deadbyte-mcp 0.9.0 → 0.10.0

package/test/compact-catalog-r36.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const gatewayNames=['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'];
+
+test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
+  const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    assert.ok(names.length<=42,`compact tool count ${names.length} exceeds 42`);
+    for(const name of gatewayNames) assert.ok(names.includes(name),`missing ${name}`);
+    for(const legacy of ['workspace_open','file_read','proof_execute','contained_transform']) assert.equal(names.includes(legacy),false,`legacy full-only tool leaked: ${legacy}`);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    assert.equal(manifest.structuredContent.status,'ok');
+    assert.equal(manifest.structuredContent.result.profile,'compact');
+    assert.match(manifest.structuredContent.result.ledger_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(manifest.structuredContent.result.capabilities.length>40);
+  } finally {await client.close().catch(()=>{});}
+});

package/test/compact-gateway-r36.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  codingInspectInputSchema,
+  machineFsGatewayInputSchema,
+  processSessionGatewayInputSchema,
+  machineObserveInputSchema,
+  registerCompactGatewayTools
+} from '../src/compact-gateway-mcp-tools.mjs';
+
+const fakeServer=()=>{
+  const tools=new Map();
+  return {
+    tools,
+    registerTool(name,definition,handler){
+      if(tools.has(name)) throw new Error(`duplicate ${name}`);
+      tools.set(name,{definition,handler});
+    }
+  };
+};
+
+test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
+  assert.equal(codingInspectInputSchema.safeParse({op:'call',tool_name:'host_exec',args:{}}).success,false);
+  assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
+});
+
+test('R36 compact schemas preserve representative preconditions',()=>{
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:'a'.repeat(64)
+  }).success,true);
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt'
+  }).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
+});
+
+test('R36 registers exactly five compact gateway names',()=>{
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  assert.deepEqual([...server.tools.keys()].sort(),[
+    'capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'
+  ]);
+});
+
+test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',async()=>{
+  const calls=[];
+  const codingRuntime={
+    stat:async args=>{calls.push(['stat',args]);return {status:'ok',root_id:args.rootId,path:args.relativePath,type:'file'};}
+  };
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  const tool=server.tools.get('coding_inspect');
+  const result=await tool.handler({op:'stat',root_id:'core',path:'src/a.mjs',hash:false});
+  assert.deepEqual(calls,[['stat',{rootId:'core',relativePath:'src/a.mjs',hash:false}]]);
+  assert.equal(result.structuredContent.status,'ok');
+  assert.equal(result.structuredContent.op,'stat');
+  assert.equal(result.structuredContent.result.path,'src/a.mjs');
+});

package/test/contained.test.mjs

@@ -364,7 +364,7 @@ test('contained execution source has a compile-time worker registry and no user
   assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
   assert.doesNotMatch(server, /executable:\s*z\./);
   assert.doesNotMatch(executor, /--worker/);
-  assert.doesNotMatch(server, /command_run|shell_execute|powershell_run/);
+  assert.doesNotMatch(server, /registerTool\(\s*['"](?:command_run|shell_execute|powershell_run)['"]/);
 });
 
 test('contained launcher imports by stdin/profile copy and never mounts a host workspace', async () => {

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.9.0');
+  assert.equal(result.receipt.runtime.package_version, '0.10.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/deferred-slot-operation.test.mjs

@@ -12,6 +12,15 @@ test('R34 deferred slot operation preserves supervisor bootstrap across rollback
   assert.match(source,/verifySlotUpdateEnvelope/);
   assert.match(source,/runSlotUpdateCli\(args,\{stateRoot\}\)/);
   assert.match(source,/--enable-autonomous-supervisor/);
+  assert.match(source,/loadPowerShellDataFile/);
+  assert.match(source,/active-release\.json/);
+  assert.match(source,/Bridge\.WorkingDirectory/);
+  assert.match(source,/src['"],['"]bridge\.mjs/);
+  assert.match(source,/--bridge-root/);
+  assert.match(source,/--bridge-script-sha256/);
+  assert.match(source,/explicitBridgeRoot/);
+  assert.match(source,/explicitBridgeSha256/);
+  assert.match(source,/bridge override requires exact root \+ SHA pair/i);
   assert.match(source,/detached:true/);
   assert.match(source,/rdc_operation_count:0/);
   assert.doesNotMatch(source,/shell:\s*true/);

