deadbyte-mcp 0.9.0 → 0.10.0

package/src/process-runtime.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
-import { appendFile, lstat, mkdir, readFile, realpath } from 'node:fs/promises';
+import { appendFile, lstat, mkdir, readFile, readdir, realpath, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { canonicalJson } from './canonical-json.mjs';
@@ -13,6 +13,7 @@ const ZERO_SHA256 = '0'.repeat(64);
 const SHA256_RE = /^[0-9a-f]{64}$/;
 const READY_PREFIX = Buffer.from('DEADBYTE_PROCESS_HOST_READY ', 'utf8');
 const START_TIMEOUT_MS = 8000;
+const TERMINAL_RECOVERY_SCHEMA = 'deadbyte.process-terminal.v1';
 
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 const nowUtc = () => new Date().toISOString();
@@ -101,15 +102,85 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
   const sessions = new Map();
   let signingPromise = null;
   let verifyPromise = null;
+  let hydrationPromise = null;
   const runtime = {
     policy,
     signing: () => (signingPromise ??= loadPrivateSigningKey(signingKeyPath)),
     verifying: () => (verifyPromise ??= loadPublicVerifyKey(verifyKeyPath))
   };
 
-  function sessionFor(sessionId) {
+  async function readVerifiedJournal(sessionId, journalPath) {
+    const verifying = await runtime.verifying();
+    const text = await readFile(journalPath, 'utf8');
+    const records = text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    let previous = ZERO_SHA256;
+    let sequence = 0;
+    for (const record of records) {
+      const { event_sha256: eventSha, key_id: keyId, signature, ...unsigned } = record;
+      if (unsigned.schema !== EVENT_SCHEMA || unsigned.session_id !== sessionId || unsigned.sequence !== sequence + 1 ||
+          unsigned.previous_event_sha256 !== previous || unsigned.policy_sha256 !== policy.policy_sha256) {
+        throw new Error('process event journal chain mismatch');
+      }
+      const canonical = Buffer.from(canonicalJson(unsigned), 'utf8');
+      const observedSha = sha256Bytes(canonical);
+      if (eventSha !== observedSha || keyId !== verifying.keyId || typeof signature !== 'string' || !cryptoVerify(null,
+          Buffer.concat([EVENT_DOMAIN, canonical]), verifying.publicKey, Buffer.from(signature, 'base64'))) {
+        throw new Error('process event journal signature mismatch');
+      }
+      previous = observedSha;
+      sequence += 1;
+    }
+    return { records, event_count: sequence, head_sha256: previous };
+  }
+
+  async function hydrateTerminalSessions() {
+    if (hydrationPromise) return hydrationPromise;
+    hydrationPromise = (async () => {
+      await mkdir(policy.state_dir, { recursive: true });
+      const names = (await readdir(policy.state_dir)).filter(name => /^[0-9a-f]{64}\.jsonl$/.test(name)).sort();
+      for (const name of names) {
+        const sessionId = name.slice(0, 64);
+        if (sessions.has(sessionId)) continue;
+        let checked;
+        try { checked = await readVerifiedJournal(sessionId, path.join(policy.state_dir, name)); }
+        catch { continue; }
+        const terminal = checked.records.at(-1);
+        if (!terminal || !['exited','terminated'].includes(terminal.type) || terminal.detail?.recovery_schema !== TERMINAL_RECOVERY_SCHEMA) continue;
+        const started = checked.records.find(record => record.type === 'started');
+        if (!started || !Number.isInteger(started.detail?.child_pid) || !/^[0-9]+$/.test(String(started.detail?.creation_filetime ?? ''))) continue;
+        const profile = policy.profiles[terminal.profile_id];
+        if (!profile || !policy.roots[terminal.root_id]) continue;
+        const outputFile = terminal.detail.output_file;
+        if (typeof outputFile !== 'string' || outputFile !== `${sessionId}.stream.bin`) continue;
+        let output;
+        try { output = await readFile(path.join(policy.state_dir, outputFile)); }
+        catch { continue; }
+        if (!Number.isInteger(terminal.detail.retained_output_bytes) || terminal.detail.retained_output_bytes !== output.length ||
+            !SHA256_RE.test(terminal.detail.retained_output_sha256 ?? '') || sha256Bytes(output) !== terminal.detail.retained_output_sha256 ||
+            !SHA256_RE.test(terminal.detail.stream_sha256 ?? '') || !Number.isInteger(terminal.detail.stream_head) ||
+            !Number.isInteger(terminal.detail.earliest_offset) || terminal.detail.earliest_offset < 0 ||
+            terminal.detail.stream_head < terminal.detail.earliest_offset || terminal.detail.stream_head - terminal.detail.earliest_offset !== output.length) continue;
+        sessions.set(sessionId, {
+          session_id:sessionId, job_id:null, profile_id:terminal.profile_id, root_id:terminal.root_id,
+          cwd_relative:typeof started.detail?.cwd === 'string' ? started.detail.cwd : '.',
+          child_pid:started.detail.child_pid, creation_filetime:String(started.detail.creation_filetime),
+          state:terminal.type, exit_code:Number.isInteger(terminal.detail.exit_code) ? terminal.detail.exit_code : null,
+          earliest_offset:terminal.detail.earliest_offset, stream_head:terminal.detail.stream_head,
+          stream_sha256:terminal.detail.stream_sha256, output, control_buffer:Buffer.alloc(0),
+          journal_head_sha256:checked.head_sha256, journal_path:path.join(policy.state_dir,name), event_count:checked.event_count,
+          max_retained_output_bytes:profile.max_retained_output_bytes, stderr:'', terminate_requested:terminal.type==='terminated',
+          protocol_error:null, transport:profile.transport, win32_input_mode:false, host:null, close_promise:Promise.resolve(),
+          recovered_terminal:true
+        });
+      }
+    })();
+    return hydrationPromise;
+  }
+
+  async function sessionFor(sessionId) {
     if (typeof sessionId !== 'string' || !SHA256_RE.test(sessionId)) throw new Error('invalid process session id');
-    const session = sessions.get(sessionId);
+    let session = sessions.get(sessionId);
+    if (!session) { await hydrateTerminalSessions(); session = sessions.get(sessionId); }
     if (!session) throw new Error(`unknown process session '${sessionId}'`);
     return session;
   }
@@ -172,6 +243,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
   }
 
