deadbyte-mcp 0.8.9 → 0.9.0

package/node_modules/typescript/package.json

@@ -0,0 +1,120 @@
+{
+    "name": "typescript",
+    "author": "Microsoft Corp.",
+    "homepage": "https://www.typescriptlang.org/",
+    "version": "5.9.3",
+    "license": "Apache-2.0",
+    "description": "TypeScript is a language for application scale JavaScript development",
+    "keywords": [
+        "TypeScript",
+        "Microsoft",
+        "compiler",
+        "language",
+        "javascript"
+    ],
+    "bugs": {
+        "url": "https://github.com/microsoft/TypeScript/issues"
+    },
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/microsoft/TypeScript.git"
+    },
+    "main": "./lib/typescript.js",
+    "typings": "./lib/typescript.d.ts",
+    "bin": {
+        "tsc": "./bin/tsc",
+        "tsserver": "./bin/tsserver"
+    },
+    "engines": {
+        "node": ">=14.17"
+    },
+    "files": [
+        "bin",
+        "lib",
+        "!lib/enu",
+        "LICENSE.txt",
+        "README.md",
+        "SECURITY.md",
+        "ThirdPartyNoticeText.txt",
+        "!**/.gitattributes"
+    ],
+    "devDependencies": {
+        "@dprint/formatter": "^0.4.1",
+        "@dprint/typescript": "0.93.4",
+        "@esfx/canceltoken": "^1.0.0",
+        "@eslint/js": "^9.20.0",
+        "@octokit/rest": "^21.1.1",
+        "@types/chai": "^4.3.20",
+        "@types/diff": "^7.0.1",
+        "@types/minimist": "^1.2.5",
+        "@types/mocha": "^10.0.10",
+        "@types/ms": "^0.7.34",
+        "@types/node": "latest",
+        "@types/source-map-support": "^0.5.10",
+        "@types/which": "^3.0.4",
+        "@typescript-eslint/rule-tester": "^8.24.1",
+        "@typescript-eslint/type-utils": "^8.24.1",
+        "@typescript-eslint/utils": "^8.24.1",
+        "azure-devops-node-api": "^14.1.0",
+        "c8": "^10.1.3",
+        "chai": "^4.5.0",
+        "chokidar": "^4.0.3",
+        "diff": "^7.0.0",
+        "dprint": "^0.49.0",
+        "esbuild": "^0.25.0",
+        "eslint": "^9.20.1",
+        "eslint-formatter-autolinkable-stylish": "^1.4.0",
+        "eslint-plugin-regexp": "^2.7.0",
+        "fast-xml-parser": "^4.5.2",
+        "glob": "^10.4.5",
+        "globals": "^15.15.0",
+        "hereby": "^1.10.0",
+        "jsonc-parser": "^3.3.1",
+        "knip": "^5.44.4",
+        "minimist": "^1.2.8",
+        "mocha": "^10.8.2",
+        "mocha-fivemat-progress-reporter": "^0.1.0",
+        "monocart-coverage-reports": "^2.12.1",
+        "ms": "^2.1.3",
+        "picocolors": "^1.1.1",
+        "playwright": "^1.50.1",
+        "source-map-support": "^0.5.21",
+        "tslib": "^2.8.1",
+        "typescript": "^5.7.3",
+        "typescript-eslint": "^8.24.1",
+        "which": "^3.0.1"
+    },
+    "overrides": {
+        "typescript@*": "$typescript"
+    },
+    "scripts": {
+        "test": "hereby runtests-parallel --light=false",
+        "test:eslint-rules": "hereby run-eslint-rules-tests",
+        "build": "npm run build:compiler && npm run build:tests",
+        "build:compiler": "hereby local",
+        "build:tests": "hereby tests",
+        "build:tests:notypecheck": "hereby tests --no-typecheck",
+        "clean": "hereby clean",
+        "gulp": "hereby",
+        "lint": "hereby lint",
+        "knip": "hereby knip",
+        "format": "dprint fmt",
+        "setup-hooks": "node scripts/link-hooks.mjs"
+    },
+    "browser": {
+        "fs": false,
+        "os": false,
+        "path": false,
+        "crypto": false,
+        "buffer": false,
+        "source-map-support": false,
+        "inspector": false,
+        "perf_hooks": false
+    },
+    "packageManager": "npm@8.19.4",
+    "volta": {
+        "node": "20.1.0",
+        "npm": "8.19.4"
+    },
+    "gitHead": "c63de15a992d37f0d6cec03ac7631872838602cb"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.8.9",
+  "version": "0.9.0",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP machine-truth runtime with signed audit chain, immutable release slots, contained execution, coding/autonomous production authority, and npx-first remote control.",
@@ -52,12 +52,14 @@
   "bundleDependencies": [
     "@modelcontextprotocol/server",
     "@modelcontextprotocol/client",
+    "typescript",
     "zod"
   ],
   "dependencies": {
+    "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "zod": "4.4.3",
-    "@modelcontextprotocol/client": "2.0.0"
+    "typescript": "5.9.3",
+    "zod": "4.4.3"
   },
   "bin": {
     "deadbyte-mcp": "src/deadbyte-cli.mjs"