package/test/fixtures/lsp-framed-server.mjs

@@ -18,6 +18,8 @@ function respond(msg){
   if(msg.method==='textDocument/documentSymbol') { if(documentSymbolNullCount>0){documentSymbolNullCount-=1;return send({jsonrpc:'2.0',id:msg.id,result:null});} return send({jsonrpc:'2.0',id:msg.id,result:[{name:'alpha',kind:12,range:{start:{line:0,character:0},end:{line:0,character:26}},selectionRange:{start:{line:0,character:16},end:{line:0,character:21}},children:[]}]}); }
   if(msg.method==='textDocument/definition') { if(!Number.isInteger(msg.params?.position?.character)) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32602,message:'position.character required'}}); if(!ready())return send({jsonrpc:'2.0',id:msg.id,result:null}); if(requiredOpenCount>0&&openedUris.length<requiredOpenCount)return send({jsonrpc:'2.0',id:msg.id,result:null}); const targetUri=requiredOpenCount>0?(openedUris.find(uri=>uri!==msg.params.textDocument.uri)??msg.params.textDocument.uri):msg.params.textDocument.uri; return send({jsonrpc:'2.0',id:msg.id,result:{uri:targetUri,range:{start:{line:0,character:16},end:{line:0,character:21}}}}); }
   if(msg.method==='textDocument/references') { if(!Number.isInteger(msg.params?.position?.character)) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32602,message:'position.character required'}}); if(referencesEmptyCount>0){referencesEmptyCount-=1;return send({jsonrpc:'2.0',id:msg.id,result:[]});} if(requiredOpenCount>0&&openedUris.length<requiredOpenCount)return send({jsonrpc:'2.0',id:msg.id,result:[]}); const uris=requiredOpenCount>0?openedUris:[msg.params.textDocument.uri]; return send({jsonrpc:'2.0',id:msg.id,result:uris.map(uri=>({uri,range:{start:{line:0,character:16},end:{line:0,character:21}}}))}); }
+  if(msg.method==='textDocument/implementation') { if(msg.params?.position?.character===999) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32601,message:'method not found'}}); const uri=openedUris.find(x=>x!==msg.params.textDocument.uri)??msg.params.textDocument.uri; return send({jsonrpc:'2.0',id:msg.id,result:[{uri,range:{start:{line:0,character:16},end:{line:0,character:21}}}]}); }
+  if(msg.method==='textDocument/rename') { if(msg.params?.newName==='UNSUPPORTED') return send({jsonrpc:'2.0',id:msg.id,error:{code:-32601,message:'method not found'}}); const changes={}; for(const uri of (openedUris.length?openedUris:[msg.params.textDocument.uri])) changes[uri]=[{range:{start:{line:0,character:16},end:{line:0,character:21}},newText:msg.params.newName}]; return send({jsonrpc:'2.0',id:msg.id,result:{changes}}); }
   if(msg.method==='textDocument/diagnostic') return send({jsonrpc:'2.0',id:msg.id,result:{kind:'full',items:[{range:{start:{line:0,character:0},end:{line:0,character:5}},severity:1,code:'fixture',message:'fixture diagnostic'}]}});
   if(msg.method==='never') return;
   if(msg.method==='oversize') return send({jsonrpc:'2.0',id:msg.id,result:{blob:'x'.repeat(65536)}});

package/test/helpers/autonomous-r34-fixture.mjs

@@ -4,6 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { generateTrustKeypair } from '../../src/trust.mjs';
 import { createCodingRuntime, loadCodingPolicy } from '../../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../../src/machine-fs.mjs';
 import { loadAutonomousPolicy } from '../../src/autonomous-policy.mjs';
 import { createNativeDiffRuntime } from '../../src/native-diff.mjs';
 import { createAutonomousRuntime } from '../../src/autonomous-runtime.mjs';
@@ -69,12 +70,13 @@ export async function createR34Fixture({authority='armed',withFailingProfile=fal
   if(authority==='armed') await arm();
   const baseCodingRuntime = createCodingRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const codingRuntime = codingRuntimeFactory ? codingRuntimeFactory(baseCodingRuntime) : baseCodingRuntime;
-  const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const machineFsRuntime = createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const nativeDiffRuntime = nativeDiffRuntimeFactory ? nativeDiffRuntimeFactory(baseNativeDiffRuntime) : baseNativeDiffRuntime;
-  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,
+  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
     signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   return {
-    root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
+    root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,machineFsRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
     initial_sha256:sha(await readFile(target)),arm,disarm,
     cleanup:()=>rm(root,{recursive:true,force:true})
   };

