deadbyte-mcp 0.8.9 → 0.9.0

package/docs/superpowers/plans/2026-09-16-deadbyte-loop-engine.md

@@ -0,0 +1,846 @@
+# R34 DEADBYTE Loop Engine Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Turn the R33 autonomous runtime into a durable Windows-native engineering loop with explicit plan/phase state, evidence-based progress detection, crash reconciliation, authority-safe waiting/resume, and out-of-band local recovery without changing the default public MCP tool catalog.
+
+**Architecture:** Keep the existing signed autonomous journal, Native Diff, coding/profile receipts, delegated runtimes, release gate, and MCP tools as the authority spine. Extract focused pure modules for plan/state/context/progress/reconciliation, then make `autonomous-runtime.mjs` the orchestrator that appends signed loop events and delegates side effects. Add a Windows-local supervisor host whose ownership and recovery state live outside the managed MCP bridge, but which can never arm privileged authority.
+
+**Tech Stack:** Node.js >=22 ESM, `node:test`, `node:crypto` Ed25519/SHA-256, `zod/v4`, Windows PowerShell 5.1 controller integration, existing DEADBYTE Native Diff/coding/process/observation runtimes.
+
+**Spec:** `docs/superpowers/specs/2026-09-16-deadbyte-loop-engine-design.md`
+
+## Global Constraints
+
+- Development workspace is `D:\Projects\deadbyte-mcp-r34-loop-engine`; sealed R33 / `0.8.10` source and published package are immutable.
+- Baseline `package.json` SHA-256 is `99bb03660e5f1915c92d6c12e1526fcde23e15838ee62589a2117e2458178765`.
+- Windows-only. Do not add Linux/macOS backends or a cross-platform abstraction layer for its own sake.
+- Source control is NON-GIT. Do not invent Git commits, branches, HEADs, or commit hashes. Each task closes with targeted tests plus signed coding/Native-Diff evidence during execution.
+- No planner-controlled authority widening. No task may add automatic Process/Coding/Autonomous/Host arming.
+- No raw arbitrary shell/executable/environment injection. Continue to use existing allowlisted profiles, owned process identities, SHA preconditions, and bounded schemas.
+- All source mutation remains exact-SHA-preconditioned and Native-Diff/current-state verifiable.
+- The default public MCP tool names remain unchanged in R34: exact public catalog stays at 68 tools unless an explicit reviewed surface change is approved. Output schemas may only gain explicitly versioned/backward-compatible loop-state fields.
+- R35 semantic/LSP intelligence, R36 multi-machine fabric, R37 commander expansion, and R38 competitor benchmark harness remain out of scope.
+- Package version remains `0.8.10` during development. Cut a successor version only when an R34 release candidate is intentionally created.
+- Every production-code task follows RED -> GREEN -> focused regression -> signed NON-GIT checkpoint.
+
+---
+
+## File Structure Locked for R34
+
+Create these focused modules:
+
+- `src/autonomous-plan.mjs` — canonical plan identity/version/transition rules; no I/O.
+- `src/autonomous-loop-state.mjs` — pure signed-event reducer that derives phase, plan, pending action, progress and waiting state.
+- `src/autonomous-context-engine.mjs` — deterministic three-layer planner context and bounded compaction.
+- `src/autonomous-progress.mjs` — deterministic machine-evidence progress/stall/regression judge.
+- `src/autonomous-action-reconcile.mjs` — deterministic action/request identity and crash reconciliation classifications.
+- `src/autonomous-local-supervisor.mjs` — Windows-local supervisor ownership/recovery primitives; no public MCP transport dependency.
+- `src/autonomous-supervisor-host.mjs` — local process entry point that runs/takes over provider-backed loops and managed-runtime recovery.
+
+Add focused tests:
+
+- `test/autonomous-plan.test.mjs`
+- `test/autonomous-loop-state.test.mjs`
+- `test/autonomous-context-engine.test.mjs`
+- `test/autonomous-progress.test.mjs`
+- `test/autonomous-action-reconcile.test.mjs`
+- `test/autonomous-local-supervisor.test.mjs`
+- `test/autonomous-r34-e2e.test.mjs`
+
+Modify existing integration points only where required:
+
+- `src/autonomous-planner.mjs`
+- `src/autonomous-planner-contracts.mjs`
+- `src/autonomous-policy.mjs`
+- `src/autonomous-runtime.mjs`
+- `src/autonomous-supervisor.mjs`
+- `src/autonomous-output-contracts.mjs`
+- `src/autonomous-mcp-tools.mjs`
+- `src/mcp-server.mjs`
+- `src/deadbyte-cli.mjs`
+- `controller/deadbyte-controller.ps1`
+- existing autonomous tests as regression coverage
+
+---
+
+### Task 1: Canonical Plan Model
+
+**Files:**
+- Create: `src/autonomous-plan.mjs`
+- Create: `test/autonomous-plan.test.mjs`
+- Modify later consumers only after this task is green.
+
+**Interfaces:**
+- Produces: `createPlan({ goalId, title, steps, reasonHash }) -> PlanV1`
+- Produces: `replanPlan(previous, { steps, reasonHash }) -> PlanV1`
+- Produces: `completePlanStep(previous, { stepId, evidence }) -> PlanV1`
+- Produces: `planIsComplete(plan) -> boolean`
+- Produces: `activePlanStep(plan) -> PlanStep|null`
+- `PlanV1` fields: `schema:'deadbyte.autonomous-plan.v1'`, `plan_id`, `plan_version`, `parent_plan_version`, `title`, `steps`, `reason_sha256`.