package/proof/CONTAINMENT-BUILD.txt

@@ -39,7 +39,7 @@ deadbyte-process-host.cpp
 exit_code=0
 ==== probe-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\containment-probe.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\containment-probe.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -59,7 +59,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-launcher-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\deadbyte-exec.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-exec.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -83,7 +83,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-worker-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\contained-transform-worker.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\contained-transform-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -104,7 +104,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-reverse-worker-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\contained-reverse-worker.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\contained-reverse-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -125,7 +125,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== named-tunnel-host-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\deadbyte-tunnel-host.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-tunnel-host.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -144,7 +144,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== process-host-dependencies ====
 
-Dump of file C:\Users\DEADBYTE\Downloads\deadbyte-mcp-r33-final-candidate-v2\bin\deadbyte-process-host.exe
+Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-process-host.exe
 
 File Type: EXECUTABLE IMAGE
 

package/proof/R34-TASK8-SUPERVISOR-CHECKPOINT.json

@@ -0,0 +1,29 @@
+{
+  "schema": "deadbyte.r34.task8-checkpoint.v1",
+  "task": 8,
+  "status": "passed",
+  "workspace": "D:\\Projects\\deadbyte-mcp-r34-loop-engine",
+  "node_executable_sha256": "9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de",
+  "sources": {
+    "src/autonomous-local-supervisor.mjs": "ab0158c3f6e270ee367ae96455dd2b75a902c808b2a10ac2c5b75fdda00be6c3",
+    "src/autonomous-supervisor.mjs": "8ea06b5941de9b346ab4e97ff6ed236964b864fbe725602baee3a54dd74527c0",
+    "src/autonomous-supervisor-host.mjs": "335022086ef41e6cc9853468d928acc864deab8009383dc22518a6ec7e749fa1",
+    "src/deadbyte-cli.mjs": "0b0d41a51559502a6ff377a4f74e6f80ea77d37002a700e04bd7c4dd3f226b42",
+    "controller/deadbyte-controller.ps1": "279dfe20345193ca229cc442b25796f12d4c8ec9f9d3e2d26a607a7342b96a5a",
+    "controller/deadbyte-controller.config.psd1.example": "f20a5bf0df576dbdd32af657640b26c5c50c39dce0b465b7488c218917c729f7"
+  },
+  "regression": {
+    "tests": 40,
+    "passed": 40,
+    "failed": 0,
+    "receipt_id": "473fb1f0f7e6a2dec1ea9d80",
+    "receipt_sha256": "255e3679051eff46ae745b16f07d6a3c40f87e42259ac651ef286c9d876ceae2",
+    "receipt_signature_valid": true,
+    "marker": "TASK8_REGRESSION=PASS"
+  },
+  "authority_contract": {
+    "self_arm": false,
+    "recovery_operations": ["resume","disarmautonomous","disarmcoding","disarmprocess","disarmhost","status"],
+    "final_required": "ONLINE + process/coding/autonomous/host DISARMED"
+  }
+}

