deadbyte-mcp 0.8.7

package/docs/V084-R28-PERSISTENT-NAMED-TUNNEL.md

@@ -0,0 +1,57 @@
+# DEADBYTE MCP V0.8.4 / R28 — Persistent Named Tunnel
+
+R28 changes the production transport binding, not MCP capability semantics. Quick Tunnel hostnames are not production identity because they are ephemeral and force the ChatGPT MCP registration to drift. R28 binds the public endpoint to a Cloudflare remotely-managed Named Tunnel and keeps both the MCP path token and Cloudflare tunnel credential outside immutable package bytes.
+
+## Production contract
+
+The immutable release ships `bin/deadbyte-tunnel-host.exe`. The host accepts exactly three values: the pinned `cloudflared.exe`, an external tunnel-token file, and one real working directory. It fixes the local origin to `http://127.0.0.1:8787` and directly launches `cloudflared tunnel --no-autoupdate --loglevel info run --token-file <file>`.
+
+The generated controller configuration binds two transport dependencies by absolute path and SHA-256:
+
+- `cloudflared.exe`
+- the external tunnel-token file
+
+The operator also supplies one persistent HTTPS origin during v2 activation. The updater combines that origin with the external MCP path token, atomically writes the resulting full endpoint to `%USERPROFILE%\.deadbyte-mcp\bridge\mcp-url.txt`, and binds that file's SHA-256 into the generation identity. A `*.trycloudflare.com` origin is rejected for v2.
+
+The token bytes are secret state. They are never package contents, release-slot contents, receipt output, or user-visible status. The generation stores only external file paths and SHA-256 pins; it does not embed either secret token value.
+
+The controller verifies the transport dependency pins before start, records them in the owned-process ledger, and re-verifies them during status observation. It also re-hashes the stable MCP URL file before use. Dependency or endpoint-file drift is a provenance conflict, not a healthy runtime.
+
+## Why this shape
+
+The tunnel host is inside the content-addressed release slot so restore can reconstruct the production launcher from release bytes. Machine-specific cloudflared and token-file paths/hashes remain generation inputs instead of source constants. This keeps source portable while making the active machine binding exact.
+Wrangler is not in the production runtime chain. It may be used only as an operator/control-plane bootstrap tool for tunnel management or credential retrieval. The long-lived transport must not depend on Wrangler OAuth refresh state, cached Wrangler-downloaded cloudflared binaries, or an experimental `wrangler tunnel run` process.
+
+The host joins itself to a Windows Job Object with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` before spawning the exact pinned cloudflared executable. The child inherits the Job, so stopping the verified host tears down the tunnel process tree.
+
+## When not to use this
+
+Do not use the R28 named-tunnel path for a random Quick Tunnel, an unpinned cloudflared binary, a token file whose exact bytes cannot be bound, or a machine where the dependency bytes cannot be verified. Do not weaken pins to recover from an upgrade or token rotation. Re-pin the new exact bytes through an operator-controlled generation update instead.
+
+## Activation and recovery
+
+The R27 immutable release-slot transaction remains the activation authority. R28 v2 extends generation input with exact cloudflared and token-file pins plus a persistent public origin and a hash-pinned stable MCP URL file. The updater rejects partial transport arguments, wrong SHA-256 values, ephemeral `trycloudflare` origins, symlink/reparse dependency files, and non-regular files before pointer activation. A legacy `deadbyte.named-tunnel.v1` config may be read for migration, but creating a new runtime from it requires an explicit v2 bootstrap.
+
+After the new runtime first reaches ONLINE, the updater holds a stability window, rechecks the exact process generation on every probe, runs the public MCP smoke gate, and checks ONLINE again before writing a completion receipt. A transient PID is not activation success.
+
+A successful R28 switch must preserve the stable public hostname across restart and cold stop/start. Rollback restores the prior active pointer and known-good runtime; it must never silently fall back to a Quick Tunnel hostname.
+
+Host authority is unrelated to transport authority. The updater does not arm the privileged host plane. Coding/autonomous standing grants are restored only under the existing explicit restore policy.
+
+## Operational consequence
+
+Changing cloudflared bytes, rotating the tunnel token, moving either dependency, changing the transport working directory, or changing `deadbyte-tunnel-host.exe` invalidates prior transport evidence. Host-binary changes are release changes; external dependency changes are generation changes. Both require fresh lifecycle and public MCP verification.
+
+The production acceptance path is: build native host, verify package manifest, bind an external tunnel token without exposing it, activate an immutable release and generation, survive the stabilization/public MCP gate, verify the fixed public endpoint, restart, cold stop/start, and prove no Quick Tunnel or Wrangler tunnel-run process remains.
+
+## Staleness
+
+Review this document whenever `native/deadbyte-tunnel-host.cpp`, `controller/deadbyte-controller.ps1`, `src/runtime-update.mjs`, `src/release-generation.mjs`, the public ingress model, or the dependency-pin contract changes.