+- A step has stable `step_id`, bounded `intent`, status `pending|active|completed`, and optional `evidence` array of `{kind,id,sha256}`.
+
+- [ ] **Step 1: Write failing plan lifecycle tests**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createPlan, replanPlan, completePlanStep, planIsComplete } from '../src/autonomous-plan.mjs';
+
+const H = c => c.repeat(64);
+
+test('plan id is goal-stable and version starts at one', () => {
+  const plan = createPlan({ goalId:H('a'), title:'Repair', reasonHash:H('b'), steps:[
+    { step_id:'inspect', intent:'Inspect source' },
+    { step_id:'verify', intent:'Verify acceptance' }
+  ] });
+  assert.equal(plan.plan_version,1);
+  assert.equal(plan.parent_plan_version,null);
+  assert.match(plan.plan_id,/^[0-9a-f]{64}$/);
+  assert.equal(plan.steps[0].status,'active');
+  assert.equal(plan.steps[1].status,'pending');
+});
+
+test('completed prefix is immutable across replan', () => {
+  let plan = createPlan({ goalId:H('a'), title:'Repair', reasonHash:H('b'), steps:[
+    { step_id:'inspect', intent:'Inspect source' }, { step_id:'fix', intent:'Apply repair' }
+  ] });
+  plan = completePlanStep(plan,{ stepId:'inspect', evidence:[{kind:'read',id:H('c'),sha256:H('d')}] });
+  assert.throws(() => replanPlan(plan,{ reasonHash:H('e'), steps:[
+    { step_id:'inspect', intent:'Changed completed intent' }, { step_id:'fix2', intent:'Alternative' }
+  ] }),/completed prefix/i);
+});
+
+test('replan changes only active/pending suffix and increments version', () => {
+  let plan = createPlan({ goalId:H('a'), title:'Repair', reasonHash:H('b'), steps:[
+    { step_id:'inspect', intent:'Inspect source' }, { step_id:'fix', intent:'Apply repair' }
+  ] });
+  plan = completePlanStep(plan,{ stepId:'inspect', evidence:[{kind:'read',id:H('c'),sha256:H('d')}] });
+  const next = replanPlan(plan,{ reasonHash:H('e'), steps:[
+    plan.steps[0], { step_id:'diagnose', intent:'Diagnose failure' }, { step_id:'fix2', intent:'Apply corrected repair' }
+  ] });
+  assert.equal(next.plan_version,2);
+  assert.equal(next.parent_plan_version,1);
+  assert.equal(next.steps[0].status,'completed');
+  assert.equal(next.steps[1].status,'active');
+});
+```
+
+- [ ] **Step 2: Run the focused tests and confirm RED**
+
+Run:
+
+```powershell
+node --test test/autonomous-plan.test.mjs
+```
+
+Expected: FAIL because `src/autonomous-plan.mjs` does not exist.
+
+- [ ] **Step 3: Implement the minimal pure plan module**
+
+Use canonical JSON + SHA-256 for `plan_id`; validate IDs with `/^[A-Za-z0-9._-]{1,64}$/`; max 24 steps; max intent 512 UTF-8 characters; exactly one `active` step unless complete; completion requires at least one evidence binding with a 64-hex hash. Do not read/write files in this module.
+
+Core identity:
+
+```js
+const planId = sha256Object({ schema:'deadbyte.autonomous-plan-id.v1', goal_id:goalId });
+```
+
+`replanPlan` must byte-compare the completed prefix using canonical JSON and reject any mutation/removal of completed steps.
+
+- [ ] **Step 4: Run focused tests GREEN plus planner regressions**
+
+```powershell
+node --test test/autonomous-plan.test.mjs test/autonomous-adversarial.test.mjs
+```
+
+Expected: all tests PASS.
+
+- [ ] **Step 5: NON-GIT evidence checkpoint**
+
+During execution, retain signed coding receipts for the new module/tests and record their final SHA-256 values in the task report. No Git metadata is permitted.
+
+---
+
+### Task 2: Pure R34 Loop State Reducer
+
+**Files:**
+- Create: `src/autonomous-loop-state.mjs`
+- Create: `test/autonomous-loop-state.test.mjs`
+- Modify: `src/autonomous-runtime.mjs` only after reducer tests are green.
+
+**Interfaces:**
+- Consumes: verified autonomous journal events and `PlanV1` snapshots from Task 1.
+- Produces: `deriveLoopState(goal, events) -> LoopStateV1`.
+- Produces phase enum exactly: `PLANNING|INSPECTING|ACTING|VERIFYING|REPLANNING|WAITING|COMPLETE`.
+- `LoopStateV1` includes `phase`, `plan`, `plan_id`, `plan_version`, `current_step`, `mutation_epoch`, `planner_round`, `replan_count`, `pending_action`, `pending_approval`, `progress`, `wait_reason`, `journal_head_sha256`.
