deadbyte-mcp 0.8.7

package/docs/superpowers/specs/2026-09-14-r30-r33-machine-control-design.md

@@ -0,0 +1,214 @@
+# DEADBYTE MCP R30-R33 Machine Control Design
+
+Status: APPROVED DIRECTION, design authority from chat 2026-09-14.
+Authority root: C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r30-process-candidate.
+Source control: NON-GIT. Never manufacture commit IDs or Git evidence.
+
+## Observed starting state
+
+- Public runtime version is 0.8.5; documented baseline is R29.
+- Fully enabled R29 exposes 46 MCP tools.
+- R29 already has Ed25519 machine identity, signed receipts/events, coding authority, autonomous authority, Native Diff, immutable release slots, and persistent tunnel transport.
+- bin/deadbyte-process-host.exe and native/deadbyte-process-host.cpp already exist in the candidate.
+- The native process host uses Windows ConPTY, CREATE_SUSPENDED, a kill-on-close Job, PID plus creation FILETIME reporting, and bidirectional byte pumps.
+- test/process-native.test.mjs proves one persistent PowerShell process preserves state across inputs and exits cleanly.
+- The process host is not registered as an MCP surface. mcp-server.mjs, remote catalog tests, README, version, and Windows gate still describe R29.
+- Remote Desktop Commander currently wins on machine reach: generic filesystem inspection, search, process/session control, and interactive terminal reach.
+- DEADBYTE MCP currently wins on authority and evidence: local policy, cryptographic identity, preconditions, signed evidence, rollback, and fail-closed release gates.
+
+## Goal
+
+Make DEADBYTE MCP sufficient for normal local engineering work without Remote Desktop Commander, while preserving stronger authority and evidence semantics.
+Replacement means DEADBYTE can perform interactive process control, machine filesystem work, search/observation, and autonomous use of those primitives without accepting caller-selected executable paths or unqualified mutations.
+
+## Design law
+
+- Do not clone another tool's API merely for parity.
+- Session launch uses locally trusted profile IDs and pinned program identity.
+- Session mutations target DEADBYTE session identity, not an unqualified numeric PID.
+- File changes require absent or SHA-256 preconditions and post-change hashing.
+- Trusted roots reject reparse-point escape.
+- Success is never inferred from terminal text alone; release completion requires current-epoch evidence.
+- Extend existing policy, receipt, strict-output, machine identity, and release-gate machinery. Do not add a second framework.
+- Every public tool uses strict input and output contracts; unknown fields fail closed.
+- Registration and authority remain separate states.
+- Read authority and mutation authority remain distinct.
+- Existing R29 surfaces remain compatible until an explicit later removal release.
+
+## Release slices
+
+R30 = interactive process/session plane.
+R31 = machine filesystem plane.
+R32 = search and observation plane.
+R33 = autonomous integration plus replacement gate.
+
+Each slice is independently releasable and must pass its own source tests, Windows target gate, public catalog gate, evidence verification, and manifest verification before the next slice starts.
+
+## R30 process plane
+
+R30 promotes the existing native ConPTY host into a public trusted session surface.
+
+Public tools:
+- process_session_start
+- process_session_input
+- process_session_read
+- process_session_status
+- process_session_list
+- process_session_terminate
+
+A trusted process policy defines session profiles. A profile fixes the program path and SHA-256, fixed launch arguments, permitted cwd roots, caller argument constraints, environment allowlist, concurrent-session bound, input bound, retained-output bound, and termination behavior.
+
+Start returns a random 256-bit session ID plus child PID, child creation FILETIME, profile ID, policy SHA-256, cwd identity, and a signed start event. PID is diagnostic only.
+
+The native host owns one Windows Job per session with kill-on-close. Descendants remain in that Job. Session termination closes the owned boundary and verifies the originally recorded process identity before reporting success.
+
+Input is bounded bytes sent only to an existing owned session. Every accepted input records sequence number, byte count, request digest, previous event digest, and signed event metadata.