+
+Code authority:
+
+- `native/deadbyte-tunnel-host.cpp`
+- `controller/deadbyte-controller.ps1`
+- `src/runtime-update.mjs`
+- `src/release-generation.mjs`
+- `scripts/build-containment.ps1`

package/docs/V085-R29-MACHINE-IDENTITY.md

@@ -0,0 +1,99 @@
+# DEADBYTE MCP V0.8.5 / R29 — Stable Machine Identity
+
+R29 introduces a cryptographic machine identity without changing the R28 transport authority,
+R27 immutable release transaction, containment boundary, or coding/autonomous grant model.
+
+## Identity contract
+
+Each canonical DEADBYTE state root owns one Ed25519 keypair below `machine/`.
+The private key never enters an MCP response, package artifact, immutable release slot, or
+generation bundle. The public key is exported as SPKI DER and represented in MCP status as base64.
+
+`machine_id = SHA256(public_key_spki_der)`.
+
+Identity initialization is create-only and lock protected. Concurrent initializers converge on the
+same completed identity or fail closed; they do not overwrite a pre-existing keypair. Private/public
+key mismatch, malformed identity state, symlink substitution, and invalid generation values fail.
+
+Release or controller-generation activation does not rotate the machine key. The identity therefore
+names the DEADBYTE state root rather than one process, tunnel, release slot, or hostname.
+
+## Public MCP surface
+
+R29 adds exactly four optional tools:
+
+- `machine_list` — returns machine records visible to this runtime.
+- `machine_status` — returns this machine's current identity and release/generation binding.
+- `machine_ping` — signs a caller nonce plus current identity/binding state.
+- `machine_revoke` — advances identity generation and epoch under local host authority.
+
+`machine_status` and each record in `machine_list` bind:
+
+- machine id and public SPKI
+- identity generation and process-online epoch
+- informational hostname/platform/architecture
+- active release id and release manifest SHA-256
+- active generation manifest SHA-256
+- machine capability set
+
+The fully enabled R29 public catalog is 46 tools. Machine mode is an independent optional catalog
+dimension; autonomous mode still requires the complete coding surface. Partial and unknown catalogs
+remain invalid.
+
+## Signed ping
+
+`machine_ping` signs a canonical `deadbyte.machine-ping.v1` body under the domain
+`DEADBYTE-MACHINE-PING-V1\0`. The body includes a caller-supplied nonce, machine id, identity
+generation, online epoch, release id, release-manifest digest, generation-manifest digest, and an
+observation timestamp.
+
+A remote verifier must decode the advertised SPKI, require Ed25519, recompute SHA-256(SPKI), require
+that digest to equal both `machine_id` and `attestation.key_id`, reconstruct the canonical domain-
+separated body, and verify the 64-byte Ed25519 signature. `verifyMachinePingPublic` implements this
+check without reading the target's local key store.
+
+A valid old signature is historical evidence, not current liveness. Current liveness additionally
+requires the ping's identity generation, online epoch, release, and generation to match a fresh
+`machine_status` observation.
+
+## Revocation and authority
+
+`machine_revoke` is deliberately not self-authorizing. The MCP handler calls the host-authority
+check before mutating identity state. With host authority absent or disarmed, revoke returns denied
+and identity state is unchanged. With authority present, revoke increments `identity_generation`
+and rotates `online_epoch`; it does not replace the Ed25519 key or machine id.
+
+This follows the existing standing-authority rule: registration is capability visibility, not
+permission. Revocation authority remains explicitly inspectable and independently removable.
+
+## Controller and release gates
+
+`MachineRuntimeEnabled` defaults to true and is forwarded only while the controller starts the
+Bridge child. The stable launcher exports the canonical DEADBYTE state root so release activation
+continues to use the same identity store.
+
+Controller `machinetest` is non-mutating. Over the configured public HTTPS MCP endpoint it requires
+all four machine tools with strict output schemas, compares `machine_status` with `machine_list`,
+issues a fresh random nonce, and independently verifies the public SPKI and Ed25519 ping signature.
+
+R29 activation still uses the R27 immutable release-slot plus atomic active-pointer transaction and
+R28 persistent named-tunnel transport. Machine identity adds no updater MCP capability. The updater's
+signed completion receipt preserves the observed prior host-authority state rather than hardcoding
+it, so authority evidence remains truthful across activation.
+
+Host command executable pins remain fail-closed. If an installed executable changes bytes, activation
+requires an explicit `--host-command-pin <command_id>=<observed_sha256>` for that exact command. The
+updater verifies the executable as a regular non-symlink file and changes only its stored digest in
+the new generation; it never edits the prior immutable generation or silently trusts drift.
+
+A predecessor that cannot boot because of such verified pin drift may be recovered only with
+`--recover-offline-predecessor`. That path requires the controller to be exactly OFFLINE with no
+owned Bridge/Cloud listener and the Host plane DISARMED. Coding/autonomous standing authority is
+still revoked before the pointer switch and may be restored explicitly after the fresh runtime gate.
