deadbyte-mcp 0.8.9 → 0.9.0

package/docs/superpowers/specs/2026-09-16-deadbyte-loop-engine-design.md

@@ -0,0 +1,435 @@
+# R34 DEADBYTE Loop Engine Design
+
+## Goal
+
+R34 turns the existing autonomous production runtime into a durable Windows-native engineering supervisor that can accept a goal, build and maintain an explicit plan, repeatedly inspect/decide/act/observe/verify, replan when evidence invalidates the plan, survive process/runtime crashes without duplicating mutations, detect lack of progress, expose live phase/state, and finish only through independently verifiable release evidence.
+
+R34 is a successor to the sealed R33 / `0.8.10` public baseline. The R33 release and candidate are immutable. Development happens only in `D:\Projects\deadbyte-mcp-r34-loop-engine`, created from the exact R33 `0.8.10` source baseline with `package.json` SHA-256 `99bb03660e5f1915c92d6c12e1526fcde23e15838ee62589a2117e2458178765`.
+
+The engine remains Windows-only. It does not add a Linux/macOS backend or cross-platform abstraction layer.
+
+## Product Intent
+
+R34 combines the strengths the project is targeting without copying their architecture:
+
+- Desktop Commander-style operational breadth remains delegated to existing bounded process/filesystem/observation runtimes.
+- Serena-style semantic intelligence is explicitly deferred to R35.
+- Remote Desktop Commander-style multi-machine control is explicitly deferred to R36.
+- Manus-style planner + execution loop is adopted as a control pattern, but all execution remains inside DEADBYTE's authority, signed-receipt, fail-closed, Windows-native model.
+
+The defining R34 property is not "the model loops." The defining property is that every loop transition is durable, bounded, evidence-driven, crash-reconcilable, authority-gated, and independently auditable.
+
+## Scope
+
+In scope:
+
+- durable initial plan creation before nontrivial mutation;
+- one supervisor loop with explicit phases `PLANNING`, `INSPECTING`, `ACTING`, `VERIFYING`, `REPLANNING`, `WAITING`, `COMPLETE`;
+- typed structured planner decisions with no JSON embedded inside prose;
+- plan creation, step completion, replan, pause and finish contracts;
+- durable current-plan identity and versioning;
+- recent working context plus compacted historical evidence plus durable project memory;
+- progress scoring from observed evidence/state changes rather than repeated planner text;
+- bounded no-progress detection and forced replan/pause;
+- crash reconciliation before every new action;
+- duplicate-mutation prevention using signed prior-action evidence and request identity;
+- per-action authority checks; planner output can never arm or widen authority;
+- resumable waiting/approval/rejection state;
+- live phase and event timeline through existing autonomous status/event surfaces;
+- independent final verification before success;
+- an out-of-band supervisor/recovery design that does not depend on the managed MCP bridge staying alive;
+- adversarial tests for stale state, repeated decisions, crash boundaries, interrupted actions, revoked authority and forged evidence.
+
+Out of scope:
+
+- semantic/LSP code intelligence and semantic rename (R35);
+- multi-machine pairing/fabric (R36);
+- broad persistent commander runtime additions beyond what R34 needs (R37);
+- competitor benchmark/final comparison harness (R38);
+- automatic authority arming;
+- raw arbitrary shell/executable/environment injection;
+- Docker-per-task isolation;
+- Linux/macOS support;
+- changing or republishing R33 `0.8.10`.
+
+## Baseline Integration
+
+R33 already provides substantial primitives that R34 must reuse instead of replacing:
+
+- signed autonomous goal and event journals;
+- durable planner request/decision events;
+- active plan state with immutable completed prefix;
+- planner contract rejection and repair;
+- Native Diff preview/apply/verify with exact SHA preconditions;
+- profile execution with signed receipts;
+- delegated process/filesystem/observation operations;
+- authority gating for coding/autonomous mutations;
+- crash reconciliation for profile receipts;
+- release gate and signed autonomous release receipt;
+- repeated identical-decision pause guard;
+- provider-backed or client-sampling planner backends.
