPath (Join-Path $coreRoot 'src\mcp-server.mjs') -PathType Leaf)) {
+        Fail "CoreRoot is not a DEADBYTE MCP package: $coreRoot"
+    }
+    $cfg['CoreRoot'] = $coreRoot
+    $workspaceRoot = if ($cfg.ContainsKey('WorkspaceRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.WorkspaceRoot)) { [string]$cfg.WorkspaceRoot } else { Join-Path $coreRoot 'workspaces' }
+    $workspaceRoot = [System.IO.Path]::GetFullPath($workspaceRoot)
+    if (-not (Test-Path -LiteralPath $workspaceRoot -PathType Container)) { Fail "WorkspaceRoot missing: $workspaceRoot" }
+    $cfg['WorkspaceRoot'] = $workspaceRoot
+    foreach ($name in @('Bridge','Cloud')) {
+        $spec = $cfg[$name]
+        if (-not $spec -or -not $spec.ContainsKey('FilePath') -or [string]::IsNullOrWhiteSpace([string]$spec.FilePath)) { Fail "$name FilePath missing" }
+        if (-not $spec.ContainsKey('Arguments')) { Fail "$name Arguments field missing" }
+        if (-not $spec.ContainsKey('WorkingDirectory')) { Fail "$name WorkingDirectory field missing" }
+        if (-not (Test-Path -LiteralPath $spec.FilePath -PathType Leaf)) { Fail "$name executable missing: $($spec.FilePath)" }
+        if (-not $spec.ContainsKey('FileSha256') -or [string]$spec.FileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$name FileSha256 invalid" }
+        $componentExecutableHash = Get-ExecutableHash ([string]$spec.FilePath)
+        if ($componentExecutableHash -ne [string]$spec.FileSha256) { Fail "$name executable hash mismatch: expected $($spec.FileSha256), found $componentExecutableHash" }
+        if ([string]::IsNullOrWhiteSpace([string]$spec.WorkingDirectory) -or -not (Test-Path -LiteralPath $spec.WorkingDirectory -PathType Container)) {
+            Fail "$name WorkingDirectory missing: $($spec.WorkingDirectory)"
+        }
+        Normalize-ComponentDependencies $name $spec
+        if ($name -eq 'Cloud' -and $spec.ContainsKey('Transport')) {
+            $transport = [string]$spec.Transport
+            $dependencyCount = @($spec.Dependencies).Count
+            if ($transport -eq 'deadbyte.named-tunnel.v1') {
+                if ($dependencyCount -ne 3) { Fail 'deadbyte.named-tunnel.v1 requires exactly three pinned dependencies' }
+            } elseif ($transport -eq 'deadbyte.named-tunnel.v2') {
+                if ($dependencyCount -ne 2) { Fail 'deadbyte.named-tunnel.v2 requires exactly cloudflared plus token-file pins' }
+            } else { Fail 'Cloud Transport unsupported' }
+        }
+        if ($name -eq 'Bridge') {
+            if (-not $spec.ContainsKey('ScriptPath') -or [string]::IsNullOrWhiteSpace([string]$spec.ScriptPath)) { Fail 'Bridge ScriptPath missing' }
+            if (-not $spec.ContainsKey('ScriptSha256') -or [string]$spec.ScriptSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'Bridge ScriptSha256 invalid' }
+            $scriptPath = [System.IO.Path]::GetFullPath([string]$spec.ScriptPath)
+            if (-not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) { Fail "Bridge ScriptPath missing: $scriptPath" }
+            $scriptHash = Get-ExecutableHash $scriptPath
+            if ($scriptHash -ne [string]$spec.ScriptSha256) { Fail "bridge script hash mismatch: expected $($spec.ScriptSha256), found $scriptHash" }
+            $spec['ScriptPath'] = $scriptPath
+        }
+    }
+    $cloudTransport = if ($cfg.Cloud.ContainsKey('Transport')) { [string]$cfg.Cloud.Transport } else { '' }
+    if ($cloudTransport -eq 'deadbyte.named-tunnel.v2') {
+        if (-not $cfg.ContainsKey('McpUrlFile') -or [string]::IsNullOrWhiteSpace([string]$cfg.McpUrlFile)) { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFile' }
+        if (-not $cfg.ContainsKey('McpUrlFileSha256') -or [string]$cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
+        $mcpUrlFile = [System.IO.Path]::GetFullPath([string]$cfg.McpUrlFile)
+        if (-not (Test-Path -LiteralPath $mcpUrlFile -PathType Leaf)) { Fail "McpUrlFile missing: $mcpUrlFile" }
+        $mcpUrlItem = Get-Item -LiteralPath $mcpUrlFile -Force
+        if (($mcpUrlItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail 'McpUrlFile must not be a reparse point' }
+        $mcpUrlHash = Get-ExecutableHash $mcpUrlFile
+        if ($mcpUrlHash -ne [string]$cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($cfg.McpUrlFileSha256), found $mcpUrlHash" }
+        $cfg['McpUrlFile'] = $mcpUrlFile
+    }
+    if ($cfg.ContainsKey('HostPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.HostPolicyFile)) {
+        $hostPolicy = [System.IO.Path]::GetFullPath([string]$cfg.HostPolicyFile)
+        if (-not (Test-Path -LiteralPath $hostPolicy -PathType Leaf)) { Fail "HostPolicyFile missing: $hostPolicy" }
+        $cfg['HostPolicyFile'] = $hostPolicy
+    } else {
+        $cfg['HostPolicyFile'] = ''
+    }
+    if ($cfg.ContainsKey('MachineRuntimeEnabled')) {
+        if ($cfg.MachineRuntimeEnabled -isnot [bool]) { Fail 'MachineRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['MachineRuntimeEnabled'] = $true
+    }
+    if ($cfg.ContainsKey('AgentRuntimeEnabled')) {
+        if ($cfg.AgentRuntimeEnabled -isnot [bool]) { Fail 'AgentRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['AgentRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('ProcessRuntimeEnabled')) {
+        if ($cfg.ProcessRuntimeEnabled -isnot [bool]) { Fail 'ProcessRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['ProcessRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('ProcessPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.ProcessPolicyFile)) {
+        $processPolicy = [System.IO.Path]::GetFullPath([string]$cfg.ProcessPolicyFile)
+        if (-not (Test-Path -LiteralPath $processPolicy -PathType Leaf)) { Fail "ProcessPolicyFile missing: $processPolicy" }
+        $cfg['ProcessPolicyFile'] = $processPolicy
+    } else {
+        $cfg['ProcessPolicyFile'] = ''
+    }
+    if ([bool]$cfg.ProcessRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.ProcessPolicyFile)) { Fail 'ProcessRuntimeEnabled requires ProcessPolicyFile' }
+    if ($cfg.ContainsKey('CodingRuntimeEnabled')) {
+        if ($cfg.CodingRuntimeEnabled -isnot [bool]) { Fail 'CodingRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['CodingRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('CodingPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) {
+        $codingPolicy = [System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile)
+        if (-not (Test-Path -LiteralPath $codingPolicy -PathType Leaf)) { Fail "CodingPolicyFile missing: $codingPolicy" }
+        $cfg['CodingPolicyFile'] = $codingPolicy
+    } else {
+        $cfg['CodingPolicyFile'] = ''
+    }
+    if ([bool]$cfg.CodingRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) { Fail 'CodingRuntimeEnabled requires CodingPolicyFile' }
+    if ($cfg.ContainsKey('MachineFsRuntimeEnabled')) {
