deadbyte-mcp 0.8.9 → 0.9.0

package/R34-BASELINE.json

@@ -0,0 +1,9 @@
+{
+    "schema":  "deadbyte.r34-workspace-baseline.v1",
+    "source":  "C:\\Users\\DEADBYTE\\Downloads\\deadbyte-mcp-r33-final-candidate-v2",
+    "source_version":  "0.8.10",
+    "source_package_json_sha256":  "99bb03660e5f1915c92d6c12e1526fcde23e15838ee62589a2117e2458178765",
+    "created_at_utc":  "2026-09-16T12:09:27.6733434Z",
+    "source_control":  "NON-GIT",
+    "purpose":  "R34 DEADBYTE Loop Engine development; sealed R33 source remains immutable"
+}

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.8.9 / R33 FINAL MACHINE BASELINE
+DEADBYTE MCP V0.9.0 / R35 PRODUCTION BASELINE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,17 +7,22 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
+  npx -y deadbyte-mcp@0.9.0 mcp
   npx deadbyte-mcp@latest remote
+  npx deadbyte-mcp@latest remote --verbose
   npx deadbyte-mcp@latest remote status
   npx deadbyte-mcp@latest remote restart
   npx deadbyte-mcp@latest audit status
   npx deadbyte-mcp@latest audit verify
 
+The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
 Bare `remote` is a foreground device session: it starts/resumes the verified runtime, arms process,
 coding, autonomous, and host authority in dependency order, independently checks that all four
-planes report ARMED, then streams new audit plus controller-runtime log records until Ctrl+C or the
-foreground input closes. Session shutdown revokes all four planes and parks the Bridge. A detached
+planes report ARMED, then shows compact completed-tool status lines only. The default console does
+not dump SHA values, request IDs, raw JSON payloads, or duplicate Bridge TOOL IN/OUT records. Use
+`remote --verbose` only when detailed audit plus Bridge diagnostics are needed. Session shutdown
+revokes all four planes and parks the Bridge. A detached
 nonce-bound guardian watches the foreground owner and performs the same revoke+park cleanup if the
 owner is hard-killed before `finally` can run. The v2 runtime marker binds owner PID, guardian PID,
 and a random 256-bit session nonce, prevents concurrent foreground sessions, and lets a later start
@@ -56,9 +61,9 @@ V0.8 adds an independently feature-gated durable agent surface:
   agent_task_approve
   agent_task_verify
 
-R23/R30 provide a separately granted 17-tool coding surface for inspect/edit/command/benchmark
-and durable coding tasks. Coding registration is not coding authority; mutating or
-executing calls require an explicit policy-bound standing coding grant.
+R23/R34 provide a separately granted 22-tool coding surface for inspect/edit/command/benchmark,
+batched file reads, JS/TS semantic navigation/edit, and durable coding tasks. Coding registration
+is not coding authority; mutating or executing calls require an explicit policy-bound standing coding grant.
 
 R24 adds a 12-tool autonomous surface for bounded goal execution, DEADBYTE Native Diff,
 model-driven diagnose/replan cycles, objective release gating, and signed release proof.
@@ -72,15 +77,15 @@ verify signed pings without trusting the target machine's local key store. Revok
 local host authority and advances identity generation plus online epoch without changing the key.
 
 The bridge accepts only complete combinations of base plus optional machine, host, agent,
-process, coding, machine-filesystem, observation, and autonomous surfaces. A fully enabled R33
-runtime has exactly 68 tools. Process authority is independently gated. Machine-filesystem and
+process, coding, machine-filesystem, observation, and autonomous surfaces. A fully enabled R34
+runtime has exactly 73 tools. Process authority is independently gated. Machine-filesystem and
 observation require the coding policy root set; autonomous requires the complete coding surface.
 Partial, dependency-invalid, unknown, or extra catalogs fail closed.
 