   async function start({ profileId, rootId, cwd = '.', args = [] }) {
+    await hydrateTerminalSessions();
     const grant = await assertProcessArmed(policy, profileId, rootId);
     const profile = policy.profiles[profileId];
     if (!profile) throw new Error(`process profile '${profileId}' is not configured`);
@@ -209,8 +281,23 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
         parseHostOutput(session, null, true);
         if (session.state === 'starting') session.ready_reject?.(new Error(`process host exited before READY: ${session.stderr}`));
         session.exit_code ??= Number.isInteger(code) ? code : null;
-        session.state = session.terminate_requested ? 'terminated' : 'exited';
-        try { await appendEvent(runtime, session, session.state, { exit_code: session.exit_code }); } catch {}
+        const terminalState = session.terminate_requested ? 'terminated' : 'exited';
+        try {
+          const outputFile = `${session.session_id}.stream.bin`;
+          const retainedOutputSha256 = sha256Bytes(session.output);
+          await writeFile(path.join(policy.state_dir, outputFile), session.output, { flag:'wx' });
+          await appendEvent(runtime, session, terminalState, {
+            recovery_schema:TERMINAL_RECOVERY_SCHEMA,
+            exit_code:session.exit_code,
+            earliest_offset:session.earliest_offset,
+            stream_head:session.stream_head,
+            stream_sha256:session.stream_sha256,
+            retained_output_bytes:session.output.length,
+            retained_output_sha256:retainedOutputSha256,
+            output_file:outputFile
+          });
+          session.state = terminalState;
+        } catch {}
         resolve();
       });
     });
@@ -223,7 +310,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
   }
 
   async function read({ sessionId, offset = 0, maxBytes = 65536 }) {
-    const session = sessionFor(sessionId);
+    const session = await sessionFor(sessionId);
     if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 262144) throw new Error('invalid process read bounds');
     if (offset > session.stream_head) throw new Error('process read offset is beyond stream head');
     const truncated = offset < session.earliest_offset;
@@ -235,10 +322,10 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
       truncated, data_base64: data.toString('base64'), state: session.state, exit_code: session.exit_code };
   }
 
-  async function status({ sessionId }) { return publicSession(sessionFor(sessionId)); }
-  async function list() { return { sessions: [...sessions.values()].map(publicSession).sort((a,b) => a.session_id.localeCompare(b.session_id)) }; }
+  async function status({ sessionId }) { return publicSession(await sessionFor(sessionId)); }
+  async function list() { await hydrateTerminalSessions(); return { sessions: [...sessions.values()].map(publicSession).sort((a,b) => a.session_id.localeCompare(b.session_id)) }; }
   async function action({ sessionId, actionId }) {
-    const session = sessionFor(sessionId);
+    const session = await sessionFor(sessionId);
     if (session.state !== 'running') throw new Error('process action requires a running session');
     await assertProcessArmed(policy, session.profile_id, session.root_id);
     const profile = policy.profiles[session.profile_id];
@@ -259,7 +346,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, session: publicSession(session) };
   }
   async function terminate({ sessionId }) {
-    const session = sessionFor(sessionId);
+    const session = await sessionFor(sessionId);
     if (['exited','terminated'].includes(session.state)) return publicSession(session);
     session.terminate_requested = true;
     session.host.kill();
@@ -268,7 +355,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
   }
 