+
+R34 therefore evolves the existing `autonomous-runtime`, `autonomous-planner`, supervisor and tests instead of building a second autonomous stack.
+
+## Public Surface Decision
+
+R34 does not add new MCP tool names by default. It reuses the existing autonomous control surface:
+
+- `autonomous_goal_submit`
+- `autonomous_goal_run`
+- `autonomous_goal_status`
+- `autonomous_goal_events`
+- `autonomous_goal_approve`
+- `autonomous_goal_cancel`
+- `autonomous_goal_verify`
+- `autonomous_release_gate`
+
+The returned schemas may gain R34 loop-state fields only where strict backward-compatible output evolution is possible. If strict output compatibility cannot be preserved, R34 must version the affected output schema explicitly rather than silently changing semantics.
+
+No public tool may directly arm Process, Coding, Autonomous or Host authority.
+
+## Architecture
+
+R34 is split into focused modules so each responsibility is independently testable.
+
+### 1. Loop State Reducer
+
+A pure reducer derives current loop state exclusively from the verified signed event journal. It owns no I/O.
+
+Derived fields include:
+
+- `phase`;
+- `plan_id` and `plan_version`;
+- active/completed/current step;
+- mutation epoch;
+- observation/evidence head;
+- progress state;
+- pending action;
+- pending approval;
+- last verified action receipt binding;
+- planner round;
+- replan count;
+- terminal/wait reason.
+
+The reducer is the only authority for reconstructed state after restart. No mutable sidecar state outranks the signed journal.
+
+### 2. Typed Planner Contract
+
+The planner produces one native structured decision object validated against a strict schema. R34 must not recover a contract by scraping JSON from prose or Markdown.
+
+Planner operations are conceptually:
+
+- `plan_create` — establish the first durable plan;
+- `inspect` — request bounded source/runtime evidence;
+- `act` — request one bounded action already supported by DEADBYTE runtimes;
+- `step_complete` — mark the active plan step complete with evidence references;
+- `replan` — replace only the mutable suffix of the plan, preserving completed history;
+- `pause` — enter durable waiting state with reason;
+- `finish` — request final verification/release gate.
+
+Provider adapters may represent these through native structured/tool-call APIs where supported. Internally every decision is normalized into one canonical R34 decision schema before it enters the journal.
+
+Planner rationale may be retained as bounded metadata, but rationale never authorizes execution and is not treated as proof.
+
+### 3. Plan Store
+
+The plan is journal-backed, versioned and content-addressed.
+
+A plan contains:
+
+- immutable `plan_id` for the goal;
+- monotonic `plan_version`;
+- title and bounded steps;
+- each step's stable `step_id`, intent, status and optional evidence bindings;
+- creation/replan reason hash;
+- parent plan version for replans.
+
+Rules:
+
+- completed prefix is immutable;
+- at most one step is active;
+- replan may only modify the active/pending suffix;
+- a step becomes completed only after its completion evidence verifies;
+- `finish` is blocked until all required plan steps are complete;
+- once all steps are complete, non-verification mutation requires an explicit replan first.
+
+### 4. Context Engine
+
+The planner view is built from three layers.
+
+**Working context** contains recent source reads, current observations, active process/search identities, current plan and recent decisions.
+
+**Historical evidence summary** contains compacted older events. Compaction must preserve machine-useful identity, including hashes, receipt ids/hashes, request ids, failure causes, mutation epochs, plan transitions, unresolved constraints and verification verdicts. Raw stale payload bytes may be dropped.
+
+**Durable project memory** contains stable project facts explicitly produced by the engine for the current goal/workspace: acceptance constraints, proven invariants, rejected approaches, important file identities and unresolved blockers. It is goal/workspace scoped, not account-personality memory.