+
+- [ ] **Step 1: Write reducer tests from synthetic verified event arrays**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { deriveLoopState } from '../src/autonomous-loop-state.mjs';
+
+const H = c => c.repeat(64);
+const goal = { goal_id:H('1') };
+const plan = { schema:'deadbyte.autonomous-plan.v1', plan_id:H('2'), plan_version:1,
+  parent_plan_version:null, title:'Repair', reason_sha256:H('3'), steps:[
+    {step_id:'inspect',intent:'Inspect source',status:'active'},
+    {step_id:'verify',intent:'Verify acceptance',status:'pending'}
+  ] };
+function eventsOf(items) {
+  return items.map(([type,payload],index) => ({
+    schema:'deadbyte.autonomous-event.v1', seq:index+1, goal_id:goal.goal_id,
+    prev_sha256:index===0?'0'.repeat(64):H(String((index%8)+1)),
+    event_sha256:H(String(((index+1)%8)+1)), type, payload
+  }));
+}
+
+test('restart replay derives identical loop state', () => {
+  const events = eventsOf([
+    ['goal_created',{}], ['plan_created',{plan}],
+    ['phase_changed',{from:'PLANNING',to:'INSPECTING',reason:'plan_ready'}],
+    ['inspection_completed',{evidence_head_sha256:H('a')}],
+    ['phase_changed',{from:'INSPECTING',to:'ACTING',reason:'evidence_ready'}]
+  ]);
+  assert.deepEqual(deriveLoopState(goal,events),deriveLoopState(goal,structuredClone(events)));
+  assert.equal(deriveLoopState(goal,events).phase,'ACTING');
+});
+
+test('action_started without completion becomes pending action after replay', () => {
+  const state = deriveLoopState(goal,eventsOf([
+    ['goal_created',{}], ['plan_created',{plan}],
+    ['action_started',{action_id:H('b'),request_sha256:H('c'),kind:'patch'}]
+  ]));
+  assert.equal(state.pending_action.action_id,H('b'));
+});
+```
+
+Also test every legal phase transition, `WAITING`, `COMPLETE`, plan/replan count, and that a terminal completion cannot regress to a mutable phase.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-loop-state.test.mjs
+```
+
+Expected: missing module/function failure.
+
+- [ ] **Step 3: Implement reducer as pure event fold**
+
+No filesystem, clock, process, planner or authority calls. Unknown legacy R33 events must remain tolerated where they are already part of a valid R33 journal; unknown R34 loop events with malformed required payloads must throw. Preserve existing fields needed by release verification instead of replacing R33 state.
+
+- [ ] **Step 4: Run GREEN and journal tamper regression**
+
+```powershell
+node --test test/autonomous-loop-state.test.mjs test/autonomous-adversarial.test.mjs
+```
+
+Expected: PASS, including existing signed-journal tamper test.
+
+- [ ] **Step 5: NON-GIT evidence checkpoint**
+
+Record signed mutation receipts + test observation receipt; no Git operations.
+
+---
+
+### Task 3: Deterministic Three-Layer Context Engine
+
+**Files:**
+- Create: `src/autonomous-context-engine.mjs`
+- Create: `test/autonomous-context-engine.test.mjs`
+- Modify: `src/autonomous-planner.mjs`
+
+**Interfaces:**
+- Produces: `buildLoopContext({ goal, policy, loopState, tree, contexts, observations, decisions, projectMemory })`.
+- Produces: `compactLoopContext(state, maxBytes)`.
+- Produces: `deriveProjectMemory(events) -> ProjectMemoryV1`.
+- Project memory is goal/workspace scoped only; it is not account memory.
+
+- [ ] **Step 1: Write failing compaction/preservation tests**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import { compactLoopContext } from '../src/autonomous-context-engine.mjs';
+
+const context = {
+  working_context:{ active_plan:null,current_step:null,recent_contexts:[],recent_observations:[],active_identities:[],recent_decisions:[] },
+  historical_evidence:{ compacted_events:[{
+    request_sha256:'a'.repeat(64),receipt_sha256:'b'.repeat(64),expected_sha256:'c'.repeat(64),
+    failure_cause:'test_failed',raw_payload:`OLD_RAW_PAYLOAD_SENTINEL${'X'.repeat(220000)}`
+  }], failures:[],receipts:[],mutation_epochs:[0],plan_transitions:[] },
+  project_memory:{ acceptance_constraints:['tests pass'],proven_invariants:[],rejected_approaches:[],important_files:[],unresolved_blockers:['test_failed'] }
+};
+
+test('compaction preserves proof identity while dropping stale payload bytes', () => {
+  const compacted = compactLoopContext(structuredClone(context),65536);
+  const json = JSON.stringify(compacted);
+  assert.ok(Buffer.byteLength(json,'utf8') <= 65536);
+  assert.match(json,/receipt_sha256/);
+  assert.match(json,/request_sha256/);
+  assert.match(json,/expected_sha256/);
+  assert.match(json,/test_failed/);
+  assert.match(json,/unresolved_blockers/);
+  assert.doesNotMatch(json,/OLD_RAW_PAYLOAD_SENTINEL/);
+});
+
+test('same input always produces byte-identical compacted context', () => {
+  const a = canonicalJson(compactLoopContext(structuredClone(context),65536));
+  const b = canonicalJson(compactLoopContext(structuredClone(context),65536));
+  assert.equal(a,b);
+});
+```
+
+Add a secret-safety test proving common credential fields are represented only by redaction metadata and never raw values.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-context-engine.test.mjs
+```
+
+- [ ] **Step 3: Implement deterministic layer ordering**
+
+Order planner state as:
+
+```js
+{
+  working_context:{ active_plan, current_step, recent_contexts, recent_observations, active_identities, recent_decisions },
+  historical_evidence:{ compacted_events, failures, receipts, mutation_epochs, plan_transitions },
+  project_memory:{ acceptance_constraints, proven_invariants, rejected_approaches, important_files, unresolved_blockers }
+}
+```
+
+Compaction priority: drop/elide stale raw payload first, then old excerpts, then old redundant tree entries. Never elide SHA preconditions, request/receipt ids+hashes, failure causes, authority state, unresolved constraints, active plan, current step, latest evidence or current file identity.