+The recovery option is not an auto-arm path and does not weaken the normal ONLINE activation gate.
+
+## Non-goals
+
+R29 does not claim hardware-rooted identity, TPM attestation, remote physical-machine proof, or
+protection against a fully compromised trusted host. It establishes a stable application-level
+cryptographic identity and release/generation-bound liveness proof for later multi-machine work.

package/docs/superpowers/plans/2026-09-14-r30-process-plane.md

@@ -0,0 +1,178 @@
+# R30 Process Plane Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Promote the existing native ConPTY host into six policy-gated, signed, strict-schema MCP process-session tools without caller-selected executable authority.
+
+**Architecture:** Keep process authority separate from coding and host authority. A new process policy resolves trusted profile IDs to pinned executable bytes and approved cwd roots. A durable runtime owns ConPTY host children, journals signed events, and exposes bounded ordered output through a strict MCP adapter.
+
+**Tech Stack:** Node.js ESM, Zod v4, MCP 2026-07-28, Windows x64 ConPTY C++, Ed25519 receipts/events, PowerShell 5.1 controller, node:test.
+
+**Spec:** `docs/superpowers/specs/2026-09-14-r30-r33-machine-control-design.md`
+
+## Global Constraints
+
+- Source control is NON-GIT. Never create Git evidence or commit IDs.
+- Windows x64 is the R30 production target.
+- No caller-selected executable path.
+- Every executable profile pins absolute path plus SHA-256.
+- Session mutation uses session ID plus observed process identity, never PID alone.
+- Registration does not imply authority; execution/input/termination require a local policy-hash-bound standing process grant.
+- Unknown schema fields fail closed.
+- Existing R29 behavior must remain green until R30 release activation.
+- Version stays 0.8.5 until the R30 gate is release-ready.
+
+---### Task 1: Process policy and standing grant
+
+**Files:**
+- Create: `src/process-policy.mjs`
+- Create: `test/process-policy.test.mjs`
+- Modify: `controller/deadbyte-controller.ps1`
+- Modify: `controller/deadbyte-controller.config.psd1.example`
+
+**Interfaces:**
+- Produces: `loadProcessPolicy(path)`, `processSessionStatus(policy)`, `assertProcessArmed(policy, profileId, rootId)`.
+- Policy schema: `deadbyte.process-policy.v1`; grant schema: `deadbyte.process-grant.v1`.
+
+- [ ] **Step 1: Write failing policy tests**
+```js
+await assert.rejects(() => loadProcessPolicy(badExecutableHash), /executable hash mismatch/);
+const status = await processSessionStatus(policy);
+assert.equal(status.armed, false);
+```
+- [ ] **Step 2: Run RED**
+Run: `node --test test/process-policy.test.mjs`
+Expected: FAIL because `src/process-policy.mjs` does not exist.
+- [ ] **Step 3: Implement minimum strict policy/grant loader**
+Normalize roots and profiles; verify executable file type/hash; bind grant to exact policy SHA-256 and allowed profile/root IDs.
+- [ ] **Step 4: Run GREEN plus existing policy tests**
+Run: `node --test test/process-policy.test.mjs test/standing-grants.test.mjs`
+Expected: PASS.
+- [ ] **Step 5: Add controller config/status/arm/disarm commands and tests**
+Extend controller tests before controller production edits; process revocation must not alter coding/autonomous grants.
+### Task 2: Durable process runtime and native-host contract
+
+**Files:**
+- Create: `src/process-runtime.mjs`
+- Create: `test/process-runtime.test.mjs`
+- Modify: `native/deadbyte-process-host.cpp`
+- Modify: `test/process-native.test.mjs`
+
+**Interfaces:**
+- Produces: `createProcessRuntime({ policy, signingKeyPath, verifyKeyPath, stateRoot, nativeHostPath })`.
+- Runtime methods: `start`, `input`, `read`, `status`, `list`, `terminate`, `verifyEventJournal`.
+
+- [ ] **Step 1: Write failing runtime lifecycle test**
+```js
+const started = await runtime.start({ profileId: 'powershell', rootId: 'core', cwd: '.', args: [] });
+await runtime.input({ sessionId: started.session_id, data: '$x=41\r\n' });
+await runtime.input({ sessionId: started.session_id, data: 'Write-Output ($x+1)\r\n' });
+const page = await runtime.read({ sessionId: started.session_id, offset: 0, maxBytes: 65536 });
+assert.match(Buffer.from(page.data_base64, 'base64').toString('utf8'), /42/);
+```
+- [ ] **Step 2: Run RED**
+Run: `node --test test/process-runtime.test.mjs`
+Expected: FAIL because runtime is absent.
+- [ ] **Step 3: Implement minimum runtime around existing native ConPTY host**
+Spawn only the pinned native host and profile executable. Persist session metadata/event journal under the configured state root. Bind child PID plus creation FILETIME plus random 256-bit session ID.