+
+Compaction is deterministic and budgeted. It must never summarize away a SHA precondition, receipt binding, failure cause, unresolved constraint or authority state required to make the next safe decision.
+
+### 5. Progress Judge
+
+The Progress Judge computes progress from machine-observed deltas, not planner self-report.
+
+Progress signals include:
+
+- new verified source/context identity;
+- new passing/failing profile evidence;
+- changed mutation epoch with verified Native Diff;
+- resolved failed acceptance condition;
+- completed plan step with evidence;
+- new diagnostic narrowing a blocker;
+- successful recovery of an interrupted action;
+- final release-readiness improvement.
+
+No-progress signals include:
+
+- repeated equivalent decisions with no new evidence;
+- repeated reads of identical SHA/content without a changed hypothesis;
+- repeated failing command/profile with identical receipt outcome and no source mutation;
+- repeated replan that leaves the executable next action materially unchanged;
+- oscillation between plan states.
+
+The judge produces a deterministic bounded verdict such as `progress`, `stalled`, or `regressed` plus machine-derived reason codes. After a configurable small number of stalled cycles, the engine must force `REPLANNING`; repeated stall after replan must enter `WAITING` instead of spinning indefinitely.
+
+The planner cannot override a stall verdict.
+
+### 6. Action Executor
+
+The executor accepts exactly one normalized action at a time.
+
+Before action start it must:
+
+1. verify goal and event journal;
+2. reconcile any previously started action;
+3. verify current authority for the requested root/runtime;
+4. validate exact action schema and identity;
+5. bind a deterministic action/request id;
+6. append durable `action_started` evidence before side effects.
+
+After execution it must independently verify the resulting receipt/journal/state and append `action_completed` only after verification.
+
+Mutations continue to use Native Diff and exact SHA preconditions. Process and observation operations continue to use their existing ownership/evidence models.
+
+### 7. Crash Reconciler
+
+Crash reconciliation runs before every new action and on supervisor takeover.
+
+For a prior `action_started` without `action_completed`, it must classify the action into one of these states:
+
+- `not_executed` — no matching signed receipt/state evidence exists; action may be retried with the same deterministic request identity;
+- `executed_verified` — matching receipt/state proves the action already happened; append recovered completion and do not execute again;
+- `executed_failed_verified` — matching evidence proves a failed outcome; record it and continue through verification/replan rules;
+- `ambiguous` — evidence is missing, conflicting or unverifiable; pause fail-closed and require operator approval/recovery.
+
+No mutation may be replayed merely because the process crashed before recording completion.
+
+### 8. Authority Gate
+
+Authority remains outside planner control.
+
+Every action that requires Process/Coding/Autonomous/Host authority checks the live grant immediately before execution. A plan may describe an action whose authority is unavailable, but the engine must enter `WAITING`/`authority_unavailable` instead of arming itself.
+
+Planner contracts cannot contain arm operations, authority-file paths, arbitrary environment variables or policy widening.
+
+Revocation during a loop stops the next privileged action. Already-started actions are reconciled from evidence before any resume.
+
+### 9. Waiting, Approval and Takeover
+
+`WAITING` is a durable phase, not an exception path.
+
+Waiting reasons include:
+
+- authority unavailable/revoked;
+- ambiguous interrupted action;
+- explicit planner checkpoint;
+- repeated no-progress after replan;
+- external dependency unavailable;
+- operator-requested pause.
+
+Approve/reject uses existing authenticated goal approval semantics. Approval resumes from the verified journal head; rejection cancels or preserves the blocked goal according to the reason contract.
+
+Supervisor takeover is safe only after proving the prior supervisor instance is gone or ownership expired according to signed/runtime identity. A new supervisor never assumes an in-memory predecessor state.
+
+### 10. Out-of-Band Supervisor Control
+
+R33 public-closeout testing exposed a control-plane weakness: parking or restarting the managed MCP bridge can remove the same transport the agent is using to supervise recovery.
