deadbyte-mcp 0.9.0 → 0.10.0

package/proof/CONTAINMENT-BUILD.txt

@@ -39,7 +39,7 @@ deadbyte-process-host.cpp
 exit_code=0
 ==== probe-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\containment-probe.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\containment-probe.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -59,7 +59,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-launcher-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-exec.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\deadbyte-exec.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -83,7 +83,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\contained-transform-worker.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\contained-transform-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -104,7 +104,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-reverse-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\contained-reverse-worker.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\contained-reverse-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -125,7 +125,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== named-tunnel-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-tunnel-host.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\deadbyte-tunnel-host.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -144,7 +144,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== process-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2\bin\deadbyte-process-host.exe
+Dump of file D:\Projects\deadbyte-mcp-r36-dev\bin\deadbyte-process-host.exe
 
 File Type: EXECUTABLE IMAGE
 

package/scripts/deferred-slot-operation.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseActivePointer } from '../src/release-slot.mjs';
-import { runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
+import { loadPowerShellDataFile, runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
 
 const HEX64=/^[0-9a-f]{64}$/;
 const RECEIPT_ID=/^r27-[A-Za-z0-9-]+$/;
@@ -22,11 +22,34 @@ const atomicJson=async(file,value)=>{
 };
 function activationArgs(manifestSha){
   if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
-  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.9.0',
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.10.0',
     '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
     '--process-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
     '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-autonomous-supervisor'];
 }
+async function bridgeBootstrapArgs(explicitBridgeRoot=null,explicitBridgeSha256=null){
+  const hasRoot=typeof explicitBridgeRoot==='string'&&explicitBridgeRoot.length>0;
+  const hasSha=typeof explicitBridgeSha256==='string'&&explicitBridgeSha256.length>0;
+  if(hasRoot!==hasSha) throw new Error('bridge override requires exact root + SHA pair');
+  let bridgeRootRaw,expectedSha256=null;
+  if(hasRoot){
+    if(!path.isAbsolute(explicitBridgeRoot)||!HEX64.test(explicitBridgeSha256)) throw new Error('bridge override requires exact root + SHA pair');
+    bridgeRootRaw=explicitBridgeRoot;expectedSha256=explicitBridgeSha256;
+  }else{
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    const config=await loadPowerShellDataFile(pointer.config_path);
+    bridgeRootRaw=config?.Bridge?.WorkingDirectory;
+    if(typeof bridgeRootRaw!=='string'||!path.isAbsolute(bridgeRootRaw)) throw new Error('active controller Bridge.WorkingDirectory must be absolute');
+  }
+  const bridgeRoot=await realpath(path.resolve(bridgeRootRaw));
+  const packageFile=path.join(bridgeRoot,'package.json');
+  const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
+  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
+  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('active Bridge package identity mismatch');
+  const scriptSha256=sha256(await readFile(bridgeScript));
+  if(expectedSha256&&scriptSha256!==expectedSha256) throw new Error('bridge override SHA-256 mismatch');
+  return ['--bridge-root',bridgeRoot,'--bridge-script-sha256',scriptSha256];
+}
 async function rollbackArgs(receiptPath){
   const resolved=await realpath(path.resolve(receiptPath));
   const allowed=path.join(stateRoot,'evidence','updates')+path.sep;
@@ -42,45 +65,60 @@ async function rollbackArgs(receiptPath){
   }
   return ['--rollback-receipt',resolved];
 }
-async function normalizedArgs(mode,value){
+async function normalizedArgs(mode,value,{explicitBridgeRoot=null,explicitBridgeSha256=null}={}){
   if(mode==='activate'){
     const args=activationArgs(value);
     args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
     args[args.indexOf('--semantic-lsp-config-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json')));
+    args.push(...await bridgeBootstrapArgs(explicitBridgeRoot,explicitBridgeSha256));
     return args;
   }
-  if(mode==='rollback') return rollbackArgs(value);
+  if(mode==='rollback'){
+    if(explicitBridgeRoot||explicitBridgeSha256) throw new Error('rollback does not accept bridge override');
+    return rollbackArgs(value);
+  }
   throw new Error("operation must be exactly 'activate' or 'rollback'");
 }
 const rawArgs=process.argv.slice(2);
-const [mode,value,workerFlag,operationIdArg]=rawArgs;
-if(!value||!['activate','rollback'].includes(mode)||!['',undefined,'--worker'].includes(workerFlag)||
-    (workerFlag==='--worker'?rawArgs.length!==4:rawArgs.length!==2)) {
-  throw new Error('usage: deferred-slot-operation.mjs <activate manifest_sha256|rollback activation_receipt>');
+const mode=rawArgs[0],value=rawArgs[1];
+if(!value||!['activate','rollback'].includes(mode)) throw new Error('usage: deferred-slot-operation.mjs <activate manifest_sha256|rollback activation_receipt> [--bridge-root ABS --bridge-script-sha256 HEX64]');
+let cursor=2,explicitBridgeRoot=null,explicitBridgeSha256=null;
+if(rawArgs[cursor]==='--bridge-root'){
+  explicitBridgeRoot=rawArgs[cursor+1]??null;
+  if(rawArgs[cursor+2]!=='--bridge-script-sha256') throw new Error('bridge override requires exact root + SHA pair');
+  explicitBridgeSha256=rawArgs[cursor+3]??null;cursor+=4;
 }
-const args=await normalizedArgs(mode,value);
+let workerFlag=null,operationIdArg=null;
+if(rawArgs[cursor]==='--worker'){workerFlag='--worker';operationIdArg=rawArgs[cursor+1]??null;cursor+=2;}
+if(cursor!==rawArgs.length) throw new Error('deferred slot operation arguments invalid');
+if((explicitBridgeRoot===null)!==(explicitBridgeSha256===null)) throw new Error('bridge override requires exact root + SHA pair');
+if(mode==='rollback'&&(explicitBridgeRoot||explicitBridgeSha256)) throw new Error('rollback does not accept bridge override');
 if(workerFlag==='--worker'){
   if(!/^[0-9a-f]{32}$/.test(operationIdArg??'')) throw new Error('deferred worker operation id invalid');
   const statePath=path.join(evidenceRoot,`${operationIdArg}.json`);
   await new Promise(resolve=>setTimeout(resolve,4000));
-  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString()});
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
   try{
+    const args=await normalizedArgs(mode,value,{explicitBridgeRoot,explicitBridgeSha256});
     const result=await runSlotUpdateCli(args,{stateRoot});
     await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'completed',
       completed_at_utc:new Date().toISOString(),receipt_path:result.receipt_path,receipt_sha256:result.receipt_sha256,
-      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root});
+      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
   }catch(error){
     await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'failed',
-      completed_at_utc:new Date().toISOString(),error:String(error?.message??error)});
+      completed_at_utc:new Date().toISOString(),error:String(error?.message??error),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
     process.exitCode=1;
   }
 }else{
   const operationId=randomBytes(16).toString('hex');
   const statePath=path.join(evidenceRoot,`${operationId}.json`);
-  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString()});
-  const child=spawn(process.execPath,[fileURLToPath(import.meta.url),mode,value,'--worker',operationId],{
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString(),bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256});
+  const workerArgs=[fileURLToPath(import.meta.url),mode,value];
+  if(explicitBridgeRoot) workerArgs.push('--bridge-root',explicitBridgeRoot,'--bridge-script-sha256',explicitBridgeSha256);
+  workerArgs.push('--worker',operationId);
+  const child=spawn(process.execPath,workerArgs,{
     cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
   });
   child.unref();
-  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0}));
+  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0,bridge_root:explicitBridgeRoot,bridge_script_sha256:explicitBridgeSha256}));
 }

