deadbyte-mcp 0.9.0 → 0.10.0

package/docs/superpowers/specs/2026-09-18-r36-zero-loss-autonomy-design.md

@@ -0,0 +1,640 @@
+# DEADBYTE MCP R36 Zero-Loss Autonomy Design
+
+## Identity and parent authority
+
+R36 is `V0.10.0 / R36`. Its immutable parent is the sealed and publicly published R35 Final Baseline:
+
+- release version: `0.9.0`
+- frozen source root: `D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2`
+- frozen manifest SHA-256: `b95e1ec1d9a7e26a96ef492306c1be4df18c883ff03ab3b6015f677d7429ec8d`
+- npm package: `deadbyte-mcp@0.9.0`
+- npm tarball SHA-256: `b9f1b6652f4c70ab9ab515908355a00fa1a84d1f4cb9fc8d4055de41a4f1e805`
+- full live MCP surface: `73` tools
+- observed ChatGPT connector surface: `42` tools
+- R35 final authority state: process/coding/autonomous/host DISARMED
+
+R35 bytes are immutable release authority. R36 development occurs only in a successor workspace. No R36 fix may patch the R35 release tree or republish `0.9.0`.
+
+The current R36 development root is:
+
+`D:\Projects\deadbyte-mcp-r36-dev`
+
+The live-log precursor already implemented in this successor root is part of R36 and must satisfy the full R36 gates below before release.
+
+## Mission
+
+R36 makes DEADBYTE MCP materially more autonomous for software-engineering work without replacing its evidence-first security model with unrestricted shell/filesystem authority.
+
+The primary product requirement is:
+
+> Every operator-authorized non-host capability required for a production coding workflow must be reachable by the agent through the actual remote connector, not merely registered in server source.
+
+The secondary requirement is operator observability:
+
+> A foreground `npx deadbyte-mcp@latest remote` session must show startup, connection, authority, tool-start, tool-completion, failure, recovery, and release activity as it occurs, with compact human-readable live logs by default and forensic detail under `--verbose`.
+
+R36 is not a Desktop Commander clone and is not a Serena clone. It takes workflow-relevant breadth from those systems while preserving DEADBYTE invariants: typed intent, local authority, exact preconditions, bounded execution, authenticated journals, signed receipts, independent verification, and an objective release gate.
+
+The engineering loop remains:
+
+`PLAN -> INSPECT -> ACT -> VERIFY -> CRITIC -> REPAIR -> RELEASE`
+
+Planner prose is never release evidence.
+
+## External reference baseline
+
+R36 behavior is benchmarked against current public capability descriptions and reproducible behavior of these projects as of 2026-09-18:
+
+- Desktop Commander local MCP: `https://github.com/wonderwhy-er/DesktopCommanderMCP`
+- Remote Desktop Commander: `https://github.com/desktop-commander/remote-desktop-commander`
+- Serena: `https://github.com/oraios/serena`
+
+Reference capabilities that matter to R36:
+
+- Desktop Commander / Remote Desktop Commander: file metadata, directory operations, progressive search, long-running processes, process output, interactive sessions, remote device activity, and visible remote-session lifecycle.
+- Serena: semantic symbol retrieval, definitions, references, code editing/refactoring, rename, diagnostics, and language-server-backed repository understanding.
+
+External implementations are behavioral references only. No implementation code is copied or vendored solely to reproduce competitor behavior. Claims in public documentation must cite either our reproducible benchmark evidence or the upstream project's public documentation/source.
+
+R36 does not claim to dominate unrelated document-editing breadth such as PDF/DOCX/XLSX or arbitrary desktop administration. The comparison target is production software-engineering autonomy.
+
+## Global invariants
+
+1. R35 `0.9.0` remains immutable and rollback-able.
+2. Process, coding, autonomous, and host authority remain independently revocable.
+3. `remote` may arm process/coding/autonomous according to local standing-grant policy but MUST NOT auto-arm host authority.
+4. Host authority remains an explicit local operator action.