+
+- [ ] **Step 4: Replace old planner-state compaction with this module**
+
+`buildPlannerPrompt` in `src/autonomous-planner.mjs` must call `buildLoopContext` and serialize one canonical `STATE=` object. Keep the existing context byte ceiling from `policy.limits.max_context_bytes`.
+
+- [ ] **Step 5: Run GREEN plus existing context regression**
+
+```powershell
+node --test test/autonomous-context-engine.test.mjs test/autonomous-adversarial.test.mjs
+```
+
+Expected: existing `planner prompt compacts stale context payloads` behavior remains green.
+
+- [ ] **Step 6: NON-GIT evidence checkpoint**
+
+Record file hashes and signed test receipt.
+
+---
+
+### Task 4: Evidence-Based Progress Judge
+
+**Files:**
+- Create: `src/autonomous-progress.mjs`
+- Create: `test/autonomous-progress.test.mjs`
+- Modify: `src/autonomous-policy.mjs`
+
+**Interfaces:**
+- Produces: `judgeProgress({ before, after, decision, evidence }) -> { verdict, score, reason_codes, fingerprint }`.
+- Verdict enum: `progress|stalled|regressed`.
+- Produces: `stallDisposition({ history, limits }) -> { action:'continue'|'replan'|'wait', reason }`.
+- Add policy limits with exact defaults: `max_stalled_cycles:2`, `max_post_replan_stalls:2`, `max_replans:8`.
+
+- [ ] **Step 1: Write failing deterministic progress tests**
+
+```js
+test('verified Native Diff epoch advance counts as progress', () => {
+  const result = judgeProgress({
+    before:{mutation_epoch:1,completed_steps:0}, after:{mutation_epoch:2,completed_steps:0},
+    decision:{kind:'act'}, evidence:{native_diff_verified:true}
+  });
+  assert.equal(result.verdict,'progress');
+  assert.ok(result.reason_codes.includes('verified_mutation_epoch_advanced'));
+});
+
+test('same read identity and equivalent decision stalls', () => {
+  const result = judgeProgress({
+    before:{evidence_head:'a'.repeat(64)}, after:{evidence_head:'a'.repeat(64)},
+    decision:{kind:'inspect',fingerprint:'b'.repeat(64)}, evidence:{same_source_sha:true}
+  });
+  assert.equal(result.verdict,'stalled');
+});
+
+test('stall policy forces replan then waiting', () => {
+  assert.equal(stallDisposition({history:['stalled','stalled'],limits:{max_stalled_cycles:2,max_post_replan_stalls:2,max_replans:8}}).action,'replan');
+  assert.equal(stallDisposition({history:['replan','stalled','stalled'],limits:{max_stalled_cycles:2,max_post_replan_stalls:2,max_replans:8}}).action,'wait');
+});
+```
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-progress.test.mjs
+```
+
+- [ ] **Step 3: Implement scoring from machine deltas only**
+
+Positive reason codes must include: `new_source_identity`, `new_profile_evidence`, `verified_mutation_epoch_advanced`, `acceptance_failure_resolved`, `plan_step_completed`, `diagnostic_narrowed`, `interrupted_action_recovered`, `release_readiness_improved`.
+
+Stall reason codes must include: `equivalent_decision_no_new_evidence`, `identical_read_repeated`, `identical_profile_failure_repeated`, `equivalent_replan`, `plan_oscillation`.
+
+Planner rationale strings must never affect score.
+
+- [ ] **Step 4: Extend policy parser fail-closed**
+
+`src/autonomous-policy.mjs` must validate the three new limits with integer bounds `[1,32]`; old policies that omit them receive the defaults above so R33 fixtures continue to load.
+
+- [ ] **Step 5: Run GREEN + policy regressions**
+
+```powershell
+node --test test/autonomous-progress.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-runtime.test.mjs
+```
+
+- [ ] **Step 6: NON-GIT evidence checkpoint**
+
+Record signed receipts and final hashes.
+
+---
+
+### Task 5: Canonical R34 Planner Decisions and Provider Adapter
+
+**Files:**
+- Modify: `src/autonomous-planner-contracts.mjs`
+- Modify: `src/autonomous-planner.mjs`
+- Create/extend tests in: `test/autonomous-adversarial.test.mjs`, `test/autonomous-loop.test.mjs`
+
+**Interfaces:**
+- Canonical decision schema becomes `deadbyte.autonomous-decision.v2` for R34 journals while the runtime remains able to read historical v1 journal decisions.
+- Canonical operations: `plan_create`, `inspect`, `act`, `step_complete`, `replan`, `pause`, `finish`.
+- `act` embeds exactly one existing bounded DEADBYTE action, never an arm command.
+- Provider adapter returns `{ backend, model, raw_response_sha256, decision }` after schema validation.