package/proof/R34-TASK9-MCP-SURFACE-CHECKPOINT.json

@@ -0,0 +1,28 @@
+{
+  "schema": "deadbyte.r34-task9-checkpoint.v1",
+  "status": "passed",
+  "workspace": "D:\\Projects\\deadbyte-mcp-r34-loop-engine",
+  "public_tool_count": 68,
+  "public_tool_unique_count": 68,
+  "public_tool_catalog_sha256": "bb7c08e116178e3da4b577b591f7058eb6caf7632358e765d28ccb20b2e36f45",
+  "mcp_server_sha256": "5a6cd82c332e4cef30c4ccfeb12f8cb3634cb6c92104931768b42ba6a84b62b3",
+  "controller_sha256": "cf8ab26a7481801da07c5c0a842df4ce1279854ed67781f967e5412da5c2aa3d",
+  "supervisor_integration_test_sha256": "127e170995460daabab88860f20f1b4c2416839e018df0e1cda23b58d032beab",
+  "exact_surface_gate": {
+    "tests": 19,
+    "pass": 19,
+    "fail": 0,
+    "receipt_id": "dc0b7e9c6c9e340c037bc54a",
+    "receipt_sha256": "f6b8ac9b6d499d51f60c7f8053a2e591e09654cdfe5bf69c449b15d133e48506"
+  },
+  "catalog_observation": {
+    "receipt_id": "7dd6df7d9b575e786101d1d0",
+    "receipt_sha256": "226e0861c01cb485ef94b91c1562a3cb70123698b9a52bb62ba883940be940cf"
+  },
+  "supervision": {
+    "in_process_compatibility": true,
+    "external_owner_mode": true,
+    "bridge_external_mode_does_not_execute_goal": true,
+    "standalone_host_advances_durable_goal": true
+  }
+}

package/scripts/capability-benchmark.mjs

@@ -0,0 +1,27 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { runCapabilityBenchmark } from '../src/capability-benchmark-runner.mjs';
+
+function argValue(name){
+  const prefix=`${name}=`;
+  const hit=process.argv.slice(2).find(value=>value.startsWith(prefix));
+  return hit?hit.slice(prefix.length):null;
+}
+
+const out=argValue('--out');
+const timeoutRaw=argValue('--timeout-ms');
+const timeoutMs=timeoutRaw===null?180000:Number(timeoutRaw);
+if(!Number.isInteger(timeoutMs)||timeoutMs<1000||timeoutMs>600000) throw new Error('capability benchmark timeout invalid');
+const env={
+  DEADBYTE_R35_SEMANTIC_CONFIG:process.env.DEADBYTE_R35_SEMANTIC_CONFIG??'',
+  DEADBYTE_R35_SEMANTIC_CONFIG_SHA256:process.env.DEADBYTE_R35_SEMANTIC_CONFIG_SHA256??''
+};
+const result=await runCapabilityBenchmark({rootUrl:new URL('../',import.meta.url),env,timeoutMs});
+const text=`${JSON.stringify(result,null,2)}\n`;
+if(out){
+  const target=path.resolve(out);
+  await mkdir(path.dirname(target),{recursive:true});
+  await writeFile(target,text,{encoding:'utf8'});
+}
+process.stdout.write(text);
+if(!result.overall_correct) process.exitCode=1;

package/scripts/deferred-slot-operation.mjs

@@ -22,9 +22,10 @@ const atomicJson=async(file,value)=>{
 };
 function activationArgs(manifestSha){
   if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
-  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.8.9',
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.9.0',
     '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
-    '--process-policy-sha256',null,'--enable-machine-fs','--enable-observation'];
+    '--process-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
+    '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-autonomous-supervisor'];
 }
 async function rollbackArgs(receiptPath){
   const resolved=await realpath(path.resolve(receiptPath));
@@ -45,6 +46,7 @@ async function normalizedArgs(mode,value){
   if(mode==='activate'){
     const args=activationArgs(value);
     args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
+    args[args.indexOf('--semantic-lsp-config-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json')));
     return args;
   }
   if(mode==='rollback') return rollbackArgs(value);

package/scripts/final-closure-verify.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 
 const HEX64=/^[0-9a-f]{64}$/;
 const UPDATE_DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
-const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R33-FINAL-CLOSURE-V1\0','utf8');
+const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R35-FINAL-CLOSURE-V1\0','utf8');
 const PING_DOMAIN=Buffer.from('DEADBYTE-MACHINE-PING-V1\0','utf8');
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
@@ -83,21 +83,21 @@ function verifyPing(ping,status,pointer){
 }
 