+
+Output is an ordered byte stream with monotonically increasing offsets. Reads request an offset plus maximum byte count and return the observed byte range, current stream head, truncation state, and stream-chain digest. Retention truncation must be explicit; silent loss is forbidden.
+
+A runtime restart does not claim a ConPTY session survived. Orphan recovery is fail-closed: only verified owned host processes may be stopped; no session is adopted merely from PID reuse or matching output.
+
+## R31 machine filesystem plane
+
+R31 adds direct machine filesystem tools over locally registered roots without exposing an unrestricted machine path namespace.
+
+Public tools:
+- machine_fs_stat
+- machine_fs_list
+- machine_fs_read
+- machine_fs_write
+- machine_fs_edit_exact
+- machine_fs_move
+- machine_fs_mkdir
+- machine_fs_delete
+
+Read results include canonical relative path, kind, size, timestamps, and SHA-256 for regular files when requested. Listing is deterministic and paged by a stable lexical cursor.
+
+All path resolution is root-relative and rejects traversal, root escape, unexpected reparse points, and type changes between validation and commit.
+
+Write uses absent/SHA-256 preconditions, same-directory temporary file, flush, atomic rename, and post-commit SHA-256 verification.
+
+Exact edit additionally requires the expected source SHA-256 and exact replacement count. It never falls back to fuzzy matching.
+
+Move/delete require exact source identity. Destructive operations produce signed preimage metadata sufficient to prove what object was targeted. Where rollback is supported, the rollback artifact is content-addressed and bound to the mutation receipt.
+
+Directory creation requires an absent precondition at the target. Existing directories are not silently treated as success.
+
+Large file reads are bounded ranges; the API never forces whole-file text decoding. Binary data uses base64 or raw-safe bounded encoding contracts.
+
+## R32 search and observation plane
+
+R32 adds bounded observation primitives instead of implementing search through an interactive session.
+
+Public tools:
+- machine_search_start
+- machine_search_page
+- machine_search_status
+- machine_search_cancel
+- machine_process_list
+- machine_system_status
+
+Search accepts trusted root IDs, file-name or content mode, literal or regular-expression mode, case policy, file filter, result bound, context-line bound, and explicit inclusion policy for hidden entries.
+
+A search receives a random search ID and immutable request digest. Result pages are ordered deterministically and tied to one result-chain head. Paging never mutates prior pages.
+
+Search work is bounded by policy for files visited, bytes scanned, results retained, output bytes, and elapsed execution. Cancellation targets only the owned search job.
+
+Process observation returns PID, creation time, image identity where readable, parent PID, session association when owned by DEADBYTE, and bounded resource observations. Observation does not grant process mutation authority.
+
+System status exposes bounded machine truth needed by engineering workflows: OS build, architecture, CPU count/load, physical memory totals/free values, DEADBYTE runtime identity, active release/generation, and authority state. Values are observations with timestamps, not cached prose claims.
+
+Search and observation receipts record request digests and observed result heads. They are not promoted into release evidence unless a gate explicitly consumes them.
+
+## R33 autonomous integration and replacement gate
+
+R33 lets the autonomous runtime consume R30-R32 through explicit planner actions and trusted profiles. It does not convert the planner into an unrestricted machine principal.
+
+Planner actions gain bounded inspect, search, filesystem mutation, session-profile start/input/read/terminate, profile execution, finish, and pause operations. Every mutating action is checked against the relevant standing grant and policy hash at execution time.
+
+Autonomous plans may reference only registered root IDs and profile IDs. The model cannot add roots, alter pinned program identity, widen limits, arm authority, or renew grants.
+
+Native Diff remains the preferred source-edit transaction. R31 mutation tools exist for general machine work and compatibility, not as a reason to bypass Native Diff in autonomous source changes.
+
+The release gate requires current mutation-epoch build/test/benchmark evidence, current Native HEAD verification when Native Diff was used, strict catalog verification, public remote smoke, manifest verification, machine identity binding, and signed completion evidence.