package/scripts/final-closure-verify.mjs

@@ -6,20 +6,32 @@ import { fileURLToPath } from 'node:url';
 
 const HEX64=/^[0-9a-f]{64}$/;
 const UPDATE_DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
-const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R35-FINAL-CLOSURE-V1\0','utf8');
+const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R36-FINAL-CLOSURE-V1\0','utf8');
 const PING_DOMAIN=Buffer.from('DEADBYTE-MACHINE-PING-V1\0','utf8');
+const R35_PREDECESSOR_RELEASE_ID='v0.9.0-b95e1ec1d9a7e26a';
+const R35_PREDECESSOR_MANIFEST='b95e1ec1d9a7e26a96ef492306c1be4df18c883ff03ab3b6015f677d7429ec8d';
+const R36_FULL_TOOL_COUNT=76;
+const R36_COMPACT_TOOL_LIMIT=42;
+const REQUIRED_PARITY_KEYS=['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification','compact_closure','full_surface'];
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
   ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
 const canonicalJson=value=>JSON.stringify(canonical(value));
 const same=(a,b)=>canonicalJson(a)===canonicalJson(b);
-function insist(ok,msg){ if(!ok) throw new Error(msg); }
+function insist(ok,msg){if(!ok) throw new Error(msg);}
+function samePath(a,b){return path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();}
+function isCandidateIdentity(value,manifest){
+  return value?.version==='0.10.0'&&value?.manifest_sha256===manifest&&value?.release_id===`v0.10.0-${manifest.slice(0,16)}`;
+}
+function isR35Identity(value){
+  return value?.version==='0.9.0'&&value?.manifest_sha256===R35_PREDECESSOR_MANIFEST&&value?.release_id===R35_PREDECESSOR_RELEASE_ID;
+}
 