package/test/multi-file-read.test.mjs

@@ -35,6 +35,9 @@ test('coding_files_read reads bounded mixed encodings in one MCP call and fails
     assert.ok((await f.client.listTools()).tools.some(t=>t.name==='coding_files_read'));
     const result=structured(await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'b.txt',encoding:'utf8'},{path:'c.bin',encoding:'base64'}],max_total_bytes:64}}));
     assert.equal(result.status,'ok'); assert.equal(result.files.length,3); assert.equal(result.total_bytes,15); assert.equal(result.files[0].content,'alpha\n'); assert.equal(result.files[2].content,Buffer.from([0,1,2,255]).toString('base64'));
+    assert.match(result.observation_sha256,/^[0-9a-f]{64}$/);
+    const repeat=structured(await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'b.txt',encoding:'utf8'},{path:'c.bin',encoding:'base64'}],max_total_bytes:64}}));
+    assert.equal(repeat.observation_sha256,result.observation_sha256);
     const denied=await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'.git/secret',encoding:'utf8'}],max_total_bytes:64}});
     assert.equal(denied.isError,true); assert.equal(denied.structuredContent.status,'failed'); assert.match(denied.structuredContent.error,/denied by policy/);
   } finally {await f.client.close().catch(()=>{}); await rm(f.root,{recursive:true,force:true}).catch(()=>{});}