+        if ($cfg.MachineFsRuntimeEnabled -isnot [bool]) { Fail 'MachineFsRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['MachineFsRuntimeEnabled'] = $false
+    }
+    if ([bool]$cfg.MachineFsRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'MachineFsRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ($cfg.ContainsKey('ObservationRuntimeEnabled')) {
+        if ($cfg.ObservationRuntimeEnabled -isnot [bool]) { Fail 'ObservationRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['ObservationRuntimeEnabled'] = $false
+    }
+    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.MachineRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires MachineRuntimeEnabled' }
+    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ($cfg.ContainsKey('AutonomousRuntimeEnabled')) {
+        if ($cfg.AutonomousRuntimeEnabled -isnot [bool]) { Fail 'AutonomousRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['AutonomousRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('AutonomousPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) {
+        $autonomousPolicy = [System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile)
+        if (-not (Test-Path -LiteralPath $autonomousPolicy -PathType Leaf)) { Fail "AutonomousPolicyFile missing: $autonomousPolicy" }
+        $cfg['AutonomousPolicyFile'] = $autonomousPolicy
+    } else {
+        $cfg['AutonomousPolicyFile'] = ''
+    }
+    if ([bool]$cfg.AutonomousRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'AutonomousRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ([bool]$cfg.AutonomousRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) { Fail 'AutonomousRuntimeEnabled requires AutonomousPolicyFile' }
+    if ([int]$cfg.StartTimeoutSeconds -lt 1 -or [int]$cfg.StartTimeoutSeconds -gt 120) { Fail 'StartTimeoutSeconds out of range' }
+    if ([int]$cfg.ProbeTimeoutSeconds -lt 1 -or [int]$cfg.ProbeTimeoutSeconds -gt 15) { Fail 'ProbeTimeoutSeconds out of range' }
+    return $cfg
+}
+
+function Assert-ControllerRootBound($Cfg) {
+    $expected = [System.IO.Path]::GetFullPath((Join-Path ([string]$Cfg.CoreRoot) 'controller')).TrimEnd('\')
+    $actual = [System.IO.Path]::GetFullPath($Root).TrimEnd('\')
+    if (-not [string]::Equals($actual, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
+        Fail "controller root mismatch: running '$actual', expected '$expected'; use canonical DEADBYTE-MCP.cmd"
+    }
+}
+
+function Get-ExecutableHash([string]$Path) {
+    (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+
+function Normalize-ComponentDependencies([string]$Name, $Spec) {
+    if (-not $Spec.ContainsKey('Dependencies')) { $Spec['Dependencies'] = @(); return }
+    $dependencies = @($Spec.Dependencies)
+    if ($dependencies.Count -gt 16) { Fail "$Name dependency count exceeds 16" }
+    $normalized = @()
+    foreach ($dependency in $dependencies) {
+        $depPath = [System.IO.Path]::GetFullPath([string]$dependency.Path)
+        $depHash = ([string]$dependency.Sha256).ToLowerInvariant()
+        if ([string]::IsNullOrWhiteSpace($depPath) -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing: $depPath" }
+        if ($depHash -cnotmatch '^[0-9a-f]{64}$') { Fail "$Name dependency SHA-256 invalid: $depPath" }
+        $item = Get-Item -LiteralPath $depPath -Force
+        if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "$Name dependency must not be a reparse point: $depPath" }
+        $actual = Get-ExecutableHash $depPath
+        if ($actual -ne $depHash) { Fail "$Name dependency hash mismatch in trusted config: $depPath" }
+        $depName = if ([string]::IsNullOrWhiteSpace([string]$dependency.Name)) { [System.IO.Path]::GetFileName($depPath) } else { [string]$dependency.Name }
+        $normalized += [ordered]@{ Name=$depName; Path=$depPath; Sha256=$depHash }
+    }
+    $Spec['Dependencies'] = $normalized
+}
+
+function Assert-ComponentDependencies([string]$Name, $Spec, [string]$Phase) {
+    foreach ($dependency in @($Spec.Dependencies)) {
+        $depPath = [string]$dependency.Path
+        $expected = [string]$dependency.Sha256
+        if (-not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing ${Phase}: $depPath" }
+        $actual = Get-ExecutableHash $depPath
+        if ($actual -ne $expected) { Fail "$Name dependency hash mismatch ${Phase}: $depPath expected $expected found $actual" }
+    }
+}
+
+function Get-LimitedProcessImagePath([int]$ProcessId) {
+    if (-not ('DeadbyteProcessQuery' -as [type])) {
+        $source = @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public static class DeadbyteProcessQuery {
+ [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inheritHandle, int processId);
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryFullProcessImageName(IntPtr process, uint flags, StringBuilder path, ref int size);
+ [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+ public static string GetImagePath(int processId) { const uint PROCESS_QUERY_LIMITED_INFORMATION=0x1000; IntPtr h=OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,false,processId); if(h==IntPtr.Zero)return null; try { var b=new StringBuilder(32768); int n=b.Capacity; return QueryFullProcessImageName(h,0,b,ref n)?b.ToString():null; } finally { CloseHandle(h); } }
+}
+'@
+        Add-Type -TypeDefinition $source -Language CSharp -ErrorAction Stop
+    }
+    try { $path=[DeadbyteProcessQuery]::GetImagePath($ProcessId); if ($null -eq $path) { return '' }; return [string]$path } catch { return '' }
+}
+
+function Get-ProcessObservation([int]$ProcessId) {
+    try { $p = Get-Process -Id $ProcessId -ErrorAction Stop } catch { return $null }
+    $image = ''
+    try {
+        $cim = Get-CimInstance Win32_Process -Filter ("ProcessId={0}" -f $ProcessId) -ErrorAction Stop
+        if ($cim -and -not [string]::IsNullOrWhiteSpace([string]$cim.ExecutablePath)) {
+            $image = [string]$cim.ExecutablePath
+        }
+    } catch {}
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = [string]$p.Path } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = Get-LimitedProcessImagePath $ProcessId } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = [string]$p.MainModule.FileName } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) { return $null }
+    try { $image = [System.IO.Path]::GetFullPath($image) } catch { return $null }
+    if (-not (Test-Path -LiteralPath $image -PathType Leaf)) { return $null }
+    try { $imageHash = Get-ExecutableHash $image } catch { return $null }
+    [pscustomobject]@{
+        pid = [int]$p.Id
+        creation_time_utc = $p.StartTime.ToUniversalTime().ToString('o')
+        image_path = $image
+        image_sha256 = $imageHash
+    }
+}
+
+function Read-Ledger([string]$Name) {
+    $path = Ledger-Path $Name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return $null }
+    try { return (Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json) } catch { return [pscustomobject]@{ corrupt = $true; path = $path } }
+}
+
+function Test-OwnedInstance([string]$Name) {
