deadbyte-mcp 0.9.0 → 0.11.0

package/test/capability-ledger-r36.test.mjs

@@ -0,0 +1,102 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CAPABILITY_LEDGER_SCHEMA,
+  capabilityProfileFromEnv,
+  createCapabilityLedger,
+  assertCapabilityClosure
+} from '../src/capability-ledger.mjs';
+
+const entry = overrides => ({
+  id:'coding.search',
+  full_tool:'coding_search',
+  compact_tool:'coding_inspect',
+  compact_op:'search',
+  runtime_flag:'DEADBYTE_CODING_RUNTIME',
+  authority:'coding',
+  mutating:false,
+  receipt_class:'observation',
+  production:true,
+  host_only:false,
+  ...overrides
+});
+
+const snapshot = names => ({
+  schema:'deadbyte.tool-surface.v1',
+  tools:names.map(name=>({name,input_sha256:'0'.repeat(64),output_sha256:'1'.repeat(64)})),
+  surface_sha256:'2'.repeat(64)
+});
+
+test('R36 capability ledger rejects duplicate ids', () => {
+  assert.throws(() => createCapabilityLedger([
+    entry({}),
+    entry({full_tool:'other_tool'})
+  ]), /duplicate capability id/i);
+});
+
+test('R36 capability ledger validates authority and canonicalizes identity', () => {
+  assert.throws(() => createCapabilityLedger([entry({authority:'root'})]), /authority/i);
+  const a=createCapabilityLedger([
+    entry({id:'process.read',full_tool:'process_session_read',compact_tool:'process_session',compact_op:'read',runtime_flag:'DEADBYTE_PROCESS_RUNTIME',authority:'process'}),
+    entry({})
+  ]);
+  const b=createCapabilityLedger([
+    entry({}),
+    entry({id:'process.read',full_tool:'process_session_read',compact_tool:'process_session',compact_op:'read',runtime_flag:'DEADBYTE_PROCESS_RUNTIME',authority:'process'})
+  ]);
+  assert.equal(a.schema,CAPABILITY_LEDGER_SCHEMA);
+  assert.equal(a.ledger_sha256,b.ledger_sha256);
+  assert.deepEqual(a.entries.map(x=>x.id),['coding.search','process.read']);
+  assert.ok(Object.isFrozen(a));
+  assert.ok(Object.isFrozen(a.entries));
+});
+
+test('R36 surface profile defaults full and accepts only full or compact', () => {
+  assert.equal(capabilityProfileFromEnv({}),'full');
+  assert.equal(capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'full'}),'full');
+  assert.equal(capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'compact'}),'compact');
+  assert.throws(() => capabilityProfileFromEnv({DEADBYTE_CAPABILITY_PROFILE:'wide'}), /full or compact/i);
+});
+
+test('R36 compact closure covers every production non-host capability', () => {
+  const ledger=createCapabilityLedger([
+    entry({}),
+    entry({id:'host.exec',full_tool:'host_exec',compact_tool:null,compact_op:null,runtime_flag:'DEADBYTE_PRIVILEGED_POLICY',authority:'host',mutating:true,receipt_class:'host',production:false,host_only:true})
+  ]);
+  assert.equal(assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search','host_exec']),
+    compactToolSnapshot:snapshot(['coding_inspect'])
+  }),true);
+});
+
+test('R36 closure fails when a production route is lost or advertised tool is absent', () => {
+  const missingCompact=createCapabilityLedger([entry({compact_tool:null,compact_op:null})]);
+  assert.throws(() => assertCapabilityClosure({
+    ledger:missingCompact,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot([])
+  }), /compact route/i);
+
+  const ledger=createCapabilityLedger([entry({})]);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot([]),
+    compactToolSnapshot:snapshot(['coding_inspect'])
+  }), /full tool/i);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot([])
+  }), /compact tool/i);
+});
+
+test('R36 compact surface hard-fails above the observed 42-tool ceiling', () => {
+  const ledger=createCapabilityLedger([entry({})]);
+  const tooMany=Array.from({length:43},(_,i)=>i===0?'coding_inspect':`extra_${i}`);
+  assert.throws(() => assertCapabilityClosure({
+    ledger,
+    fullToolSnapshot:snapshot(['coding_search']),
+    compactToolSnapshot:snapshot(tooMany)
+  }), /42/i);
+});