+- [ ] **Step 4: Add output offset/hash-chain and truncation tests before implementation**
+Verify monotonic offsets, explicit earliest retained offset, stable stream head, and no silent truncation.
+- [ ] **Step 5: Harden native host only where tests expose missing contract**
+Native stdout control records must remain machine-parseable and distinguish host READY/EXIT records from PTY payload bytes.
+- [ ] **Step 6: Run GREEN**
+Run: `node --test test/process-native.test.mjs test/process-runtime.test.mjs`
+Expected: PASS with no orphan host or child process.
+### Task 3: Strict MCP process surface
+
+**Files:**
+- Create: `src/process-output-contracts.mjs`
+- Create: `src/process-mcp-tools.mjs`
+- Create: `test/process-mcp-tools.test.mjs`
+- Modify: `src/mcp-server.mjs`
+
+**Interfaces:**
+- Produces six tools: `process_session_start`, `process_session_input`, `process_session_read`, `process_session_status`, `process_session_list`, `process_session_terminate`.
+- Every output schema is a Zod strict object and every error path is validated before return.
+
+- [ ] **Step 1: Write failing tool-catalog/strict-contract tests**
+```js
+registerProcessTools(server, { runtime });
+assert.deepEqual([...server.tools.keys()].sort(), expectedSix);
+for (const tool of server.tools.values()) assert.equal(tool.spec.outputSchema.additionalProperties, false);
+```
+- [ ] **Step 2: Run RED**
+Run: `node --test test/process-mcp-tools.test.mjs`
+Expected: FAIL because adapter/contracts are absent.
+- [ ] **Step 3: Implement output contracts and adapters**
+Start/input/terminate failures return denied/failed states without leaking executable paths beyond policy-approved identity fields.
+- [ ] **Step 4: Add MCP server feature flag/policy loading**
+Use `DEADBYTE_PROCESS_RUNTIME=0|1` and `DEADBYTE_PROCESS_POLICY`. Runtime enabled without a valid policy must fail startup.
+- [ ] **Step 5: Run GREEN and schema suite**
+Run: `node --test test/process-mcp-tools.test.mjs test/output-schema.test.mjs`
+Expected: PASS.
+
+### Task 4: Exact public catalog and controller integration
+
+**Files:**
+- Modify: `src/remote-mcp-smoke-client.mjs`
+- Modify: `src/remote-mcp-r24-disarmed-smoke-client.mjs`
+- Modify: `test/remote-r24-catalog.test.mjs`
+- Modify: `controller/deadbyte-controller.ps1`
+- Modify: `test/controller.test.mjs`
+- Create: `src/remote-mcp-process-smoke-client.mjs`
+
+**Interfaces:**
+- Catalog dimension: process=false/true, independent of machine/host/agent/coding/autonomous registration.
+- Fully enabled R30 count becomes 52 tools: prior 46 plus six process tools.
+
+- [ ] **Step 1: Change catalog tests first to require the process dimension and 52-tool full catalog**
+Run: `node --test test/remote-r24-catalog.test.mjs`
+Expected: FAIL against R29 catalog code.
+- [ ] **Step 2: Update remote catalog generation and disarmed full-catalog expectation**
+Partial process catalogs remain invalid.
+- [ ] **Step 3: Add public process smoke client**
+Smoke performs status, start approved shell profile, two inputs with preserved state, ordered read, terminate, final status, and journal/receipt verification.
+- [ ] **Step 4: Add controller `armprocess`, `disarmprocess`, `processstatus`, `processtest`**
+Bridge environment injects process runtime/policy only from trusted controller config.
+- [ ] **Step 5: Run focused GREEN**
+Run: `node --test test/remote-r24-catalog.test.mjs test/controller*.test.mjs test/process-*.test.mjs`
+Expected: PASS.
+### Task 5: Release gate, docs, manifest, evidence
+
+**Files:**
+- Modify: `scripts/gate-windows.ps1`
+- Modify: `package.json`
+- Modify: `README.txt`
+- Create: `docs/V086-R30-PROCESS-PLANE.md`
+- Modify: `MANIFEST.SHA256` through the existing manifest writer only after tests pass.
+
+**Interfaces:**
+- Adds npm smoke command for the process plane and Windows-gate step.
+- Produces one R30 gate receipt/evidence set; version bump is deferred until this task is green.
+
+- [ ] **Step 1: Add failing package/gate boundary tests before release-file edits**
+Assert process smoke is present in package scripts and Windows gate source.
+- [ ] **Step 2: Update package/gate/docs minimally**
+Document exact authority boundary, six tools, restart semantics, output truncation semantics, and 52-tool fully enabled catalog.
+- [ ] **Step 3: Run source test suite**
+Run: `npm test`
+Expected: all tests PASS, zero skipped R30 production tests except platform-conditional non-Windows tests when not on Windows.