+5. No gateway accepts a raw tool name plus arbitrary JSON as a generic dispatch escape hatch.
+6. Raw shell strings remain forbidden at privileged execution boundaries.
+7. Raw arbitrary stdin to processes is not introduced in R36. Process interaction remains policy-defined and typed.
+8. Filesystem mutations retain root policy and stale-state protection.
+9. Mutation and command claims require signed/authenticated evidence where the underlying R35 primitive already requires it.
+10. Public remote compactness must never silently remove semantic capability. If a full capability is intentionally omitted from compact mode, the release gate must name it and fail unless the omission is explicitly classified as host-only or non-production.
+11. Audit/live logs must redact secrets and large payload bodies before terminal presentation.
+12. A successful planner `finish` is never sufficient for release completion.
+13. R36 Final requires exact rollback to R35 and exact restore to R36.
+14. The exact npm tarball published as `latest` must be the tarball independently verified before publication.
+
+## R36-A: Dual Surface and Zero-Loss Capability Gateway
+
+### Problem
+
+R35 proves a full live MCP catalog of 73 tools, but the actual ChatGPT connector used for production work exposes only 42 tools. The missing set includes high-value coding primitives such as search/stat/multi-read/symbol tools, machine filesystem operations, process sessions, and observation tools.
+
+A source-level `registerTool()` therefore does not prove agent reachability.
+
+### Surface profiles
+
+R36 defines two explicit public surface profiles:
+
+- `full`: the complete typed MCP catalog for clients that can accept it.
+- `compact`: a remote-agent catalog bounded to 42 tools or fewer.
+
+The active profile is explicit and auditable. Local stdio defaults to `full`. The remote Bridge profile defaults to `compact` unless the connected client proves support for the full surface.
+
+### Capability identity
+
+Every production capability has a stable capability id independent of its presentation as a direct tool or gateway operation. Examples:
+
+- `coding.search`
+- `coding.stat`
+- `coding.files_read`
+- `semantic.outline`
+- `semantic.definition`
+- `semantic.references`
+- `semantic.diagnostics`
+- `semantic.implementations`
+- `semantic.rename_preview`
+- `machine_fs.stat`
+- `machine_fs.list`
+- `machine_fs.read`
+- `machine_fs.write`
+- `machine_fs.edit_exact`
+- `machine_fs.mkdir`
+- `machine_fs.move`
+- `machine_fs.delete`
+- `process.start`
+- `process.read`
+- `process.status`
+- `process.list`
+- `process.action`
+- `process.terminate`
+- `observation.search_start`
+- `observation.search_page`
+- `observation.search_status`
+- `observation.search_cancel`
+- `observation.process_list`
+- `observation.system_status`
+
+The canonical capability ledger maps each capability id to:
+
+- full-surface tool/schema identity;
+- compact-surface route/schema identity;
+- required runtime flag;
+- required authority plane;
+- mutating/read-only classification;
+- receipt/evidence class;
+- host-only flag.
+
+### Compact gateways
+
+Compact mode uses a small number of typed grouped tools. Each gateway uses a discriminated union of known operations; it is not a generic arbitrary dispatcher.
+
+Required gateways:
+
+1. `coding_inspect`
+   - `stat`
+   - `search`
+   - `files_read`
+   - `symbol_outline`
+   - `symbol_definition`
+   - `symbol_references`
+   - `symbol_diagnostics`
+   - `symbol_implementations`
+   - `symbol_rename_preview`
+
+2. `machine_fs`
+   - `stat`
+   - `list`
+   - `read`
+   - `write`
+   - `edit_exact`
+   - `mkdir`
+   - `move`
+   - `delete`
+
+3. `process_session`
+   - `start`
+   - `read`
+   - `status`
+   - `list`
+   - `action`
+   - `terminate`
+
+4. `machine_observe`
+   - machine identity/status operations that do not require privileged revoke authority;
+   - durable search start/page/status/cancel;
+   - process observation;
+   - system observation.