+
+Remote Desktop Commander replacement is declared only after a parity suite proves these workflows solely through DEADBYTE MCP:
+1. inspect a tree and bounded file ranges;
+2. exact-precondition file edit plus verification;
+3. deterministic file/content search with paging;
+4. start an approved interactive session, preserve state across inputs, read ordered output, and terminate its Job;
+5. list processes and machine resource state;
+6. run the normal coding/autonomous build-test-debug loop;
+7. recover fail-closed after interrupted runtime;
+8. verify all evidence independently.
+
+The replacement declaration is a release artifact, not a README sentence. Until that gate passes, Remote Desktop Commander remains a bootstrap/development dependency and must not be called removed.
+
+## Failure semantics
+
+- Policy missing, malformed, or hash-mismatched: deny before side effect.
+- Standing grant absent or stale: deny before side effect.
+- Program/file identity mismatch: deny before side effect.
+- Session/search ID unknown or stale: deny; never fall back to PID or path guessing.
+- Output retention gap: return explicit earliest available offset and truncation flag.
+- Concurrent file precondition conflict: no commit; return observed current SHA-256 when safe.
+- Partial filesystem commit: fail closed and emit recovery evidence; never report committed without post-commit verification.
+- Child/session crash: preserve terminal event and exit observation; do not translate crash into success.
+- Runtime crash: restart from durable journals only; do not infer completed side effects from files or processes alone.
+- Evidence signature/hash verification failure: release gate fails.
+
+## Verification strategy
+
+Every slice follows RED -> GREEN -> adversarial -> Windows target -> public remote -> manifest verification.
+
+R30 tests cover policy parsing, strict schemas, profile rejection, pinned identity mismatch, session start/input/read/status/list/terminate, ConPTY state persistence, output offsets, truncation, Job descendant cleanup, PID-reuse defense, crash recovery, disarmed authority, signed-event verification, and exact public catalog counts.
+
+R31 tests cover traversal, reparse escape, TOCTOU identity change, absent/hash conflicts, atomic write, exact replacement count, binary range reads, deterministic listing/paging, move/delete preimages, rollback evidence, disarmed authority, and strict output contracts.
+
+R32 tests cover literal/regex search, deterministic ordering, paging continuity, cancellation, policy bounds, hidden-file policy, result-chain verification, process creation-time identity, system observations, and read-only authority separation.
+
+R33 tests cover planner cannot widen authority, policy/grant revocation mid-run, Native Diff preference for source edits, current-epoch release evidence, interrupted autonomous recovery, replacement parity suite, public tunnel path, and independent completion-receipt verification.
+
+No release advances because unit tests alone pass. The physical Windows target gate and public MCP edge both remain required for claims about production behavior.
+
+## Release progression
+
+R30 cannot claim complete until the six process tools are public, strict-schema verified, policy-gated, signed-event backed, covered by native and MCP tests, included in exact catalog tests, included in Windows gate, documented, and bound into the release manifest.
+
+R31 starts only from a passing R30 release candidate. R32 starts only from a passing R31 release candidate. R33 starts only from a passing R32 release candidate.
+
+Version numbers are assigned only when a slice is release-ready. Do not bump versions merely because implementation started.
+
+## Non-goals
+
+- No GUI remote desktop or screen streaming in this baseline.
+- No unrestricted whole-machine root namespace.
+- No generic remote service manager.
+- No registry editor surface.
+- No raw disk or firmware mutation surface.
+- No arbitrary privilege escalation.
+- No dependency on Git for transaction identity, rollback, or release proof.
+- No attempt to preserve interactive ConPTY sessions across DEADBYTE runtime restart.
+- No compatibility abstraction for non-Windows process hosting in R30; Windows x64 is the target.
+
+## Final acceptance
+
+Final baseline is accepted only when R30-R33 gates all pass from the canonical candidate, the replacement parity suite uses no Remote Desktop Commander calls, the immutable release activates successfully, rollback to the previous known-good slot is proven, the stable public endpoint reports the expected exact catalog and machine identity, and an independent verifier accepts the signed completion receipt.
+
+Any missing physical/public evidence remains explicitly PENDING. QEMU, mocks, local source tests, or prose never substitute for the required target evidence.