 STRICT OUTPUT CONTRACT
 ----------------------
 R22.1 established strict object outputSchema contracts for the original 15 tools.
-R23/R30 apply the same contract to all 17 coding tools, R24 applies it to all
+R23/R34 apply the same contract to all 22 coding tools, R24 applies it to all
 12 autonomous tools, and R29 applies it to all four machine tools. The core validates structuredContent locally on success
 and error paths, and the HTTP Bridge
 preserves outputSchema at the public MCP edge. Unknown top-level output fields
@@ -265,6 +270,127 @@ See:
   docs/V071-HOST-PLANE.md
   docs/V073-TUNNEL-STDIO-COMPAT.md
 
+MCP CLIENT CONFIGURATION
+------------------------
+The local stdio entry point is quiet and suitable for MCP hosts:
+
+  npx -y deadbyte-mcp@0.9.0 mcp
+
+CLAUDE DESKTOP
+Use the standard local-server entry in claude_desktop_config.json:
+
+  {
+    "mcpServers": {
+      "deadbyte": {
+        "command": "npx",
+        "args": ["-y", "deadbyte-mcp@0.9.0", "mcp"]
+      }
+    }
+  }
+
+CURSOR
+Create .cursor/mcp.json:
+
+  {
+    "mcpServers": {
+      "deadbyte": {
+        "type": "stdio",
+        "command": "npx",
+        "args": ["-y", "deadbyte-mcp@0.9.0", "mcp"]
+      }
+    }
+  }
+
+VS CODE
+Create .vscode/mcp.json:
+
+  {
+    "servers": {
+      "deadbyte": {
+        "type": "stdio",
+        "command": "npx",
+        "args": ["-y", "deadbyte-mcp@0.9.0", "mcp"]
+      }
+    }
+  }
+
+CODEX
+Add this to ~/.codex/config.toml:
+
+  [mcp_servers.deadbyte]
+  command = "npx"
+  args = ["-y", "deadbyte-mcp@0.9.0", "mcp"]
+
+The remote device path remains `npx deadbyte-mcp@latest remote`. Remote public MCP uses the
+verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
+URL or tunnel token into a repository.
+
+PRODUCTION TRACER BULLET
+------------------------
+The executable tracer test uses a real MCP client through the `deadbyte-mcp mcp` CLI entry point:
+
+  initialize / negotiate MCP 2026-07-28
+  tools/list
+  coding_file_read
+  coding_text_replace with exact file precondition
+  coding_receipt_verify
+  coding_command_run through a pinned executable/script policy
+  coding_receipt_verify
+  coding_file_read to verify committed state
+
+The test fails if negotiation closes, if a required tool is absent, if the edit is not surgical,
+if the command exits nonzero, or if either signed receipt fails independent verification.
+
+SEMANTIC CODE AND CONTEXT DISCIPLINE
+------------------------------------
+The R34 coding surface has 22 tools and the fully enabled public surface has exactly 73 tools.
+`coding_files_read` batches bounded reads. `coding_symbol_outline`, `coding_symbol_definition`,
+`coding_symbol_references`, and `coding_symbol_replace` use the bundled TypeScript language service
+for JavaScript/TypeScript (JS/TS). Symbol mutation still commits through the coding plane's exact
+file precondition and signed surgical-edit receipt path.
+
+The built-in semantic engine is deliberately limited to JS/TS in this baseline. DEADBYTE does not
+claim Serena's broader language breadth; unsupported languages must fail honestly rather than fall
+back to grep and call it semantic navigation. CONTEXT.md and `deadbyte://context` define domain
+vocabulary while bounded semantic/search/resource tools provide progressive disclosure instead of
+whole-repository prompt dumps.
+
+DOCUMENT ADAPTER EXTENSION
+--------------------------
+`src/document-adapter.mjs` is the bounded production document adapter extension seam. Adapters
+declare an id, one operation, accepted MIME types, output MIME type, and input/output byte budgets.
+Duplicate adapters, operation mismatch, MIME mismatch, or budget overflow fail closed. An installed
+converter can expose operation `markdown_to_pdf`; no fake PDF, DOCX, or spreadsheet tool is listed
+when no converter is configured.
+
+SECURITY DEFAULTS
+-----------------
+Workspace allowlist and coding-policy root checks are on by design. Paths are root-relative and
+traversal, symlink escape, denied paths, stale preconditions, and unknown executables fail closed.
+Destructive or executable host work requires the relevant standing grant / authority plane.
+Process execution uses policy-selected profiles or pinned scripts rather than a raw caller-selected
+shell command. Audit files retain request identity, timing, bounded metadata, and signed evidence
+even though normal `remote` console output is compact; use `remote --verbose` for forensic output.
+
+EVIDENCE-BASED COMPARISON
+-------------------------
+Desktop Commander provides a mature local filesystem/terminal MCP and Remote Desktop Commander
+adds a hosted remote relay. DEADBYTE's measured differential is a self-owned content-addressed
+release chain, separately revocable process/coding/autonomous/host authority planes,
+hash-preconditioned edits, Ed25519 signed receipts and journals, contained fixed workers, exact
+public-catalog gates, and tested rollback/restore. This is a mechanism comparison, not a marketing
+score.
+
+Serena has broader semantic language coverage through multiple language-server backends. DEADBYTE
+currently does not match that semantic breadth: its built-in semantic backend is JS/TS. For JS/TS,
+DEADBYTE adds exact file identity, receipt-backed symbol replacement, durable coding/autonomous
+journals, and release evidence around semantic operations. Broader pinned LSP adapters belong in a
+successor rather than pretending unsupported languages are already production-ready.
+
+Remote Desktop Commander uses a hosted account/OAuth relay. DEADBYTE instead uses its own verified
+named-tunnel device path plus immutable release/generation binding. The trade-off is explicit:
+hosted convenience on one side; self-owned release/evidence authority on the other.
+
 NO RAW SHELL COMMAND STRING. NO CALLER-SELECTED EXECUTABLE. CODING AND AUTONOMOUS
 EXECUTION REQUIRE EXPLICIT LOCAL STANDING GRANTS. REPORTS ARE CLAIMS; VERIFIED
 OBSERVATIONS AND SIGNED EVIDENCE ARE AUTHORITY.