   async function verifyEventJournal({ sessionId }) {
-    const session = sessionFor(sessionId);
+    const session = await sessionFor(sessionId);
     const verifying = await runtime.verifying();
     const text = await readFile(session.journal_path, 'utf8');
     const records = text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));

package/src/process-smoke-client.mjs

@@ -14,10 +14,18 @@ const ZERO_SHA256 = '0'.repeat(64);
 const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, '..');
-const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
+const productionPolicyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
 const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
-const policy = await loadProcessPolicy(policyPath);
 const smokeTrust = await import('node:fs/promises').then(({ mkdtemp }) => mkdtemp(path.join(os.tmpdir(), 'deadbyte-process-smoke-')));
+const smokePolicyPath = path.join(smokeTrust, 'smoke-policy.json');
+const productionPolicy = JSON.parse(await readFile(productionPolicyPath, 'utf8'));
+const smokePolicy = {
+  ...productionPolicy,
+  grant_file: path.join(smokeTrust, 'process-grant.json'),
+  state_dir: path.join(smokeTrust, 'process-state')
+};
+await writeFile(smokePolicyPath, `${JSON.stringify(smokePolicy, null, 2)}\n`, { flag: 'wx' });
+const policy = await loadProcessPolicy(smokePolicyPath);
 const keys = await generateTrustKeypair({ privateKeyPath: path.join(smokeTrust, 'private.pem'), publicKeyPath: path.join(smokeTrust, 'public.pem') });
 await mkdir(path.dirname(policy.grant_file), { recursive: true });
 const grant = { schema: PROCESS_GRANT_SCHEMA, policy_sha256: policy.policy_sha256,
@@ -29,7 +37,7 @@ const client = new Client({ name: 'deadbyte-process-smoke', version: '0.8.0' },
   { versionNegotiation: { mode: { pin: '2026-07-28' } } });
 const transport = new StdioClientTransport({
   command: process.execPath, args: [serverPath], cwd: repoRoot,
-  env: { ...getDefaultEnvironment(), DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: policyPath,
+  env: { ...getDefaultEnvironment(), DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: smokePolicyPath,
     DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath },
   stderr: 'pipe'
 });

package/src/r36-compact-disarmed-probe.mjs

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { R36_COMPACT_GATEWAYS, R36_COMPACT_TOOL_LIMIT } from './remote-mcp-r36-parity-client.mjs';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+function structured(result,label){
+  if(result.isError) throw new Error(`${label} returned error: ${JSON.stringify(result.structuredContent??result.content)}`);
+  if(!result.structuredContent||typeof result.structuredContent!=='object') throw new Error(`${label} missing structured output`);
+  return result.structuredContent;
+}
+function gateway(result,label){
+  const value=structured(result,label);
+  if(value.status!=='ok'||!value.result||typeof value.result!=='object') throw new Error(`${label} gateway status=${String(value.status)}`);
+  return value.result;
+}
+export async function probeR36CompactDisarmed(endpointText){
+  const endpoint=new URL(endpointText);
+  if(endpoint.protocol!=='https:') throw new Error('R36 compact disarmed probe requires HTTPS');
+  const client=new Client({name:'deadbyte-r36-compact-disarmed-probe',version:'0.10.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StreamableHTTPClientTransport(endpoint);
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    if(names.length>R36_COMPACT_TOOL_LIMIT) throw new Error(`R36 compact catalog exceeds ${R36_COMPACT_TOOL_LIMIT}: ${names.length}`);
+    for(const name of R36_COMPACT_GATEWAYS) if(!names.includes(name)) throw new Error(`R36 compact gateway missing ${name}`);
+    for(const tool of listed.tools) if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties) throw new Error(`tool ${tool.name} missing strict output schema`);
+    const manifest=gateway(await client.callTool({name:'capability_manifest',arguments:{}}),'capability_manifest');
+    if(manifest.profile!=='compact'||!/^[0-9a-f]{64}$/.test(String(manifest.ledger_sha256??''))) throw new Error('R36 compact manifest malformed');
+    const required=manifest.capabilities.filter(item=>item?.production===true&&item?.host_only!==true);
+    for(const item of required) if(typeof item.compact_tool!=='string'||!names.includes(item.compact_tool)) throw new Error(`compact route missing ${String(item.id)}`);
+    const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
+    const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous_session_status');
+    if(coding.armed!==false||autonomous.coding_armed!==false||autonomous.autonomous_armed!==false) throw new Error('R36 compact authority must be DISARMED');
+    const machine=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_status'}}),'machine_status');
+    const nonce=`r36-final-${randomBytes(16).toString('hex')}`;
+    const ping=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_ping',nonce}}),'machine_ping');
+    if(ping.nonce!==nonce||ping.machine_id!==machine.machine_id||ping.release_id!==machine.release_id||ping.release_manifest_sha256!==machine.release_manifest_sha256) throw new Error('R36 compact machine ping binding mismatch');
+    return {status:'passed',profile:'compact',tool_count:names.length,tools:names,catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),strict_output_schemas:true,ledger_sha256:manifest.ledger_sha256,capability_count:manifest.capabilities.length,production_non_host_capabilities:required.length,capability_closure:true,coding_armed:false,autonomous_armed:false,release_id:machine.release_id,release_manifest_sha256:machine.release_manifest_sha256,machine_status:machine,machine_ping:ping,nonce,protocol_revision:client.getNegotiatedProtocolVersion()};
+  } finally {await client.close().catch(()=>{});}
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const endpoint=process.argv[2];
+  if(!endpoint) throw new Error('usage: node src/r36-compact-disarmed-probe.mjs https://host/mcp/path');
+  probeR36CompactDisarmed(endpoint).then(v=>console.log(JSON.stringify(v,null,2))).catch(e=>{console.error(e instanceof Error?e.stack:String(e));process.exitCode=1;});
+}