+
+## R30 safety amendment: policy-pinned interactive actions
+
+This amendment supersedes the earlier R30 arbitrary-input wording.
+`process_session_input` accepts only a locally defined `action_id`; callers cannot provide terminal text or raw bytes.
+Each process profile may define a bounded map of named input actions to exact UTF-8 bytes. Those bytes are part of the process-policy SHA-256 and therefore require a local policy change plus grant refresh to change.
+
+The process runtime may still host an interactive ConPTY program, but remote authority is limited to starting an approved profile, invoking named fixed input actions, reading bounded output, inspecting status/list, and terminating sessions it owns.
+No public tool may accept caller-selected executable paths, shell command strings, script bodies, arbitrary stdin, or raw PID mutation.
+
+### 2026-09-14 R30 supervision amendment
+Observed Windows ConPTY evidence disproved the original assumption that raw terminal text can be treated as a stable R30 input contract. R30 release scope is therefore narrowed to five policy-pinned supervision tools: `process_session_start`, `process_session_read`, `process_session_status`, `process_session_list`, and `process_session_terminate`.
+
+`process_session_input` is explicitly PENDING and is not part of R30 release acceptance, catalog count, or replacement claims. It may return only in a later slice after terminal-protocol emulation passes physical Windows adversarial tests. R30 must not expose arbitrary stdin, caller-selected executable paths, or caller-selected command strings.
+
+Final V0.8.6 / R30 release acceptance keeps the fully enabled public catalog at 48 tools: prior R29 46 plus `coding_stat` and `coding_search`. The five process-session tools remain unregistered and fail closed in this release; native supervision plus process policy/grant evidence is retained as foundation only. `process_session_input` remains PENDING. All other R30 authority, identity, Windows-gate, and public-evidence requirements remain in force.

package/docs/superpowers/specs/2026-09-14-r31-r33-final-baseline-successor-design.md

@@ -0,0 +1,133 @@
+# DEADBYTE MCP R31-R33 Final Baseline Successor Design
+
+Status: REVIEW READY. Approved direction from chat 2026-09-14.
+Source control: NON-GIT. Do not invent commits, branches, or HEAD evidence.
+
+## Frozen predecessor
+
+- Active known-good release is `V0.8.6 / R30`.
+- Active release ID is `v0.8.6-7b057342c381906a`.
+- Release manifest SHA-256 is `7b057342c381906a9f1ab9dbdbe72d935125be9131a09328e95601cad1d2ad15`.
+- Public catalog is exactly 48 tools.
+- `coding_stat` and `coding_search` are live and verified.
+- R30 process policy/native supervision foundation exists but public process-session tools remain unregistered.
+- R30 stays immutable and is the rollback known-good predecessor for all successor activation work.
+
+## Goal
+
+Complete the machine-control baseline that R30 intentionally deferred, without introducing an unrestricted remote shell or unrestricted whole-machine mutation plane.
+The final declaration is earned only when R31-R33 successor gates, replacement parity, activation, rollback, public edge verification, manifest verification, and signed completion evidence all pass.
+
+## Successor sequence
+
+R31 begins with a mandatory Process Prerequisite Gate, then adds bounded machine filesystem authority.
+R32 adds bounded search, process observation, and system observation.
+R33 integrates these capabilities into autonomous execution and runs the Remote Desktop Commander replacement parity gate.
+No successor release number is assigned until its complete release gate is green.
+## Global authority law
+
+- Registration never implies authorization.
+- Every control action requires a current local policy plus a standing grant bound to the exact policy SHA-256.
+- Public callers select only registered root, profile, session, and action identifiers within policy-defined bounds.
+- Trusted roots are relative, confined, and verified before and after any permitted change.
+- Process control targets DEADBYTE-owned session identity rather than an unqualified operating-system process identifier.
+- Runtime restart does not adopt a prior session from weak identity evidence.
+- Existing Native Diff remains the preferred source-edit transaction for autonomous source work.
+- Every public tool uses strict input and output schemas and rejects unknown fields.