package/test/native-diff-topology-r36.test.mjs

@@ -0,0 +1,105 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { access, mkdtemp, mkdir, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createCodingRuntime, loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../src/machine-fs.mjs';
+import { loadAutonomousPolicy } from '../src/autonomous-policy.mjs';
+import { createNativeDiffRuntime, NATIVE_DIFF_V2_SCHEMA } from '../src/native-diff.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const exists=file=>access(file).then(()=>true,()=>false);
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r36-topology-'));
+  const project=path.join(root,'project'); const trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  const codingPath=path.join(root,'coding-policy.json');
+  await writeFile(codingPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:path.join(root,'coding-lease.json'),evidence_dir:path.join(root,'coding-evidence'),roots:{project:{path:project,read:true,write:true,exec:false,deny_paths:[]}},commands:{},max_read_bytes:524288,max_write_bytes:2097152}));
+  const codingPolicy=await loadCodingPolicy(codingPath);
+  await writeFile(codingPolicy.lease_file,JSON.stringify({schema:'deadbyte.coding-lease.v1',policy_sha256:codingPolicy.policy_sha256,instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+3600000).toISOString()}));
+  const autoPath=path.join(root,'autonomous-policy.json');
+  await writeFile(autoPath,JSON.stringify({schema:'deadbyte.autonomous-policy.v1',enabled:true,lease_file:path.join(root,'auto-lease.json'),evidence_dir:path.join(root,'auto-evidence'),root_ids:['project'],coding_policy_sha256:codingPolicy.policy_sha256,planner:{backend:'client_sampling',max_tokens:2048},profiles:{},limits:{max_files_per_diff:12,max_diff_bytes:1048576}}));
+  const policy=await loadAutonomousPolicy(autoPath,codingPolicy);
+  await writeFile(policy.lease_file,JSON.stringify({schema:'deadbyte.autonomous-lease.v1',policy_sha256:policy.policy_sha256,instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+1800000).toISOString()}));
+  const codingRuntime=createCodingRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const machineFsRuntime=createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const nativeDiff=createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  return {root,project,keys,policy,codingRuntime,machineFsRuntime,nativeDiff};
+}
+
+test('R36 Native Diff V2 commits mkdir write move and independently verifies mixed receipts',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'seed.txt'),'seed\n');
+    const seed=await f.machineFsRuntime.stat({rootId:'project',relativePath:'seed.txt',hash:true});
+    const preview=await f.nativeDiff.preview({rootId:'project',title:'topology commit',operations:[
+      {kind:'mkdir',path:'dst'},
+      {kind:'write',path:'dst/new.txt',expected_sha256:'absent',encoding:'utf8',content:'new\n'},
+      {kind:'move',source_path:'seed.txt',destination_path:'dst/seed.txt',expected_source_identity:seed.identity_sha256}
+    ]});
+    assert.equal(preview.schema,NATIVE_DIFF_V2_SCHEMA); assert.equal(preview.operation_count,3);
+    const applied=await f.nativeDiff.apply({diffId:preview.diff_id});
+    assert.equal(applied.status,'committed');
+    assert.equal(await readFile(path.join(f.project,'dst','new.txt'),'utf8'),'new\n');
+    assert.equal(await readFile(path.join(f.project,'dst','seed.txt'),'utf8'),'seed\n');
+    assert.equal(await exists(path.join(f.project,'seed.txt')),false);
+    const verified=await f.nativeDiff.verify({diffId:preview.diff_id});
+    assert.equal(verified.ok,true); assert.equal(verified.current_state_matches,true);