 export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
-  insist(envelope?.body?.schema==='deadbyte.r33-final-closure.v1','closure schema mismatch');
-  insist(envelope.body.version==='0.8.9','closure version mismatch');
-  insist(envelope.body.release_label==='R33 FINAL MACHINE BASELINE','closure release label mismatch');
+  insist(envelope?.body?.schema==='deadbyte.r35-final-closure.v1','closure schema mismatch');
+  insist(envelope.body.version==='0.9.0','closure version mismatch');
+  insist(envelope.body.release_label==='R35 FINAL MACHINE BASELINE','closure release label mismatch');
   const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
   const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
   insist(sha256(bodyBytes)===envelope.body_sha256,'closure body hash mismatch');
   const {closure_sha256,...unsigned}=envelope;
   insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===closure_sha256,'closure envelope hash mismatch');
-  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R33-FINAL-CLOSURE-V1','closure attestation contract mismatch');
+  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R35-FINAL-CLOSURE-V1','closure attestation contract mismatch');
   insist(envelope.attestation.key_id===keyInfo.key_id,'closure signer mismatch');
   insist(cryptoVerify(null,Buffer.concat([CLOSURE_DOMAIN,bodyBytes]),keyInfo.key,Buffer.from(envelope.attestation.signature_base64,'base64')),'closure signature invalid');
 
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
   insist(same(pointer,envelope.body.active_pointer),'active pointer drift');
-  insist(pointer.version==='0.8.9','active pointer version mismatch');
+  insist(pointer.version==='0.9.0','active pointer version mismatch');
   insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'release id/content address mismatch');
   const releaseFiles=await verifyTree(pointer.release_root,'MANIFEST.SHA256',pointer.manifest_sha256);
   const generationFiles=await verifyTree(pointer.generation_root,'GENERATION.SHA256',pointer.generation_manifest_sha256);
@@ -109,10 +109,10 @@ export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.
     insist(sha256(await readFile(item.path))===item.sha256,`${name} evidence hash mismatch`);
   }
   const parity=JSON.parse(await readFile(evidence.parity.path,'utf8'));
-  insist(parity.schema==='deadbyte.r33-parity.v1'&&parity.status==='passed','parity evidence invalid');
+  insist(parity.schema==='deadbyte.r35-parity.v1'&&parity.status==='passed','parity evidence invalid');
   insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity release binding mismatch');
   insist(parity.rdc_operation_count===0&&parity.execution_provider==='deadbyte_mcp','parity execution provider mismatch');
-  insist(parity.successor_disarmed?.tool_count===68&&parity.successor_disarmed?.coding_armed===false&&parity.successor_disarmed?.autonomous_armed===false,'final public disarmed gate invalid');
+  insist(parity.successor_disarmed?.tool_count===73&&parity.successor_disarmed?.coding_armed===false&&parity.successor_disarmed?.autonomous_armed===false,'final public disarmed gate invalid');
   for(const key of ['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification']) insist(parity.requirements?.[key]===true,`parity requirement missing ${key}`);
 
   const activation=JSON.parse(await readFile(evidence.activation.path,'utf8'));
@@ -127,9 +127,9 @@ export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.
   insist(restore.body.active_pointer?.manifest_sha256===pointer.manifest_sha256&&same(restore.body.active_pointer,pointer),'restore/current pointer mismatch');
   insist(rollback.body.activation_receipt_sha256===activation.receipt_sha256,'rollback not bound to activation');
   const windowsGate=JSON.parse(await readFile(evidence.windows_gate.path,'utf8'));
-  insist(windowsGate.schema==='deadbyte.r33-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
+  insist(windowsGate.schema==='deadbyte.r35-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
   insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate manifest binding mismatch');
-  insist(windowsGate.marker==='DEADBYTE V0.8.9 / R33 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.9.0 / R35 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
 
   const machine=envelope.body.machine;
   insist(machine?.status?.release_id===pointer.release_id&&machine.status.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine status binding mismatch');

package/scripts/final-closure.mjs

@@ -4,9 +4,9 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
-import { R33_EXPECTED_TOOLS } from '../src/remote-mcp-r33-parity-client.mjs';
+import { R34_EXPECTED_TOOLS } from '../src/remote-mcp-r34-parity-client.mjs';
 