+
+- [ ] **Step 1: Write failing contract tests**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseR34PlannerDecision } from '../src/autonomous-planner.mjs';
+
+const policy = { limits:{ max_context_bytes:262144,max_files_per_diff:8 }, profiles:{} };
+
+test('R34 decision parser rejects authority arming and prose-wrapped JSON', () => {
+  assert.throws(() => parseR34PlannerDecision('Here is JSON: {"kind":"finish"}',policy),/structured|contract/i);
+  assert.throws(() => parseR34PlannerDecision(JSON.stringify({
+    schema:'deadbyte.autonomous-decision.v2', kind:'act', action:{kind:'armcoding'}
+  }),policy),/unsupported|authority/i);
+});
+
+test('replan carries only a suffix plan proposal', () => {
+  const d = parseR34PlannerDecision(JSON.stringify({
+    schema:'deadbyte.autonomous-decision.v2', kind:'replan', reason:'test failed',
+    steps:[{step_id:'diagnose',intent:'Inspect failing evidence'},{step_id:'fix',intent:'Apply corrected patch'}]
+  }),policy);
+  assert.equal(d.kind,'replan');
+});
+```
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-adversarial.test.mjs test/autonomous-loop.test.mjs
+```
+
+The new R34 assertions must fail before parser implementation.
+
+- [ ] **Step 3: Implement strict v2 normalization**
+
+Use `z.discriminatedUnion('kind', ...)` from `zod/v4`; no Markdown stripping or regex JSON extraction. For provider-native structured output, keep provider-specific envelopes outside core state and hash raw response bytes. Client sampling remains request-id-bound.
+
+- [ ] **Step 4: Keep bounded repair semantics**
+
+Malformed decisions append `planner_rejected`; after three contract failures the loop must enter durable `WAITING` with `planner_contract_repeated_failure`, preserving existing fail-closed behavior.
+
+- [ ] **Step 5: Run GREEN**
+
+```powershell
+node --test test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs
+```
+
+- [ ] **Step 6: NON-GIT evidence checkpoint**
+
+Record signed receipts and parser module hashes.
+
+---
+
+### Task 6: Action Identity and Crash Reconciliation
+
+**Files:**
+- Create: `src/autonomous-action-reconcile.mjs`
+- Create: `test/autonomous-action-reconcile.test.mjs`
+- Modify: `src/autonomous-runtime.mjs`
+
+**Interfaces:**
+- Produces: `actionIdentity({ goalId, planId, planVersion, stepId, mutationEpoch, decisionEventSha, action }) -> { action_id, request_sha256 }`.
+- Produces: `reconcileStartedAction({ startedEvent, journal, runtimes, verifyKeyPath }) -> { classification, evidence, reason }`.
+- Classification enum exactly: `not_executed|executed_verified|executed_failed_verified|ambiguous`.
+
+- [ ] **Step 1: Write failing reconciliation tests with fake runtimes**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { reconcileStartedAction } from '../src/autonomous-action-reconcile.mjs';
+
+const H = c => c.repeat(64);
+const patchStarted = { type:'action_started', event_sha256:H('1'), payload:{
+  action_id:H('2'), request_sha256:H('3'), action:{kind:'patch',diff_id:H('4')}
+} };
+
+test('verified mutation receipt classifies as executed without requesting replay', async () => {
+  const result = await reconcileStartedAction({
+    startedEvent:patchStarted, journal:[],
+    runtimes:{ nativeDiffRuntime:{ async verify({diffId}){
+      assert.equal(diffId,H('4'));
+      return {ok:true,current_state_matches:true,receipt_sha256:H('a')};
+    } } }
+  });
+  assert.equal(result.classification,'executed_verified');
+  assert.equal(result.replay_allowed,false);
+});
+
+test('conflicting or unverifiable evidence is ambiguous', async () => {
+  const result = await reconcileStartedAction({
+    startedEvent:patchStarted, journal:[],
+    runtimes:{ nativeDiffRuntime:{ async verify(){ return {ok:false,reason:'receipt signature mismatch'}; } } }
+  });
+  assert.equal(result.classification,'ambiguous');
+  assert.equal(result.replay_allowed,false);
+});
+```
+
+Also cover no receipt/state -> `not_executed`, verified failed command/profile -> `executed_failed_verified`, stale request hash, receipt substitution and current-state mismatch.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-action-reconcile.test.mjs
+```
+
+- [ ] **Step 3: Implement deterministic action identity**
+
+Identity must bind goal, current plan/version/step, mutation epoch, normalized action and decision event hash. Retrying after `not_executed` reuses the same identity; a replan/step/version change necessarily produces a different identity.
+
+- [ ] **Step 4: Integrate pre-action journal protocol**
+
+Before every side effect `autonomous-runtime.mjs` must:
+
+```text
+verify journal -> reconcile prior action -> check live authority -> append action_started -> execute -> independently verify -> append action_completed
+```
+
+If reconciliation is `executed_verified`, append `action_reconciled` + recovered `action_completed` and do not invoke the side effect again. If `ambiguous`, append `waiting_entered` with `ambiguous_interrupted_action`.
+
+- [ ] **Step 5: Add crash injection test at the dangerous boundary**
+
+Inject termination after Native Diff apply succeeds but before `action_completed`; reconstruct runtime; verify file changed exactly once and journal gains recovered completion rather than a second mutation.
+
+- [ ] **Step 6: Run GREEN + existing crash tests**
+
+```powershell
+node --test test/autonomous-action-reconcile.test.mjs test/coding-crash.test.mjs test/agent-runtime-crash.test.mjs test/autonomous-adversarial.test.mjs
+```
+
+- [ ] **Step 7: NON-GIT evidence checkpoint**
+
+Run `native_diff_verify` on the implementation transaction during execution and retain receipt SHA-256.