+    $ledger = Read-Ledger $Name
+    if (-not $ledger) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='no-ledger'; Ledger=$null; Observation=$null } }
+    if ($ledger.PSObject.Properties.Name -contains 'corrupt' -and $ledger.corrupt -eq $true) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='corrupt-ledger'; Ledger=$ledger; Observation=$null } }
+    if ($ledger.schema -ne $ControllerSchema -or -not $ledger.instance_nonce) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null } }
+    if ($Name -eq 'Bridge') {
+        if (-not ($ledger.PSObject.Properties.Name -contains 'script_path') -or -not ($ledger.PSObject.Properties.Name -contains 'script_sha256')) {
+            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null }
+        }
+        $scriptPath = [string]$ledger.script_path
+        $scriptHash = [string]$ledger.script_sha256
+        if ([string]::IsNullOrWhiteSpace($scriptPath) -or $scriptHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) {
+            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null }
+        }
+        try { $observedScriptHash = Get-ExecutableHash $scriptPath } catch { $observedScriptHash = '' }
+        if ($observedScriptHash -ne $scriptHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null } }
+    }
+    if ($ledger.PSObject.Properties.Name -contains 'dependencies') {
+        foreach ($dependency in @($ledger.dependencies)) {
+            $depPath = [string]$dependency.path
+            $depHash = [string]$dependency.sha256
+            if ([string]::IsNullOrWhiteSpace($depPath) -or $depHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) {
+                return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null }
+            }
+            try { $observedDependencyHash = Get-ExecutableHash $depPath } catch { $observedDependencyHash = '' }
+            if ($observedDependencyHash -ne $depHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null } }
+        }
+    }
+    $obs = Get-ProcessObservation ([int]$ledger.pid)
+    if (-not $obs) { try { [void](Get-Process -Id ([int]$ledger.pid) -ErrorAction Stop); return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-unobservable'; Ledger=$ledger; Observation=$null } } catch { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-missing'; Ledger=$ledger; Observation=$null } } }
+    if ($obs.creation_time_utc -ne [string]$ledger.creation_time_utc) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='pid-reused'; Ledger=$ledger; Observation=$obs } }
+    if (-not [string]::Equals($obs.image_path, [string]$ledger.image_path, [System.StringComparison]::OrdinalIgnoreCase)) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-path-mismatch'; Ledger=$ledger; Observation=$obs } }
+    if ($obs.image_sha256 -ne [string]$ledger.image_sha256) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-hash-mismatch'; Ledger=$ledger; Observation=$obs } }
+    [pscustomobject]@{ Name=$Name; Alive=$true; Reason='verified'; Ledger=$ledger; Observation=$obs }
+}
+
+function Write-Ledger([string]$Name, $Observation, [string]$Nonce, $Spec = $null) {
+    Ensure-Directory $RuntimeDir
+    $body = [ordered]@{
+        schema = $ControllerSchema
+        component = $Name.ToLowerInvariant()
+        instance_nonce = $Nonce
+        pid = [int]$Observation.pid
+        creation_time_utc = [string]$Observation.creation_time_utc
+        image_path = [string]$Observation.image_path
+        image_sha256 = [string]$Observation.image_sha256
+    }
+    if ($Name -eq 'Bridge') {
+        if (-not $Spec) { Fail 'Bridge ledger requires launch specification' }
+        $body['script_path'] = [string]$Spec.ScriptPath
+        $body['script_sha256'] = [string]$Spec.ScriptSha256
+    }
+    if ($Spec -and @($Spec.Dependencies).Count -gt 0) {
+        $body['dependencies'] = @($Spec.Dependencies | ForEach-Object { [ordered]@{ name=[string]$_.Name; path=[string]$_.Path; sha256=[string]$_.Sha256 } })
+    }
+    $tmp = (Ledger-Path $Name) + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination (Ledger-Path $Name) -Force
+}
+
+function Start-OwnedComponent([string]$Name, $Spec, $Cfg = $null) {
+    $current = Test-OwnedInstance $Name
+    if ($current.Alive) { return $current }
+    if ($current.Reason -in @('process-unobservable','pid-reused','image-path-mismatch','image-hash-mismatch','script-hash-mismatch','dependency-hash-mismatch','corrupt-ledger','ledger-schema')) {
+        Fail "$Name ownership conflict: $($current.Reason); refusing to attach or kill an unverified process"
+    }
+    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
+    if ($Name -eq 'Cloud') { Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue }
+    Ensure-Directory $LogDir
+    $stdout = Log-Path $Name 'stdout'
+    $stderr = Log-Path $Name 'stderr'
+    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
+    $nonceBytes = New-Object byte[] 32
+    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($nonceBytes)
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $componentExecutableHash = Get-ExecutableHash ([string]$Spec.FilePath)
+    if ($componentExecutableHash -ne [string]$Spec.FileSha256) { Fail "$Name executable hash mismatch before start: expected $($Spec.FileSha256), found $componentExecutableHash" }
+    Assert-ComponentDependencies $Name $Spec 'before start'
+    if ($Name -eq 'Bridge') {
+        $bridgeScriptHash = Get-ExecutableHash ([string]$Spec.ScriptPath)
+        if ($bridgeScriptHash -ne [string]$Spec.ScriptSha256) { Fail "bridge script hash mismatch before start: expected $($Spec.ScriptSha256), found $bridgeScriptHash" }
+    }
+    $args = [string]$Spec.Arguments
+    $start = @{ FilePath=[string]$Spec.FilePath; WorkingDirectory=[string]$Spec.WorkingDirectory; PassThru=$true; WindowStyle='Hidden'; RedirectStandardOutput=$stdout; RedirectStandardError=$stderr }
+    if (-not [string]::IsNullOrWhiteSpace($args)) { $start.ArgumentList = $args }
+    $hadCoreRootEnv = Test-Path Env:DEADBYTE_CORE_ROOT
+    $previousCoreRootEnv = $env:DEADBYTE_CORE_ROOT
+    $hadHostPolicyEnv = Test-Path Env:DEADBYTE_PRIVILEGED_POLICY
+    $previousHostPolicyEnv = $env:DEADBYTE_PRIVILEGED_POLICY
+    $hadWorkspaceRootEnv = Test-Path Env:DEADBYTE_WORKSPACE_ROOT
+    $previousWorkspaceRootEnv = $env:DEADBYTE_WORKSPACE_ROOT
+    $hadAuditRuntimeEnv = Test-Path Env:DEADBYTE_AUDIT_RUNTIME
+    $previousAuditRuntimeEnv = $env:DEADBYTE_AUDIT_RUNTIME
+    $hadMachineRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_RUNTIME
+    $previousMachineRuntimeEnv = $env:DEADBYTE_MACHINE_RUNTIME
+    $hadAgentRuntimeEnv = Test-Path Env:DEADBYTE_AGENT_RUNTIME
+    $previousAgentRuntimeEnv = $env:DEADBYTE_AGENT_RUNTIME
+    $hadProcessRuntimeEnv = Test-Path Env:DEADBYTE_PROCESS_RUNTIME
+    $previousProcessRuntimeEnv = $env:DEADBYTE_PROCESS_RUNTIME
+    $hadProcessPolicyEnv = Test-Path Env:DEADBYTE_PROCESS_POLICY
+    $previousProcessPolicyEnv = $env:DEADBYTE_PROCESS_POLICY