package/src/r36-full-surface-probe.mjs

@@ -0,0 +1,56 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { fileURLToPath } from 'node:url';
+import { R36_EXPECTED_TOOLS } from './remote-mcp-r36-parity-client.mjs';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+export async function probeR36FullSurface({packageRoot,generationRoot,stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
+  const pkgRoot=packageRoot?path.resolve(packageRoot):path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+  const gen=path.resolve(generationRoot);
+  const semanticPath=path.join(gen,'semantic-lsp-config.json');
+  const semanticSha=sha256(await readFile(semanticPath));
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_STATE_ROOT:path.resolve(stateRoot),
+    DEADBYTE_CORE_ROOT:pkgRoot,
+    DEADBYTE_WORKSPACE_ROOT:path.join(pkgRoot,'workspaces'),
+    DEADBYTE_CAPABILITY_PROFILE:'full',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:path.join(gen,'process-policy.json'),
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(gen,'coding-policy.json'),
+    DEADBYTE_SEMANTIC_LSP_CONFIG:semanticPath,
+    DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:semanticSha,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(gen,'autonomous-policy.json'),
+    DEADBYTE_PRIVILEGED_POLICY:path.join(gen,'host-policy.json')
+  };
+  const client=new Client({name:'deadbyte-r36-full-surface-probe',version:'0.10.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[path.join(pkgRoot,'src','mcp-server.mjs')],cwd:pkgRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    if(JSON.stringify(names)!==JSON.stringify(R36_EXPECTED_TOOLS)) throw new Error(`R36 full catalog mismatch count=${names.length}`);
+    for(const tool of listed.tools){
+      if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties) throw new Error(`R36 full tool ${tool.name} missing strict output schema`);
+    }
+    return {status:'passed',profile:'full',tool_count:names.length,tools:names,catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),strict_output_schemas:true,protocol_revision:client.getNegotiatedProtocolVersion()};
+  } finally {await client.close().catch(()=>{});}
+}
+
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){
+  const [packageRoot,generationRoot]=process.argv.slice(2);
+  if(!packageRoot||!generationRoot) throw new Error('usage: node src/r36-full-surface-probe.mjs <package-root> <generation-root>');
+  probeR36FullSurface({packageRoot,generationRoot}).then(v=>console.log(JSON.stringify(v,null,2))).catch(e=>{console.error(e instanceof Error?e.stack:String(e));process.exitCode=1;});
+}