+
+---
+
+### Task 7: R34 Loop Orchestrator, Phases, Waiting and Approval
+
+**Files:**
+- Modify: `src/autonomous-runtime.mjs`
+- Modify: `src/autonomous-output-contracts.mjs`
+- Modify: `src/autonomous-mcp-tools.mjs`
+- Create: `test/helpers/autonomous-r34-fixture.mjs`
+- Create: `test/autonomous-r34-e2e.test.mjs`
+- Extend: `test/autonomous-loop.test.mjs`, `test/autonomous-adversarial.test.mjs`
+
+**Interfaces:**
+- `status()` and `run()` expose backward-compatible existing fields plus `loop:{schema:'deadbyte.autonomous-loop-state.v1',phase,plan_id,plan_version,current_step,replan_count,progress,pending_action,pending_approval,wait_reason}`.
+- Test helper `createR34Fixture({ plannerDecisions = [], authority = 'armed' }) -> Promise<{root,project,runtime,policy,codingPolicy,keys,planner,cleanup}>` creates the same real coding/native-diff/autonomous stack used by current loop tests, with a temporary project and trust keys.
+- Test helper `driveClientPlanner(runtime, goalId, decisions) -> Promise<RunResult>` repeatedly calls `run`; whenever status is `input_required`, it binds the next strict decision to `planner_request.request_id`; it returns on `completed|paused|cancelled|terminal` and throws if decisions are exhausted.
+- Test helper decision constructors `planCreateDecision()`, `inspectDecision()`, `patchDecision(expectedSha)`, `stepCompleteDecision(evidence)`, `finishDecision()` return complete `deadbyte.autonomous-decision.v2` objects; no prose or implicit fields.
+- No new public MCP tool names.
+- `approve()` resumes from the verified journal head and never arms authority.
+
+- [ ] **Step 1: Write failing phase-path E2E test**
+
+```js
+test('R34 loop executes plan -> inspect -> act -> verify -> step complete -> finish', async () => {
+  const f = await r34Fixture();
+  const goal = await f.runtime.submit({ submissionId:'r34-happy', rootId:'project', title:'repair', goal:'make value fixed', acceptance:'tests pass' });
+  const result = await drivePlanner(f,goal.goal_id,[
+    planCreateDecision(), inspectDecision(), patchDecision(), stepCompleteDecision(), finishDecision()
+  ]);
+  assert.equal(result.state,'succeeded');
+  const status = await f.runtime.status({goalId:goal.goal_id});
+  assert.equal(status.loop.phase,'COMPLETE');
+  assert.equal(status.loop.plan_version,1);
+  assert.equal((await f.runtime.verify({goalId:goal.goal_id})).ok,true);
+});
+```
+
+Add tests for failing profile -> `VERIFYING` -> `REPLANNING`; missing authority -> `WAITING`; operator approval after re-arm -> same journal head lineage; reject -> cancelled; incomplete plan -> finish blocked.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-r34-e2e.test.mjs
+```
+
+- [ ] **Step 3: Replace implicit R33 loop control with explicit signed phase events**
+
+`autonomous-runtime.mjs` remains the I/O orchestrator but calls Tasks 1-6 modules. Every phase transition appends `phase_changed`. Initial nontrivial work requires `plan_created` before mutation. `step_completed` requires verified evidence bindings. `replan` calls `replanPlan` and appends `plan_replanned`.
+
+- [ ] **Step 4: Integrate Progress Judge**
+
+After `verification_completed`, append `progress_judged`. On stall threshold: transition to `REPLANNING`; repeated post-replan stall: append `waiting_entered` with `no_progress_after_replan`.
+
+- [ ] **Step 5: Convert authority absence to durable waiting where safe**
+
+A missing/revoked privilege before a not-yet-started action produces `WAITING/authority_unavailable`; it must not auto-arm. A revoked authority during an already-started action first goes through reconciliation.
+
+- [ ] **Step 6: Version output shape explicitly without breaking tool names**
+
+Extend `autonomousGoalRunOutputSchema` and `autonomousGoalStatusOutputSchema` with optional strict `loop` object. Existing R33 fields remain until a later major surface change. Update descriptions from R24/R33 wording to R34 without changing registration names.
+
+- [ ] **Step 7: Run focused GREEN**
+
+```powershell
+node --test test/autonomous-r34-e2e.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-runtime.test.mjs
+```
+
+- [ ] **Step 8: NON-GIT evidence checkpoint**
+
+Verify all mutation receipts and capture focused test receipt/output hashes.
+
+---
+
+### Task 8: Windows-Local Out-of-Band Supervisor
+
+**Files:**
+- Create: `src/autonomous-local-supervisor.mjs`
+- Create: `src/autonomous-supervisor-host.mjs`
+- Create: `test/autonomous-local-supervisor.test.mjs`
+- Modify: `src/autonomous-supervisor.mjs`
+- Modify: `src/deadbyte-cli.mjs`
+- Modify: `controller/deadbyte-controller.ps1`
+
+**Interfaces:**
+- Local ownership marker schema: `deadbyte.autonomous-supervisor-owner.v1` with `pid`, `creation_time_utc`, `image_path`, `image_sha256`, `instance_nonce`, `started_at_utc`.
+- Supervisor journal remains under autonomous evidence/state, not bridge memory.