+    $hadCodingRuntimeEnv = Test-Path Env:DEADBYTE_CODING_RUNTIME
+    $previousCodingRuntimeEnv = $env:DEADBYTE_CODING_RUNTIME
+    $hadMachineFsRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_FS_RUNTIME
+    $previousMachineFsRuntimeEnv = $env:DEADBYTE_MACHINE_FS_RUNTIME
+    $hadObservationRuntimeEnv = Test-Path Env:DEADBYTE_OBSERVATION_RUNTIME
+    $previousObservationRuntimeEnv = $env:DEADBYTE_OBSERVATION_RUNTIME
+    $hadCodingPolicyEnv = Test-Path Env:DEADBYTE_CODING_POLICY
+    $previousCodingPolicyEnv = $env:DEADBYTE_CODING_POLICY
+    $hadAutonomousRuntimeEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_RUNTIME
+    $previousAutonomousRuntimeEnv = $env:DEADBYTE_AUTONOMOUS_RUNTIME
+    $hadAutonomousPolicyEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_POLICY
+    $previousAutonomousPolicyEnv = $env:DEADBYTE_AUTONOMOUS_POLICY
+    try {
+        if ($Name -eq 'Bridge' -and $Cfg) {
+            $env:DEADBYTE_AUDIT_RUNTIME = '1'
+            $env:DEADBYTE_CORE_ROOT = [string]$Cfg.CoreRoot
+            $env:DEADBYTE_WORKSPACE_ROOT = [string]$Cfg.WorkspaceRoot
+            $env:DEADBYTE_MACHINE_RUNTIME = if ([bool]$Cfg.MachineRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_AGENT_RUNTIME = if ([bool]$Cfg.AgentRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_PROCESS_RUNTIME = if ([bool]$Cfg.ProcessRuntimeEnabled) { '1' } else { '0' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) {
+                $env:DEADBYTE_PROCESS_POLICY = [string]$Cfg.ProcessPolicyFile
+            }
+            $env:DEADBYTE_CODING_RUNTIME = if ([bool]$Cfg.CodingRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_MACHINE_FS_RUNTIME = if ([bool]$Cfg.MachineFsRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_OBSERVATION_RUNTIME = if ([bool]$Cfg.ObservationRuntimeEnabled) { '1' } else { '0' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) {
+                $env:DEADBYTE_CODING_POLICY = [string]$Cfg.CodingPolicyFile
+            }
+            $env:DEADBYTE_AUTONOMOUS_RUNTIME = if ([bool]$Cfg.AutonomousRuntimeEnabled) { '1' } else { '0' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) {
+                $env:DEADBYTE_AUTONOMOUS_POLICY = [string]$Cfg.AutonomousPolicyFile
+            }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) {
+                $env:DEADBYTE_PRIVILEGED_POLICY = [string]$Cfg.HostPolicyFile
+            }
+        } else {
+            Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue
+        }
+        $proc = Start-Process @start
+    } finally {
+        if ($hadCoreRootEnv) { $env:DEADBYTE_CORE_ROOT = $previousCoreRootEnv }
+        else { Remove-Item Env:DEADBYTE_CORE_ROOT -ErrorAction SilentlyContinue }
+        if ($hadHostPolicyEnv) { $env:DEADBYTE_PRIVILEGED_POLICY = $previousHostPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY -ErrorAction SilentlyContinue }
+        if ($hadWorkspaceRootEnv) { $env:DEADBYTE_WORKSPACE_ROOT = $previousWorkspaceRootEnv }
+        else { Remove-Item Env:DEADBYTE_WORKSPACE_ROOT -ErrorAction SilentlyContinue }
+        if ($hadAuditRuntimeEnv) { $env:DEADBYTE_AUDIT_RUNTIME = $previousAuditRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadMachineRuntimeEnv) { $env:DEADBYTE_MACHINE_RUNTIME = $previousMachineRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_MACHINE_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadAgentRuntimeEnv) { $env:DEADBYTE_AGENT_RUNTIME = $previousAgentRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AGENT_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadProcessRuntimeEnv) { $env:DEADBYTE_PROCESS_RUNTIME = $previousProcessRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_PROCESS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadProcessPolicyEnv) { $env:DEADBYTE_PROCESS_POLICY = $previousProcessPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_PROCESS_POLICY -ErrorAction SilentlyContinue }
+        if ($hadCodingRuntimeEnv) { $env:DEADBYTE_CODING_RUNTIME = $previousCodingRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_CODING_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadMachineFsRuntimeEnv) { $env:DEADBYTE_MACHINE_FS_RUNTIME = $previousMachineFsRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadObservationRuntimeEnv) { $env:DEADBYTE_OBSERVATION_RUNTIME = $previousObservationRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadCodingPolicyEnv) { $env:DEADBYTE_CODING_POLICY = $previousCodingPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_CODING_POLICY -ErrorAction SilentlyContinue }
+        if ($hadAutonomousRuntimeEnv) { $env:DEADBYTE_AUTONOMOUS_RUNTIME = $previousAutonomousRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadAutonomousPolicyEnv) { $env:DEADBYTE_AUTONOMOUS_POLICY = $previousAutonomousPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_POLICY -ErrorAction SilentlyContinue }
+    }
+    Start-Sleep -Milliseconds 150
+    $obs = Get-ProcessObservation ([int]$proc.Id)
+    if (-not $obs) { Fail "$Name exited before identity capture; see $stderr" }
+    $expected = [System.IO.Path]::GetFullPath([string]$Spec.FilePath)
+    if (-not [string]::Equals($obs.image_path, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
+        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
+        Fail "$Name spawned a wrapper instead of the configured long-lived executable; observed '$($obs.image_path)'"
+    }
+    if ($obs.image_sha256 -ne (Get-ExecutableHash $expected)) {
+        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
+        Fail "$Name executable changed during start"
+    }
+    Write-Ledger $Name $obs $nonce $Spec
+    return Test-OwnedInstance $Name
+}
+
+function Stop-OwnedComponent([string]$Name) {
+    $owned = Test-OwnedInstance $Name
+    if (-not $owned.Ledger) { return }
+    if (-not $owned.Alive) {
+        if ($owned.Reason -eq 'process-missing') { Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue; return }
+        Fail "$Name is not provably owned ($($owned.Reason)); refusing Stop-Process"
+    }
+    Stop-Process -Id ([int]$owned.Ledger.pid) -Force -ErrorAction Stop
+    try { Wait-Process -Id ([int]$owned.Ledger.pid) -Timeout 5 -ErrorAction SilentlyContinue } catch {}
+    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
+}
+
+function Test-LocalReady($Cfg) {
+    try {
+        $r = Invoke-WebRequest -UseBasicParsing -Uri ([string]$Cfg.LocalReadyUri) -TimeoutSec ([int]$Cfg.ProbeTimeoutSeconds)
+        return ($r.StatusCode -ge 200 -and $r.StatusCode -lt 300)
+    } catch { return $false }
+}
+function Get-LocalReadyListenerOwners($Cfg) {
+    try { $uri = [Uri]([string]$Cfg.LocalReadyUri) } catch { Fail 'LocalReadyUri is invalid' }
+    if (-not $uri.IsLoopback) { Fail 'LocalReadyUri must be loopback for owned readiness attribution' }
+    try {
+        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object {
+            [int]$_.LocalPort -eq [int]$uri.Port -and (