-const DOMAIN=Buffer.from('DEADBYTE-R33-FINAL-CLOSURE-V1\0','utf8');
+const DOMAIN=Buffer.from('DEADBYTE-R35-FINAL-CLOSURE-V1\0','utf8');
 const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
@@ -22,17 +22,17 @@ function structured(result,label){
 async function publicMachineEvidence(){
   const endpoint=new URL((await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim());
   insist(endpoint.protocol==='https:','final closure requires HTTPS public endpoint');
-  const client=new Client({name:'deadbyte-r33-final-closure',version:'0.8.9'},
+  const client=new Client({name:'deadbyte-r35-final-closure',version:'0.9.0'},
     {versionNegotiation:{mode:{pin:'2026-07-28'}}});
   const transport=new StreamableHTTPClientTransport(endpoint);
   try{
     await client.connect(transport);
     const listed=await client.listTools();
     const names=listed.tools.map(tool=>tool.name).sort();
-    insist(JSON.stringify(names)===JSON.stringify(R33_EXPECTED_TOOLS),'final public catalog is not exact 68');
+    insist(JSON.stringify(names)===JSON.stringify(R34_EXPECTED_TOOLS),'final public catalog is not exact 73');
     for(const tool of listed.tools) insist(tool.outputSchema?.type==='object'&&tool.outputSchema?.additionalProperties===false,`tool ${tool.name} output schema drift`);
     const status=structured(await client.callTool({name:'machine_status',arguments:{}}),'machine_status');
-    const nonce=`r33-final-${randomBytes(16).toString('hex')}`;
+    const nonce=`r35-final-${randomBytes(16).toString('hex')}`;
     const ping=structured(await client.callTool({name:'machine_ping',arguments:{nonce}}),'machine_ping');
     const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
     const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous_session_status');
@@ -61,13 +61,13 @@ async function atomicCreate(file,bytes){
 
 export async function writeFinalClosure({parityPath,activationPath,windowsGatePath}){
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
-  insist(pointer.version==='0.8.9','final closure requires V0.8.9 active release');
+  insist(pointer.version==='0.9.0','final closure requires V0.8.11 active release');
   const parity=JSON.parse(await readFile(path.resolve(parityPath),'utf8'));
-  insist(parity.schema==='deadbyte.r33-parity.v1'&&parity.status==='passed','parity evidence is not passed');
+  insist(parity.schema==='deadbyte.r35-parity.v1'&&parity.status==='passed','parity evidence is not passed');
   insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity/current release mismatch');
   insist(parity.rollback?.receipt_path&&parity.restore?.receipt_path,'parity rollback/restore receipt paths missing');
   const windowsGate=JSON.parse(await readFile(path.resolve(windowsGatePath),'utf8'));
-  insist(windowsGate.schema==='deadbyte.r33-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
+  insist(windowsGate.schema==='deadbyte.r35-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
   insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate/current release mismatch');
   const machine=await publicMachineEvidence();
   insist(machine.status.release_id===pointer.release_id&&machine.status.release_manifest_sha256===pointer.manifest_sha256,'machine status/current release mismatch');
@@ -76,7 +76,7 @@ export async function writeFinalClosure({parityPath,activationPath,windowsGatePa
     rollback:await fileEvidence(parity.rollback.receipt_path), restore:await fileEvidence(parity.restore.receipt_path),
     windows_gate:await fileEvidence(windowsGatePath)
   };
-  const body={schema:'deadbyte.r33-final-closure.v1',version:'0.8.9',release_label:'R33 FINAL MACHINE BASELINE',
+  const body={schema:'deadbyte.r35-final-closure.v1',version:'0.9.0',release_label:'R35 FINAL MACHINE BASELINE',
     completed_at_utc:new Date().toISOString(),active_pointer:pointer,evidence,
     public_catalog:{tool_count:machine.tool_count,strict_output_schemas:machine.strict_output_schemas},
     machine:{status:machine.status,ping:machine.ping,nonce:machine.nonce},
@@ -87,10 +87,10 @@ export async function writeFinalClosure({parityPath,activationPath,windowsGatePa
   const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
   const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
   const signature=cryptoSign(null,Buffer.concat([DOMAIN,bodyBytes]),privateKey);
-  const envelope={body,body_sha256:sha256(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R33-FINAL-CLOSURE-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
+  const envelope={body,body_sha256:sha256(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R35-FINAL-CLOSURE-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
   envelope.closure_sha256=sha256(Buffer.from(canonicalJson(envelope),'utf8'));
   const dir=path.join(stateRoot,'evidence','release');
-  const file=path.join(dir,`r33-final-${pointer.manifest_sha256.slice(0,16)}.json`);
+  const file=path.join(dir,`r35-final-${pointer.manifest_sha256.slice(0,16)}.json`);
   const bytes=Buffer.from(`${JSON.stringify(envelope,null,2)}\n`,'utf8');
   await atomicCreate(file,bytes);
   return {status:'written',path:file,sha256:sha256(bytes),closure_sha256:envelope.closure_sha256,release_id:pointer.release_id};