+- [ ] **Step 4: Run Windows batch gate**
+Run: `npm run gate:windows`
+Expected: PASS including native build, process smoke, existing R29 planes, containment, authority and manifest verification.
+- [ ] **Step 5: Run public process gate against candidate runtime**
+Use controller process grant and `processtest`; verify exact public catalog and signed process evidence.
+- [ ] **Step 6: Bump release identity only after all prior gates pass**
+Advance version/R number consistently, regenerate manifest, rerun complete Windows and public gates.
+- [ ] **Step 7: Produce final R30 closure evidence**
+Record manifest SHA-256, test counts, native-host SHA-256, policy SHA-256, exact catalog count, public process proof and known pending items. Never mark R31 started before this closure is valid.
+
+## Plan self-review
+
+Spec coverage: R30 policy, six tools, ConPTY state, identity, output ordering/truncation, signed events, controller grant, exact catalog, Windows/public gates and manifest are each assigned above.
+
+Placeholder scan: this plan intentionally contains no TBD/TODO/FIXME markers.
+
+Type/name consistency: process policy, runtime and MCP adapter use the same `profileId/rootId/sessionId` internal names and `profile_id/root_id/session_id` public fields. Public tool names match the approved spec exactly.
+
+Execution mode: inline in this session because the workspace is NON-GIT and the user requested uninterrupted completion. Release activation remains a separate destructive boundary after candidate gates prove safe.

package/docs/superpowers/plans/2026-09-14-r31-process-prerequisite.md

@@ -0,0 +1,132 @@
+# R31 Process Prerequisite Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Finish the bounded DEADBYTE-owned process supervision prerequisite required before R31 machine-filesystem work may begin, without adding arbitrary remote shell/stdin authority.
+
+**Architecture:** Reuse `process-policy.mjs`, the existing Windows ConPTY host, controller standing grants, trust keys, strict MCP schemas, and immutable release machinery. The runtime owns sessions by random session ID plus observed process creation identity; public callers may select only policy-defined profile/root/action IDs. Raw terminal bytes, caller-selected executable paths, shell command strings, script bodies, and PID-only mutation remain outside the public contract.
+
+**Tech Stack:** Node.js ESM, node:test, Zod v4, MCP 2026-07-28, Windows x64 ConPTY C++, Ed25519 signed events, PowerShell 5.1 controller.
+
+**Spec:** `docs/superpowers/specs/2026-09-14-r31-r33-final-baseline-successor-design.md`
+
+## Global Constraints
+
+- Source control is NON-GIT; no commits, branches, HEADs, or synthetic Git evidence.
+- `V0.8.6 / R30`, release `v0.8.6-7b057342c381906a`, remains immutable active known-good until successor candidate gates are complete.
+- Public process authority is policy-pinned and standing-grant gated.
+- Session mutation uses DEADBYTE session identity and verified child creation identity, never an unqualified PID.
+- `process_session_action` accepts only a configured `action_id`; no arbitrary stdin/text payload field exists.
+- If Windows named-action transport is not reliable, the action surface stays fail-closed and the replacement parity gate remains blocked.
+- Unknown input/output fields fail closed; outputs are bounded and truncation is explicit.
+- Version/release identity is not advanced in this plan.
+
+---
+### Task 1: Runtime lifecycle and owned-session identity
+
+**Files:**
+- Modify: `src/process-runtime.mjs`
+- Create: `test/process-runtime.test.mjs`
+- Modify only if the RED test proves necessary: `native/deadbyte-process-host.cpp`
+- Modify only if native contract changes: `test/process-native.test.mjs`
+
+**Interfaces:**
+- `createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })`
+- `start({ profileId, rootId, cwd='.', args=[] })`
+- `read({ sessionId, offset, maxBytes })`
+- `status({ sessionId })`, `list()`, `terminate({ sessionId })`
+- Public session identity fields remain `session_id`, `child_pid`, `creation_filetime`, `profile_id`, `root_id`.
+
+- [ ] **Step 1: Write RED lifecycle tests** proving grant denial, pinned hash checks, one approved profile start, READY parsing, session identity, ordered output, status/list, and owned termination.
+- [ ] **Step 2: Run RED:** `node --test test/process-runtime.test.mjs test/process-native.test.mjs`; failure must be the current `pending the Windows release gate` path or missing runtime behavior.
+- [ ] **Step 3: Implement the minimum runtime** around the pinned native host. Spawn only `policy.native_host.path`; executable/args/cwd come only from the selected policy profile and validated request bounds.
+- [ ] **Step 4: Separate host control records from PTY payload** and retain bounded output with `earliest_offset`, `stream_head`, and explicit truncation.
+- [ ] **Step 5: Add signed start/exit/terminate journal assertions** using the existing Ed25519 trust helpers; journal sequence and previous-event hash must chain exactly.
+- [ ] **Step 6: Run GREEN:** same command, zero orphan host/child processes and zero skipped Windows tests on the Windows target.