+    assert.equal(verified.operation_receipts_verified,3);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rolls back mkdir/write when later topology operation fails',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'seed.txt'),'seed\n');
+    const seed=await f.machineFsRuntime.stat({rootId:'project',relativePath:'seed.txt',hash:true});
+    const preview=await f.nativeDiff.preview({rootId:'project',title:'topology rollback',operations:[
+      {kind:'mkdir',path:'dst'},
+      {kind:'write',path:'dst/temp.txt',expected_sha256:'absent',encoding:'utf8',content:'temporary\n'},
+      {kind:'move',source_path:'seed.txt',destination_path:'dst/seed.txt',expected_source_identity:seed.identity_sha256}
+    ]});
+    const sabotaged=Object.freeze({...f.machineFsRuntime,move:async()=>{throw new Error('forced topology failure');}});
+    const runtime=createNativeDiffRuntime({policy:f.policy,codingRuntime:f.codingRuntime,machineFsRuntime:sabotaged,signingKeyPath:f.keys.privateKeyPath,verifyKeyPath:f.keys.publicKeyPath});
+    await assert.rejects(runtime.apply({diffId:preview.diff_id}),/rolled back/i);
+    assert.equal(await exists(path.join(f.project,'dst')),false);
+    assert.equal(await readFile(path.join(f.project,'seed.txt'),'utf8'),'seed\n');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rejects stale move identity and destination collision before mutation',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'a.txt'),'one'); await writeFile(path.join(f.project,'b.txt'),'occupied');
+    const state=await f.machineFsRuntime.stat({rootId:'project',relativePath:'a.txt',hash:true});
+    await writeFile(path.join(f.project,'a.txt'),'two');
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'move',source_path:'a.txt',destination_path:'c.txt',expected_source_identity:state.identity_sha256}]}),/identity|precondition/i);
+    const fresh=await f.machineFsRuntime.stat({rootId:'project',relativePath:'a.txt',hash:true});
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'move',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:fresh.identity_sha256}]}),/destination.*absent|collision|precondition/i);
+    assert.equal(await readFile(path.join(f.project,'a.txt'),'utf8'),'two');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rmdir accepts only exact empty directory identity',async()=>{
+  const f=await fixture(); try{
+    await mkdir(path.join(f.project,'empty')); await mkdir(path.join(f.project,'nonempty')); await writeFile(path.join(f.project,'nonempty','x.txt'),'x');
+    const empty=await f.machineFsRuntime.stat({rootId:'project',relativePath:'empty'});
+    const nonempty=await f.machineFsRuntime.stat({rootId:'project',relativePath:'nonempty'});
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'nonempty',expected_source_identity:nonempty.identity_sha256}]}),/empty/i);
+    const preview=await f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'empty',expected_source_identity:empty.identity_sha256}]});
+    assert.equal((await f.nativeDiff.apply({diffId:preview.diff_id})).status,'committed');
+    assert.equal(await exists(path.join(f.project,'empty')),false);
+    assert.equal((await f.nativeDiff.verify({diffId:preview.diff_id})).ok,true);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 denies topology through reparse points',async t=>{
+  const f=await fixture(); try{
+    const outside=path.join(f.root,'outside'); await mkdir(outside);
+    const link=path.join(f.project,'link');
+    try { await symlink(outside,link,process.platform==='win32'?'junction':'dir'); }
+    catch(error){ if(['EPERM','EACCES','ENOSYS'].includes(error?.code)){t.skip(`symlink unavailable: ${error.code}`);return;} throw error; }
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'link',expected_source_identity:'0'.repeat(64)}]}),/reparse|symlink/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});