+
+5. `capability_manifest`
+   - returns the active profile, canonical capability ids, reachability state, required authority, schema identity, and full/compact mapping.
+
+Gateway handlers call the same runtime functions as the corresponding full tools. They do not invoke one MCP tool from another MCP tool and do not bypass the existing policy/receipt layer.
+
+### Zero-loss acceptance
+
+For the production coding capability set:
+
+`full capabilities - host-only capabilities = compact reachable capabilities`
+
+This is compared by capability id, not by tool count.
+
+Release fails if:
+
+- a full production capability has no compact route;
+- compact claims a capability whose runtime handler is unavailable;
+- the compact route changes authority requirements relative to the full route;
+- the compact route drops stale-state or receipt requirements;
+- duplicate capability ids exist;
+- connector-visible schema differs from the canonical compact ledger.
+
+The final gate must inspect the actual connected ChatGPT/agent catalog in addition to server-side `tools/list` evidence whenever that integration is available.
+
+## R36-B: Coding inspection breadth
+
+### Search
+
+The R35 `coding_search` literal-only implementation is upgraded rather than replaced by a raw host search.
+
+Required query dimensions:
+
+- target: `content | path`
+- mode: `literal | regex`
+- case sensitivity
+- root-relative starting path
+- bounded maximum file bytes
+- bounded maximum total scanned bytes
+- bounded page size
+- optional continuation cursor
+
+Search behavior:
+
+- deterministic path ordering;
+- multiple matches per file;
+- line/column for content matches;
+- bounded surrounding preview;
+- binary/non-UTF8 classification without accidental text decoding;
+- deny-path enforcement before file access;
+- explicit truncation reason;
+- query identity SHA-256;
+- result/page identity SHA-256;
+- each content match includes the observed file SHA-256;
+- continuation cursor binds the normalized query and retained search snapshot/session identity;
+- stale/foreign cursor fails closed.
+
+For wide or long-running searches, the durable observation search runtime may be reused under the same compact gateway so the agent can page/cancel without blocking the remote proxy.
+
+### Stat
+
+`coding_stat` must expose enough identity for a later mutation decision:
+
+- normalized relative path;
+- object type;
+- byte count where applicable;
+- mtime in UTC;
+- SHA-256 when requested and valid for the object type;
+- reparse/symlink/junction classification;
+- stable object/file identity when the platform can supply it without widening authority;
+- policy root id;
+- observation identity SHA-256.
+
+Reparse points are never followed silently across the allowed root.
+
+### Multi-read
+
+`coding_files_read` remains bounded and gains an aggregate observation digest over ordered `(path, sha256, bytes, encoding)` entries. This digest can be carried into planner context and evidence records.
+
+## R36-C: Semantic coding parity and stronger mutation integrity
+
+R36 keeps existing language routing and required tracer languages from R35: TypeScript/JavaScript, Python, Rust, and C/C++.
+
+Existing semantic capabilities remain:
+
+- outline;
+- definition;
+- references;
+- receipt-backed symbol replacement.
+
+R36 adds public/internal capability ids for:
+
+- diagnostics;
+- implementations;
+- transactional rename preview.
+
+### Diagnostics
+
+Diagnostics return normalized severity, code, bounded message, location, backend identity, target file SHA-256, and result identity.
+
+### Implementations
+
+Where the backend supports implementation lookup, results normalize to the same location structure used by definitions/references. Unsupported backend operations return an explicit typed unsupported-capability result; they do not fall back to grep while pretending to be semantic.
+
+### Rename preview
+
+Cross-file rename is a two-stage evidence path:
+
+1. semantic backend computes the exact affected edits against observed file identities;
+2. DEADBYTE converts those edits into a content-addressed Native Diff transaction.
+
+The semantic operation returns a `diff_id`, affected file count, edit count, backend identity, and observed preimage identities. Commit remains `native_diff_apply(diff_id)` and independent verification remains `native_diff_verify(diff_id)`.