+
+R34 must separate the loop supervisor's local recovery authority from the managed public MCP bridge. The minimum R34 design is a Windows-local supervisor process/state path that can:
+
+- observe the managed bridge/runtime status;
+- resume/reconcile a loop after managed bridge restart;
+- restore the runtime to an ONLINE + authority-disarmed state after lifecycle tests or controlled recovery;
+- write durable supervisor events/receipts outside the bridge process lifetime.
+
+This channel is local-machine only in R34. Multi-machine remote supervisor control belongs to R36.
+
+It must not become an unauthenticated backdoor. It uses existing pinned executable/script identity and explicit local authority policy. It cannot arm privileged planes automatically.
+
+## Loop State Machine
+
+The canonical loop is:
+
+`PLANNING -> INSPECTING -> ACTING -> VERIFYING -> (INSPECTING | REPLANNING | WAITING | COMPLETE)`
+
+Detailed behavior:
+
+1. `PLANNING`: create the initial plan if none exists; otherwise select/maintain the active step.
+2. `INSPECTING`: gather bounded evidence needed for the active step.
+3. `ACTING`: perform at most one bounded action after authority and crash reconciliation gates.
+4. `VERIFYING`: independently verify the action result and evaluate acceptance/progress.
+5. `REPLANNING`: update only the mutable plan suffix when evidence invalidates the current route or progress stalls.
+6. `WAITING`: stop execution durably until authority, operator decision or external condition permits resume.
+7. `COMPLETE`: reached only after finish request, required release profiles, Native Diff/current-state verification and signed final receipt all pass.
+
+Every transition is represented by a signed event. A process restart reconstructs the same phase from the journal.
+
+## Event Model
+
+R34 extends the autonomous event vocabulary with explicit loop semantics. Event names may be refined during implementation, but the semantic set is fixed:
+
+- loop/supervisor started or taken over;
+- phase changed;
+- plan created;
+- plan replanned;
+- step activated;
+- inspection requested/completed;
+- action started;
+- action reconciled;
+- action completed;
+- verification completed;
+- progress judged;
+- step completed;
+- waiting entered/resumed;
+- finish requested;
+- final verification/release completed.
+
+Events remain hash-chained and Ed25519-signed using the existing autonomous journal model. New events must preserve replay determinism: deriving state from the same verified journal must produce the same logical loop state.
+
+## Structured Output and Provider Adapters
+
+R34 prefers provider-native structured/tool calling where the provider supports it. Provider-specific response envelopes do not enter core state directly.
+
+Each provider adapter must output the same canonical R34 decision object. The adapter records provider/model identity and a hash of the raw provider response, while the normalized decision is validated independently.
+
+For client-sampling MCP mode, the client receives the typed schema/contract and returns one normalized response bound to the planner request id.
+
+Malformed or schema-invalid responses are rejected and may be repaired a bounded number of times. Repeated contract failure enters `WAITING` rather than consuming unbounded turns.
+
+## Error Handling
+
+R34 is fail-closed.
+
+- Journal/signature failure: stop immediately; no action.
+- Authority missing: `WAITING`, no auto-arm.
+- SHA precondition failure: return to inspection/replan; never force overwrite.
+- Missing receipt after an interrupted mutation: classify as ambiguous unless current state plus signed evidence proves exactly what occurred.
+- Provider outage: bounded retry/backoff, then `WAITING` with durable reason.
+- Runtime/tool error with verified receipt: record observed failure, judge progress, then inspect/replan.
+- Repeated planner contract error: bounded repair attempts, then `WAITING`.
+- Repeated no-progress: forced replan; repeated stall after replan -> `WAITING`.
+- Supervisor crash: new supervisor reconstructs from signed journal and reconciles the last action before doing anything else.
+
+No error path may silently delete evidence, reset plan history, arm authority or mark a step complete without verification.