 function parseManifest(text){
   const out=new Map();
   for(const [i,line] of text.split(/\r?\n/).entries()){
     if(!line) continue;
-    const m=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line); insist(m,`manifest line ${i+1} malformed`);
+    const m=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line);insist(m,`manifest line ${i+1} malformed`);
     insist(!path.posix.isAbsolute(m[2])&&!m[2].split('/').includes('..')&&!out.has(m[2]),`unsafe/duplicate manifest path ${m[2]}`);
     out.set(m[2],m[1]);
   }
@@ -32,9 +44,9 @@ async function walk(root,rel=''){
   for(const name of names){
     const childRel=rel?`${rel}/${name}`:name;
     const full=path.join(root,...childRel.split('/'));
-    const st=await lstat(full); insist(!st.isSymbolicLink(),`symlink forbidden: ${childRel}`);
+    const st=await lstat(full);insist(!st.isSymbolicLink(),`symlink forbidden: ${childRel}`);
     if(st.isDirectory()) files.push(...await walk(root,childRel));
-    else { insist(st.isFile(),`non-file forbidden: ${childRel}`); files.push(childRel); }
+    else{insist(st.isFile(),`non-file forbidden: ${childRel}`);files.push(childRel);}
   }
   return files;
 }
@@ -45,13 +57,11 @@ async function verifyTree(root,manifestName,expectedDigest){
   const actual=(await walk(root)).filter(rel=>rel!==manifestName).sort((a,b)=>a.localeCompare(b,'en'));
   const expected=[...entries.keys()].sort((a,b)=>a.localeCompare(b,'en'));
   insist(same(actual,expected),`${manifestName} exact tree mismatch`);
-  for(const [rel,digest] of entries){
-    insist(sha256(await readFile(path.join(root,...rel.split('/'))))===digest,`${manifestName} file hash mismatch: ${rel}`);
-  }
+  for(const [rel,digest] of entries) insist(sha256(await readFile(path.join(root,...rel.split('/'))))===digest,`${manifestName} file hash mismatch: ${rel}`);
   return entries.size;
 }
 function publicKeyInfo(publicPem){
-  const key=createPublicKey(publicPem); insist(key.asymmetricKeyType==='ed25519','public key must be Ed25519');
+  const key=createPublicKey(publicPem);insist(key.asymmetricKeyType==='ed25519','public key must be Ed25519');
   const der=Buffer.from(key.export({type:'spki',format:'der'}));
   return {key,key_id:sha256(der),spki_base64:der.toString('base64')};
 }
@@ -71,8 +81,7 @@ function verifyPing(ping,status,pointer){
   insist(status?.status==='ok'&&typeof status.public_key_spki_base64==='string','machine status malformed');
   const der=Buffer.from(status.public_key_spki_base64,'base64');
   insist(der.toString('base64')===status.public_key_spki_base64,'machine SPKI base64 non-canonical');
-  const machineKey=createPublicKey({key:der,format:'der',type:'spki'});
-  insist(machineKey.asymmetricKeyType==='ed25519','machine key must be Ed25519');
+  const machineKey=createPublicKey({key:der,format:'der',type:'spki'});insist(machineKey.asymmetricKeyType==='ed25519','machine key must be Ed25519');
   const machineId=sha256(der);
   insist(status.machine_id===machineId&&ping.machine_id===machineId&&ping.attestation?.key_id===machineId,'machine id/key mismatch');
   insist(ping.release_id===pointer.release_id&&ping.release_manifest_sha256===pointer.manifest_sha256,'machine ping release binding mismatch');
@@ -83,77 +92,117 @@ function verifyPing(ping,status,pointer){
 }
 
 export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
-  insist(envelope?.body?.schema==='deadbyte.r35-final-closure.v1','closure schema mismatch');
-  insist(envelope.body.version==='0.9.0','closure version mismatch');
-  insist(envelope.body.release_label==='R35 FINAL MACHINE BASELINE','closure release label mismatch');
+  insist(envelope?.body?.schema==='deadbyte.r36-final-closure.v1','closure schema mismatch');
+  insist(envelope.body.version==='0.10.0','closure version mismatch');
+  insist(envelope.body.release_label==='R36 FINAL MACHINE BASELINE','closure release label mismatch');
   const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
   const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
   insist(sha256(bodyBytes)===envelope.body_sha256,'closure body hash mismatch');
   const {closure_sha256,...unsigned}=envelope;
   insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===closure_sha256,'closure envelope hash mismatch');
-  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R35-FINAL-CLOSURE-V1','closure attestation contract mismatch');
+  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R36-FINAL-CLOSURE-V1','closure attestation contract mismatch');
   insist(envelope.attestation.key_id===keyInfo.key_id,'closure signer mismatch');
   insist(cryptoVerify(null,Buffer.concat([CLOSURE_DOMAIN,bodyBytes]),keyInfo.key,Buffer.from(envelope.attestation.signature_base64,'base64')),'closure signature invalid');
 