+
+No semantic rename may directly mutate files before a Native Diff exists.
+
+This gives symbol rename Serena-like workflow breadth while preserving DEADBYTE stale-state rejection and transactional proof.
+
+## R36-D: Transactional filesystem topology
+
+R35 machine filesystem already provides `mkdir`, `move`, and `delete`; R36 makes topology mutation a transaction-class capability rather than a set of unrelated convenience calls.
+
+Native Diff evolves to a versioned transaction format that can represent:
+
+- file write;
+- exact replace;
+- file delete;
+- directory create;
+- move/rename;
+- empty-directory delete where explicitly requested.
+
+Topology preconditions include, as applicable:
+
+- source object identity;
+- source type;
+- source SHA-256 for regular files;
+- destination absence or exact destination identity;
+- parent directory identity;
+- reparse classification.
+
+A topology transaction records signed preimage state before the first mutation. If a later operation fails, rollback restores the prior topology where rollback is safe and objectively verifiable. If rollback cannot be proven, the transaction terminates `conflicted`/`ambiguous`; it must not report success.
+
+Recursive destructive delete is not introduced as a generic primitive in R36.
+
+## R36-E: Process autonomy without raw shell expansion
+
+The existing `process_session_*` runtime is the R36 process authority. R36 does not create a second competing process model.
+
+Required compact reachability:
+
+- start approved profile;
+- read ordered output with byte cursor;
+- status;
+- list owned sessions;
+- execute policy-defined named action;
+- terminate owned session.
+
+Process identity remains a DEADBYTE logical session id. The agent does not gain authority merely from knowing an OS PID.
+
+Long build/test/server workflows must support:
+
+- start returning before process completion;
+- bounded incremental output reads;
+- monotonic output cursor;
+- output truncation state;
+- observed exit state;
+- owned-session crash/restart reconciliation;
+- bounded cancellation/termination;
+- signed process journal evidence.
+
+R36 does not add generic arbitrary stdin or arbitrary process attach. Debugger/REPL interaction is only available through explicit policy-defined actions. A future version may add a separately designed typed interactive lease if benchmark evidence proves named actions insufficient.
+
+## R36-F: Autonomous planner capability parity
+
+The autonomous planner must stop reasoning as if only tree/read/write/replace/command/benchmark exist.
+
+The R36 planner receives a compact capability manifest derived from the same canonical ledger used by the MCP surface. It contains only currently configured runtime capabilities and their authority/read-only/mutation classes.
+
+The R36 typed planner action model includes first-class actions for:
+
+- tree inspection;
+- search;
+- stat;
+- multi-file read;
+- semantic outline/definition/references/diagnostics/implementations;
+- semantic rename preview;
+- Native Diff preview/apply/verify;
+- machine filesystem stat/list/read and transactional topology requests;
+- process start/read/status/list/action/terminate;
+- observation search/process/system operations;
+- release profiles;
+- checkpoint/pause/finish.
+
+The old generic `delegate: record<string,json>` path is removed from production planning or restricted to a compatibility adapter that validates into one of the typed R36 capability schemas before execution. Arbitrary operation records are not an authority surface.
+
+Planner context records capability id, observation identity, mutation epoch, and evidence identity. Progress fingerprints ignore rationale prose.
+
+The autonomous loop may proceed without repeated operator transport work as long as required process/coding/autonomous standing grants remain valid. Missing authority transitions the goal to a durable waiting state; it never self-arms.
+
+## R36-G: RDC-style live activity logs
+
+The foreground remote UX must provide continuous operator visibility.
+
+### Compact default
+
+`npx deadbyte-mcp@latest remote` prints concise lifecycle and activity lines. Emoji are semantic markers, not decoration.
+
+Required marker vocabulary:
+
+- `🚀` device/runtime startup;
+- `🔌` transport/Bridge/Cloud connection;
+- `✅` successful readiness/tool completion;
+- `❌` tool/runtime failure;
+- `🔐` authority state;
+- `▶` tool/action start;
+- `♻️` recovery/resume;
+- `⚠️` bounded warning.