+- Evidence must be current-epoch and independently verifiable.
+- Missing Windows or public evidence remains explicitly PENDING.
+
+## R31 Process Prerequisite Gate
+
+Before R31 machine-filesystem work advances, the successor must finish the existing bounded process-supervision design using the current process policy, native host, controller grants, trust keys, and MCP contract machinery.
+The public surface is limited to starting a registered profile, observing owned-session output/state, listing owned sessions, invoking a locally registered named action when supported, and terminating an owned session.
+No second process authority framework is introduced.
+The named-action surface remains fail-closed unless Windows tests prove the exact registered action transport reliably.
+Final replacement parity additionally requires at least one policy-defined named action to be exercised across a persistent owned session; if that proof is absent, RDC replacement cannot be declared.
+
+## R31 Machine Filesystem Gate
+
+R31 adds bounded filesystem work over locally registered roots only.
+The public surface covers metadata, deterministic listing, bounded reads, exact-precondition writes/edits, directory creation, move, and delete inside registered roots.
+
+Required properties:
+- root-relative paths only;
+- deterministic lexical ordering for listings;
+- bounded range reads for large or binary files;
+- absent or SHA-256 preconditions before any permitted change;
+- exact replacement counts for text edits;
+- same-directory staging plus post-commit hash verification where atomic replacement is supported;
+- explicit source identity for move/delete;
+- signed or hash-bound evidence describing the preimage and observed result;
+- fail-closed handling for traversal, reparse escape, type drift, and concurrent-precondition conflicts.
+
+R31 must reuse the existing root-confinement, coding-policy, receipt, and strict-schema patterns where they already fit.
+It must not create a parallel unrestricted path namespace.
+
+R31 acceptance requires the Process Prerequisite Gate plus machine-filesystem unit/adversarial tests, Windows target evidence, exact public catalog verification, manifest verification, immutable-slot activation, and rollback proof.
+## R32 Observation Gate
+
+R32 adds bounded, deterministic observation over registered roots and the local runtime.
+Search results must be ordered, paged, and constrained by explicit policy limits for work and output size.
+Runtime observations must be timestamped and must distinguish DEADBYTE-owned state from unrelated operating-system state.
+Observation permission remains separate from change permission.
+Receipts bind the request digest and the observed result head.
+
+R32 acceptance requires all R31 gates to remain green plus R32 adversarial-bound tests, Windows evidence, public catalog/smoke evidence, manifest verification, immutable-slot activation, and rollback proof.
+
+## R33 Autonomous Integration Gate
+
+R33 integrates only the bounded identifiers and contracts established by R31-R32.
+The autonomous layer cannot add roots, alter pinned identities, widen policy limits, arm authority, or renew grants.
+Authority and policy hashes are rechecked at execution time.
+Native Diff remains preferred for autonomous source edits.
+
+R33 acceptance requires the complete predecessor gate set plus autonomous authority-revocation tests, interrupted-run recovery, public evidence, manifest verification, activation, rollback proof, and the final replacement parity suite.
+## Final replacement parity suite
+
+The replacement declaration is a release artifact, not a README claim.
+It is accepted only when the final successor can complete the required engineering workflows through DEADBYTE MCP itself, with Remote Desktop Commander absent from the parity run.
+
+The parity suite must prove:
+1. deterministic tree inspection and bounded file reads;
+2. exact-precondition file change plus independent verification;
+3. deterministic bounded file/content search;
+4. approved owned-session lifecycle and bounded output observation;
+5. bounded process/runtime and system observation;
+6. the normal coding build-test-debug loop;
+7. autonomous execution without authority widening;
+8. fail-closed recovery after interruption;
+9. independent verification of signed/hash-bound evidence.
+
+RDC remains a bootstrap/development dependency until this suite passes on the active successor release.
+
+## Failure semantics
+
+Policy, grant, identity, precondition, or evidence mismatch denies before claiming success.
+Unknown or stale owned identifiers never fall back to PID/path guessing.
+Retention gaps and partial observations are reported explicitly.
+Interrupted operations preserve recovery evidence and do not become success by inference.