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
   insist(same(pointer,envelope.body.active_pointer),'active pointer drift');
-  insist(pointer.version==='0.9.0','active pointer version mismatch');
-  insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'release id/content address mismatch');
+  insist(pointer.version==='0.10.0','active pointer version mismatch');
+  insist(isCandidateIdentity(pointer,pointer.manifest_sha256),'release id/content address mismatch');
   const releaseFiles=await verifyTree(pointer.release_root,'MANIFEST.SHA256',pointer.manifest_sha256);
   const generationFiles=await verifyTree(pointer.generation_root,'GENERATION.SHA256',pointer.generation_manifest_sha256);
   insist(sha256(await readFile(path.join(stateRoot,'bin','DEADBYTE-MCP.ps1')))===pointer.launcher_sha256,'launcher hash mismatch');
+
+  const predecessor=envelope.body.predecessor;
+  insist(isR35Identity(predecessor),'closure predecessor is not exact sealed R35');
+  const immutable=envelope.body.immutable_slot;
+  insist(immutable?.protected===true,'closure immutable-slot protection missing');
+  insist(samePath(immutable.release_root,pointer.release_root),'closure immutable release_root mismatch');
+  insist(!samePath(immutable.development_root,immutable.release_root),'closure development_root aliases immutable release_root');
+
+  const surfaces=envelope.body.surfaces;
+  insist(surfaces?.local_full?.status==='passed'&&surfaces.local_full.tool_count===R36_FULL_TOOL_COUNT&&surfaces.local_full.strict_output_schemas===true,'closure local full 76-tool proof invalid');
+  insist(HEX64.test(surfaces.local_full.catalog_sha256??''),'closure local full catalog hash missing');
+  insist(surfaces?.public_compact?.status==='passed'&&surfaces.public_compact.tool_count<=R36_COMPACT_TOOL_LIMIT&&surfaces.public_compact.capability_closure===true,'closure public compact capability proof invalid');
+  insist(surfaces.public_compact.coding_armed===false&&surfaces.public_compact.autonomous_armed===false,'closure compact authority is not DISARMED');
+  insist(HEX64.test(surfaces.public_compact.catalog_sha256??'')&&HEX64.test(surfaces.public_compact.ledger_sha256??''),'closure compact catalog/ledger hash missing');
+
   const evidence=envelope.body.evidence;
   insist(evidence&&evidence.parity&&evidence.activation&&evidence.rollback&&evidence.restore&&evidence.windows_gate,'closure evidence set incomplete');
   for(const [name,item] of Object.entries(evidence)){
-    if(!item?.path||!HEX64.test(item.sha256??'')) continue;
+    insist(item?.path&&HEX64.test(item.sha256??''),`${name} evidence identity malformed`);
     insist(sha256(await readFile(item.path))===item.sha256,`${name} evidence hash mismatch`);
   }
+
   const parity=JSON.parse(await readFile(evidence.parity.path,'utf8'));
-  insist(parity.schema==='deadbyte.r35-parity.v1'&&parity.status==='passed','parity evidence invalid');
-  insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity release binding mismatch');
-  insist(parity.rdc_operation_count===0&&parity.execution_provider==='deadbyte_mcp','parity execution provider mismatch');
-  insist(parity.successor_disarmed?.tool_count===73&&parity.successor_disarmed?.coding_armed===false&&parity.successor_disarmed?.autonomous_armed===false,'final public disarmed gate invalid');
-  for(const key of ['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification']) insist(parity.requirements?.[key]===true,`parity requirement missing ${key}`);
+  insist(parity.schema==='deadbyte.r36-parity.v1'&&parity.status==='passed','R36 parity evidence invalid');
+  insist(parity.rdc_operation_count===0&&parity.execution_provider==='deadbyte_mcp','R36 parity execution provider mismatch');
+  insist(isCandidateIdentity(parity.candidate,pointer.manifest_sha256),'R36 parity candidate binding mismatch');
+  insist(isCandidateIdentity(parity.successor,pointer.manifest_sha256),'R36 parity successor binding mismatch');
+  insist(isR35Identity(parity.predecessor),'R36 parity predecessor binding mismatch');
+  insist(parity.local_full?.status==='passed'&&parity.local_full.tool_count===R36_FULL_TOOL_COUNT&&parity.local_full.strict_output_schemas===true,'R36 parity local full proof invalid');
+  insist(parity.local_full.catalog_sha256===surfaces.local_full.catalog_sha256,'R36 local full catalog drift between parity and closure');
+  insist(parity.public_compact?.status==='passed'&&parity.public_compact.tool_count<=R36_COMPACT_TOOL_LIMIT&&parity.public_compact.capability_closure===true&&parity.public_compact.gateway_count===5,'R36 parity public compact proof invalid');
+  insist(parity.successor_disarmed?.status==='passed'&&parity.successor_disarmed.tool_count<=R36_COMPACT_TOOL_LIMIT&&parity.successor_disarmed.capability_closure===true&&parity.successor_disarmed.coding_armed===false&&parity.successor_disarmed.autonomous_armed===false,'R36 parity successor disarmed proof invalid');
+  insist(parity.successor_disarmed.catalog_sha256===surfaces.public_compact.catalog_sha256,'R36 compact catalog drift between restore and closure');
+  insist(parity.successor_disarmed.ledger_sha256===surfaces.public_compact.ledger_sha256,'R36 capability ledger drift between restore and closure');
+  insist(parity.immutable_slot?.protected===true,'R36 parity immutable-slot proof missing');
+  insist(samePath(parity.immutable_slot.release_root,pointer.release_root),'R36 parity immutable release_root mismatch');
+  insist(samePath(parity.immutable_slot.development_root,immutable.development_root),'R36 parity/closure development_root mismatch');
+  insist(!samePath(parity.immutable_slot.development_root,pointer.release_root),'R36 mutable development_root aliases immutable release slot');
+  for(const key of REQUIRED_PARITY_KEYS) insist(parity.requirements?.[key]===true,`R36 parity requirement missing ${key}`);
 
