deadbyte-mcp 0.8.7

package/controller/deadbyte-host-policy.json.example

@@ -0,0 +1,33 @@
+{
+  "schema": "deadbyte.host-policy.v1",
+  "enabled": true,
+  "arm_file": "C:\\REPLACE\\controller\\runtime\\host-arm.json",
+  "max_read_bytes": 262144,
+  "max_write_bytes": 1048576,
+  "roots": {
+    "core": {
+      "path": "C:\\REPLACE\\deadbyte-mcp-v0.7.1",
+      "read": true,
+      "write": true,
+      "exec": true
+    },
+    "bridge": {
+      "path": "C:\\REPLACE\\deadbyte-chatgpt-bridge",
+      "read": true,
+      "write": true,
+      "exec": true
+    }
+  },
+  "commands": {
+    "powershell_script": {
+      "kind": "script",
+      "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+      "executable_sha256": "REPLACE_WITH_SHA256",
+      "root_ids": ["core", "bridge"],
+      "prefix_args": ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File"],
+      "extensions": [".ps1"],
+      "timeout_ms": 120000,
+      "max_output_bytes": 1048576
+    }
+  }
+}

package/controller/deadbyte-process-policy.json

@@ -0,0 +1,47 @@
+{
+  "schema": "deadbyte.process-policy.v1",
+  "enabled": true,
+  "grant_file": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2\\controller\\runtime\\process-grant.json",
+  "state_dir": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2\\controller\\runtime\\process-state",
+  "native_host": {
+    "path": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2\\bin\\deadbyte-process-host.exe",
+    "sha256": "40575aae3f3127f3a5649fa6f142e29ad7e8660a3bff5fad2cdfe03cdfe66816"
+  },
+  "roots": {
+    "core": {
+      "path": "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2",
+      "deny_paths": [
+        "node_modules",
+        "controller/runtime",
+        "evidence"
+      ]
+    }
+  },
+  "profiles": {
+    "ping_hold": {
+      "executable": "C:\\Windows\\System32\\cmd.exe",
+      "executable_sha256": "97ac98b1a92c286054cce55239cfccdfc23a5517bd07fe693072c9ca96c7dabb",
+      "root_ids": [
+        "core"
+      ],
+      "prefix_args": [
+        "/d",
+        "/q"
+      ],
+      "transport": "pipe",
+      "max_args": 0,
+      "max_arg_bytes": 256,
+      "max_sessions": 1,
+      "max_input_bytes": 4096,
+      "max_retained_output_bytes": 65536,
+      "env_allow": [
+        "PATH",
+        "TEMP",
+        "TMP"
+      ],
+      "input_actions": {
+        "ping": "echo DEADBYTE_ACTION_PING\r\n"
+      }
+    }
+  }
+}