+
+## Security Invariants
+
+R34 must preserve these invariants:
+
+- no planner-controlled authority widening;
+- no raw arbitrary command execution path introduced by the Loop Engine;
+- no raw PID/executable/environment acceptance where existing runtimes intentionally use owned identities/profiles;
+- all source mutations remain SHA-preconditioned and Native-Diff verified;
+- completed plan history is immutable;
+- every side effect has durable pre-side-effect intent evidence;
+- every claimed completion has independently checked post-side-effect evidence;
+- crash ambiguity pauses instead of guessing;
+- release success requires current-state verification, not only historical receipts;
+- public runtime recovery cannot bypass local security policy;
+- Windows-only semantics remain first-class rather than hidden behind a cross-platform abstraction.
+
+## Testing Strategy
+
+Implementation follows TDD. Each capability begins with a failing focused test before production code changes.
+
+Required focused suites:
+
+1. Plan lifecycle
+   - initial plan required for nontrivial goal;
+   - immutable completed prefix;
+   - one active step;
+   - replan mutates only suffix;
+   - incomplete plan blocks finish.
+
+2. Phase reducer
+   - every phase transition derives deterministically from journal;
+   - restart reconstructs identical state;
+   - malformed/tampered journal fails closed.
+
+3. Context engine
+   - deterministic compaction;
+   - preserves SHA/receipt/failure/unresolved-constraint identities;
+   - stays inside byte budget;
+   - does not expose forbidden raw secrets.
+
+4. Progress judge
+   - recognizes verified progress;
+   - catches repeated equivalent decision/no-new-evidence loops;
+   - forces replan;
+   - repeated post-replan stall pauses.
+
+5. Crash reconciliation
+   - crash before side effect;
+   - crash after side effect before completion event;
+   - verified success recovery without duplicate mutation;
+   - verified failure recovery;
+   - ambiguous evidence pauses;
+   - stale/forged receipt rejected.
+
+6. Authority
+   - missing/revoked Coding/Autonomous/Process/Host authority blocks relevant action;
+   - planner cannot arm;
+   - resume after operator arm continues from same journal head;
+   - revocation mid-loop prevents the next privileged action.
+
+7. Supervisor
+   - takeover after dead owner;
+   - refuses takeover of live verified owner;
+   - bridge restart does not lose loop state;
+   - local recovery returns managed runtime ONLINE while leaving privileged authority DISARMED.
+
+8. End-to-end loop
+   - inspect -> patch -> verify -> step complete -> finish;
+   - observed test failure -> diagnose -> replan -> fix -> verify;
+   - persistent process/session observation delegated safely;
+   - cancellation and approval paths;
+   - signed final release receipt independently verifies.
+
+Adversarial cases must include malicious paths, stale hashes, receipt substitution, event deletion/reorder, PID reuse, stale supervisor identity, duplicate action replay, provider repeated garbage, large context pressure and authority loss.
+
+## Acceptance Gate
+
+R34 is not complete until all of the following are observed on the exact candidate bytes:
+
+- full pre-existing R33 suite remains green;
+- all new R34 focused/adversarial tests pass;
+- deterministic journal replay proves identical derived loop state across restart;
+- a real multi-step workspace task completes through the full loop with signed evidence;
+- injected crash after mutation but before completion does not duplicate the mutation;
+- no-progress scenario forces replan and then pauses when still stalled;
+- authority revoke prevents further privileged actions without corrupting goal state;
+- out-of-band local supervisor restores managed MCP after bridge lifecycle loss while leaving all privileged planes DISARMED;
+- final autonomous release receipt independently verifies current Native Diff head and required profiles;
+- exact public tool catalog change, if any, is explicitly reviewed rather than accidental;
+- Windows gate passes on exact release bytes;
+- immutable release/package generation and final closure follow the proven R33 release process.
+
+## Versioning and Release Discipline
+
+R34 development starts from R33 `0.8.10` but must receive a new package version only when its release candidate is cut. The design does not preselect that semantic version.