   const activation=JSON.parse(await readFile(evidence.activation.path,'utf8'));
   const rollback=JSON.parse(await readFile(evidence.rollback.path,'utf8'));
   const restore=JSON.parse(await readFile(evidence.restore.path,'utf8'));
-  verifyUpdateEnvelope(activation,keyInfo); verifyUpdateEnvelope(rollback,keyInfo); verifyUpdateEnvelope(restore,keyInfo);
-  insist(activation.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&activation.body.rollback_performed===false,'activation receipt invalid');
-  insist(rollback.body.schema==='deadbyte.r31-slot-rollback-receipt.v1'&&rollback.body.rollback_performed===true,'rollback receipt invalid');
-  insist(restore.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&restore.body.rollback_performed===false,'restore receipt invalid');
-  insist(activation.body.active_pointer?.manifest_sha256===pointer.manifest_sha256,'activation candidate mismatch');
-  insist(rollback.body.from_pointer?.manifest_sha256===pointer.manifest_sha256,'rollback source mismatch');
-  insist(restore.body.active_pointer?.manifest_sha256===pointer.manifest_sha256&&same(restore.body.active_pointer,pointer),'restore/current pointer mismatch');
-  insist(rollback.body.activation_receipt_sha256===activation.receipt_sha256,'rollback not bound to activation');
+  verifyUpdateEnvelope(activation,keyInfo);verifyUpdateEnvelope(rollback,keyInfo);verifyUpdateEnvelope(restore,keyInfo);
+  insist(activation.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&activation.body.rollback_performed===false,'R36 activation receipt invalid');
+  insist(activation.body.release_version==='0.10.0'&&activation.body.candidate_manifest_sha256===pointer.manifest_sha256,'R36 activation candidate identity invalid');
+  insist(isCandidateIdentity(activation.body.active_pointer,pointer.manifest_sha256),'R36 activation active pointer invalid');
+  insist(isR35Identity(activation.body.prior_pointer),'R36 activation predecessor is not exact R35');
+  insist(samePath(activation.body.development_root,immutable.development_root),'R36 activation development_root mismatch');
+  insist(!samePath(activation.body.development_root,activation.body.active_pointer.release_root),'R36 activation development_root aliases release slot');
+
+  insist(rollback.body.schema==='deadbyte.r31-slot-rollback-receipt.v1'&&rollback.body.rollback_performed===true,'R36 rollback receipt invalid');
+  insist(isCandidateIdentity(rollback.body.from_pointer,pointer.manifest_sha256),'R36 rollback source is not exact candidate');
+  insist(isR35Identity(rollback.body.active_pointer),'R36 rollback target is not exact R35 predecessor');
+  insist(rollback.body.activation_receipt_sha256===activation.receipt_sha256,'R36 rollback not bound to activation receipt');
+
+  insist(restore.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&restore.body.rollback_performed===false,'R36 restore receipt invalid');
+  insist(restore.body.release_version==='0.10.0'&&restore.body.candidate_manifest_sha256===pointer.manifest_sha256,'R36 restore candidate identity invalid');
+  insist(isR35Identity(restore.body.prior_pointer),'R36 restore predecessor is not exact R35');
+  insist(isCandidateIdentity(restore.body.active_pointer,pointer.manifest_sha256)&&same(restore.body.active_pointer,pointer),'R36 restore/current pointer mismatch');
+  insist(samePath(restore.body.development_root,immutable.development_root),'R36 restore development_root mismatch');
+  insist(!samePath(restore.body.development_root,restore.body.active_pointer.release_root),'R36 restore development_root aliases release slot');
+
   const windowsGate=JSON.parse(await readFile(evidence.windows_gate.path,'utf8'));
-  insist(windowsGate.schema==='deadbyte.r35-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
-  insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate manifest binding mismatch');
-  insist(windowsGate.marker==='DEADBYTE V0.9.0 / R35 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
+  insist(windowsGate.schema==='deadbyte.r36-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'R36 Windows gate evidence invalid');
+  insist(windowsGate.version==='0.10.0'&&windowsGate.manifest_sha256===pointer.manifest_sha256,'R36 Windows gate manifest/version binding mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.10.0 / R36 WINDOWS BATCH GATE: PASS','R36 Windows gate PASS marker mismatch');
 
   const machine=envelope.body.machine;
-  insist(machine?.status?.release_id===pointer.release_id&&machine.status.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine status binding mismatch');
+  insist(machine?.status?.release_id===pointer.release_id&&machine.status.release_manifest_sha256===pointer.manifest_sha256&&machine.status.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine status binding mismatch');
   verifyPing(machine.ping,machine.status,pointer);
   insist(machine.ping.nonce===machine.nonce,'machine ping nonce binding mismatch');
 