package/src/remote-live-log.mjs

@@ -0,0 +1,76 @@
+const SAFE_ARG_KEYS=Object.freeze(['root_id','path','pattern','command_id','profile_id','session_id','goal_id','task_id','step_id','mode']);
+const LIFECYCLE=Object.freeze({
+  device_start:'🚀 [DEVICE] Starting DEADBYTE MCP...',
+  bridge_connected:'🔌 [BRIDGE] Local bridge connected',
+  cloud_connected:'🔌 [CLOUD] Remote MCP connected',
+  session_new:'[SESSION] New foreground session',
+  session_restored:'♻️ [SESSION] Previous result stream replayed',
+  ready:'✅ [READY] DEADBYTE MCP online',
+  cleanup:'🔐 [AUTH] Revoking session authority...'
+});
+
+function safeAtom(value){
+  if(typeof value==='string'){
+    if(value.length<1||value.length>160||/[\r\n\0]/.test(value)) return null;
+    return value;
+  }
+  if(typeof value==='number'&&Number.isFinite(value)) return String(value);
+  if(typeof value==='boolean') return String(value);
+  return null;
+}
+
+function summarizeArgs(args){
+  if(!args||typeof args!=='object'||Array.isArray(args)) return '';
+  const parts=[];
+  for(const key of SAFE_ARG_KEYS){
+    if(!Object.hasOwn(args,key)) continue;
+    const value=safeAtom(args[key]);
+    if(value!==null) parts.push(`${key.replace(/_id$/,'')}=${value}`);
+  }
+  return parts.length?` ${parts.join(' ')}`:'';
+}
+
+function formatDuration(ms){
+  const value=Number(ms);
+  if(!Number.isFinite(value)||value<0) return '';
+  if(value<1000) return `${Math.round(value)}ms`;
+  return `${(value/1000).toFixed(2)}s`;
+}
+
+export function formatCompactAuditEvent(event){
+  if(!event||typeof event!=='object'||Array.isArray(event)||typeof event.tool!=='string'||!event.tool) return null;
+  if(event.event_type==='tool.request') return `▶ RUN ${event.tool}${summarizeArgs(event.args)}`;
+  if(event.event_type==='tool.result'){
+    const marker=event.outcome?.is_error===true?'❌ ERR':'✅ OK';
+    const duration=formatDuration(event.outcome?.duration_ms);
+    return `${marker} ${event.tool}${duration?` ${duration}`:''}`;
+  }
+  return null;
+}
+
+export function formatRemoteLifecycle(kind){
+  if(typeof kind!=='string'||!Object.hasOwn(LIFECYCLE,kind)) throw new Error(`unknown remote lifecycle '${String(kind)}'`);
+  return LIFECYCLE[kind];
+}
+
+export function createLiveActivityTracker(){
+  const pending=new Map();
+  return Object.freeze({
+    observe(event){
+      if(!event||typeof event!=='object'||Array.isArray(event)) return null;
+      if(event.event_type==='tool.request'&&typeof event.request_id==='string'&&event.request_id&&typeof event.tool==='string'&&event.tool){
+        pending.set(event.request_id,{request_id:event.request_id,tool:event.tool});
+      }else if(event.event_type==='tool.result'&&typeof event.request_id==='string'&&event.request_id){
+        pending.delete(event.request_id);
+      }
+      return formatCompactAuditEvent(event);
+    },
+    pending(){return [...pending.values()].map(item=>({...item}));},
+    reconcileInterrupted(reason='session_end'){
+      const suffix=reason==='session_end'?'session ended before result':reason==='recovery'?'session recovered before result':'result not observed before stream ended';
+      const lines=[...pending.values()].map(item=>`⚠️ INTERRUPTED ${item.tool} — ${suffix}`);
+      pending.clear();
+      return lines;
+    }
+  });
+}

package/src/remote-mcp-autonomous-smoke-client.mjs

@@ -3,7 +3,7 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
-import { R34_EXPECTED_TOOLS } from './remote-mcp-r34-parity-client.mjs';
+import { R36_COMPACT_GATEWAYS, R36_COMPACT_TOOL_LIMIT } from './remote-mcp-r36-parity-client.mjs';
 import { promptContexts, promptObservations, promptMutationEpoch } from './autonomous-live-state.mjs';
 
 const endpointText = process.argv[2];
@@ -96,7 +96,7 @@ function plannerDecision(prompt) {
   return { schema:'deadbyte.autonomous-decision.v1', action:'inspect', summary:'gather current fixture state before deciding next action',
     reads:[{ path:fixtureRelative, max_bytes:4096 }] };
 }const client = new Client(
-  { name:'deadbyte-r24-public-autonomous-gate', version:'0.8.0' },
+  { name:'deadbyte-r36-public-autonomous-gate', version:'0.10.0' },
   { capabilities:{ sampling:{} }, versionNegotiation:{ mode:{ pin:'2026-07-28' } },
     inputRequired:{ autoFulfill:true, maxRounds:16 } }
 );
@@ -113,7 +113,11 @@ try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
-  if (JSON.stringify(names) !== JSON.stringify(R34_EXPECTED_TOOLS)) throw new Error(`R34 public catalog mismatch: ${JSON.stringify(names)}`);
+  if (names.length > R36_COMPACT_TOOL_LIMIT) throw new Error(`R36 compact public catalog exceeds ${R36_COMPACT_TOOL_LIMIT}: ${names.length}`);
+  for (const name of R36_COMPACT_GATEWAYS) if (!names.includes(name)) throw new Error(`R36 compact public gateway missing ${name}`);
+  for (const name of ['autonomous_goal_submit','autonomous_goal_run','autonomous_goal_status','autonomous_goal_events','autonomous_goal_verify','autonomous_release_gate','autonomous_session_status','native_diff_apply','native_diff_preview','native_diff_verify']) {
+    if (!names.includes(name)) throw new Error(`R36 compact autonomous control missing ${name}`);
+  }
   for (const tool of listed.tools) {
     if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false || !tool.outputSchema?.properties) {
       throw new Error(`tool ${tool.name} missing strict output schema`);

package/src/remote-mcp-coding-smoke-client.mjs

@@ -19,7 +19,7 @@ const taskPath = `workspaces/demo/.deadbyte-coding-task-${tag}.txt`;
 const codingTools = [
   'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write', 'coding_files_read',
   'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat',
-  'coding_symbol_definition', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_replace',
+  'coding_symbol_definition', 'coding_symbol_diagnostics', 'coding_symbol_implementations', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_rename_preview', 'coding_symbol_replace',
   'coding_task_approve', 'coding_task_cancel', 'coding_task_events', 'coding_task_run', 'coding_task_status',
   'coding_task_submit', 'coding_task_verify', 'coding_text_replace', 'coding_tree'
 ];