package/scripts/gate-windows.ps1

@@ -9,7 +9,7 @@ function Invoke-GateStep {
     Write-Host "==== $Name ===="
     & npm.cmd @NpmArgs
     if ($LASTEXITCODE -ne 0) {
-        throw "DEADBYTE V0.8.9 / R33 gate failed at $Name with exit code $LASTEXITCODE"
+        throw "DEADBYTE V0.9.0 / R35 gate failed at $Name with exit code $LASTEXITCODE"
     }
 }
 
@@ -36,7 +36,7 @@ Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run', 'manifest:verif
 Write-Host '==== windows-gate-evidence ===='
 & node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence.mjs')
 if ($LASTEXITCODE -ne 0) {
-    throw "DEADBYTE V0.8.9 / R33 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
+    throw "DEADBYTE V0.9.0 / R35 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
 }
 
-Write-Host '==== DEADBYTE V0.8.9 / R33 WINDOWS BATCH GATE: PASS ===='
+Write-Host '==== DEADBYTE V0.9.0 / R35 WINDOWS BATCH GATE: PASS ===='

package/scripts/release-parity.mjs

@@ -99,18 +99,18 @@ async function scheduleDeferred(mode, value) {
 async function publicDisarmed(url) {
   const script = path.join(root, 'src', 'remote-mcp-r24-disarmed-smoke-client.mjs');
   const result = parseJsonOutput((await run(process.execPath, [script, url], { timeoutMs:90000 })).stdout, 'public disarmed gate');
-  assert(result.status === 'passed' && result.tool_count === 68, 'public disarmed gate failed exact catalog');
+  assert(result.status === 'passed' && result.tool_count === 73, 'public disarmed gate failed exact catalog');
   assert(result.coding_armed === false && result.autonomous_armed === false, 'public authority remained armed');
   return result;
 }export function validateParityEvidence(value) {
-  assert(value?.schema === 'deadbyte.r33-parity.v1', 'parity schema mismatch');
+  assert(value?.schema === 'deadbyte.r35-parity.v1', 'parity schema mismatch');
   assert(value.status === 'passed', 'parity status is not passed');
   assert(value.rdc_operation_count === 0 && value.execution_provider === 'deadbyte_mcp', 'parity used non-DEADBYTE execution');
-  assert(value.public_full?.status === 'passed' && value.public_full?.tools?.length === 68, 'public full gate missing exact 68');
-  assert(value.machine_control?.status === 'passed' && value.machine_control?.tool_count === 68, 'machine control parity missing');
-  assert(value.autonomous?.status === 'passed' && value.autonomous?.tool_count === 68, 'autonomous parity missing');
+  assert(value.public_full?.status === 'passed' && value.public_full?.tools?.length === 73, 'public full gate missing exact 73');
+  assert(value.machine_control?.status === 'passed' && value.machine_control?.tool_count === 73, 'machine control parity missing');
+  assert(value.autonomous?.status === 'passed' && value.autonomous?.tool_count === 73, 'autonomous parity missing');
   assert(value.rollback?.state === 'completed' && value.restore?.state === 'completed', 'rollback/restore not completed');
-  assert(value.predecessor_disarmed?.tool_count === 68 && value.successor_disarmed?.tool_count === 68, 'disarmed public gate missing');
+  assert(value.predecessor_disarmed?.tool_count === 73 && value.successor_disarmed?.tool_count === 73, 'disarmed public gate missing');
   for (const key of ['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification']) {
     assert(value.requirements?.[key] === true, `parity requirement not proven: ${key}`);
   }