+                [string]$_.LocalAddress -eq [string]$uri.Host -or
+            [string]$_.LocalAddress -eq '0.0.0.0' -or
+            [string]$_.LocalAddress -eq '::'
+            )
+        })
+    } catch { Fail "cannot inspect listener ownership for local readiness endpoint: $($_.Exception.Message)" }
+    return @($listeners | ForEach-Object { [int]$_.OwningProcess } | Sort-Object -Unique)
+}
+
+function Assert-LocalReadyPortAvailable($Cfg) {
+    $owners = @(Get-LocalReadyListenerOwners $Cfg)
+    if ($owners.Count -gt 0) {
+        Fail ("local readiness endpoint already has listener pid(s)={0}; refusing to start an unverified Bridge" -f ($owners -join ','))
+    }
+}
+
+function Test-LocalReadyOwned($Cfg, $Bridge) {
+    if (-not $Bridge -or -not $Bridge.Alive) { return $false }
+    $owners = @(Get-LocalReadyListenerOwners $Cfg)
+    if ($owners.Count -ne 1 -or $owners[0] -ne [int]$Bridge.Ledger.pid) { return $false }
+    return (Test-LocalReady $Cfg)
+}
+
+function Get-ObservedState($Cfg) {
+    $bridge = Test-OwnedInstance 'Bridge'
+    $cloud = Test-OwnedInstance 'Cloud'
+    $ready = if ($bridge.Alive) { try { Test-LocalReadyOwned $Cfg $bridge } catch { $false } } else { $false }
+    $state = if (-not $bridge.Alive -and -not $cloud.Alive) { 'OFFLINE' }
+             elseif (-not $bridge.Alive -and $cloud.Alive) { 'PARKED' }
+             elseif ($bridge.Alive -and $cloud.Alive -and $ready) { 'ONLINE' }
+             else { 'DEGRADED' }
+    [pscustomobject]@{ State=$state; Bridge=$bridge; Cloud=$cloud; LocalReady=$ready }
+}
+
+function Wait-LocalReady($Cfg) {
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    do {
+        $bridge = Test-OwnedInstance 'Bridge'
+        if (-not $bridge.Alive) { return $false }
+        if (Test-LocalReadyOwned $Cfg $bridge) { return $true }
+        Start-Sleep -Milliseconds 250
+    } while ([DateTime]::UtcNow -lt $deadline)
+    return $false
+}
+
+function Wait-PublicDnsReady($Cfg, [string]$Url) {
+    try { $uri = [Uri]$Url } catch { Fail 'public MCP URL is invalid' }
+    if ($uri.Scheme -ne 'https') { Fail 'public MCP URL must be HTTPS' }
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    $requiredConsecutive = 3
+    $consecutive = 0
+    do {
+        try {
+            $addresses = @([System.Net.Dns]::GetHostAddresses($uri.DnsSafeHost))
+            if ($addresses.Count -gt 0) { $consecutive += 1 } else { $consecutive = 0 }
+        } catch { $consecutive = 0 }
+        if ($consecutive -ge $requiredConsecutive) { return }
+        Start-Sleep -Milliseconds 750
+    } while ([DateTime]::UtcNow -lt $deadline)
+    Fail 'public endpoint DNS did not become stably resolvable before gate'
+}
+
+function Get-CurrentUrl($Cfg) {
+    if ($Cfg.ContainsKey('McpUrlFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpUrlFile)) {
+        $fullFile = [string]$Cfg.McpUrlFile
+        if (-not (Test-Path -LiteralPath $fullFile -PathType Leaf)) { Fail "McpUrlFile missing: $fullFile" }
+        $transport = if ($Cfg.Cloud.ContainsKey('Transport')) { [string]$Cfg.Cloud.Transport } else { '' }
+        if ($transport -eq 'deadbyte.named-tunnel.v2') {
+            if (-not $Cfg.ContainsKey('McpUrlFileSha256') -or [string]$Cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
+            $fullHash = Get-ExecutableHash $fullFile
+            if ($fullHash -ne [string]$Cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($Cfg.McpUrlFileSha256), found $fullHash" }
+        }
+        $full = (Read-TextFileSafe $fullFile).Trim()
+        if ($full -notmatch '^https://') { Fail 'McpUrlFile must contain one HTTPS MCP endpoint' }
+        if ($transport -eq 'deadbyte.named-tunnel.v2') {
+            try { $fullUri = [System.Uri]$full } catch { Fail 'McpUrlFile must contain one valid HTTPS MCP endpoint' }
+            if ($fullUri.DnsSafeHost.ToLowerInvariant().EndsWith('.trycloudflare.com')) { Fail 'trycloudflare endpoint forbidden for deadbyte.named-tunnel.v2' }
+        }
+        return $full
+    }
+    $cloud = Test-OwnedInstance 'Cloud'
+    if (-not $cloud.Alive) { return $null }
+    $originFile = Join-Path $RuntimeDir 'current-origin.txt'
+    $origin = (Read-TextFileSafe $originFile).Trim()
+    if (-not $origin) {
+        $pattern = [string]$Cfg.UrlRegex
+        foreach ($file in @((Log-Path 'Cloud' 'stdout'), (Log-Path 'Cloud' 'stderr'))) {
+            $text = Read-TextFileSafe $file
+            $m = [regex]::Matches($text, $pattern)
+            if ($m.Count -gt 0) { $origin = $m[$m.Count - 1].Value }
+        }
+        if (-not $origin) { return $null }
+        Set-Content -LiteralPath $originFile -Value $origin -Encoding ASCII
+    }
+    $suffix = ''
+    if ($Cfg.ContainsKey('McpPathFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpPathFile)) {
+        $pathFile = [string]$Cfg.McpPathFile
+        if (-not (Test-Path -LiteralPath $pathFile -PathType Leaf)) { Fail "McpPathFile missing: $pathFile" }
+        $suffix = (Read-TextFileSafe $pathFile).Trim()
+        if ($suffix -and -not $suffix.StartsWith('/')) { Fail 'MCP path file must contain an absolute URL path beginning with slash' }
+        if ($suffix -match '[\r\n]') { Fail 'MCP path file contains newline data' }
+    }
+    return $origin.TrimEnd('/') + $suffix
+}
+
+function Wait-CurrentUrl($Cfg) {
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    do {
+        $cloud = Test-OwnedInstance 'Cloud'
+        if (-not $cloud.Alive) { return $null }
+        $url = Get-CurrentUrl $Cfg
+        if ($url) { return $url }
+        Start-Sleep -Milliseconds 250
+    } while ([DateTime]::UtcNow -lt $deadline)
+    return $null
+}
+
+function Invoke-CoreGate($Cfg, [string]$ScriptName, [string[]]$ExtraArguments = @()) {
+    $coreRoot = [string]$Cfg.CoreRoot
+    $script = Join-Path (Join-Path $coreRoot 'src') $ScriptName
+    if (-not (Test-Path -LiteralPath $script -PathType Leaf)) { Fail "core gate script missing: $script" }
+    $node = (Get-Command node.exe -ErrorAction Stop).Source
+    $stdout = Log-Path 'CoreGate' 'stdout'
+    $stderr = Log-Path 'CoreGate' 'stderr'
+    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
+    $argv = @(('"{0}"' -f $script))
+    foreach ($arg in $ExtraArguments) {
+        if ($arg -match '[\r\n"]') { Fail 'core gate argument contains forbidden quoting/newline data' }
+        $argv += ('"{0}"' -f $arg)
+    }
+    $proc = Start-Process -FilePath $node -ArgumentList $argv -WorkingDirectory $coreRoot -Wait -PassThru -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr
+    if ($proc.ExitCode -ne 0) {
+        $detail = if (Test-Path -LiteralPath $stderr) { (Get-Content -LiteralPath $stderr -Raw -Encoding UTF8).Trim() } else { '' }
+        Fail "core gate $ScriptName failed exit=$($proc.ExitCode): $detail"
+    }
+    Write-Host (Get-Content -LiteralPath $stdout -Raw -Encoding UTF8)
+}
+
+function Start-Deadbyte($Cfg) {
+    $state = Get-ObservedState $Cfg