package/docs/ARCHITECTURE.md

@@ -0,0 +1,168 @@
+# DEADBYTE MCP V0.8.7 / R33 ARCHITECTURE
+
+```mermaid
+flowchart TD
+    A[Modern MCP Client] --> B[Ingress / Optional Probe Prefilter]
+    B --> C[Strict MCP 2026-07-28 Boundary]
+    C --> D[Typed Capability Registry]
+    D --> E[Base 5 Tools]
+    D --> MI[Optional Machine 4 Tools]
+    D --> F[Optional Host 3 Tools]
+    D --> G[Optional Agent 7 Tools]
+    D --> PR[Optional Process 6 Tools]
+    D --> V[Optional Coding 17 Tools]
+    D --> MF[Optional Machine FS 8 Tools]
+    D --> OB[Optional Observation 6 Tools]
+    D --> AA[Optional Autonomous 12 Tools]
+    E --> H[Workspace Path Policy]
+    E --> I[Contained Operation Policy]
+    I --> J[Private Import]
+    J --> K[Windows AppContainer]
+    K --> L[Atomic Job / Fixed Worker]
+    L --> M[Host Semantic Gate]
+    M --> N[Create-New Output + Receipt V2]
+    MI --> MK[Persistent Ed25519 Machine Key]
+    MK --> MP[Signed Nonce + Release/Generation Binding]
+    G --> O[Durable Agent Task]
+    O --> P[Signed Plan]
+    P --> Q[Signed Hash-Chained Events]
+    Q --> R[Proof / Fixed Contained Steps]
+    R --> S[Signed Task Receipt]
+    V --> W[Coding Policy + Explicit Standing Grant]
+    W --> X[Hash-Precondition Edit / Pinned Script Command / Benchmark]
+    X --> Y[Signed Coding Action Receipts]
+    Y --> Z[Durable Signed Coding Task]
+    AA --> AB[Autonomous Policy + Explicit Standing Grant]
+    AB --> AC[Planner / Native Diff / Profile Evidence]
+    AC --> AD[Objective Release Gate + Signed Release Receipt]
+    T[Lifecycle Controller] --> U[Observed Process State]
+```
+
+The lifecycle controller is not execution authority. It starts, parks, resumes,
+observes, or stops verified owned processes and feature-gates the agent catalog;
+it cannot manufacture arbitrary MCP capabilities.
+
+## Exact capability catalogs
+
+Only complete combinations of base plus optional machine, host, agent, process, coding,
+machine-filesystem, observation, and autonomous surfaces are valid at the HTTP bridge. A fully
+enabled R33 runtime exposes exactly 68 tools. Process authority is independently granted;
+machine-filesystem and observation reuse coding-policy roots; autonomous requires the complete
+coding surface. Partial, dependency-invalid, unknown, or extra catalogs fail closed.
+
+## Immutable execution invariants
+
+- no general shell in the containment/agent core
+- no caller-selected executable or argv
+- no host workspace mount inside AppContainer
+- zero AppContainer network capabilities plus active loopback denial proof
+- atomic Job assignment, active process limit one, no breakaway
+- 128 MiB contained process memory limit
+- compile-time operation registry and resource budgets
+- host semantic recomputation before contained output export
+- canonical signed execution receipts
+- agent plans/events/cancel requests authenticated by Ed25519
+- agent events additionally linked by canonical SHA-256 previous hashes
+- interrupted agent steps adopted only through independently verified signed receipts
+
+## Optional host plane
+
+The host plane remains outside AppContainer and is explicit host authority. A
+configured policy registers its three tools, but each authorized host call still
+requires an explicit policy-hash-bound standing grant. The grant remains active only
+until explicit operator revocation; registration alone is never authority. See
+`V071-HOST-PLANE.md`.
+
+## Durable agent plane
+
+The agent plane is orchestration, not new execution authority. Its executable
+steps delegate only to the existing proof and fixed contained-transform paths.
+Checkpoint, retry, cancellation, journal, recovery, and task-receipt behavior is
+documented in `V080-AGENT-RUNTIME.md`.
+
+## R23 coding plane
+
+The coding plane is a separately granted host-code authority surface, not an
+AppContainer sandbox. Source reads/writes are root/path policy constrained. Writes
+use SHA-256 preconditions and atomic commit. Command execution uses policy-selected
+executable hashes, script hashes, bounded argv/output/time, `shell:false`, and an
+environment allowlist. The executed child still has the current host user's file
+permissions; this is why coding authority requires an explicit standing grant until
+operator revocation.
+
+Durable coding tasks authenticate plans, events, cancellation and final task receipts
+with Ed25519. Interrupted commands/benchmarks without a signed action receipt pause
+rather than blind-rerun; interrupted writes are retried only when the target still
+matches the exact pre-mutation state.
+
+## R24 autonomous production plane
+
+The autonomous plane layers a second explicit standing grant on top of coding authority.