+
+Do not add an emoji to every informational line.
+
+Required lifecycle visibility:
+
+- runtime start;
+- Bridge connect/readiness;
+- Cloud/tunnel connect/readiness;
+- remote session claim/resume;
+- device ONLINE readiness;
+- process/coding/autonomous authority state;
+- explicit Host DISARMED state;
+- live tool request start;
+- correlated result completion;
+- duration;
+- bounded result summary;
+- recovery/reconnect;
+- disconnect and authority cleanup.
+
+Example compact activity:
+
+```text
+DEADBYTE MCP
+
+🚀 Starting device runtime...
+   Bridge   connecting...
+🔌 Bridge connected pid=5132
+🔌 Remote tunnel connected
+✅ Device ONLINE
+
+🔐 Process     ARMED
+🔐 Coding      ARMED
+🔐 Autonomous  ARMED
+   Host        DISARMED
+
+▶ coding.search req=8e21... root=projects pattern="releaseGate"
+✅ coding.search req=8e21... 37ms results=12
+
+▶ native_diff.apply req=0f12... diff=62da...
+✅ native_diff.apply req=0f12... 121ms receipt=9c37...
+
+▶ process.read req=79d2... session=218a...
+❌ process.read req=79d2... 1.31s status=failed
+```
+
+### Verbose mode
+
+`remote --verbose` additionally exposes bounded forensic metadata:
+
+- full audit sequence number;
+- request id;
+- tool and capability id;
+- runtime/profile ids;
+- receipt ids/hashes where safe;
+- cursor identity;
+- Bridge stdout/stderr diagnostic lines;
+- sanitized policy/profile metadata.
+
+Verbose mode still does not dump secrets, raw large content bodies, replacement bodies, auth tokens, tunnel tokens, private keys, or raw credential material.
+
+### Ordering and correlation
+
+The log watcher establishes its baseline before startup actions begin so newly created log files are read from byte zero and existing log files are tailed from their prior end.
+
+A request start must become visible before its terminal result. Result duration is computed from correlated request/result timestamps by request id. Orphaned requests after crash/restart are displayed as interrupted/reconciled states rather than silently disappearing.
+
+## R36-H: Capability benchmark and competitor evidence
+
+The R35 offline corpus is extended into an R36 production coding corpus. Required cases:
+
+1. repository tree exploration;
+2. literal content search;
+3. regex content search;
+4. filename/path search;
+5. deterministic search paging and cancel;
+6. bounded multi-file read;
+7. rich stat/reparse handling;
+8. stale-edit race rejection;
+9. transactional multi-file Native Diff;
+10. topology mkdir/move/delete rollback;
+11. TypeScript symbol navigation;
+12. Python symbol navigation;
+13. Rust symbol navigation;
+14. C/C++ symbol navigation;
+15. diagnostics normalization;
+16. implementation lookup where supported;
+17. cross-file rename preview -> Native Diff -> apply -> verify;
+18. long process start/output/status/terminate;
+19. policy-defined process action;
+20. process crash/reconciliation;
+21. autonomous failing-test diagnosis and repair;
+22. autonomous search + semantic inspection + patch + test loop;
+23. release-gate refusal when planner claims finish without evidence;
+24. provider/Bridge interruption recovery;
+25. remote result replay/deduplication;
+26. compact connector capability closure;
+27. live-log request-before-result ordering;
+28. live-log redaction;
+29. forged/stale receipt rejection;
+30. rollback to R35 and exact R36 restore.
+
+Metrics include:
+
+- correctness/pass;
+- agent round trips;
+- elapsed time;
+- bytes returned;
+- stale-state rejection;
+- duplicate side effects;
+- recovery success;
+- capability reachability;
+- evidence verification result;
+- release-gate result.
+
+Competitor evidence matrix uses current upstream documented/public capabilities and, when locally runnable without paid quota or unavailable service state, direct observed runs. Public DEADBYTE claims must distinguish documented competitor capability from directly observed competitor behavior.