   const grantNames=['process-grant.json','coding-grant.json','autonomous-grant.json','host-grant.json'];
   insist(envelope.body.authority?.all_disarmed===true,'closure authority not disarmed');
   for(const name of grantNames){
-    let exists=true; try { await lstat(path.join(stateRoot,'runtime',name)); } catch(error){ if(error?.code==='ENOENT') exists=false; else throw error; }
+    let exists=true;try{await lstat(path.join(stateRoot,'runtime',name));}catch(error){if(error?.code==='ENOENT') exists=false;else throw error;}
     insist(!exists,`authority grant still present: ${name}`);
     insist(envelope.body.authority.grants_absent?.[name]===true,`closure grant absence not recorded: ${name}`);
   }
   return {ok:true,status:'passed',release_id:pointer.release_id,manifest_sha256:pointer.manifest_sha256,
     generation_manifest_sha256:pointer.generation_manifest_sha256,release_files:releaseFiles,generation_files:generationFiles,
-    machine_id:machine.status.machine_id,parity_sha256:evidence.parity.sha256,closure_sha256:envelope.closure_sha256};
+    machine_id:machine.status.machine_id,parity_sha256:evidence.parity.sha256,closure_sha256:envelope.closure_sha256,
+    full_tool_count:R36_FULL_TOOL_COUNT,compact_tool_count:surfaces.public_compact.tool_count};
 }
 
 const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
 if(invoked){
   const file=process.argv[2];
   if(!file) throw new Error('usage: node scripts/final-closure-verify.mjs <closure.json>');
-  try {
+  try{
     const envelope=JSON.parse(await readFile(path.resolve(file),'utf8'));
     console.log(JSON.stringify(await verifyFinalClosureObject(envelope),null,2));
-  } catch(error){ console.error(error instanceof Error?error.stack:String(error)); process.exitCode=1; }
+  }catch(error){console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;}
 }

package/scripts/final-closure.mjs

@@ -1,96 +1,103 @@
-import { createHash, createPrivateKey, createPublicKey, randomBytes, sign as cryptoSign } from 'node:crypto';
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign } from 'node:crypto';
 import { lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
-import { R34_EXPECTED_TOOLS } from '../src/remote-mcp-r34-parity-client.mjs';
+import { probeR36FullSurface } from '../src/r36-full-surface-probe.mjs';
+import { probeR36CompactDisarmed } from '../src/r36-compact-disarmed-probe.mjs';
+import {
+  validateParityEvidence,
+  R35_PREDECESSOR_RELEASE_ID,
+  R35_PREDECESSOR_MANIFEST
+} from './release-parity.mjs';
 
-const DOMAIN=Buffer.from('DEADBYTE-R35-FINAL-CLOSURE-V1\0','utf8');
+const DOMAIN=Buffer.from('DEADBYTE-R36-FINAL-CLOSURE-V1\0','utf8');
 const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
   ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
 const canonicalJson=value=>JSON.stringify(canonical(value));
-function insist(ok,msg){ if(!ok) throw new Error(msg); }
-async function fileEvidence(file){ const abs=path.resolve(file),bytes=await readFile(abs); return {path:abs,sha256:sha256(bytes)}; }
-function structured(result,label){
-  if(result.isError) throw new Error(`${label} error: ${JSON.stringify(result.structuredContent??result.content)}`);
-  insist(result.structuredContent&&typeof result.structuredContent==='object',`${label} missing structured output`);
-  return result.structuredContent;
+function insist(ok,msg){if(!ok) throw new Error(msg);}
+function samePath(a,b){return path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();}
+async function fileEvidence(file){const abs=path.resolve(file),bytes=await readFile(abs);return {path:abs,sha256:sha256(bytes)};}
+async function publicUrl(){
+  const value=(await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim();
+  const url=new URL(value);insist(url.protocol==='https:','final closure requires HTTPS public endpoint');return value;
 }
-async function publicMachineEvidence(){
-  const endpoint=new URL((await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim());
-  insist(endpoint.protocol==='https:','final closure requires HTTPS public endpoint');
-  const client=new Client({name:'deadbyte-r35-final-closure',version:'0.9.0'},
-    {versionNegotiation:{mode:{pin:'2026-07-28'}}});
-  const transport=new StreamableHTTPClientTransport(endpoint);
-  try{
-    await client.connect(transport);
-    const listed=await client.listTools();
-    const names=listed.tools.map(tool=>tool.name).sort();
-    insist(JSON.stringify(names)===JSON.stringify(R34_EXPECTED_TOOLS),'final public catalog is not exact 73');
-    for(const tool of listed.tools) insist(tool.outputSchema?.type==='object'&&tool.outputSchema?.additionalProperties===false,`tool ${tool.name} output schema drift`);
-    const status=structured(await client.callTool({name:'machine_status',arguments:{}}),'machine_status');
-    const nonce=`r35-final-${randomBytes(16).toString('hex')}`;
-    const ping=structured(await client.callTool({name:'machine_ping',arguments:{nonce}}),'machine_ping');
-    const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
-    const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous_session_status');
-    insist(coding.armed===false,'coding authority must be DISARMED before closure');
-    insist(autonomous.coding_armed===false&&autonomous.autonomous_armed===false,'autonomous authority must be DISARMED before closure');
-    return {tool_count:names.length,strict_output_schemas:true,status,ping,nonce};
-  } finally { await client.close().catch(()=>{}); }
-}
-
 async function grantAbsence(){
   const out={};
   for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','host-grant.json']){
-    let absent=false; try { await lstat(path.join(stateRoot,'runtime',name)); }
-    catch(error){ if(error?.code==='ENOENT') absent=true; else throw error; }
-    insist(absent,`authority grant still present: ${name}`); out[name]=true;
+    let absent=false;try{await lstat(path.join(stateRoot,'runtime',name));}catch(error){if(error?.code==='ENOENT') absent=true;else throw error;}
+    insist(absent,`authority grant still present: ${name}`);out[name]=true;
   }
   return out;
 }
 async function atomicCreate(file,bytes){
   await mkdir(path.dirname(file),{recursive:true});
-  const temp=`${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  const temp=`${file}.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`;
   const handle=await open(temp,'wx');
-  try { await handle.writeFile(bytes); await handle.sync(); } finally { await handle.close(); }
-  try { await rename(temp,file); } catch(error){ await rm(temp,{force:true}).catch(()=>{}); throw error; }
+  try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+  try{await rename(temp,file);}catch(error){await rm(temp,{force:true}).catch(()=>{});throw error;}
 }
 