+- `observeCurrentProcessIdentity(pid = process.pid) -> Promise<{pid,creation_time_utc,image_path,image_sha256}>` uses Windows process observation and returns no result if identity cannot be proven.
+- `claimSupervisor(options)`, `observeSupervisor(options)`, `takeoverSupervisor(options)`, `releaseSupervisor(options)` must verify Windows process identity, not PID alone.
+- Test helper `localSupervisorFixture({ ownerPid, ownerIdentity })` writes one temporary marker/policy rooted under a temp directory and returns `{ options, cleanup }`; `cleanup()` removes only that temp root.
+- Local recovery may invoke only pinned controller operations needed to observe/resume/park managed runtime and disarm planes; it must never invoke `arm*`.
+
+- [ ] **Step 1: Write failing ownership/takeover tests**
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { observeCurrentProcessIdentity, observeSupervisor, takeoverSupervisor } from '../src/autonomous-local-supervisor.mjs';
+import { localSupervisorFixture } from './helpers/autonomous-r34-fixture.mjs';
+
+test('local supervisor refuses takeover of live verified owner', async () => {
+  const identity = await observeCurrentProcessIdentity();
+  const f = await localSupervisorFixture({ ownerPid:process.pid, ownerIdentity:identity });
+  try { await assert.rejects(takeoverSupervisor(f.options),/live verified owner/i); }
+  finally { await f.cleanup(); }
+});
+
+test('stale PID reuse does not inherit ownership', async () => {
+  const identity = await observeCurrentProcessIdentity();
+  const f = await localSupervisorFixture({ ownerPid:process.pid,
+    ownerIdentity:{...identity,creation_time_utc:'2000-01-01T00:00:00.000Z'} });
+  try {
+    const state = await observeSupervisor(f.options);
+    assert.equal(state.reason,'pid_reused');
+  } finally { await f.cleanup(); }
+});
+```
+
+Add tests proving controller command allowlist contains `status/resume/park/disarm*` and rejects every `arm*`, arbitrary command, executable and environment input.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/autonomous-local-supervisor.test.mjs
+```
+
+- [ ] **Step 3: Implement Windows identity verification**
+
+Reuse the controller's established process identity principles: PID + creation time + full image path + image SHA-256. Fail closed if identity cannot be observed. Marker writes are same-directory atomic replacements after initial exclusive claim.
+
+- [ ] **Step 4: Implement supervisor host loop**
+
+`src/autonomous-supervisor-host.mjs` loads trusted policy/runtimes, claims local supervisor ownership, scans durable provider-backed goals, calls the existing bounded runtime `run`, and reconciles/takes over only from verified journal state. The host process must survive managed bridge stop/restart because it is not a child of the bridge.
+
+- [ ] **Step 5: Implement managed-runtime recovery without self-arming**
+
+When a lifecycle/recovery flow leaves the bridge unavailable, the local host may call the pinned PowerShell launcher with `resume`, then explicitly call `disarmautonomous`, `disarmcoding`, `disarmprocess`, `disarmhost`. Final recovery acceptance is `ONLINE + all privileged planes DISARMED`.
+
+- [ ] **Step 6: Wire controller/CLI start-stop without changing public MCP tool catalog**
+
+Add local-only controller lifecycle commands for the supervisor host, guarded by exact script/executable hash in trusted config. Do not expose a remote public `arm` or arbitrary supervisor exec tool.
+
+- [ ] **Step 7: Run GREEN plus remote-session regression**
+
+```powershell
+node --test test/autonomous-local-supervisor.test.mjs test/autonomous-supervisor-integration.test.mjs test/remote-session-cli.test.mjs
+```
+
+- [ ] **Step 8: NON-GIT evidence checkpoint**
+
+Record supervisor executable/script identity, test receipts and final source hashes.
+
+---
+
+### Task 9: Supervisor + MCP Integration and Public Surface Compatibility
+
+**Files:**
+- Modify: `src/mcp-server.mjs`
+- Modify: `src/autonomous-supervisor.mjs`
+- Modify: `src/autonomous-output-contracts.mjs`
+- Modify: `src/autonomous-mcp-tools.mjs`
+- Modify: `test/autonomous-supervisor-integration.test.mjs`
+- Modify: `test/output-schema.test.mjs`
+- Modify: `test/remote-r24-catalog.test.mjs` or successor catalog assertion file
+
+**Interfaces:**
+- Provider-backed goals may be advanced by the local supervisor even if no client repeatedly calls `autonomous_goal_run`.
+- Client-sampling goals remain `input_required` and are never fabricated by the supervisor.
+- Public autonomous tool names remain exactly the existing set from the spec.
+
+- [ ] **Step 1: Add failing schema/catalog assertions**
+
+Assert that status/run outputs accept the strict optional `loop` object and reject unknown loop fields. Assert the exact public catalog count/name set does not change accidentally.
+
+- [ ] **Step 2: Run RED**
+
+```powershell
+node --test test/output-schema.test.mjs test/remote-r24-catalog.test.mjs test/autonomous-supervisor-integration.test.mjs
+```
+
+- [ ] **Step 3: Wire supervisor lifecycle in `mcp-server.mjs` without making bridge authoritative**
+
+The MCP server may observe/report local supervisor state and may continue to start the in-process compatibility supervisor only when the out-of-band host is explicitly not configured. If the local host owns supervision, the bridge must not create a competing owner.