+Its planner can inspect, propose DEADBYTE Native Diff operations, run policy-pinned profiles,
+finish, or pause. Native Diff uses content hashes, signed preimages, transaction rollback,
+and conflict detection; it does not depend on Git or GitHub. Required profile evidence is
+bound to the current mutation epoch and a planner finish request cannot bypass the objective
+release gate. Public client-planner mode uses authenticated MCP 2026-07-28 multi-round
+sampling through the Bridge. Revoking coding authority also revokes autonomous authority.
+
+## R25 Manus control semantics
+
+R25 keeps the R24 execution and release authority intact while improving planner control.
+Invalid structured decisions become signed `planner_rejected` evidence and receive bounded
+repair prompts; stale context payloads compact to identity/evidence skeletons before the
+hard context budget fails; and optional authoritative plan snapshots persist as signed
+planner-decision state without adding another agent round. Completed plan prefixes are
+immutable. A complete plan blocks further work and an incomplete plan blocks `finish`.
+The objective R24 release gate remains the only completion authority. See
+`V081-R25-MANUS-CONTROL-SEMANTICS.md`.
+
+## R26 runtime self-update boundary
+
+R26 adds no MCP capability. Its historical updater verified an exact candidate and swapped only
+`src` by same-volume directory rename after revoking coding/autonomous authority. That design and
+its recovery evidence remain documented in `V082-R26-RUNTIME-SELF-UPDATE.md`.
+
+## R27 immutable release-slot boundary
+
+R27 removes live package-file replacement from activation. A verified tarball is materialized into
+a content-addressed immutable release slot. Controller configuration plus coding/autonomous/host
+policies form a separate immutable generation with its own GENERATION.SHA256. Mutable workspaces,
+ledgers, grants and evidence live outside both stores. Coding/host core authority points to an
+explicit mutable development root, never the active slot. After verified stop, activation commits
+only active-release.json by atomic same-directory rename. The stable launcher self-verifies its hash
+and every release/generation manifest entry before boot. Rollback restores the prior pointer,
+launcher and workspace placement, then restarts known-good runtime. See
+`V083-R27-IMMUTABLE-RELEASE-SLOTS.md`.
+
+## R28 persistent named-tunnel boundary
+
+R28 keeps the R27 immutable slot transaction and replaces ephemeral Quick Tunnel identity with a
+generation-bound remotely-managed Named Tunnel launch contract. The immutable release owns the
+native tunnel host. The generation owns exact path/SHA-256 pins for `cloudflared.exe` and an
+external tunnel-token file; secret token bytes never enter release/package contents or status
+output. The host directly launches the exact pinned cloudflared with `--token-file`, so Wrangler
+OAuth/cache state and Wrangler-downloaded cloudflared binaries are outside the production runtime
+chain. Controller startup re-hashes both dependencies before launch and owned status re-hashes the
+ledger-bound set. Activation additionally requires a stability window plus public MCP smoke before
+the completion receipt. The native host fixes the local origin at `127.0.0.1:8787` and uses a
+kill-on-close Windows Job so tunnel descendants cannot survive the verified host. See
+`V084-R28-PERSISTENT-NAMED-TUNNEL.md`.
+
+## R29 stable machine-identity boundary
+
+R29 adds one persistent Ed25519 identity per canonical DEADBYTE state root. The private key remains
+outside immutable release and generation stores so release activation does not create a new machine.
+`machine_id` is SHA-256 over the public SPKI DER bytes; `machine_status` and `machine_list` return
+that SPKI so a remote verifier can independently derive the same identifier.
+
+`machine_ping` signs a domain-separated canonical payload containing caller nonce, machine id,
+identity generation, online epoch, release id, release manifest SHA-256, and generation manifest
+SHA-256. A process restart rotates the online epoch while preserving the key identity. A privileged
+`machine_revoke` requires the separately armed host authority, increments identity generation, and
+rotates the epoch. Historical signatures are not erased; callers reject them as stale when their
+binding no longer matches current machine status.
+
+The controller defaults `MachineRuntimeEnabled` on, forwards it only to the Bridge child, and adds a
+non-mutating `machinetest` public HTTPS gate. That gate cross-checks status/list, derives machine_id
+from public SPKI, issues a random nonce, and verifies the Ed25519 signature without target-local key
+access. See `V085-R29-MACHINE-IDENTITY.md`.