+A release failure leaves or restores the previous immutable known-good pointer through the canonical updater rollback path.
+## Non-goals
+
+- no GUI remote desktop or screen streaming;
+- no unrestricted whole-machine root namespace;
+- no generic remote service-manager surface;
+- no registry-editor surface;
+- no raw disk or firmware mutation surface;
+- no arbitrary privilege escalation;
+- no Git dependency for transaction identity or release proof;
+- no claim that an owned process session survives a DEADBYTE runtime restart.
+
+## Final acceptance
+
+The Final Baseline is declared only after all successor gates pass from one canonical candidate and the immutable successor activates successfully.
+The stable public endpoint must report the expected exact catalog, release identity, generation identity, strict schemas, and machine identity.
+The final manifest and tree verification must match the activated release.
+The canonical updater must produce a successful signed activation receipt with no rollback performed.
+Each successor activation must prove rollback to its immediate predecessor, then restore and reverify the successor.
+The frozen R30 release slot and manifest must remain byte-identical and independently verifiable throughout the entire R31-R33 progression.
+The replacement parity suite must run without RDC operations.
+An independent verifier must accept the final completion evidence.
+
+Until every item above has current evidence, status is SUCCESSOR IN PROGRESS rather than Final.

package/docs/superpowers/specs/2026-09-15-r33-audit-chain-npx-design.md

@@ -0,0 +1,145 @@
+# R33 DEADBYTE Audit Chain + NPX Entrypoint Design
+
+## Goal
+
+Turn tool-call logging into tamper-evident machine evidence and make `npx deadbyte-mcp@latest ...` the primary user-facing launcher without changing the R33 public MCP catalog.
+
+## Scope
+
+In scope:
+- audit every MCP tool request before the handler executes;
+- deny the tool call if the durable request audit cannot be committed;
+- append a correlated result event after handler completion/failure;
+- canonical JSONL event chain with monotonic sequence, request id, previous hash and event hash;
+- recursive secret-safe argument sanitization;
+- oversized/payload argument hashing instead of raw storage;
+- authority/release/generation context on every event;
+- bounded immutable segment rotation;
+- Ed25519 signed checkpoint for every closed segment;
+- cross-segment chain continuity;
+- an implementation-independent verifier and CLI;
+- `npx deadbyte-mcp@latest remote ...` and `npx deadbyte-mcp@latest audit verify` UX;
+- preserve exact 68 public MCP tools for R33.
+
+Out of scope:
+- Serena-style semantic code intelligence;
+- new public MCP audit tools (`audit_status`, `audit_recent`, `audit_verify`);
+- raw output transcript storage;
+- removing the existing compatibility controller scripts before the npx path has release/rollback proof.
+
+## Event Model
+
+Each JSONL event uses schema `deadbyte.tool-audit-event.v1` and contains:
+- `seq`: monotonically increasing integer starting at 1;
+- `ts`: UTC ISO timestamp;
+- `event_type`: `tool.request` or `tool.result`;
+- `request_id`: UUID shared by request/result;
+- `tool`: MCP tool name;
+- `prev_sha256`: previous event hash, all-zero genesis for seq 1;
+- `context`: release/generation/machine/authority snapshot;
+- request-only `args`: sanitized arguments;
+- result-only `outcome`: status, error flag, duration, receipt SHA-256 values and optional hashed error identity;
+- `event_sha256`: SHA-256 of canonical JSON for all event fields except `event_sha256`.
+
+The request event is fsync'd before the tool handler is invoked. If this write or context collection fails, the handler is never called.
+
+The result event never stores raw handler output. Successful/failed structured result status is retained plus receipt hashes. Thrown errors are represented by name plus byte count/hash of the message, never raw message text.