 export async function writeFinalClosure({parityPath,activationPath,windowsGatePath}){
   const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
-  insist(pointer.version==='0.9.0','final closure requires V0.8.11 active release');
+  insist(pointer.version==='0.10.0','final closure requires V0.10.0 active release');
+  insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'final closure release id/content address mismatch');
+
   const parity=JSON.parse(await readFile(path.resolve(parityPath),'utf8'));
-  insist(parity.schema==='deadbyte.r35-parity.v1'&&parity.status==='passed','parity evidence is not passed');
-  insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity/current release mismatch');
+  insist(parity.schema==='deadbyte.r36-parity.v1','R36 parity schema mismatch at final closure');
+  validateParityEvidence(parity);
+  insist(parity.candidate?.release_id===pointer.release_id&&parity.candidate?.manifest_sha256===pointer.manifest_sha256,'parity candidate/current release mismatch');
+  insist(parity.successor?.release_id===pointer.release_id&&parity.successor?.manifest_sha256===pointer.manifest_sha256,'parity successor/current release mismatch');
+  insist(parity.predecessor?.release_id===R35_PREDECESSOR_RELEASE_ID&&parity.predecessor?.manifest_sha256===R35_PREDECESSOR_MANIFEST,'parity predecessor identity mismatch');
   insist(parity.rollback?.receipt_path&&parity.restore?.receipt_path,'parity rollback/restore receipt paths missing');
+  insist(parity.immutable_slot?.protected===true,'parity immutable-slot proof missing');
+  insist(samePath(parity.immutable_slot.release_root,pointer.release_root),'parity immutable release root mismatch');
+  insist(!samePath(parity.immutable_slot.development_root,pointer.release_root),'development_root must differ from immutable release_root');
+
   const windowsGate=JSON.parse(await readFile(path.resolve(windowsGatePath),'utf8'));
-  insist(windowsGate.schema==='deadbyte.r35-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
-  insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate/current release mismatch');
-  const machine=await publicMachineEvidence();
-  insist(machine.status.release_id===pointer.release_id&&machine.status.release_manifest_sha256===pointer.manifest_sha256,'machine status/current release mismatch');
+  insist(windowsGate.schema==='deadbyte.r36-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'R36 Windows gate evidence invalid');
+  insist(windowsGate.version==='0.10.0'&&windowsGate.manifest_sha256===pointer.manifest_sha256,'R36 Windows gate/current release mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.10.0 / R36 WINDOWS BATCH GATE: PASS','R36 Windows gate marker mismatch');
+
+  const localFull=await probeR36FullSurface({packageRoot:pointer.release_root,generationRoot:pointer.generation_root,stateRoot});
+  insist(localFull.status==='passed'&&localFull.tool_count===76&&localFull.strict_output_schemas===true,'final local full 76-tool proof failed');
+  const compact=await probeR36CompactDisarmed(await publicUrl());
+  insist(compact.status==='passed'&&compact.tool_count<=42&&compact.capability_closure===true,'final public compact capability closure failed');
+  insist(compact.coding_armed===false&&compact.autonomous_armed===false,'final public compact authority is not DISARMED');
+  insist(compact.release_id===pointer.release_id&&compact.release_manifest_sha256===pointer.manifest_sha256,'final public compact release binding mismatch');
+  insist(compact.machine_status?.release_id===pointer.release_id&&compact.machine_status?.release_manifest_sha256===pointer.manifest_sha256,'final machine status/current release mismatch');
+  insist(compact.machine_ping?.nonce===compact.nonce,'final machine ping nonce mismatch');
+
   const evidence={
-    parity:await fileEvidence(parityPath), activation:await fileEvidence(activationPath),
-    rollback:await fileEvidence(parity.rollback.receipt_path), restore:await fileEvidence(parity.restore.receipt_path),
+    parity:await fileEvidence(parityPath),activation:await fileEvidence(activationPath),
+    rollback:await fileEvidence(parity.rollback.receipt_path),restore:await fileEvidence(parity.restore.receipt_path),
     windows_gate:await fileEvidence(windowsGatePath)
   };
-  const body={schema:'deadbyte.r35-final-closure.v1',version:'0.9.0',release_label:'R35 FINAL MACHINE BASELINE',
-    completed_at_utc:new Date().toISOString(),active_pointer:pointer,evidence,
-    public_catalog:{tool_count:machine.tool_count,strict_output_schemas:machine.strict_output_schemas},
-    machine:{status:machine.status,ping:machine.ping,nonce:machine.nonce},
-    authority:{all_disarmed:true,grants_absent:await grantAbsence()}};
+  const body={
+    schema:'deadbyte.r36-final-closure.v1',version:'0.10.0',release_label:'R36 FINAL MACHINE BASELINE',
+    completed_at_utc:new Date().toISOString(),active_pointer:pointer,
+    predecessor:{release_id:R35_PREDECESSOR_RELEASE_ID,version:'0.9.0',manifest_sha256:R35_PREDECESSOR_MANIFEST},
+    immutable_slot:{protected:true,release_root:path.resolve(pointer.release_root),development_root:path.resolve(parity.immutable_slot.development_root)},
+    surfaces:{
+      local_full:{status:localFull.status,profile:localFull.profile,tool_count:localFull.tool_count,catalog_sha256:localFull.catalog_sha256,strict_output_schemas:localFull.strict_output_schemas,protocol_revision:localFull.protocol_revision},
+      public_compact:{status:compact.status,profile:compact.profile,tool_count:compact.tool_count,catalog_sha256:compact.catalog_sha256,strict_output_schemas:compact.strict_output_schemas,ledger_sha256:compact.ledger_sha256,capability_count:compact.capability_count,production_non_host_capabilities:compact.production_non_host_capabilities,capability_closure:compact.capability_closure,coding_armed:compact.coding_armed,autonomous_armed:compact.autonomous_armed,protocol_revision:compact.protocol_revision}
+    },
+    evidence,
+    machine:{status:compact.machine_status,ping:compact.machine_ping,nonce:compact.nonce},
+    authority:{all_disarmed:true,grants_absent:await grantAbsence()}
+  };
   const privateKey=createPrivateKey(await readFile(path.join(stateRoot,'trust','ed25519-private.pem')));
   const publicKey=createPublicKey(privateKey);
   insist(privateKey.asymmetricKeyType==='ed25519'&&publicKey.asymmetricKeyType==='ed25519','closure signing key must be Ed25519');
   const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
   const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
   const signature=cryptoSign(null,Buffer.concat([DOMAIN,bodyBytes]),privateKey);
-  const envelope={body,body_sha256:sha256(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R35-FINAL-CLOSURE-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
+  const envelope={body,body_sha256:sha256(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R36-FINAL-CLOSURE-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
   envelope.closure_sha256=sha256(Buffer.from(canonicalJson(envelope),'utf8'));
   const dir=path.join(stateRoot,'evidence','release');
-  const file=path.join(dir,`r35-final-${pointer.manifest_sha256.slice(0,16)}.json`);
+  const file=path.join(dir,`r36-final-${pointer.manifest_sha256.slice(0,16)}.json`);
   const bytes=Buffer.from(`${JSON.stringify(envelope,null,2)}\n`,'utf8');
   await atomicCreate(file,bytes);
   return {status:'written',path:file,sha256:sha256(bytes),closure_sha256:envelope.closure_sha256,release_id:pointer.release_id};
@@ -102,5 +109,5 @@ if(invoked){
   if(!parityPath||!activationPath||!windowsGatePath) throw new Error('usage: node scripts/final-closure.mjs <parity.json> <activation-receipt.json> <windows-gate.json>');
   writeFinalClosure({parityPath,activationPath,windowsGatePath})
     .then(result=>console.log(JSON.stringify(result,null,2)))
-    .catch(error=>{ console.error(error instanceof Error?error.stack:String(error)); process.exitCode=1; });
+    .catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
 }