package/docs/AUTHORITY.md

@@ -0,0 +1,56 @@
+# DEADBYTE V0.6 EXECUTION AUTHORITY CONTRACT
+
+## Public authority
+
+The only contained execution API is `contained_transform` with a compile-time
+operation enum:
+
+- `uppercase_ascii`
+- `lowercase_ascii`
+- `reverse_bytes`
+
+The caller does not select a native executable. Operation-to-worker resolution
+remains package policy.
+
+## MCP boundary
+
+The MCP input is a strict object. Fields outside the declared schema are rejected.
+In particular there is no public field for:
+
+- executable / executable path
+- worker ID / worker path
+- argv / command line
+- shell / cmd.exe / PowerShell
+- environment
+- invocation challenge / request digest
+- AppContainer capabilities
+- Job policy
+- host workspace mount
+
+## Native boundary
+
+`deadbyte-exec.exe` accepts exactly the trusted control-plane argv shape:
+
+- `--operation <fixed-operation>`
+- `--challenge <64-hex>`
+- `--request-digest <64-hex>`
+
+Any extra/missing/reordered flag is rejected with exit code 64 before the
+contained worker is created.
+
+Workers also use an exact internal argv shape, including the private profile
+paths/canaries and the internally generated network-probe port. The MCP caller
+cannot supply that shape directly through a tool field.
+
+## Runtime smoke
+
+`npm run authority:smoke` performs adversarial checks including:
+
+- direct native extra `--worker C:\\Windows\\System32\\cmd.exe` -> reject;
+- MCP extra `executable` -> reject;
+- MCP extra `argv` -> reject;
+- path-shaped operation value -> reject;
+- rejected calls must not create workspace outputs.
+
+This is an execution-authority freeze, not an arbitrary-command feature.
+`command_run` remains absent.

package/docs/CHILD-CONTROL.md

@@ -0,0 +1,31 @@
+# DEADBYTE MCP V0.3.13 CHILD CONTROL DECISION
+
+## Target observation from V0.3.10
+
+The orthogonal matrix produced a direct decision:
+
+    policy-direct
+      parent exits 0xC0000142 before probe completion
+
+    suspended-policy
+      parent exits 0xC0000142 before probe completion
+
+    job-atomic
+      parent probe completed
+      normal child payload denied
+      CREATE_BREAKAWAY_FROM_JOB payload denied
+      ActiveProcessLimit = 1
+      breakaway flags disabled
+
+    job-atomic-ui
+      same hostile result with UI restrictions enabled
+
+    job-atomic-policy
+      adding the child-policy attribute restores 0xC0000142 failure
+
+Therefore V0.3.13 removes PROCESS_CREATION_CHILD_PROCESS_RESTRICTED from the
+production launcher and selects atomic Job assignment as the target-tested child
+control candidate.
+
+This is not a claim of semantic equivalence. It is an evidence-based replacement
+for the exact direct child-execution paths exercised on the target host.

package/docs/CONSTRUCTION-LADDER.md

@@ -0,0 +1,84 @@
+# HISTORICAL DIAGNOSTIC — V0.3.8 APPCONTAINER CONSTRUCTION LADDER
+
+## V0.3.9 build-contract repair
+
+V0.3.7 never reached this ladder on the target because appcontainer-stage.cpp
+used ConvertSidToStringSidW without including sddl.h. V0.3.9 repairs only that
+compile contract and adds a preflight that requires both native ladder artifacts
+before diagnostics start. The ladder stages and security policy are unchanged.
+
+## Evidence entering this experiment
+
+The target host produced `STATUS_DLL_INIT_FAILED` (`0xC0000142`) before entrypoint
+for both regular AppContainer and LPAC, including a custom no-CRT executable that
+imports only KERNEL32. Therefore the LPAC AAP opt-out variable is eliminated as
+the unique cause.
+
+## Controlled variable strategy
+
+The new probe is `bootstrap-exitcode.exe`:
+
+```text
+custom PE entrypoint
+  -> ExitProcess(66)
+```
+
+No pipe is needed to prove entrypoint execution. If the observed child exit code
+is 66, loader initialization completed and the custom entrypoint ran.
+
+The new `appcontainer-stage.exe` starts with the Microsoft-style minimal
+AppContainer construction and adds one constraint at each stage.
+
+```mermaid
+flowchart TD
+    S0[SECURITY_CAPABILITIES only]
+    S1[+ profile cwd]
+    S2[+ unicode environment flag]
+    S3[+ no-window]
+    S4[+ suspended start]
+    S5[+ child-process policy]
+    S6[+ explicit handle list]
+    S7[+ basic Job limits]
+    S8[+ UI Job limits]
+
+    S0 --> S1 --> S2 --> S3 --> S4 --> S5 --> S6 --> S7 --> S8
+```
+
+## Interpretation
+
+`security-only` fails:
+
+```text
+basic AppContainer launch/profile/image/environment surface remains suspect
+```
+
+`security-only` passes and a later stage fails:
+
+```text
+the newly introduced construction mechanism is the first observed boundary
+```
+
+All stages pass but the full probe still fails:
+
+```text
+process construction is exonerated
+failure belongs to the full probe behavior or its resource requirements
+```
+
+## Invariants
+
+- regular AppContainer only for the ladder: LPAC was already eliminated by A/B
+- zero capabilities
+- no broad ACE grants
+- no automatic fallback
+- no general process execution exposed through MCP
+- exact child exit code retained
+- stage 0 intentionally excludes Job, handle inheritance and child policy
+
+## Why UI restrictions remain a candidate, not a conclusion
+
+Windows Job UI restrictions are separate controls applied after AppContainer
+identity construction. Current Microsoft sandbox implementations also treat UI
+policy separately. Some programs can fail initialization under aggressive UI
+restrictions, but V0.3.9 does not assume that is the present cause. The ladder
+must observe it.