@@ -123,15 +123,15 @@ export async function runReleaseParity(activationReceiptPath) {
   assert(pointer.manifest_sha256 === candidateManifest, 'active release is not the canonical candidate');
   const url = await publicUrl();
   const publicFullScript = path.join(root, 'src', 'remote-mcp-smoke-client.mjs');
-  const machineScript = path.join(root, 'src', 'remote-mcp-r33-parity-client.mjs');
+  const machineScript = path.join(root, 'src', 'remote-mcp-r34-parity-client.mjs');
   const autonomousScript = path.join(root, 'src', 'remote-mcp-autonomous-smoke-client.mjs');  let publicFull,machineControl,autonomous,publicGatesPassed=false;
   try {
     publicFull = parseJsonOutput((await run(process.execPath, [publicFullScript, url, 'full'], { timeoutMs:180000 })).stdout, 'public full gate');
-    machineControl = parseJsonOutput((await run(process.execPath, [machineScript, url], { timeoutMs:600000 })).stdout, 'R33 machine parity');
-    autonomous = parseJsonOutput((await run(process.execPath, [autonomousScript, url], { timeoutMs:900000 })).stdout, 'R33 autonomous parity');
-    assert(publicFull.status === 'passed' && publicFull.tools?.length === 68, 'public full gate did not expose exact 68');
-    assert(machineControl.status === 'passed' && machineControl.tool_count === 68, 'machine-control parity failed');
-    assert(autonomous.status === 'passed' && autonomous.tool_count === 68, 'autonomous parity failed');
+    machineControl = parseJsonOutput((await run(process.execPath, [machineScript, url], { timeoutMs:600000 })).stdout, 'R34 machine parity');
+    autonomous = parseJsonOutput((await run(process.execPath, [autonomousScript, url], { timeoutMs:900000 })).stdout, 'R34 autonomous parity');
+    assert(publicFull.status === 'passed' && publicFull.tools?.length === 73, 'public full gate did not expose exact 73');
+    assert(machineControl.status === 'passed' && machineControl.tool_count === 73, 'machine-control parity failed');
+    assert(autonomous.status === 'passed' && autonomous.tool_count === 73, 'autonomous parity failed');
     publicGatesPassed=true;
   } finally {
     let restoreError=null;
@@ -152,7 +152,7 @@ export async function runReleaseParity(activationReceiptPath) {
   assert(finalPointer.manifest_sha256 === candidateManifest, 'restore did not return canonical candidate');
 
   const evidence = {
-    schema:'deadbyte.r33-parity.v1', status:'passed', completed_at_utc:new Date().toISOString(),
+    schema:'deadbyte.r35-parity.v1', status:'passed', completed_at_utc:new Date().toISOString(),
     release_id:finalPointer.release_id, manifest_sha256:candidateManifest,
     execution_provider:'deadbyte_mcp', rdc_operation_count:0,
     public_full:publicFull, machine_control:machineControl, autonomous,
@@ -175,7 +175,7 @@ export async function runReleaseParity(activationReceiptPath) {
   validateParityEvidence(evidence);
   const evidenceDir = path.join(stateRoot, 'evidence', 'release');
   await mkdir(evidenceDir, { recursive:true });
-  const evidencePath = path.join(evidenceDir, `r33-parity-${candidateManifest.slice(0,16)}.json`);
+  const evidencePath = path.join(evidenceDir, `r35-parity-${candidateManifest.slice(0,16)}.json`);
   const bytes = Buffer.from(`${JSON.stringify(evidence, null, 2)}\n`, 'utf8');
   await writeFile(evidencePath, bytes);
   return { evidence, evidence_path:evidencePath, evidence_sha256:sha256(bytes) };