+
+No R34 test or helper may mutate or republish R33 `0.8.10`.
+
+The project remains NON-GIT in this environment. Superpowers documentation is still written under `docs/superpowers`, but no Git commit/HEAD may be invented as evidence.
+
+## R34 Done Definition
+
+R34 is done when DEADBYTE MCP can run a durable engineering goal through an explicit, evidence-driven plan loop; survive/reconcile crashes without duplicate side effects; detect and stop non-progress; respect live authority without self-arming; keep context bounded without losing proof identity; expose reconstructable live phases; recover the managed MCP runtime through a separate local supervisor path; and produce an independently verified final release receipt on the exact candidate state.

package/docs/superpowers/specs/2026-09-17-r35-production-successor-design.md

@@ -0,0 +1,220 @@
+# DEADBYTE MCP R35 Production Successor Design
+
+## Identity and parent authority
+
+R35 is `V0.9.0 / R35`. Its immutable parent is the sealed R34 Production Final Baseline:
+
+- release id: `v0.8.11-6c01e5285e065220`
+- manifest SHA-256: `6c01e5285e065220db07d7719f78bb6aa4fde88365419281b33be1b1d59dd3c5`
+- manifest entries: `1560`
+- public MCP tools: `73`
+- source regression: `452/452 PASS`
+- closure SHA-256: `5102fd0d3735dbbc324f3de6d208f2e37b72562980d9b965d4a923887a9950f3`
+- independent verify SHA-256: `a49a8641a3c102c7715e220b03ee6057e1cd833eb184e8051596c6e1dfeefab6`
+
+R34 bytes are read-only authority. R35 must be created as a separate workspace and every release proof must be able to roll back to this exact R34 release.
+
+## Mission
+
+R35 extends DEADBYTE MCP without weakening R34 safety or operator ergonomics. The release keeps the R34 public tool names stable unless a versioned schema change is proven necessary, while improving semantic breadth, context provenance, durable loop reliability, provider failure handling, remote resume behavior, and evidence-based comparative benchmarks.
+
+The engineering loop remains single-agent and evidence-first:
+
+`PLAN -> INSPECT -> ACT -> VERIFY -> CRITIC -> REPAIR -> RELEASE`
+
+No phase may claim success from prose. Release completion requires observed tests, signed evidence, immutable slot activation, rollback to sealed R34, restore to R35, all authority planes DISARMED, signed closure, and independent verification.
+
+## Global invariants
+
+1. R34 sealed release is never modified in place.
+2. Workspace allowlists remain on by default.
+3. Process, coding, autonomous, and host authority remain independently revocable and never auto-arm.
+4. Raw shell command strings remain forbidden at privileged boundaries.
+5. Public tool names stay compatible with the R34 73-tool surface unless an explicit R35 versioned contract test approves a change.
+6. Context is retrieved progressively. Whole-repository dumping is not a planner primitive.
+7. Retries must change a hypothesis or wait for an observed state transition; identical blind retries are rejected.
+8. Full audit payloads stay on disk; compact terminal UX must not expose long SHA/payload noise by default.
+9. GPL implementation code is not vendored or copied. External projects may inform behavior and acceptance tests only.
+10. R35 Final cannot be declared until rollback/restore and independent final verification pass.
+
+## R35-A: Tool Surface Archaeology
+
+Add a canonical public-surface ledger that records each MCP tool name plus canonical input-schema and output-schema hashes. The R34 73-tool surface becomes the compatibility baseline.
+
+The ledger must support:
+
+- deterministic canonicalization of schemas;
+- duplicate-name rejection;
+- exact tool-set comparison;
+- classification of changes as `unchanged`, `added`, `removed`, or `schema_changed`;
+- a hard release failure for accidental removal/schema drift;
+- an explicit versioned allowlist for intentional R35 additions.