package/test/package-boundary.test.mjs

@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
 const root = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
@@ -22,6 +23,11 @@ function packFiles() {
   return entry.files.map(item => item.path.replaceAll('\\', '/')).sort();
 }
 
+test('R36 successor source root contains no nested npm tarball artifacts',()=>{
+  const tarballs=readdirSync(root,{withFileTypes:true}).filter(item=>item.isFile()&&item.name.endsWith('.tgz')).map(item=>item.name).sort();
+  assert.deepEqual(tarballs,[]);
+});
+
 test('R28 package boundary contains only immutable workspace seed files', () => {
   const files = packFiles();
   const workspacePayload = files.filter(rel => rel.startsWith('workspaces/'));

package/test/process-longrun-r36.test.mjs

@@ -0,0 +1,82 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PROCESS_GRANT_SCHEMA, PROCESS_POLICY_SCHEMA, loadProcessPolicy } from '../src/process-policy.mjs';
+import { createProcessRuntime } from '../src/process-runtime.mjs';
+import { generateTrustKeypair } from '../src/trust.mjs';
+
+const repo=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const host=path.join(repo,'bin','deadbyte-process-host.exe');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r36-longrun-'));
+  const project=path.join(root,'project'); const trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const script=path.join(project,'longrun.mjs');
+  await writeFile(script,`process.stdout.write('chunk-1\\n');\nsetTimeout(()=>process.stdout.write('chunk-2\\n'),180);\nsetTimeout(()=>process.stdout.write('chunk-3\\n'),360);\nsetTimeout(()=>process.exit(0),540);\n`);
+  const grantFile=path.join(root,'process-grant.json'); const stateDir=path.join(root,'state'); const policyPath=path.join(root,'process-policy.json');
+  const raw={schema:PROCESS_POLICY_SCHEMA,enabled:true,grant_file:grantFile,state_dir:stateDir,native_host:{path:host,sha256:sha(await readFile(host))},roots:{core:{path:project,deny_paths:[]}},profiles:{longrun:{executable:process.execPath,executable_sha256:sha(await readFile(process.execPath)),root_ids:['core'],transport:'pipe',prefix_args:[script],max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{}}}};
+  await writeFile(policyPath,JSON.stringify(raw));
+  const policy=await loadProcessPolicy(policyPath);
+  await writeFile(grantFile,JSON.stringify({schema:PROCESS_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:'6'.repeat(64),profile_ids:['longrun'],root_ids:['core'],granted_at_utc:new Date().toISOString()}));
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  const make=()=>createProcessRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  return {root,project,stateDir,policy,keys,make,runtime:make()};
+}
+
+async function waitState(runtime,id,state,timeout=5000){const end=Date.now()+timeout;while(Date.now()<end){const s=await runtime.status({sessionId:id});if(s.state===state)return s;await sleep(30);}throw new Error(`timeout waiting ${state}`);}
+
+test('R36 process runtime publishes terminal state only after durable terminal journal commit', async()=>{
+  const source=await readFile(path.join(repo,'src','process-runtime.mjs'),'utf8');
+  assert.match(source,/const terminalState = session\.terminate_requested \? 'terminated' : 'exited'/);
+  const commit=source.indexOf("await appendEvent(runtime, session, terminalState");
+  const publish=source.indexOf('session.state = terminalState;',commit);
+  assert.ok(commit>=0&&publish>commit,'terminal state must publish after terminal event commit');
+});
+
+test('R36 long process returns before exit and exposes monotonic cursor chunks', {skip:process.platform!=='win32'}, async()=>{
+  const f=await fixture(); try{
+    const startedAt=Date.now();
+    const started=await f.runtime.start({profileId:'longrun',rootId:'core',cwd:'.',args:[]});
+    assert.equal(started.state,'running');
+    assert.ok(Date.now()-startedAt<500,'start waited for child exit');
+    let offset=0; let text=''; let sawPartial=false;
+    const end=Date.now()+5000;
+    while(Date.now()<end){
+      const page=await f.runtime.read({sessionId:started.session_id,offset,maxBytes:8});
+      assert.ok(page.next_offset>=offset); assert.ok(page.next_offset<=page.stream_head);
+      if(page.next_offset<page.stream_head||page.state==='running') sawPartial=true;
+      text+=Buffer.from(page.data_base64,'base64').toString('utf8'); offset=page.next_offset;
+      if(page.state==='exited'&&offset===page.stream_head) break;
+      await sleep(35);
+    }
+    assert.equal(sawPartial,true); assert.match(text,/chunk-1/); assert.match(text,/chunk-2/); assert.match(text,/chunk-3/);
+    const terminal=await waitState(f.runtime,started.session_id,'exited'); assert.equal(terminal.exit_code,0);
+    await assert.rejects(()=>f.runtime.status({sessionId:'f'.repeat(64)}),/unknown process session/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 terminal process session is recovered from signed journal after wrapper restart', {skip:process.platform!=='win32'}, async()=>{
+  const f=await fixture(); try{
+    const started=await f.runtime.start({profileId:'longrun',rootId:'core',cwd:'.',args:[]});
+    await waitState(f.runtime,started.session_id,'exited');
+    const original=await f.runtime.status({sessionId:started.session_id});
+    const checked=await f.runtime.verifyEventJournal({sessionId:started.session_id}); assert.equal(checked.ok,true);
+    const restarted=f.make();
+    const recovered=await restarted.status({sessionId:started.session_id});
+    assert.equal(recovered.state,'exited'); assert.equal(recovered.exit_code,0); assert.equal(recovered.session_id,started.session_id);
+    assert.equal(recovered.journal_head_sha256,original.journal_head_sha256);
+    const listed=await restarted.list(); assert.ok(listed.sessions.some(s=>s.session_id===started.session_id));
+    const page=await restarted.read({sessionId:started.session_id,offset:0,maxBytes:65536});
+    const text=Buffer.from(page.data_base64,'base64').toString('utf8');
+    assert.match(text,/chunk-1/); assert.match(text,/chunk-3/); assert.equal(page.state,'exited');
+    const verified=await restarted.verifyEventJournal({sessionId:started.session_id}); assert.equal(verified.ok,true); assert.equal(verified.head_sha256,recovered.journal_head_sha256);
+    await assert.rejects(()=>restarted.status({sessionId:'e'.repeat(64)}),/unknown process session/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});

package/test/process-release-gate.test.mjs

@@ -5,12 +5,21 @@ import { fileURLToPath } from 'node:url';
 
 const packagePath = fileURLToPath(new URL('../package.json', import.meta.url));
 const gatePath = fileURLToPath(new URL('../scripts/gate-windows.ps1', import.meta.url));
+const processSmokePath = fileURLToPath(new URL('../src/process-smoke-client.mjs', import.meta.url));
 
 test('R31 package exposes the bounded process smoke command', async () => {
   const pkg = JSON.parse(await readFile(packagePath, 'utf8'));
   assert.equal(pkg.scripts['mcp:process:smoke'], 'node src/process-smoke-client.mjs');
 });
 