package/bench/fixtures/corpus.json

@@ -0,0 +1,17 @@
+{
+  "schema": "deadbyte.r35-capability-corpus.v1",
+  "suite_id": "r35-offline-v1",
+  "cases": [
+    {"case_id":"filesystem_bounded_read","purpose":"bounded multi-file filesystem reads","round_trips":2},
+    {"case_id":"exact_edit_stale_reject","purpose":"receipt-backed exact edit plus stale precondition rejection","round_trips":4},
+    {"case_id":"paged_search","purpose":"bounded paged search with durable status","round_trips":4},
+    {"case_id":"process_owned_lifecycle","purpose":"owned process lifecycle and stale identity rejection","round_trips":6},
+    {"case_id":"semantic_typescript","purpose":"TypeScript symbol navigation and receipt-backed replace","round_trips":5},
+    {"case_id":"semantic_python","purpose":"Pyright cross-file navigation and receipt-backed replace","round_trips":5},
+    {"case_id":"semantic_rust","purpose":"rust-analyzer cross-file navigation and receipt-backed replace","round_trips":5},
+    {"case_id":"semantic_cpp","purpose":"clangd cross-file navigation and receipt-backed replace","round_trips":5},
+    {"case_id":"context_provenance","purpose":"provenance-preserving deterministic context compaction","round_trips":2},
+    {"case_id":"autonomous_fail_repair","purpose":"failed verification through critic repair and release","round_trips":8},
+    {"case_id":"remote_replay_dedupe","purpose":"resumable cursor replay without duplicate terminal display","round_trips":4}
+  ]
+}

package/bin/WORKER-REGISTRY.txt

@@ -2,11 +2,11 @@ schema=deadbyte.worker-registry.v1
 version=0.6.0
 policy=compile-time-operation-to-executable
 launcher.executable=deadbyte-exec.exe
-launcher.sha256=3406bb25ba2d3ba8d15e12702ad657ffc536c234d0489b69730f242f912ebed7
+launcher.sha256=1fe14b8f312f33f9cc90cb3ad1b3e7657e93235465bda62307ed837bdcee985b
 operation.lowercase_ascii=contained-transform-v1
 operation.reverse_bytes=contained-reverse-v1
 operation.uppercase_ascii=contained-transform-v1
 worker.contained-reverse-v1.executable=contained-reverse-worker.exe
-worker.contained-reverse-v1.sha256=4e574d929b8050de4ec8a3012f857e0aa3b5d08c034ebba4d8ffd822ace6ba00
+worker.contained-reverse-v1.sha256=e4989357ba06f24e049845290ba01c35c442dcebe2b048bfea52a04fc6b96f19
 worker.contained-transform-v1.executable=contained-transform-worker.exe
-worker.contained-transform-v1.sha256=c912a61c34142a2e1653cf4da16a5d33af3a588a0c5449752ed5af4926c092b6
+worker.contained-transform-v1.sha256=158c34b6c9e6d8476a31cdb34f354ace5a3c1071f2af54607e701baecc674405

package/controller/README.TXT

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.8.9 / R33 CONTROLLER
+DEADBYTE MCP V0.9.0 / R35 CONTROLLER
 ====================================
 