+
+The ledger is evidence, not a marketing report. It must be generated from the same registered tool definitions used by the server.
+
+## R35-B: Generic semantic backend
+
+Keep the four R34 public semantic operations stable:
+
+- outline
+- definition
+- references
+- replace-by-symbol
+
+Refactor `src/semantic-code.mjs` into an engine-neutral runtime with backend selection by source language. The existing TypeScript language service becomes one backend rather than the architecture itself.
+
+Required R35 tracer languages are:
+
+- TypeScript/JavaScript
+- Python
+- Rust
+- C/C++
+
+Go remains an optional adapter/benchmark language. It may be exercised when a pinned `gopls` is available, but missing or failing Go coverage does not block R35 Final because it is not part of the primary DEADBYTE workflow.
+
+Backend requirements:
+
+- bounded project/file discovery;
+- workspace allowlist and deny-path enforcement before server launch/read;
+- deterministic symbol/location normalization;
+- stale file/symbol preconditions for mutation;
+- diagnostics capability exposed internally for acceptance and future public use;
+- no uncontrolled language-server download at runtime;
+- server executable identity must be configured/pinned if an external LSP process is used.
+
+R35 does not claim Serena-equivalent language breadth from this focused set. Final requires the four workflow-relevant tracer languages to pass the same acceptance corpus; optional Go evidence is reported separately and does not inflate the breadth claim.
+
+## R35-C: Context provenance ledger
+
+Extend the autonomous context engine so each retained context or observation carries a compact provenance envelope:
+
+- `source_kind`
+- `source_id`
+- `source_sha256` when bytes are available
+- `observed_at_utc`
+- `byte_count`
+- `trust_class`
+- `relevance_epoch`
+
+Compaction must preserve provenance even when payload text is elided. Repeated identical source evidence must be deduplicated by stable identity, not by model-written rationale.
+
+The planner receives compact provenance and current evidence, not entire historical payloads. Secret redaction remains before hashing/presentation where exposing a digest would create a secret oracle.
+
+## R35-D: Looped Engineering V2
+
+The durable autonomous loop remains single-agent. Add explicit machine phases and critic/repair state without introducing multi-agent chat orchestration.
+
+Required state transitions:
+
+- PLAN selects or revises a bounded plan.
+- INSPECT gathers evidence.
+- ACT performs one preconditioned mutation/action.
+- VERIFY executes the narrow acceptance probe.
+- CRITIC classifies observed failure or insufficient proof.
+- REPAIR changes the plan/hypothesis.
+- RELEASE runs required profiles and produces signed terminal evidence.
+
+Progress fingerprints must ignore rationale text and depend on observed state, evidence identities, mutation epoch, plan completion, and resolved blockers. Identical decision + identical evidence must stall and replan rather than loop forever.
+
+Todo projection must be derivable from the signed journal so a restart can resume without trusting mutable prompt memory.
+
+## R35-E: Provider circuit state
+
+Add a signed provider-health state machine only for network/provider calls:
+
+- `CLOSED`
+- `OPEN`
+- `HALF_OPEN`
+
+A circuit state includes provider id, failure class, failure count, opened time, next probe time, and last successful observation. Opening a circuit never grants authority and never triggers an unconfigured provider fallback.
+
+Local deterministic tools do not use this circuit breaker.
+
+Half-open probes are bounded and explicit. Success closes the circuit; failure reopens it with a bounded backoff policy. State must survive restart through authenticated evidence.
+
+## R35-F: Capability benchmark corpus
+
+Create reproducible offline fixtures and metrics for:
+
+- filesystem correctness and bounded reads;
+- surgical edit precision and stale-precondition rejection;
+- search pagination and deterministic ordering;
+- process lifecycle and resume;
+- semantic navigation/edit correctness for the four required tracer languages, with optional Go reported separately;
+- context bytes retained/elided with provenance intact;
+- autonomous recovery after deliberate tool/test failure;
+- remote reconnect/resume and result deduplication.