+
+### Task 2: Named policy action transport
+
+**Files:**
+- Modify: `src/process-runtime.mjs`
+- Modify: `test/process-runtime.test.mjs`
+- Modify only if required by observed Windows behavior: `native/deadbyte-process-host.cpp`, `test/process-native.test.mjs`
+
+**Interfaces:**
+- `action({ sessionId, actionId })`
+- `actionId` resolves only through `policy.profiles[profile_id].input_actions[actionId]`.
+- No public/runtime method accepts arbitrary input bytes or terminal text.
+
+- [ ] **Step 1: Write RED Windows test** with one harmless policy-defined action that changes observable state in the already-owned session, then a second approved observation proves persistence.
+- [ ] **Step 2: Run RED** and record exact failure mode before native/runtime edits.
+- [ ] **Step 3: Implement only the smallest transport needed** to write the exact policy-defined bytes to the already-owned host stdin; enforce `max_input_bytes` and reject unknown action IDs before side effects.
+- [ ] **Step 4: Record a signed action event** containing action ID, byte count, action-bytes SHA-256, prior journal head, and resulting event head; do not store raw action bytes in public output.
+- [ ] **Step 5: Run GREEN plus adversarial cases** for unknown action ID, stale/disarmed grant, closed session, oversize policy action, and PID/session mismatch defense.
+- [ ] **Step 6: If physical Windows persistence is not reliable, revert the public action path to fail-closed and mark the successor replacement gate PENDING; do not weaken the contract.
+### Task 3: Strict MCP process surface
+
+**Files:**
+- Create: `src/process-output-contracts.mjs`
+- Create: `src/process-mcp-tools.mjs`
+- Create: `test/process-mcp-tools.test.mjs`
+- Modify: `src/mcp-server.mjs`
+- Replace the old fail-closed source assertion in: `test/process-supervision.test.mjs`
+
+**Interfaces:**
+- Public tools: `process_session_start`, `process_session_read`, `process_session_status`, `process_session_list`, `process_session_terminate`.
+- Conditional sixth tool: `process_session_action`, only when Task 2 Windows proof is green.
+- MCP startup uses `DEADBYTE_PROCESS_RUNTIME=0|1` and `DEADBYTE_PROCESS_POLICY`; enabled mode without a valid policy fails startup.
+
+- [ ] **Step 1: Write RED catalog/schema tests** requiring the five bounded supervision tools, strict input/output objects, bounded numeric/string fields, and no executable/path/raw-input fields.
+- [ ] **Step 2: Add RED action-schema test only if Task 2 is green**; schema contains `session_id` + `action_id` only.
+- [ ] **Step 3: Run RED:** `node --test test/process-supervision.test.mjs test/process-mcp-tools.test.mjs`.
+- [ ] **Step 4: Implement `process-output-contracts.mjs` and `registerProcessTools(...)`** using `structuredToolResult` patterns already used by coding/machine tools.
+- [ ] **Step 5: Wire process policy/runtime into `mcp-server.mjs`** without changing coding/host/autonomous authority behavior.
+- [ ] **Step 6: Run GREEN plus existing output-schema tests** and confirm disabled process runtime leaves the prior catalog unchanged.
+
+### Task 4: Controller, remote catalog, and live smoke
+
+**Files:**
+- Modify: `src/remote-mcp-smoke-client.mjs`
+- Modify: `src/remote-mcp-r24-disarmed-smoke-client.mjs`
+- Modify: `test/remote-r24-catalog.test.mjs`
+- Modify: `controller/deadbyte-controller.ps1` only where current process config/status commands are incomplete
+- Modify: `test/controller.test.mjs` / existing standing-grant tests as applicable
+- Create: `src/remote-mcp-process-smoke-client.mjs`
+
+**Interfaces:**
+- Process registration is an independent catalog dimension; partial registration is invalid.
+- Public smoke uses only configured IDs and never passes executable paths or arbitrary terminal text.
+
+- [ ] **Step 1: Write RED exact-catalog tests** from the actual enabled tool count after Task 3; do not guess the count before enumerating registered tools.
+- [ ] **Step 2: Update bridge/remote expected catalogs** to include exactly the process surface proven in Task 3.
+- [ ] **Step 3: Extend controller tests** so `processstatus`, `armprocess`, and `disarmprocess` preserve coding/autonomous/host authority separation.
+- [ ] **Step 4: Add public process smoke**: status → approved start → bounded read → optional approved named action if proven → status/list → terminate → signed journal verification.
+- [ ] **Step 5: Run focused GREEN:** process, controller, remote-catalog, bridge-contract, and output-schema tests.
+
+### Task 5: Candidate release gate without activation
+
+**Files:**
+- Modify: `scripts/gate-windows.ps1`
+- Modify: `package.json`
+- Modify current successor docs/README only after behavior is green
+- Regenerate: `MANIFEST.SHA256` only through the canonical manifest writer
+
+**Interfaces:**
+- Windows gate adds the process smoke after source tests and before final manifest verify.