+
+## Sanitization
+
+Recursive sanitizer behavior:
+- secret keys/values (`token`, `password`, `secret`, `authorization`, private keys, recovery codes, cookies, credentials, environment) become `{redacted:true,reason:"secret",byte_count:N}` with no raw value and no secret hash oracle;
+- mutation/source payload keys (`content`, `old_string`, `new_string`, raw text/base64 payloads) become `{redacted:true,reason:"payload",byte_count:N,sha256:H}`;
+- otherwise-safe strings larger than 2048 UTF-8 bytes become `{redacted:true,reason:"oversize",byte_count:N,sha256:H}`;
+- useful identifiers, paths, command/profile/root ids, bounds and existing SHA-256 preconditions stay visible;
+- arrays/objects are bounded by depth/item/key limits.
+
+## Authority + Release Binding
+
+Each event context records:
+- active `release_id`;
+- `release_manifest_sha256`;
+- `generation_id` and `generation_manifest_sha256` when present;
+- machine id / identity generation / online epoch when machine runtime is enabled;
+- process/coding/autonomous/host authority as configured+armed+reason snapshots.
+
+When the machine runtime is enabled, audit context must agree with its verified active-release binding. Audit context failure is fail-closed before handler execution.
+
+## Segments + Signed Checkpoints
+
+Audit state lives only below `${DEADBYTE_STATE_ROOT}/audit`.
+
+Segment names are monotonic (`segment-00000001.jsonl`, ...). A segment closes when either:
+- record count reaches 1000; or
+- adding another event would exceed 10 MiB.
+
+A closed segment is immutable. Its checkpoint (`checkpoint-00000001.json`) contains:
+- segment index/file;
+- first/last seq;
+- first previous hash;
+- head event hash;
+- segment byte count and SHA-256 manifest;
+- previous checkpoint SHA-256;
+- creation timestamp;
+- checkpoint self hash;
+- Ed25519 key id and signature over a dedicated `DEADBYTE-AUDIT-CHECKPOINT-V1` domain.
+
+The first event of the next segment references the prior segment head. No trimming may break the chain.
+
+## Independent Verification
+
+`src/audit-verify.mjs` must independently parse bytes and recompute:
+- segment ordering;
+- every JSON line and schema;
+- seq monotonicity;
+- event hashes;
+- prev-hash chain;
+- request/result correlation;
+- segment hashes/byte counts;
+- checkpoint self hashes;
+- previous-checkpoint chain;
+- Ed25519 checkpoint signatures;
+- cross-segment continuity.
+
+It must not call writer validation helpers.
+
+Tampered, deleted, reordered records or bad signatures must fail verification.
+
+## NPX UX
+
+Keep package identity `deadbyte-mcp` for R33 to avoid a broad scoped-package migration. Primary commands:
+
+```text
+npx deadbyte-mcp@latest remote
+npx deadbyte-mcp@latest remote status
+npx deadbyte-mcp@latest remote restart
+npx deadbyte-mcp@latest audit verify
+npx deadbyte-mcp@latest audit status
+```
+
+`remote` delegates to the stable active-release PowerShell launcher under `~/.deadbyte-mcp/bin/DEADBYTE-MCP.ps1` using `shell:false`; it does not expose tokens or invoke the legacy `.cmd` path. Bare `remote` maps to controller `start`.
+
+The existing `.cmd` compatibility artifact may remain inside R33 until the new path passes activation/rollback/restore. It is no longer the documented primary UX.
+
+## Acceptance
+
+TDD must prove:
+- request audit occurs before handler side effect;
+- request audit failure blocks mutation;
+- request/result correlation;
+- no raw handler output in result audit;
+- recursive secret redaction;
+- payload/oversized hashing;
+- authority/release context binding;
+- monotonic sequence and event hash chain;
+- clean independent verification;
+- tampered line detected;
+- deleted line detected;
+- reordered line detected;
+- bad checkpoint signature detected;
+- cross-segment continuity;
+- restart/resume preserves chain;
+- npx/bin mapping and remote command avoid `.cmd`;
+- public MCP catalog remains exact 68.
+
+Any source mutation invalidates earlier manifest/gate/activation evidence. Final release work resumes only after focused tests, full suite and a fresh canonical Windows gate pass on the exact new bytes.

package/mcp-server.mjs

@@ -0,0 +1 @@
+import './src/mcp-server.mjs';