+
+Metrics include correctness, round trips, bytes returned, elapsed time, stale-precondition rejection, recovery success, and duplicate side-effect count.
+
+Competitor comparisons in README/docs may only claim advantages supported by reproducible measurements. Serena remains acknowledged as broader in language ecosystem until R35 evidence proves otherwise.
+
+## R35-G: Remote reliability
+
+Preserve R34 compact default terminal logging and `--verbose` forensic mode.
+
+Add resumable remote-session identity:
+
+- stable session id;
+- monotonically increasing result cursor;
+- bounded replay from a cursor;
+- duplicate-result suppression by request/result identity;
+- reconnect tests across Bridge restart;
+- no authority auto-arm during reconnect.
+
+A reconnect may observe or resume only authority that is already valid under local standing-grant policy.
+
+## R35-H: Release and final proof
+
+R35 release closure requires, in order:
+
+1. focused slice tests green;
+2. full source regression green;
+3. exact public-surface ledger comparison against R34;
+4. four required semantic tracer languages green (TypeScript/JavaScript, Python, Rust, C/C++), with Go reported as optional evidence;
+5. benchmark corpus green with recorded evidence;
+6. canonical Windows gate PASS on one exact manifest;
+7. immutable R35 slot activation;
+8. public parity against exact R35 tool surface;
+9. supervisor `RUNNING [verified]`;
+10. signed rollback to sealed R34 `v0.8.11-6c01e5285e065220`;
+11. R34 public verification;
+12. exact R35 restore;
+13. R35 public verification;
+14. process/coding/autonomous/host all DISARMED;
+15. signed R35 final closure;
+16. independent final verifier PASS.
+
+## Error handling
+
+Every new subsystem fails closed:
+
+- unknown semantic language/backend -> typed unsupported-language error, no grep fallback masquerading as semantic;
+- missing LSP executable pin -> explicit configuration error;
+- provenance budget overflow -> deterministic compaction then explicit budget error;
+- circuit state corruption/signature failure -> provider unavailable, no silent reset;
+- remote cursor outside retained window -> explicit replay-window error;
+- schema ledger drift -> release gate failure;
+- benchmark flake -> preserve raw diagnostic evidence and stop release; do not auto-waive.
+
+## Testing strategy
+
+All behavior changes use RED -> GREEN TDD. Focused tests precede full regression. Flaky timing tests must wait on the exact terminal condition they assert, not an earlier proxy condition. Windows sharing and process-lifecycle tests use bounded retries only around known OS races and preserve the original failure if the bound is exceeded.
+
+Test layers:
+
+- pure deterministic unit tests for ledger/provenance/circuit/progress logic;
+- tool-layer integration tests for semantic and remote contracts;
+- crash/restart tests for durable loop/circuit/session state;
+- four required-language fixture tests, plus optional Go fixture evidence when available;
+- public MCP tracer/parity tests;
+- Windows containment/release gate;
+- rollback/restore/final closure verification.
+
+## Versioning and public compatibility
+
+R35 version is `0.9.0`. R34's 73 public tool names are the baseline. New public tools are not required for the first R35 Final; internal capability may expand behind existing tools/resources. If a new public tool becomes necessary, its addition must be recorded in the surface ledger and all parity clients must derive from the canonical R35 surface authority rather than duplicating hand-maintained arrays.
+
+## Definition of Done
+
+R35 is Final only when the product is installable and operable by real MCP clients, the R34 tracer bullet still works, the R35 slices above have objective tests, no hot-path placeholder is exposed, public compatibility is machine-checked, the four required semantic tracer languages are green with Go reported separately as optional evidence, remote reconnect/resume is proven, benchmark evidence is reproducible, Windows gate is manifest-bound PASS, rollback to sealed R34 and exact restore succeed, all privileged planes finish DISARMED, and the independent R35 closure verifier passes.