+    if ($state.State -eq 'ONLINE') { return $state }
+    if ($state.State -eq 'DEGRADED') { Fail 'runtime is DEGRADED; use status and stop only if identities remain verified' }
+    $cloudWasAlive = [bool]$state.Cloud.Alive
+    Assert-LocalReadyPortAvailable $Cfg
+    try {
+        Start-OwnedComponent 'Bridge' $Cfg.Bridge $Cfg | Out-Null
+        if (-not (Wait-LocalReady $Cfg)) { Fail 'bridge started but owned local readiness gate failed' }
+        Start-OwnedComponent 'Cloud' $Cfg.Cloud $Cfg | Out-Null
+        if (-not (Wait-CurrentUrl $Cfg)) { Fail 'public endpoint metadata did not become available before timeout' }
+        $final = Get-ObservedState $Cfg
+        if ($final.State -ne 'ONLINE') { Fail "start gate failed: observed $($final.State)" }
+        return $final
+    } catch {
+        try { Stop-OwnedComponent 'Bridge' } catch {}
+        if (-not $cloudWasAlive) { try { Stop-OwnedComponent 'Cloud' } catch {} }
+        throw
+    }
+}
+
+function Park-Deadbyte($Cfg) {
+    Stop-OwnedComponent 'Bridge'
+    $s = Get-ObservedState $Cfg
+    if ($s.State -notin @('PARKED','OFFLINE')) { Fail "park gate failed: observed $($s.State)" }
+    return $s
+}
+
+function Stop-Deadbyte($Cfg) {
+    Stop-OwnedComponent 'Bridge'
+    Stop-OwnedComponent 'Cloud'
+    Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'OFFLINE') { Fail "stop gate failed: observed $($s.State)" }
+    return $s
+}
+
+function Get-HostPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
+    $policyPath = [string]$Cfg.HostPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid host policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.host-policy.v1' -or $policy.enabled -ne $true) { Fail 'host policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.arm_file)) { Fail 'host policy arm_file missing' }
+    $armFile = [System.IO.Path]::GetFullPath([string]$policy.arm_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $armFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'host policy arm_file must live under controller runtime directory' }
+    [pscustomobject]@{
+        Path = $policyPath
+        Sha256 = Get-ExecutableHash $policyPath
+        ArmFile = $armFile
+    }
+}
+
+function Get-HostArmStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-HostPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.ArmFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $arm = Get-Content -LiteralPath $meta.ArmFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($arm.schema -ne 'deadbyte.host-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$arm.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+}
+
+function Arm-Host($Cfg) {
+    $meta = Get-HostPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{
+        schema = 'deadbyte.host-grant.v2'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        granted_at_utc = $now.ToString('o')
+    }
+    $tmp = $meta.ArmFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.ArmFile -Force
+    Write-Host 'PRIVILEGED HOST PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Host($Cfg) {
+    $meta = Get-HostPolicyMetadata $Cfg
+    Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+    Write-Host 'PRIVILEGED HOST PLANE DISARMED'
+}
+
+function Show-HostStatus($Cfg) {
+    $h = Get-HostArmStatus $Cfg
+    Write-Host ("Host plane    : {0} [{1}]" -f $(if ($h.Armed) { 'ARMED' } elseif ($h.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $h.Reason)
+    return $h
+}
+
+function Get-ProcessPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { Fail 'process plane is not configured' }
+    $policyPath = [string]$Cfg.ProcessPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid process policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.process-policy.v1' -or $policy.enabled -ne $true) { Fail 'process policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'process policy grant_file missing' }
+    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'process policy grant_file must live under controller runtime directory' }
+    $profileIds = @($policy.profiles.PSObject.Properties.Name)
+    $rootIds = @($policy.roots.PSObject.Properties.Name)
+    if ($profileIds.Count -lt 1 -or $rootIds.Count -lt 1) { Fail 'process policy requires profiles and roots' }
+    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; GrantFile=$grantFile; ProfileIds=$profileIds; RootIds=$rootIds }
+}
+
+function Get-ProcessGrantStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-ProcessPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($grant.schema -ne 'deadbyte.process-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    $profiles = @($grant.profile_ids); $roots = @($grant.root_ids)
+    if ($profiles.Count -lt 1 -or @($profiles | Where-Object { $_ -notin $meta.ProfileIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='profiles-invalid' } }
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+}
+
+function Arm-Process($Cfg) {
+    $meta = Get-ProcessPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $body = [ordered]@{
+        schema = 'deadbyte.process-grant.v1'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        profile_ids = @($meta.ProfileIds)
+        root_ids = @($meta.RootIds)
+        granted_at_utc = [DateTime]::UtcNow.ToString('o')
+    }
+    $tmp = $meta.GrantFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    Write-Host 'PROCESS PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Process($Cfg) {
+    $meta = Get-ProcessPolicyMetadata $Cfg
+    Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    Write-Host 'PROCESS PLANE DISARMED'
+}
+
+function Show-ProcessStatus($Cfg) {
+    $p = Get-ProcessGrantStatus $Cfg
+    Write-Host ("Process plane  : {0} [{1}]" -f $(if ($p.Armed) { 'ARMED' } elseif ($p.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $p.Reason)
+    return $p
+}
+
+function Get-CodingPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { Fail 'coding plane is not configured' }
+    $policyPath = [string]$Cfg.CodingPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid coding policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.coding-policy.v1' -or $policy.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'coding policy lease_file missing' }
+    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'coding policy lease_file must live under controller runtime directory' }
+    $rootIds = @($policy.roots.PSObject.Properties.Name)
+    if ($rootIds.Count -lt 1) { Fail 'coding policy requires at least one root' }
+    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; LeaseFile=$leaseFile; RootIds=$rootIds }
+}
+
+function Get-CodingLeaseStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-CodingPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($lease.schema -ne 'deadbyte.coding-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    $roots = @($lease.root_ids)
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+}