+- This task does not change the active release pointer or successor version identity.
+
+- [ ] **Step 1: Write RED package/gate tests** requiring the process smoke command and Windows-gate stage.
+- [ ] **Step 2: Add the minimal npm script and gate invocation.**
+- [ ] **Step 3: Run full `npm test`**; require zero failures.
+- [ ] **Step 4: Run canonical `npm run gate:windows`** from the isolated successor candidate; require native build, manifest write/verify, all MCP planes, process smoke, containment, authority, and final-manifest stages to PASS.
+- [ ] **Step 5: Run candidate public process smoke against a non-production candidate runtime** and independently verify signed/hash-bound process evidence.
+- [ ] **Step 6: Reverify frozen R30 release ID + manifest bytes are unchanged.**
+- [ ] **Step 7: Record exact candidate catalog count, manifest SHA-256, test count, native-host SHA-256, process-policy SHA-256, and any remaining PENDING item.**
+
+## Plan self-review
+
+Spec coverage: this plan closes only the mandatory Process Prerequisite Gate; machine-filesystem work gets its own plan after this gate is green.
+Placeholder scan: no TBD/TODO/FIXME markers are permitted.
+Type consistency: internal methods use camelCase IDs; public contracts use snake_case IDs. `process_session_action` exists only after the Windows named-action proof passes.
+Safety: no task adds caller-selected executables, shell command strings, script bodies, raw stdin, unrestricted PID mutation, or whole-machine authority.
+Execution: use an isolated NON-GIT successor copy. R30 active release remains immutable until a later successor release plan explicitly reaches activation.

package/docs/superpowers/plans/2026-09-15-r33-audit-chain-npx.md

@@ -0,0 +1,132 @@
+# R33 Audit Chain + NPX Entrypoint Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: use systematic debugging, test-driven development, and verification-before-completion. This repository is NON-GIT; use exact SHA-256 preconditions and observed test/gate evidence instead of commits.
+
+**Goal:** Replace simple audit history with a tamper-evident signed audit chain and add an npx-first DEADBYTE launcher while preserving the exact 68-tool R33 MCP catalog.
+
+**Architecture:** `tool-audit.mjs` owns durable pre-handler request logging, post-handler outcome logging, sanitization and immutable segment/checkpoint writing. `audit-context.mjs` binds events to release/generation/authority machine state. `audit-verify.mjs` independently verifies the chain without importing writer validation. `deadbyte-cli.mjs` provides npx commands and delegates remote control to the stable PS1 launcher without using `.cmd`.
+
+**Tech Stack:** Node.js >=22 ESM, canonical JSON, SHA-256, Ed25519, node:test, Windows PowerShell stable launcher.
+
+**Spec:** `docs/superpowers/specs/2026-09-15-r33-audit-chain-npx-design.md`
+
+## Global Constraints
+
+- Project is NON-GIT. Never invent commit/branch/HEAD evidence.
+- Audit request must be durably committed before a handler can mutate state.
+- Audit write/context failure before handler execution must fail closed.
+- Audit files live only below `${DEADBYTE_STATE_ROOT}/audit`, never immutable release slots.
+- Raw tool result payloads are never stored.
+- Secret values are never stored and are not hashed into an offline guessing oracle.
+- Payload/oversized non-secret values are represented by byte count + SHA-256.
+- Closed segments are immutable and signed with the existing Ed25519 trust key under an audit-specific domain.
+- Independent verifier must not call writer validation helpers.
+- R33 public MCP catalog must remain exactly 68 tools.
+- Serena/semantic-code-plane scope is excluded.
+- Any source mutation makes previous manifest/release-gate evidence stale.
+
+---
+
+### Task 1: Audit event chain and sanitizer
+
+**Files:**
+- Modify: `src/tool-audit.mjs`
+- Modify: `test/tool-audit.test.mjs`
+
+**Interfaces:**
+- `sanitizeAuditArgs(args) -> sanitized JSON value`
+- `await createToolAudit({stateRoot, signingKeyPath, contextProvider, maxSegmentBytes?, maxSegmentRecords?, clock?})`
+- returned audit object: `recordRequest(tool,args)`, `recordResult(token,result,error,durationMs)`, `seal()`, `status()`
+- `installToolAudit(server,audit)` wraps every future `registerTool` handler.
+
+- [ ] Write RED tests for secret redaction, payload hashing, oversized hashing, monotonic seq, request/result request_id correlation and no raw result payload.
+- [ ] Run `node test/tool-audit.test.mjs` and observe contract failures against the current simple logger.
+- [ ] Implement canonical event hashing and durable fsync append with serialized writer queue.
+- [ ] Implement request-before-handler wrapper and result summary.
+- [ ] Re-run focused tests to GREEN.
+- [ ] Record exact file SHA-256 values after GREEN.