+
+- [ ] **Step 4: Update user-visible descriptions and schemas**
+
+Descriptions should say R34 loop/supervisor, but tool names and authority semantics stay unchanged. `autonomous_goal_status` returns journal-derived phase/progress/plan state; `autonomous_goal_events` remains the raw authenticated timeline.
+
+- [ ] **Step 5: Run GREEN and catalog exactness gate**
+
+```powershell
+node --test test/output-schema.test.mjs test/autonomous-supervisor-integration.test.mjs test/remote-r24-catalog.test.mjs
+```
+
+- [ ] **Step 6: NON-GIT evidence checkpoint**
+
+Capture catalog list/hash and output-schema test receipts.
+
+---
+
+### Task 10: Full Adversarial R34 Acceptance
+
+**Files:**
+- Create/extend: `test/autonomous-r34-e2e.test.mjs`
+- Extend: `test/autonomous-adversarial.test.mjs`
+- Extend: `test/autonomous-supervisor-integration.test.mjs`
+- No production changes unless a test demonstrates a root-cause defect; any fix follows a new RED -> GREEN cycle.
+
+**Interfaces:**
+- This task consumes all prior modules and proves the spec acceptance matrix.
+
+- [ ] **Step 1: Add the complete adversarial matrix**
+
+Required named cases:
+
+```text
+R34 replay reconstructs byte-equivalent logical loop state
+R34 crash after mutation before completion never duplicates mutation
+R34 forged receipt substitution enters WAITING
+R34 stale SHA returns to inspect/replan without force overwrite
+R34 repeated identical evidence forces replan then WAITING
+R34 authority revoke blocks next privileged action
+R34 approval resumes same journal lineage after operator re-arm
+R34 provider garbage pauses after bounded repair attempts
+R34 context pressure preserves proof identities under byte limit
+R34 event deletion/reorder/signature tamper fails before state trust
+R34 stale supervisor PID identity cannot take over live process
+R34 bridge loss is recovered by local supervisor to ONLINE and all-DISARMED
+R34 full inspect-act-verify-replan-finish emits independently verifiable release receipt
+```
+
+- [ ] **Step 2: Run the R34 focused/adversarial set**
+
+```powershell
+node --test test/autonomous-plan.test.mjs test/autonomous-loop-state.test.mjs test/autonomous-context-engine.test.mjs test/autonomous-progress.test.mjs test/autonomous-action-reconcile.test.mjs test/autonomous-local-supervisor.test.mjs test/autonomous-r34-e2e.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 3: Run the entire pre-existing R33 suite on R34 bytes**
+
+```powershell
+npm test
+```
+
+Expected: all tests pass; no R33 regression is waived.
+
+- [ ] **Step 4: Run exact catalog/schema gates**
+
+```powershell
+node --test test/output-schema.test.mjs test/remote-r24-catalog.test.mjs test/r33-closeout-regression.test.mjs
+```
+
+Expected: public catalog drift is zero unless an explicit reviewed versioned schema change is documented.
+
+- [ ] **Step 5: Run a real multi-step disposable workspace goal**
+
+Use a scratch project under the configured `projects`/test root. The goal must inspect at least two files, perform a SHA-preconditioned Native Diff, observe one failing verification, replan, apply a corrected mutation, complete plan steps, run required profiles, and finish with `autonomous_goal_verify.ok === true`.
+
+Acceptance evidence must include the goal id, journal head, plan id/version history, Native Diff ids/receipt hashes, progress verdicts, release receipt hash, and final source hashes.
+
+- [ ] **Step 6: Inject the dangerous crash on real R34 runtime bytes**
+
+Use a test-only crash hook after successful mutation evidence is durable but before `action_completed`. Restart the runtime/supervisor. Verify exactly one source mutation occurred, the recovered action id is unchanged, an `action_reconciled` event exists, and current-state verification passes.
+
+- [ ] **Step 7: Prove out-of-band recovery**
+
+Stop/park the managed Bridge during an active local supervisor run. Verify the local supervisor process remains alive, reconstructs the goal from the signed journal, restores the managed runtime to ONLINE when the controlled recovery path requires it, and leaves Process/Coding/Autonomous/Host DISARMED after recovery.
+
+- [ ] **Step 8: Run full Windows gate on exact candidate bytes**
+
+Only after all source/test work is frozen:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows.ps1
+```
+
+Expected: canonical Windows gate PASS on the exact R34 candidate bytes.
+
+- [ ] **Step 9: Independent verification before any R34 completion claim**
+
+Verify every final release/autonomous/Native-Diff receipt using independent verifier paths. Recompute candidate manifest/package hashes. Confirm R33 `0.8.10` files and npm artifact were never modified or republished.
+
+- [ ] **Step 10: NON-GIT final development checkpoint**
+
+Record exact R34 workspace manifest, Windows gate evidence, focused/full test counts, public catalog identity, release receipt hash, and all authority planes DISARMED. Do not call the result a release until the separate release-candidate/version/package/activation/public-closeout process is executed on those exact bytes.
+
+---
+
+## Execution Order and Review Gates
+
+Execute Tasks 1-10 strictly in order because each later interface depends on earlier deterministic state contracts. After each task, review the diff/receipts and rerun that task's focused tests before continuing. If three attempted fixes expose unrelated coupling in the same area, stop and reassess the architecture rather than stacking a fourth patch.
+
+The release process is deliberately not part of Tasks 1-9. Task 10 only proves an R34 development candidate. Version cut, manifest, deterministic package, activation/rollback, npm publication and public closeout are a separate evidence phase after the implementation candidate is frozen.