+
+function Arm-Coding($Cfg) {
+    $meta = Get-CodingPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{
+        schema = 'deadbyte.coding-grant.v2'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        root_ids = @($meta.RootIds)
+        granted_at_utc = $now.ToString('o')
+    }
+    $tmp = $meta.LeaseFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    Write-Host 'CODING PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Coding($Cfg) {
+    $meta = Get-CodingPolicyMetadata $Cfg
+    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    try { Disarm-Autonomous $Cfg -Quiet } catch { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    Write-Host 'CODING PLANE DISARMED; AUTONOMOUS AUTHORITY REVOKED'
+}
+
+function Show-CodingStatus($Cfg) {
+    $c = Get-CodingLeaseStatus $Cfg
+    Write-Host ("Coding plane  : {0} [{1}]" -f $(if ($c.Armed) { 'ARMED' } elseif ($c.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $c.Reason)
+    return $c
+}
+
+function Get-AutonomousPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { Fail 'autonomous plane is not configured' }
+    $policyPath = [string]$Cfg.AutonomousPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid autonomous policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.autonomous-policy.v1' -or $policy.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'autonomous policy lease_file missing' }
+    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'autonomous policy lease_file must live under controller runtime directory' }
+    $codingMeta = Get-CodingPolicyMetadata $Cfg
+    if ([string]$policy.coding_policy_sha256 -ne [string]$codingMeta.Sha256) { Fail 'autonomous policy coding_policy_sha256 mismatch' }
+    $rootIds = @($policy.root_ids)
+    if ($rootIds.Count -lt 1) { Fail 'autonomous policy requires at least one root' }
+    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; LeaseFile=$leaseFile; RootIds=$rootIds; CodingPolicySha256=$codingMeta.Sha256 }
+}
+
+function Get-AutonomousLeaseStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-AutonomousPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    $coding = Get-CodingLeaseStatus $Cfg
+    if (-not $coding.Armed) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-disarmed' } }
+    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($lease.schema -ne 'deadbyte.autonomous-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$lease.coding_policy_sha256 -ne [string]$meta.CodingPolicySha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-policy-digest' } }
+    $roots = @($lease.root_ids)
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+}
+
+function Arm-Autonomous($Cfg) {
+    $coding = Get-CodingLeaseStatus $Cfg
+    if (-not $coding.Armed) { Fail 'autonomous plane requires an active coding lease; run armcoding first' }
+    $meta = Get-AutonomousPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{ schema='deadbyte.autonomous-grant.v2'; policy_sha256=[string]$meta.Sha256; coding_policy_sha256=[string]$meta.CodingPolicySha256; instance_nonce=$nonce; root_ids=@($meta.RootIds); granted_at_utc=$now.ToString('o') }
+    $tmp = $meta.LeaseFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    Write-Host 'AUTONOMOUS PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Autonomous($Cfg, [switch]$Quiet) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return }
+    $meta = Get-AutonomousPolicyMetadata $Cfg
+    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    if (-not $Quiet) { Write-Host 'AUTONOMOUS PLANE DISARMED' }
+}
+
+function Show-AutonomousStatus($Cfg) {
+    $a = Get-AutonomousLeaseStatus $Cfg
+    Write-Host ("Autonomous     : {0} [{1}]" -f $(if ($a.Armed) { 'ARMED' } elseif ($a.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $a.Reason)
+    return $a
+}
+
+function Show-State($Cfg) {
+    $s = Get-ObservedState $Cfg
+    $bp = if ($s.Bridge.Alive) { $s.Bridge.Ledger.pid } else { '-' }
+    $cp = if ($s.Cloud.Alive) { $s.Cloud.Ledger.pid } else { '-' }
+    $url = Get-CurrentUrl $Cfg
+    Write-Host ("DEADBYTE MCP = {0}" -f $s.State)
+    Write-Host ("Bridge PID   : {0} [{1}]" -f $bp, $s.Bridge.Reason)
+    Write-Host ("Cloud PID    : {0} [{1}]" -f $cp, $s.Cloud.Reason)
+    Write-Host ("Local ready  : {0}" -f $s.LocalReady)
+    Write-Host ("URL          : {0}" -f $(if ($url) { $url } else { '<unknown>' }))
+    Write-Host ("Machine runtime: {0}" -f $(if ([bool]$Cfg.MachineRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Agent runtime : {0}" -f $(if ([bool]$Cfg.AgentRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Process rt    : {0}" -f $(if ([bool]$Cfg.ProcessRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Coding runtime: {0}" -f $(if ([bool]$Cfg.CodingRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Machine FS rt : {0}" -f $(if ([bool]$Cfg.MachineFsRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Observation rt: {0}" -f $(if ([bool]$Cfg.ObservationRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Autonomous rt : {0}" -f $(if ([bool]$Cfg.AutonomousRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Show-ProcessStatus $Cfg | Out-Null
+    Show-CodingStatus $Cfg | Out-Null
+    Show-AutonomousStatus $Cfg | Out-Null
+    Show-HostStatus $Cfg | Out-Null
+    return $s
+}
+
+function Invoke-MachineSmoke($Cfg) {
+    if (-not [bool]$Cfg.MachineRuntimeEnabled) { Fail 'machinetest requires MachineRuntimeEnabled' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "machinetest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-machine-smoke-client.mjs' @($url)
+    Write-Host 'MACHINE IDENTITY LIVE GATE PASS: public status/list + SPKI identity + signed Ed25519 ping verified.'
+}
+
+function Invoke-Smoke($Cfg, [bool]$Full) {
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "MCP test requires ONLINE; observed $($s.State)" }
+    if (-not (Test-LocalReady $Cfg)) { Fail 'local readiness probe failed' }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable; configure McpUrlFile or McpPathFile' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-smoke-client.mjs' @($url, $(if ($Full) { 'full' } else { 'smoke' }))
+    if ($Full) {
+        Invoke-CoreGate $Cfg 'mcp-contained-smoke-client.mjs'
+        Write-Host 'FULL GATE PASS: public modern MCP + proof + public contained proof + local canonical 3-operation AppContainer/replay/evidence gate.'
+    } else {
+        Write-Host 'MCP SMOKE PASS: public modern MCP + exact tool catalog + signed proof + independent verification.'
+    }
+}
+
+function Invoke-HostSmoke($Cfg) {
+    $h = Get-HostArmStatus $Cfg
+    if (-not $h.Armed) { Fail 'hosttest requires an active local arm lease; run armhost first' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "hosttest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-host-smoke-client.mjs' @($url)
+    Write-Host 'HOST PLANE LIVE GATE PASS: public host write + hash readback + hash-pinned exec + cleanup.'