package/src/remote-mcp-r36-parity-client.mjs

@@ -0,0 +1,175 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { R34_EXPECTED_TOOLS } from './remote-mcp-r34-parity-client.mjs';
+import { loadCodingPolicy } from './coding-plane.mjs';
+import { verifyMachineFsReceiptFile } from './machine-fs.mjs';
+import { verifyObservationReceiptFile } from './observation-runtime.mjs';
+
+export const R36_EXPECTED_TOOLS=Object.freeze([...new Set([
+  ...R34_EXPECTED_TOOLS,
+  'coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_rename_preview'
+])].sort());
+if(R36_EXPECTED_TOOLS.length !== 76) throw new Error(`R36 full catalog identity mismatch: ${R36_EXPECTED_TOOLS.length}`);
+export const R36_COMPACT_GATEWAYS=Object.freeze(['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'].sort());
+export const R36_COMPACT_TOOL_LIMIT=42;
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const verifyKeyPath=path.join(stateRoot,'trust','ed25519-public.pem');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+function structured(result,label){
+  if(result.isError) throw new Error(`${label} returned error: ${JSON.stringify(result.structuredContent??result.content)}`);
+  if(!result.structuredContent||typeof result.structuredContent!=='object') throw new Error(`${label} missing structured output`);
+  return result.structuredContent;
+}
+function gateway(result,label){
+  const value=structured(result,label);
+  if(value.status!=='ok'||!value.result||typeof value.result!=='object') throw new Error(`${label} gateway status=${String(value.status)} error=${String(value.error??'')}`);
+  return value.result;
+}
+async function fileSha(relative){return sha256(await readFile(path.join(repoRoot,...relative.split('/'))));}
+async function verifyMachineReceipt(policy,receiptId,operation){
+  const checked=await verifyMachineFsReceiptFile({policy,verifyKeyPath,receiptId});
+  if(!checked.ok||checked.signature_valid!==true||checked.operation!==operation) throw new Error(`machine-fs receipt verification failed for ${operation}`);
+  return checked;
+}
+async function verifyObservationReceipt(policy,receiptId){
+  const checked=await verifyObservationReceiptFile({policy,verifyKeyPath,receiptId});
+  if(!checked.ok||checked.signature_valid!==true) throw new Error('observation receipt verification failed');
+  return checked;
+}
+async function waitSearch(client,searchId){
+  for(let attempt=0;attempt<200;attempt+=1){
+    const status=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_status',search_id:searchId}}),'search_status');
+    if(['completed','cancelled','failed'].includes(status.state)) return status;
+    await sleep(25);
+  }
+  throw new Error('R36 compact search timeout');
+}
+async function waitProcessOutput(client,sessionId){
+  for(let attempt=0;attempt<100;attempt+=1){
+    const page=gateway(await client.callTool({name:'process_session',arguments:{op:'read',session_id:sessionId,offset:0,max_bytes:65536}}),'process read');
+    if(Buffer.from(page.data_base64??'','base64').toString('utf8').includes('DEADBYTE_ACTION_PING')) return page;
+    await sleep(50);
+  }
+  throw new Error('R36 compact process output timeout');
+}
+
+export async function runR36CompactParity(endpointText){
+  const endpoint=new URL(endpointText);
+  if(endpoint.protocol!=='https:') throw new Error('R36 compact parity requires HTTPS');
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  const policy=await loadCodingPolicy(path.join(pointer.generation_root,'coding-policy.json'));
+  const client=new Client({name:'deadbyte-r36-compact-parity',version:'0.10.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StreamableHTTPClientTransport(endpoint);
+  const tag=randomBytes(8).toString('hex');
+  const scratchRoot='parity_scratch';
+  const target=`.deadbyte-r36-parity-${tag}.txt`;
+  let processSession=null,targetPresent=false;
+  const machineReceipts=[],observationReceipts=[];
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    if(names.length>R36_COMPACT_TOOL_LIMIT) throw new Error(`R36 compact catalog exceeds ${R36_COMPACT_TOOL_LIMIT}: ${names.length}`);
+    for(const name of R36_COMPACT_GATEWAYS) if(!names.includes(name)) throw new Error(`R36 compact gateway missing ${name}`);
+    for(const tool of listed.tools){
+      if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties) throw new Error(`tool ${tool.name} missing strict output schema`);
+    }
+    const manifest=gateway(await client.callTool({name:'capability_manifest',arguments:{}}),'capability_manifest');
+    if(manifest.schema!=='deadbyte.capability-manifest.v1'||manifest.profile!=='compact'||!Array.isArray(manifest.capabilities)||!/^[0-9a-f]{64}$/.test(String(manifest.ledger_sha256??''))) throw new Error('R36 compact capability manifest malformed');