package/scripts/gate-windows.ps1

@@ -9,7 +9,7 @@ function Invoke-GateStep {
     Write-Host "==== $Name ===="
     & npm.cmd @NpmArgs
     if ($LASTEXITCODE -ne 0) {
-        throw "DEADBYTE V0.9.0 / R35 gate failed at $Name with exit code $LASTEXITCODE"
+        throw "DEADBYTE V0.10.0 / R36 gate failed at $Name with exit code $LASTEXITCODE"
     }
 }
 
@@ -36,7 +36,7 @@ Invoke-GateStep -Name 'release-manifest-final' -NpmArgs @('run', 'manifest:verif
 Write-Host '==== windows-gate-evidence ===='
 & node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence.mjs')
 if ($LASTEXITCODE -ne 0) {
-    throw "DEADBYTE V0.9.0 / R35 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
+    throw "DEADBYTE V0.10.0 / R36 gate failed at windows-gate-evidence with exit code $LASTEXITCODE"
 }
 
-Write-Host '==== DEADBYTE V0.9.0 / R35 WINDOWS BATCH GATE: PASS ===='
+Write-Host '==== DEADBYTE V0.10.0 / R36 WINDOWS BATCH GATE: PASS ===='

package/scripts/release-parity-tests.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+$root = Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+    & node.exe --test test\r36-finalization.test.mjs test\r36-release-identity.test.mjs test\deferred-slot-operation.test.mjs
+    if ($LASTEXITCODE -ne 0) { throw "release parity tests failed with exit code $LASTEXITCODE" }
+    Write-Output 'R36 RELEASE PARITY TEST PASS'
+} finally { Pop-Location }