+test('R36 process smoke isolates grant and recovery state outside the release source tree', async () => {
+  const source = await readFile(processSmokePath, 'utf8');
+  assert.match(source, /smoke-policy\.json/);
+  assert.match(source, /grant_file:\s*path\.join\(smokeTrust,\s*'process-grant\.json'\)/);
+  assert.match(source, /state_dir:\s*path\.join\(smokeTrust,\s*'process-state'\)/);
+  assert.match(source, /DEADBYTE_PROCESS_POLICY:\s*smokePolicyPath/);
+});
+
 test('R31 Windows gate refreshes the native-host policy pin before manifest freeze', async () => {
   const pkg = JSON.parse(await readFile(packagePath, 'utf8'));
   const source = await readFile(gatePath, 'utf8');

package/test/production-docs.test.mjs

@@ -9,9 +9,9 @@ const readme=()=>readFile(path.join(root,'README.txt'),'utf8');
 
 test('production README documents one-command stdio configs for major MCP clients',async()=>{
   const text=await readme();
-  assert.match(text,/npx -y deadbyte-mcp@0\.9\.0 mcp/);
+  assert.match(text,/npx -y deadbyte-mcp@0\.10\.0 mcp/);
   assert.match(text,/CLAUDE DESKTOP/);
-  assert.match(text,/"mcpServers"[\s\S]*?"command"\s*:\s*"npx"[\s\S]*?"-y"[\s\S]*?"deadbyte-mcp@0\.9\.0"[\s\S]*?"mcp"/);
+  assert.match(text,/"mcpServers"[\s\S]*?"command"\s*:\s*"npx"[\s\S]*?"-y"[\s\S]*?"deadbyte-mcp@0\.10\.0"[\s\S]*?"mcp"/);
   assert.match(text,/CURSOR/);
   assert.match(text,/\.cursor\/mcp\.json/);
   assert.match(text,/VS CODE/);
@@ -20,7 +20,7 @@ test('production README documents one-command stdio configs for major MCP client
   assert.match(text,/CODEX/);
   assert.match(text,/\[mcp_servers\.deadbyte\]/);
   assert.match(text,/command\s*=\s*"npx"/);
-  assert.match(text,/args\s*=\s*\["-y",\s*"deadbyte-mcp@0\.9\.0",\s*"mcp"\]/);
+  assert.match(text,/args\s*=\s*\["-y",\s*"deadbyte-mcp@0\.10\.0",\s*"mcp"\]/);
 });
 
 test('production README records tracer bullet, semantic scope, remote UX, safety and document extension',async()=>{

package/test/prompts-resources.test.mjs

@@ -24,7 +24,13 @@ test('MCP exposes compact workflow prompts and source-of-truth context resources
 
     const resources=await client.listResources();
     const uris=resources.resources.map(r=>r.uri).sort();
-    assert.deepEqual(uris,['deadbyte://architecture','deadbyte://context']);
+    assert.deepEqual(uris,['deadbyte://architecture','deadbyte://context','deadbyte://surface-profile']);
+    const surface=await client.readResource({uri:'deadbyte://surface-profile'});
+    const surfaceText=surface.contents.map(c=>'text' in c?c.text:'').join('\n');
+    const surfaceState=JSON.parse(surfaceText);
+    assert.equal(surfaceState.schema,'deadbyte.surface-profile.v1');
+    assert.equal(surfaceState.profile,'full');
+    assert.equal(surfaceState.compact_tool_limit,42);
     const context=await client.readResource({uri:'deadbyte://context'});
     const contextText=context.contents.map(c=>'text' in c?c.text:'').join('\n');
     assert.match(contextText,/Machine truth/i); assert.match(contextText,/Authority plane/i); assert.match(contextText,/Loop Supervisor/i);

package/test/r33-closeout-regression.test.mjs

@@ -86,7 +86,7 @@ test('audit restart reconciles an orphan request with an explicit interrupted re
   }finally{await rm(stateRoot,{recursive:true,force:true});}
 });
 