package/scripts/semantic-preflight.ps1

@@ -0,0 +1,73 @@
+param(
+  [Parameter(Mandatory=$true)][string]$ConfigPath,
+  [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-fA-F]{64}$')][string]$ConfigSha256,
+  [string[]]$RequiredIds=@('pyright','rust-analyzer','clangd'),
+  [string]$OutputPath=''
+)
+$ErrorActionPreference='Stop'
+function Hash-Lower([string]$Path){
+  if(-not (Test-Path -LiteralPath $Path -PathType Leaf)){ throw "missing file: $Path" }
+  return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+$configFull=[IO.Path]::GetFullPath($ConfigPath)
+$expected=$ConfigSha256.ToLowerInvariant()
+$observed=Hash-Lower $configFull
+if($observed -ne $expected){ throw "semantic config SHA-256 mismatch: expected $expected found $observed" }
+$config=Get-Content -LiteralPath $configFull -Raw -Encoding UTF8 | ConvertFrom-Json
+if([string]$config.schema -ne 'deadbyte.semantic-lsp-config.v1'){ throw 'semantic config schema mismatch' }
+$servers=@($config.servers)
+$seen=@{}
+$records=@()
+foreach($server in $servers){
+  $id=[string]$server.id
+  if([string]::IsNullOrWhiteSpace($id)){ throw 'semantic server id missing' }
+  if($seen.ContainsKey($id)){ throw "duplicate semantic server id: $id" }
+  $seen[$id]=$true
+  $exe=[string]$server.executable_path
+  $exeExpected=([string]$server.executable_sha256).ToLowerInvariant()
+  if($exeExpected -notmatch '^[0-9a-f]{64}$'){ throw "semantic executable SHA invalid for $id" }
+  $exeObserved=Hash-Lower $exe
+  if($exeObserved -ne $exeExpected){ throw "semantic executable SHA-256 mismatch for ${id}: expected $exeExpected found $exeObserved" }
+  $deps=@()
+  foreach($dep in @($server.dependencies)){
+    $depPath=[string]$dep.path
+    $depExpected=([string]$dep.expected_sha256).ToLowerInvariant()
+    if($depExpected -notmatch '^[0-9a-f]{64}$'){ throw "semantic dependency SHA invalid for $id" }
+    $depObserved=Hash-Lower $depPath
+    if($depObserved -ne $depExpected){ throw "semantic dependency SHA-256 mismatch for ${id}: expected $depExpected found $depObserved" }
+    $deps += [ordered]@{path=$depPath;sha256=$depObserved}
+  }
+  $settle=0
+  if($null -ne $server.startup_settle_ms){ $settle=[int]$server.startup_settle_ms }
+  $records += [ordered]@{
+    id=$id
+    language_id=[string]$server.language_id
+    required=[bool]$server.required
+    executable_path=$exe
+    executable_sha256=$exeObserved
+    dependencies=$deps
+    startup_settle_ms=$settle
+    status='pinned'
+  }
+}
+foreach($required in $RequiredIds){
+  if(-not $seen.ContainsKey($required)){ throw "missing required semantic server: $required" }
+}
+$payload=[ordered]@{
+  schema='deadbyte.r35-semantic-preflight.v1'
+  status='passed'
+  config_path=$configFull
+  config_sha256=$observed
+  builtin=@([ordered]@{id='typescript';language_id='typescript';status='builtin';required=$true})
+  required_ids=@('typescript') + @($RequiredIds)
+  servers=$records
+}
+$json=$payload | ConvertTo-Json -Depth 12
+if($OutputPath){
+  $out=[IO.Path]::GetFullPath($OutputPath)
+  $dir=Split-Path -Parent $out
+  if($dir -and -not(Test-Path -LiteralPath $dir)){ New-Item -ItemType Directory -Force -Path $dir | Out-Null }
+  [IO.File]::WriteAllText($out,$json,[Text.UTF8Encoding]::new($false))
+}
+Write-Output $json
+Write-Host ("R35_SEMANTIC_PREFLIGHT_PASS config={0} required={1}" -f $observed,(@('typescript')+@($RequiredIds) -join ','))