+    const required=manifest.capabilities.filter(item=>item?.production===true&&item?.host_only!==true);
+    for(const item of required){
+      if(typeof item.compact_tool!=='string'||!names.includes(item.compact_tool)) throw new Error(`compact capability route missing: ${String(item.id)}`);
+    }
+    const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
+    const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous_session_status');
+    if(coding.armed!==true||autonomous.coding_armed!==true||autonomous.autonomous_armed!==true) throw new Error('R36 compact parity requires coding and autonomous standing grants');
+    const tree=structured(await client.callTool({name:'coding_tree',arguments:{root_id:'core',path:'workspaces/demo',max_depth:2,max_entries:128}}),'coding_tree');
+    if(tree.status!=='ok'||!Array.isArray(tree.entries)) throw new Error('coding_tree malformed');
+    const stat=gateway(await client.callTool({name:'coding_inspect',arguments:{op:'stat',root_id:'core',path:'package.json',hash:true}}),'coding stat');
+    if(stat.type!=='file'||!/^[0-9a-f]{64}$/.test(String(stat.sha256??''))||!/^[0-9a-f]{64}$/.test(String(stat.observation_sha256??''))) throw new Error('coding stat identity missing');
+    const search=gateway(await client.callTool({name:'coding_inspect',arguments:{op:'search',root_id:'core',path:'src',pattern:'R36_CAPABILITY_LEDGER',target:'content',mode:'literal',case_sensitive:true,max_results:20,max_file_bytes:262144,max_scan_bytes:4194304,page_size:20,cursor:null}}),'coding search');
+    if(!Array.isArray(search.matches)||search.matches.length<1) throw new Error('coding search returned no R36 ledger match');
+
+    const buildScript='scripts/autonomous-build.ps1';
+    const testScript='scripts/release-parity-tests.ps1';
+    const build=structured(await client.callTool({name:'coding_command_run',arguments:{root_id:'core',command_id:'powershell_script',script_path:buildScript,script_sha256:await fileSha(buildScript),args:[],cwd:'.',timeout_ms:120000}},{timeout:180000,maxTotalTimeout:180000}),'coding build');
+    if(build.status!=='passed'||build.exit_code!==0) throw new Error('R36 coding build failed');
+    const buildVerify=structured(await client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:build.receipt_id}}),'coding build receipt');
+    if(buildVerify.ok!==true||buildVerify.signature_valid!==true) throw new Error('R36 coding build receipt invalid');
+    const tests=structured(await client.callTool({name:'coding_command_run',arguments:{root_id:'core',command_id:'powershell_script',script_path:testScript,script_sha256:await fileSha(testScript),args:[],cwd:'.',timeout_ms:300000}},{timeout:360000,maxTotalTimeout:360000}),'coding tests');
+    if(tests.status!=='passed'||tests.exit_code!==0) throw new Error('R36 coding tests failed');
+    const testVerify=structured(await client.callTool({name:'coding_receipt_verify',arguments:{receipt_id:tests.receipt_id}}),'coding test receipt');
+    if(testVerify.ok!==true||testVerify.signature_valid!==true) throw new Error('R36 coding test receipt invalid');
+
+    const initial=`needle-${tag}\n`;
+    const write=gateway(await client.callTool({name:'machine_fs',arguments:{op:'write',root_id:scratchRoot,path:target,content:initial,encoding:'utf8',expected_sha256:'absent'}}),'machine_fs write');
+    targetPresent=true;machineReceipts.push(write.receipt_id);await verifyMachineReceipt(policy,write.receipt_id,'machine_fs_write');
+    const bounded=gateway(await client.callTool({name:'machine_fs',arguments:{op:'read',root_id:scratchRoot,path:target,offset:0,max_bytes:128,hash_file:true}}),'machine_fs read');
+    if(Buffer.from(bounded.data_base64,'base64').toString('utf8')!==initial||bounded.file_sha256!==write.sha256) throw new Error('R36 bounded machine read mismatch');
+    const edit=gateway(await client.callTool({name:'machine_fs',arguments:{op:'edit_exact',root_id:scratchRoot,path:target,expected_sha256:write.sha256,old_string:'needle',new_string:'beta',expected_replacements:1}}),'machine_fs edit');
+    machineReceipts.push(edit.receipt_id);await verifyMachineReceipt(policy,edit.receipt_id,'machine_fs_edit_exact');
+    const stale=await client.callTool({name:'machine_fs',arguments:{op:'edit_exact',root_id:scratchRoot,path:target,expected_sha256:write.sha256,old_string:'beta',new_string:'bad',expected_replacements:1}});
+    const staleValue=stale.structuredContent;
+    if(!staleValue||typeof staleValue!=='object') throw new Error('R36 stale machine-fs denial missing structured output');
+    if(stale.isError!==true||staleValue.status!=='denied'||!/precondition mismatch/i.test(String(staleValue.error??''))) {
+      throw new Error(`R36 stale machine-fs precondition was not denied: ${JSON.stringify(staleValue)}`);
+    }
+