+}
+
+function Invoke-CodingSmoke($Cfg) {
+    $c = Get-CodingLeaseStatus $Cfg
+    if (-not $c.Armed) { Fail 'codingtest requires an active local coding lease; run armcoding first' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "codingtest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-coding-smoke-client.mjs' @($url)
+    Write-Host 'CODING PLANE LIVE GATE PASS: public edit + command + benchmark + durable coding-task receipt verification.'
+}
+
+function Invoke-AutonomousSmoke($Cfg) {
+    $a = Get-AutonomousLeaseStatus $Cfg
+    if (-not $a.Armed) { Fail 'autonomoustest requires active coding + autonomous leases; run armcoding then armautonomous' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "autonomoustest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-autonomous-smoke-client.mjs' @($url)
+    Write-Host 'AUTONOMOUS PRODUCTION LIVE GATE PASS: public sampling MRTR + native diff + fail/diagnose/replan + build/test/benchmark + signed release gate.'
+}
+
+function Clean-Stale {
+    Ensure-Directory $RuntimeDir
+    foreach ($name in @('Bridge','Cloud')) {
+        $o = Test-OwnedInstance $name
+        if ($o.Ledger -and -not $o.Alive -and $o.Reason -eq 'process-missing') {
+            Remove-Item -LiteralPath (Ledger-Path $name) -Force -ErrorAction SilentlyContinue
+        } elseif ($o.Ledger -and -not $o.Alive -and $o.Reason -ne 'no-ledger') {
+            Write-Warning "$name ledger retained: $($o.Reason). No unverified process was killed."
+        }
+    }
+}
+
+function Run-Command([string]$Name) {
+    $cfg = Get-Config
+    Assert-ControllerRootBound $cfg
+    Ensure-Directory $RuntimeDir; Ensure-Directory $LogDir
+    switch ($Name) {
+        'start'   { Start-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'resume'  { Start-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'park'    { Park-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'stop'    { Stop-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'restart' { Stop-Deadbyte $cfg | Out-Null; Start-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'status'  { Show-State $cfg | Out-Null }
+        'url'     { $u=Get-CurrentUrl $cfg; if (-not $u) { Fail 'URL unavailable' }; Write-Output $u }
+        'test'    { Invoke-Smoke $cfg $false }
+        'fulltest'{ Invoke-Smoke $cfg $true }
+        'toggle'  { $s=Get-ObservedState $cfg; if ($s.State -eq 'ONLINE') { Park-Deadbyte $cfg | Out-Null } elseif ($s.State -in @('PARKED','OFFLINE')) { Start-Deadbyte $cfg | Out-Null } else { Fail 'toggle refuses DEGRADED state' }; Show-State $cfg | Out-Null }
+        'clean'   { Clean-Stale; Show-State $cfg | Out-Null }
+        'machinetest' { Invoke-MachineSmoke $cfg }
+        'armhost' { Arm-Host $cfg; Show-HostStatus $cfg | Out-Null }
+        'disarmhost' { Disarm-Host $cfg; Show-HostStatus $cfg | Out-Null }
+        'hoststatus' { Show-HostStatus $cfg | Out-Null }
+        'hosttest' { Invoke-HostSmoke $cfg }
+        'armprocess' { Arm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
+        'disarmprocess' { Disarm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
+        'processstatus' { Show-ProcessStatus $cfg | Out-Null }
+        'armcoding' { Arm-Coding $cfg; Show-CodingStatus $cfg | Out-Null }
+        'disarmcoding' { Disarm-Coding $cfg; Show-CodingStatus $cfg | Out-Null; Show-AutonomousStatus $cfg | Out-Null }
+        'codingstatus' { Show-CodingStatus $cfg | Out-Null }
+        'codingtest' { Invoke-CodingSmoke $cfg }
+        'armautonomous' { Arm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
+        'disarmautonomous' { Disarm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
+        'autonomousstatus' { Show-AutonomousStatus $cfg | Out-Null }
+        'autonomoustest' { Invoke-AutonomousSmoke $cfg }
+        default   { Fail "unknown command '$Name'" }
+    }
+}
+
+if ($Command -ne 'menu') { Run-Command $Command; exit 0 }
+
+while ($true) {
+    Clear-Host
+    $cfg = Get-Config
+    Assert-ControllerRootBound $cfg
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.8.7 / R33'
+    Write-Host '======================================'
+    Show-State $cfg | Out-Null
+    Write-Host ''
+    Write-Host '[1] Start / Resume'
+    Write-Host '[2] Park'
+    Write-Host '[3] Full Stop'
+    Write-Host '[4] Restart'
+    Write-Host '[5] Transport smoke test'
+    Write-Host '[6] Public transport gate'
+    Write-Host '[7] Show current URL'
+    Write-Host '[8] Clean stale ledgers'
+    Write-Host '[9] Enable privileged host plane (standing grant)'
+    Write-Host '[10] Revoke privileged host plane'
+    Write-Host '[11] Host plane status'
+    Write-Host '[12] Host plane LIVE gate (requires grant)'
+    Write-Host '[13] Enable coding plane (standing grant)'
+    Write-Host '[14] Revoke coding plane'
+    Write-Host '[15] Coding plane status'
+    Write-Host '[16] Coding plane LIVE gate (requires grant)'
+    Write-Host '[17] Enable autonomous plane (standing grant)'
+    Write-Host '[18] Revoke autonomous plane'
+    Write-Host '[19] Autonomous plane status'
+    Write-Host '[20] Autonomous production LIVE gate'
+    Write-Host '[21] Machine identity LIVE gate (non-mutating)'
+    Write-Host '[22] Enable process plane (standing grant)'
+    Write-Host '[23] Revoke process plane'
+    Write-Host '[24] Process plane status'
+    Write-Host '[0] Exit controller (runtime stays as-is)'
+    $choice = Read-Host 'Select'
+    try {
+        switch ($choice) {
+            '1' { Run-Command 'start' }
+            '2' { Run-Command 'park' }
+            '3' { Run-Command 'stop' }
+            '4' { Run-Command 'restart' }
+            '5' { Run-Command 'test' }
+            '6' { Run-Command 'fulltest' }
+            '7' { Run-Command 'url' }
+            '8' { Run-Command 'clean' }
+            '9' { Run-Command 'armhost' }
+            '10' { Run-Command 'disarmhost' }
+            '11' { Run-Command 'hoststatus' }
+            '12' { Run-Command 'hosttest' }
+            '13' { Run-Command 'armcoding' }
+            '14' { Run-Command 'disarmcoding' }
+            '15' { Run-Command 'codingstatus' }
+            '16' { Run-Command 'codingtest' }
+            '17' { Run-Command 'armautonomous' }
+            '18' { Run-Command 'disarmautonomous' }
+            '19' { Run-Command 'autonomousstatus' }
+            '20' { Run-Command 'autonomoustest' }
+            '21' { Run-Command 'machinetest' }
+            '22' { Run-Command 'armprocess' }
+            '23' { Run-Command 'disarmprocess' }
+            '24' { Run-Command 'processstatus' }
+            '0' { exit 0 }
+            default { Write-Warning 'invalid selection' }
+        }
+    } catch { Write-Host $_.Exception.Message -ForegroundColor Red }
+    if ($choice -ne '0') { [void](Read-Host 'Press Enter') }
+}