 ENTRY POINT
@@ -8,8 +8,10 @@ Primary operator entry point:
   npx deadbyte-mcp@latest remote
 
 Bare `remote` is a foreground device session. It starts the verified runtime, arms process,
-coding, autonomous, and host authority, verifies all four planes are ARMED, then streams new
-audit/runtime logs. Ctrl+C/SIGTERM or foreground input closure revokes all four planes and parks
+coding, autonomous, and host authority, verifies all four planes are ARMED, then prints compact
+human tool results only. It never dumps SHA text, request IDs, payload JSON, or duplicate Bridge
+stdout by default; use `remote --verbose` for the detailed audit/runtime stream. Ctrl+C/SIGTERM or
+foreground input closure revokes all four planes and parks
 the Bridge. A detached nonce-bound guardian performs the same fixed revoke+park cleanup if the
 foreground owner is hard-killed. The v2 session marker records owner PID, guardian PID, and random
 256-bit nonce so a guardian cannot remove a replacement session marker; a later start recovers only
@@ -75,6 +77,10 @@ Registration does not authorize mutation/execution.
   codingstatus   report configured/standing-grant/disarmed state
   codingtest     run public edit + command + benchmark + durable task proof
 
+The coding surface also exposes bounded multi-file reads plus TypeScript-backed symbol outline,
+definition, references, and receipt-backed edit-by-symbol. Semantic edits still commit through the
+same coding lease, exact file precondition, and signed surgical-edit receipt path.
+
 Coding commands are explicit host-code authority and are not AppContainer sandboxed.
 The standing grant remains active until explicit revoke; no timer maintenance is required.
 
@@ -88,7 +94,7 @@ policy digests and profile hashes to the explicit mutable development root; the
   armautonomous      require coding authority, then enable a standing autonomous grant
   disarmautonomous   revoke autonomous authority immediately
   autonomousstatus   report configured/standing-grant/coding-disarmed state
-  autonomoustest     run the 68-tool public catalog sampling MRTR production gate
+  autonomoustest     run the 73-tool public catalog sampling MRTR production gate
 
 disarmcoding also revokes autonomous authority. No MCP tool creates or widens either
 grant. With an openai_compatible planner the MCP server starts a background supervisor;

package/controller/deadbyte-controller.config.psd1.example

@@ -18,14 +18,28 @@
     # R32 observation is read-only over registered roots/local runtime and never arms coding mutation authority.
     ObservationRuntimeEnabled = $false
     CodingPolicyFile = ''
+    # Optional R35 multi-language semantic LSP config. Path and SHA-256 must be supplied together.
+    # The release generator copies these exact bytes into the immutable generation when configured.
+    SemanticLspConfigFile = ''
+    SemanticLspConfigSha256 = ''
     # Autonomous production loop is another explicit opt-in and requires the coding plane.
     AutonomousRuntimeEnabled = $false
     AutonomousPolicyFile = ''
+    # R34 local supervisor is Windows-local, out-of-band from Bridge, and never arms authority.
+    AutonomousSupervisorEnabled = $false
     # Optional privileged host plane policy. Empty keeps host read/write/exec unregistered.
     HostPolicyFile = ''
 
     # These are TRUSTED LOCAL launch specifications, never MCP-callable input.
     # Point each spec at the actual long-lived executable. Avoid npm.cmd/cmd.exe wrappers.
+    Supervisor = @{
+        FilePath = 'C:\Program Files\nodejs\node.exe'
+        FileSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+        Arguments = 'src\autonomous-supervisor-host.mjs'
+        WorkingDirectory = 'C:\REPLACE\release'
+        ScriptPath = 'C:\REPLACE\release\src\autonomous-supervisor-host.mjs'
+        ScriptSha256 = '0000000000000000000000000000000000000000000000000000000000000000'
+    }
     Bridge = @{
         FilePath = 'C:\Program Files\nodejs\node.exe'
         FileSha256 = '0000000000000000000000000000000000000000000000000000000000000000'