+
+R36 does not publish a blanket claim of superiority from tool count. The release may claim that DEADBYTE has stronger evidence/state-integrity semantics or better measured coding-task completion only when the corresponding reproducible case supports the statement.
+
+## R36-I: Public surface, protocol, and compatibility
+
+R36 version is `0.10.0`.
+
+The full surface may grow beyond R35's 73 tools for diagnostics/implementations/semantic rename preview/capability metadata. Intentional additions are recorded in the canonical surface ledger.
+
+Compact remote surface is bounded to 42 tools or fewer and must include the capability gateways needed for zero-loss production coding reachability.
+
+R35 direct tool names remain available in `full` profile unless a versioned compatibility test explicitly allows replacement. Existing clients using `coding_tree`, `coding_file_read`, Native Diff, autonomous goal tools, and host tools remain valid.
+
+MCP protocol identity remains explicit. R36 must run the project's compatibility/conformance probes against its declared protocol revision and preserve the existing legacy probe adapter rules where still required.
+
+## R36-J: Release, activation, rollback, and npm publication
+
+R36 release closure is sequential. No later stage can excuse an earlier failure.
+
+Required gates:
+
+1. focused RED -> GREEN unit/integration tests for every R36 subsystem;
+2. full source regression with zero failures;
+3. canonical full-surface ledger generation and verification;
+4. canonical compact-surface ledger generation and verification;
+5. capability-closure proof: every production non-host capability reachable in compact mode;
+6. actual remote connector catalog check when connector integration is available;
+7. semantic tracer gates for TypeScript/JavaScript, Python, Rust, and C/C++;
+8. R36 capability benchmark corpus PASS;
+9. live-log startup/request/result/redaction/recovery tests PASS;
+10. process long-running output/reconciliation tests PASS;
+11. transactional topology/rollback adversarial tests PASS;
+12. public remote smoke against the exact candidate;
+13. Windows gate PASS on one exact frozen candidate manifest;
+14. deterministic package emission and package-boundary scan;
+15. immutable R36 slot activation;
+16. public full/compact parity against the active R36 slot;
+17. loop supervisor `RUNNING [verified]`;
+18. signed rollback to exact sealed R35 `0.9.0` identity;
+19. R35 public verification after rollback;
+20. exact R36 restore;
+21. R36 public verification after restore;
+22. process/coding/autonomous/host all DISARMED;
+23. signed R36 final closure;
+24. implementation-independent final verifier PASS;
+25. create exact npm tarball outside the frozen candidate;
+26. inspect tarball identity/boundary and run local tarball `npx` smoke;
+27. publish that exact tarball as `deadbyte-mcp@0.10.0` with dist-tag `latest`;
+28. verify npm registry `latest == 0.10.0`;
+29. download the registry tarball and prove byte-for-byte SHA-256 equality with the pre-publish tarball;
+30. run registry-backed `npx deadbyte-mcp@latest --help`, `remote status`, and `supervisor status`;
+31. run a real foreground `npx deadbyte-mcp@latest remote` smoke showing the R36 live-log startup path;
+32. finish with process/coding/autonomous/host DISARMED.
+
+If npm requires browser/2FA confirmation, the operator completes only that npm-owned confirmation locally. Passwords, tokens, and OTP values are never transmitted through the agent chat.
+
+`0.9.0` remains available and immutable after `latest` advances.