-test('Windows R35 gate emits manifest-bound machine-readable evidence outside the candidate tree', async()=>{
+test('Windows R36 gate emits manifest-bound machine-readable evidence outside the candidate tree', async()=>{
   const stateRoot=await temp('deadbyte-r33-windows-evidence-');
   try{
     const gate=await readFile(path.join(root,'scripts','gate-windows.ps1'),'utf8');
@@ -99,11 +99,12 @@ test('Windows R35 gate emits manifest-bound machine-readable evidence outside th
     assert.equal(summary.status,'written');
     const evidence=JSON.parse(await readFile(summary.path,'utf8'));
     const manifestSha=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
-    assert.equal(evidence.schema,'deadbyte.r35-windows-gate.v1');
+    assert.equal(evidence.schema,'deadbyte.r36-windows-gate.v1');
     assert.equal(evidence.status,'passed');
     assert.equal(evidence.exit_code,0);
+    assert.equal(evidence.version,'0.10.0');
     assert.equal(evidence.manifest_sha256,manifestSha);
-    assert.equal(evidence.marker,'DEADBYTE V0.9.0 / R35 WINDOWS BATCH GATE: PASS');
+    assert.equal(evidence.marker,'DEADBYTE V0.10.0 / R36 WINDOWS BATCH GATE: PASS');
     assert.ok(summary.path.startsWith(path.join(stateRoot,'evidence','release')));
   }finally{await rm(stateRoot,{recursive:true,force:true});}
 });

package/test/r33-finalization.test.mjs

@@ -26,16 +26,17 @@ test('release parity and final verifier are package entry points', async () => {
   assert.equal(typeof verifyFinalClosureObject, 'function');
 });
 
-test('final closure verifier is implementation-independent from production helpers', async () => {
+test('R36 final closure verifier is implementation-independent from production helpers', async () => {
   const verifier = await text('scripts/final-closure-verify.mjs');
   const writer = await text('scripts/final-closure.mjs');
   assert.doesNotMatch(verifier, /from ['"]\.\.\/src\//);
   assert.match(verifier, /DEADBYTE-R27-SLOT-UPDATE-V1/);
   assert.match(verifier, /DEADBYTE-MACHINE-PING-V1/);
-  assert.match(verifier, /DEADBYTE-R35-FINAL-CLOSURE-V1/);
-  assert.match(writer, /pointer\.version==='0\.9\.0'/);
-  assert.match(verifier, /envelope\.body\.version==='0\.9\.0'/);
-  assert.match(verifier, /release_label==='R35 FINAL MACHINE BASELINE'/);
+  assert.match(verifier, /DEADBYTE-R36-FINAL-CLOSURE-V1/);
+  assert.match(writer, /pointer\.version==='0\.10\.0'/);
+  assert.match(verifier, /envelope\.body\.version==='0\.10\.0'/);
+  assert.match(verifier, /release_label==='R36 FINAL MACHINE BASELINE'/);
+  assert.match(verifier, /b95e1ec1d9a7e26a96ef492306c1be4df18c883ff03ab3b6015f677d7429ec8d/);
 });
 
 test('final closure verifier canonicalizes traversal order before exact-tree comparison', async () => {
@@ -44,11 +45,15 @@ test('final closure verifier canonicalizes traversal order before exact-tree com
   assert.match(verifier, /const expected=\[\.\.\.entries\.keys\(\)\]\.sort\(\(a,b\)=>a\.localeCompare\(b,'en'\)\);/);
 });
 
-test('autonomous live gate reuses the canonical R34 73-tool catalog', async () => {
+test('R36 autonomous live gate binds the compact gateway contract instead of the historical 73-tool public catalog', async () => {
   const autonomous = await text('src/remote-mcp-autonomous-smoke-client.mjs');
-  assert.match(autonomous, /import \{ R34_EXPECTED_TOOLS \} from '\.\/remote-mcp-r34-parity-client\.mjs';/);
-  assert.doesNotMatch(autonomous, /const expectedTools\s*=\s*\[/);
-  assert.match(autonomous, /JSON\.stringify\(names\) !== JSON\.stringify\(R34_EXPECTED_TOOLS\)/);
+  assert.match(autonomous, /R36_COMPACT_GATEWAYS/);
+  assert.match(autonomous, /R36_COMPACT_TOOL_LIMIT/);
+  assert.match(autonomous, /names\.length > R36_COMPACT_TOOL_LIMIT/);
+  for (const name of ['autonomous_goal_submit','autonomous_goal_run','autonomous_goal_verify','autonomous_release_gate','native_diff_apply','native_diff_verify']) {
+    assert.match(autonomous,new RegExp(name));
+  }
+  assert.doesNotMatch(autonomous, /R34_EXPECTED_TOOLS/);
 });
 
 test('R34 parity proves coding package tests before package-visible scratch mutation', async () => {