package/docs/CONTAINMENT.md

@@ -0,0 +1,92 @@
+# WINDOWS CONTAINMENT CONTRACT — V0.3 FROZEN / V0.4 CONSUMER
+
+## Accepted target baseline
+
+V0.3.13 regular AppContainer containment passed the full hostile smoke on the target Windows host.
+
+Observed target facts:
+
+    mode                               appcontainer
+    token is AppContainer              true
+    LPAC                               false
+    LPAC token query available         false
+    AAP behavioral mode evidence       true
+    declared network capabilities      0
+    host-only canary read              denied
+    own-profile write                  passed
+    child process denied               true
+    normal child payload denied        true
+    explicit breakaway payload denied  true
+    child control                      job-active-process-limit
+    Job assignment                     atomic-attribute
+    Job breakaway enabled              false
+    active process limit               1
+    process memory limit               134217728
+    profile cleanup                    true
+
+Evidence is preserved in:
+
+- `proof/TARGET-V0313-CONTAINMENT-PASS.txt`
+- `proof/TARGET-V0313-CONTAINMENT-PASS.sha256`
+- `proof/V03-FREEZE.txt`
+
+The V0.4 contained execution path consumes this same regular-AppContainer + atomic-Job design.
+
+## Mode evidence
+
+Regular AppContainer validation uses both API and access-control behavior:
+
+- `TokenIsAppContainer` query required and true
+- `TokenCapabilities` query required
+- capability count zero
+- if the LPAC-specific query is available it must not report LPAC
+- `ALL_APPLICATION_PACKAGES` canary must be readable
+- host-only canary must remain unreadable
+
+The AAP behavioral canary avoids converting an unavailable LPAC-specific query into a guessed false value.
+
+## Atomic Job child control
+
+Production containment uses:
+
+    PROC_THREAD_ATTRIBUTE_JOB_LIST
+      atomic Job assignment at process creation
+
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+    JOB_OBJECT_LIMIT_ACTIVE_PROCESS
+      ActiveProcessLimit = 1
+    JOB_OBJECT_LIMIT_PROCESS_MEMORY
+      ProcessMemoryLimit = 128 MiB
+
+and does not set:
+
+    JOB_OBJECT_LIMIT_BREAKAWAY_OK
+    JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK
+
+The target hostile matrix observed both a direct child payload and an explicit `CREATE_BREAKAWAY_FROM_JOB` payload denied.
+
+The target also observed `PROCESS_CREATION_CHILD_PROCESS_RESTRICTED` causing `STATUS_DLL_INIT_FAILED`, so that mechanism is deliberately not used in the production baseline.
+
+## V0.4 execution-specific application
+
+`deadbyte-exec.exe` creates the fixed transform worker with:
+
+- `PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES`
+- AppContainer SID
+- `CapabilityCount = 0`
+- `PROC_THREAD_ATTRIBUTE_JOB_LIST`
+- the frozen Job limits above
+- retained UI Job restrictions
+- no inherited host workspace handle
+- no host workspace path
+- no user-selected executable
+
+The worker rechecks AppContainer identity, zero capabilities, AAP/host canaries, Job membership, and direct/breakaway child denial during each contained transform.
+
+## Non-claims
+
+- `network_capabilities = 0` is a no-declared-network-capability fact, not an active socket denial proof.
+- Job Object is not claimed equivalent to every brokered process creation API.
+- V0.4.0 does not claim arbitrary binary or shell safety.
+- A compromised Windows host remains outside this trust boundary.
+- No remote or hardware attestation is claimed.