+
+### Task 2: Immutable rotation and signed checkpoints
+
+**Files:**
+- Modify: `src/tool-audit.mjs`
+- Modify: `test/tool-audit.test.mjs`
+
+**Interfaces:**
+- segment files: `audit/segment-NNNNNNNN.jsonl`
+- checkpoint files: `audit/checkpoint-NNNNNNNN.json`
+- checkpoint signature domain: `DEADBYTE-AUDIT-CHECKPOINT-V1\0`
+
+- [ ] Write RED tests that force two-record rotation and check cross-segment `prev_sha256` continuity.
+- [ ] Write RED restart/resume test using the same state root.
+- [ ] Implement segment discovery/recovery, max-record/max-byte rotation and atomic signed checkpoint creation.
+- [ ] Ensure a closed segment is never reopened.
+- [ ] Re-run focused tests to GREEN.
+
+### Task 3: Authority/release/generation context
+
+**Files:**
+- Create: `src/audit-context.mjs`
+- Modify: `src/mcp-server.mjs`
+- Modify: `test/tool-audit.test.mjs`
+
+**Interfaces:**
+- `createAuditContextProvider({stateRoot, packageRoot, machineRuntime, processPolicy, codingRuntime, autonomousRuntime, hostPolicy}) -> async () => context`
+- context contains exact release/generation identity and authority snapshots.
+
+- [ ] Write RED tests for release manifest binding and process/coding/autonomous/host configured+armed state fields.
+- [ ] Implement provider using verified machine runtime status when available plus package manifest/generation identity cross-checks.
+- [ ] Import `processSessionStatus` and reuse existing authority readers; never arm/renew authority.
+- [ ] Make `DEADBYTE_AUDIT_RUNTIME=1` instantiate the async audit writer with signing key + context provider before tool registration.
+- [ ] Re-run focused integration test through stdio.
+
+### Task 4: Independent audit verifier
+
+**Files:**
+- Create: `src/audit-verify.mjs`
+- Create: `test/audit-verify.test.mjs`
+
+**Interfaces:**
+- `verifyAuditChain({stateRoot, verifyKeyPath}) -> {ok,event_count,request_count,result_count,segment_count,checkpoint_count,head_sha256,last_seq,...}` or `{ok:false,reason}`
+
+- [ ] Write clean-chain acceptance test.
+- [ ] Write RED tamper tests: edited line, deleted line, reordered line, bad checkpoint signature, broken cross-segment chain.
+- [ ] Implement independent parser/hash/checkpoint/signature verification without importing `tool-audit.mjs` validation code.
+- [ ] Verify unmatched request/result identities are reported as failure unless an explicitly open final request is the only incomplete tail caused by process death; R33 default is strict complete-pair verification for sealed segments.
+- [ ] Re-run verifier tests to GREEN.
+
+### Task 5: NPX-first CLI
+
+**Files:**
+- Create: `src/deadbyte-cli.mjs`
+- Modify: `package.json`
+- Create: `test/cli-entrypoint.test.mjs`
+- Modify: `README.txt`
+
+**Interfaces:**
+- package bin: `deadbyte-mcp -> src/deadbyte-cli.mjs`
+- `npx deadbyte-mcp@latest remote [start|status|restart|stop|url|...]`
+- bare `remote` maps to `start`
+- `npx deadbyte-mcp@latest audit verify`
+- `npx deadbyte-mcp@latest audit status`
+
+- [ ] Write RED tests that package bin exists, CLI has a node shebang, remote delegates to `~/.deadbyte-mcp/bin/DEADBYTE-MCP.ps1`, and source does not invoke `.cmd`.
+- [ ] Implement CLI using `spawn`/`spawnSync` with `shell:false` and exact remaining args.
+- [ ] Implement `audit verify/status` using independent verifier/status readers.
+- [ ] Remove `private:true` and add public publish config only if package-boundary tests show no secret/private artifact exposure; otherwise keep registry publishing blocked and report the blocker rather than weaken packaging.
+- [ ] Update README primary examples to npx while retaining `.cmd` only as compatibility implementation detail.
+- [ ] Re-run CLI/package-boundary tests.
+
+### Task 6: Regression and release gates
+
+**Files:** no new feature scope.
+
+- [ ] Run focused audit + verifier + CLI tests.
+- [ ] Run full `npm test`; report observed total, never assume previous 343.
+- [ ] Run package-boundary and relevant controller/runtime smokes.
+- [ ] Run fresh canonical Windows gate from the exact source bytes.
+- [ ] Record fresh manifest SHA-256 and gate evidence; all earlier manifests become predecessor-only evidence.
+- [ ] Freeze candidate after gate PASS; no more source changes.
+- [ ] Continue immutable activation, fresh exact-68 discovery, controlled authority window, release parity, signed rollback, predecessor verification, exact successor restore, final closure and independent final verification.
+- [ ] Final authority state must be process/coding/autonomous/host DISARMED.
+- [ ] Only then use verdict `BASELINE_FINAL_LIVE`.