+    const searchStart=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_start',root_id:scratchRoot,path:'.',pattern:tag,case_sensitive:true,max_results:20,max_files:200,max_bytes:262144,max_file_bytes:16384}}),'observe search start');
+    const searchStatus=await waitSearch(client,searchStart.search_id);
+    if(searchStatus.state!=='completed'||!searchStatus.receipt_id) throw new Error('R36 compact observation search failed');
+    observationReceipts.push(searchStatus.receipt_id);await verifyObservationReceipt(policy,searchStatus.receipt_id);
+    const page=gateway(await client.callTool({name:'machine_observe',arguments:{op:'search_page',search_id:searchStart.search_id,limit:20,cursor:null}}),'observe search page');
+    if(!page.results.some(item=>item.path===target)) throw new Error('R36 compact search did not return parity file');
+    const system=gateway(await client.callTool({name:'machine_observe',arguments:{op:'system_status'}}),'system status');
+    observationReceipts.push(system.receipt_id);await verifyObservationReceipt(policy,system.receipt_id);
+    const machineStatus=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_status'}}),'machine status');
+    if(machineStatus.release_id!==pointer.release_id||machineStatus.release_manifest_sha256!==pointer.manifest_sha256) throw new Error('R36 compact machine status release mismatch');
+
+    const started=gateway(await client.callTool({name:'process_session',arguments:{op:'start',profile_id:'ping_hold',root_id:'core',cwd:'.',args:[]}}),'process start');
+    processSession=started.session_id??started.session?.session_id;
+    if(!/^[0-9a-f]{64}$/.test(String(processSession??''))) throw new Error('R36 compact process session id missing');
+    const action=gateway(await client.callTool({name:'process_session',arguments:{op:'action',session_id:processSession,action_id:'ping'}}),'process action');
+    const processRead=await waitProcessOutput(client,processSession);
+    const terminated=gateway(await client.callTool({name:'process_session',arguments:{op:'terminate',session_id:processSession}}),'process terminate');
+    const terminalState=terminated.state??terminated.session?.state;
+    if(action.action_id!=='ping'||terminalState!=='terminated') throw new Error('R36 compact process lifecycle failed');
+
+    const fsStat=gateway(await client.callTool({name:'machine_fs',arguments:{op:'stat',root_id:scratchRoot,path:target,hash:true}}),'machine_fs stat');
+    const deleted=gateway(await client.callTool({name:'machine_fs',arguments:{op:'delete',root_id:scratchRoot,path:target,expected_source_identity:fsStat.identity_sha256}}),'machine_fs delete');
+    machineReceipts.push(deleted.receipt_id);await verifyMachineReceipt(policy,deleted.receipt_id,'machine_fs_delete');targetPresent=false;
+
+    return {status:'passed',protocol_revision:client.getNegotiatedProtocolVersion(),profile:'compact',tool_count:names.length,tools:names,
+      catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),strict_output_schemas:true,ledger_sha256:manifest.ledger_sha256,
+      capability_count:manifest.capabilities.length,production_non_host_capabilities:required.length,capability_closure:true,
+      gateway_count:R36_COMPACT_GATEWAYS.length,tree_entries:tree.entries.length,coding_stat_verified:true,coding_search_result_count:search.matches.length,
+      machine_fs_receipts_verified:machineReceipts.length,observation_receipts_verified:observationReceipts.length,
+      observation_search_result_count:page.results.length,process_session_id:processSession,process_output_bytes:processRead.stream_head,
+      process_journal_head_sha256:terminated.journal_head_sha256??terminated.session?.journal_head_sha256,
+      build_receipt_id:build.receipt_id,test_receipt_id:tests.receipt_id,coding_receipts_verified:2,
+      execution_provider:'deadbyte_mcp',rdc_operation_count:0};
+  } finally {
+    if(processSession) await client.callTool({name:'process_session',arguments:{op:'terminate',session_id:processSession}}).catch(()=>{});
+    if(targetPresent){
+      try{const fsStat=gateway(await client.callTool({name:'machine_fs',arguments:{op:'stat',root_id:scratchRoot,path:target,hash:false}}),'cleanup stat');
+        if(fsStat.identity_sha256) await client.callTool({name:'machine_fs',arguments:{op:'delete',root_id:scratchRoot,path:target,expected_source_identity:fsStat.identity_sha256}}).catch(()=>{});
+      }catch{}
+    }
+    await client.close().catch(()=>{});
+  }
+}
+
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){
+  const endpoint=process.argv[2];
+  if(!endpoint) throw new Error('usage: node src/remote-mcp-r36-parity-client.mjs https://host/mcp/path');
+  runR36CompactParity(endpoint).then(result=>console.log(JSON.stringify(result,null,2))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}