+
+## Error handling and fail-closed behavior
+
+- unknown compact gateway operation -> schema rejection before handler execution;
+- unavailable runtime capability -> typed unavailable result; no silent fallback to host authority;
+- missing coding/process/autonomous grant -> durable waiting/denied state; no self-arm;
+- host disarmed -> host capability denied even if compact/full surface advertises the tool;
+- stale search cursor -> explicit stale/foreign cursor error;
+- regex exceeding bounds or invalid syntax -> typed search error before repository scan;
+- binary file in text search -> classify/skip according to query policy, never lossy decode silently;
+- semantic backend unsupported operation -> explicit unsupported capability;
+- stale semantic rename preimage -> Native Diff refuses apply;
+- filesystem topology conflict -> rollback or terminal ambiguous/conflicted state with evidence;
+- process output cursor outside retained range -> explicit retained-window error;
+- process session ownership mismatch -> deny;
+- live-log parse error -> preserve runtime operation, emit bounded warning, retain raw audit on disk;
+- audit/receipt verification failure -> release gate failure;
+- connector capability loss -> release gate failure;
+- benchmark failure/flakiness -> preserve raw evidence and stop release; no waiver from planner prose;
+- npm registry artifact mismatch -> stop and do not move/retain `latest` as successful R36 closure.
+
+## Testing strategy
+
+All R36 behavior changes use RED -> GREEN TDD.
+
+Test layers:
+
+- pure unit tests for capability ledger/mapping, gateway schema discrimination, search cursor identity, result digests, live-log formatting, and planner action parsing;
+- tool integration tests proving gateway and full tool paths produce equivalent authority/evidence semantics;
+- remote connector catalog tests proving compact profile size and capability closure;
+- filesystem adversarial tests for traversal, symlink/reparse, stale identity, rollback, and conflicts;
+- process integration tests for long-running output, cursoring, termination, crash reconciliation, and action allowlists;
+- semantic tracer tests for the four required languages plus diagnostics/implementations/rename where supported;
+- autonomous loop tests proving planner use of search/stat/semantic/process/filesystem capabilities;
+- live-log lifecycle tests including request-before-result and crash reconciliation;
+- full source regression;
+- Windows native/containment gate;
+- public HTTPS/remote parity;
+- release rollback/restore/final closure;
+- npm registry byte-identity and `npx` smoke.
+
+Timing tests wait for the exact condition they assert. An earlier proxy event must not be used to declare later output present.
+
+## Versioning and frozen-artifact policy
+
+- R36 public version: `0.10.0`.
+- R35 `0.9.0` is never patched or republished.
+- Development mutations occur only in R36 successor roots.
+- A candidate becomes immutable before canonical Windows/release parity gates.
+- A genuine defect discovered after freeze creates a successor candidate (`r1`, `r2`, etc.); the frozen candidate is not silently edited.
+- npm publication always uses the exact already-verified tarball, never an unverified rebuild after authentication.
+
+## Definition of Done
+
+R36 is Final only when all of the following are objectively true at the same time:
+
+- the actual agent-facing compact connector reaches 100% of the declared production non-host capability ledger;
+- full typed clients retain the complete typed surface;
+- search/stat/multi-read semantics are sufficient for large-repository inspection with deterministic bounded behavior;
+- semantic diagnostics/implementations and transactional cross-file rename are evidence-backed;
+- machine filesystem topology mutations are preconditioned and transactionally verifiable;
+- long-running process workflows are observable and controllable without arbitrary raw shell/stdin expansion;
+- the autonomous planner can select and execute the new capabilities as first-class typed actions;
+- foreground remote Live Logs continuously expose startup, connection, authority, tool start/result, recovery, and cleanup without leaking secrets;
+- the R36 benchmark corpus passes and comparison claims are traceable to evidence;
+- full regression and Windows gates pass on one exact candidate;
+- exact R35 rollback and exact R36 restore pass;
+- final closure and independent verifier pass;
+- all privileged planes are DISARMED at closure;
+- the exact verified npm tarball is published as `deadbyte-mcp@0.10.0` and registry `latest` resolves to it;
+- the registry-downloaded tarball matches the pre-publish SHA-256 byte-for-byte;
+- `npx deadbyte-mcp@latest remote` executes the public R36 build and displays the new live activity UX.
+
+Only after these conditions pass may R36 be described as the production successor to R35 and publicly released as the current DEADBYTE MCP baseline.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP machine-truth runtime with signed audit chain, immutable release slots, contained execution, coding/autonomous production authority, and npx-first remote control.",