package/test/coding-catalog-consistency.test.mjs

@@ -8,7 +8,7 @@ const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const expected=[
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat','coding_symbol_definition',
-  'coding_symbol_outline','coding_symbol_references','coding_symbol_replace','coding_task_approve','coding_task_cancel',
+  'coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace','coding_task_approve','coding_task_cancel',
   'coding_task_events','coding_task_run','coding_task_status','coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'
 ].sort();
 function extract(source){
@@ -17,7 +17,7 @@ function extract(source){
   return [...m[1].matchAll(/'([^']+)'/g)].map(x=>x[1]).sort();
 }
 for(const rel of ['src/machine-fs-smoke-client.mjs','src/observation-smoke-client.mjs','src/remote-mcp-coding-smoke-client.mjs','src/remote-mcp-smoke-client.mjs']){
-  test(`${rel} uses the exact R34 22-tool coding catalog`,async()=>{
+  test(`${rel} uses the exact R36 25-tool coding catalog`,async()=>{
     const source=await readFile(path.join(root,...rel.split('/')),'utf8');
     assert.deepEqual(extract(source),expected);
   });

package/test/coding-plane.test.mjs

@@ -15,7 +15,7 @@ const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
 const workspaceRoot = path.join(repoRoot, 'workspaces');
 const codingTools = [
   'coding_benchmark_run', 'coding_command_run', 'coding_file_read', 'coding_file_write', 'coding_files_read',
-  'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat', 'coding_symbol_definition', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_replace', 'coding_task_approve', 'coding_task_cancel',
+  'coding_receipt_verify', 'coding_search', 'coding_session_status', 'coding_stat', 'coding_symbol_definition', 'coding_symbol_diagnostics', 'coding_symbol_implementations', 'coding_symbol_outline', 'coding_symbol_references', 'coding_symbol_rename_preview', 'coding_symbol_replace', 'coding_task_approve', 'coding_task_cancel',
   'coding_task_events', 'coding_task_run', 'coding_task_status', 'coding_task_submit',
   'coding_task_verify', 'coding_text_replace', 'coding_tree'
 ];
@@ -69,7 +69,7 @@ async function fixture() {
   return { root, client, transport };
 }
 
-test('R34 hermetic coding fixture exposes the exact 34-tool no-host catalog', async () => {
+test('R36 hermetic coding fixture exposes the exact 37-tool no-host catalog', async () => {
   const f = await fixture();
   try {
     await f.client.connect(f.transport);

package/test/coding-runtime.test.mjs

@@ -56,6 +56,22 @@ test('coding plane edits files under lease and verifies signed action receipts',
   } finally { await rm(f.root, { recursive: true, force: true }); }
 });
 
+test('R36 coding stat exposes mutation-relevant observation identity', async () => {
+  const f = await fixture();
+  try {
+    await writeFile(path.join(f.project,'stat.txt'),'stat-body\n');
+    const value=await f.runtime.stat({rootId:'project',relativePath:'stat.txt',hash:true});
+    assert.equal(value.status,'ok');
+    assert.equal(value.normalized_path,'stat.txt');
+    assert.equal(value.type,'file');
+    assert.equal(value.reparse_state,'none');
+    assert.match(value.sha256,/^[0-9a-f]{64}$/);
+    assert.match(value.object_identity_sha256,/^[0-9a-f]{64}$/);
+    assert.match(value.observation_sha256,/^[0-9a-f]{64}$/);
+    assert.equal(value.policy_root_id,'project');
+  } finally { await rm(f.root, { recursive: true, force: true }); }
+});
+
 test('coding plane rejects mutation when lease is absent or precondition is stale', async () => {
   const f = await fixture({ armed: false });
   try {

package/test/coding-search-r36.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createSearchCursorCodec } from '../src/search-cursor.mjs';
+import { createCodingSearch } from '../src/coding-search.mjs';
+
+async function fixture(){
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r36-search-'));
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(temp,'private.pem'),publicKeyPath:path.join(temp,'public.pem')});
+  const state=new Map([
+    ['src/a.txt',Buffer.from('foo1 foo2\nbar foo3\n','utf8')],
+    ['src/b.txt',Buffer.from('other FOO4 and foo5\n','utf8')],
+    ['src/foo-file.js',Buffer.from('nothing here\n','utf8')],
+    ['src/binary.bin',Buffer.from([0xff,0xfe,0x00,0x61])]
+  ]);
+  let reads=0;
+  const tree=async()=>({status:'ok',root_id:'core',path:'.',truncated:false,entries:[...state].map(([p,b])=>({path:p,type:'file',bytes:b.length}))});
+  const fileRead=async({relativePath,encoding})=>{
+    reads+=1;
+    const bytes=state.get(relativePath);
+    if(!bytes) throw new Error('missing');
+    return {status:'ok',root_id:'core',path:relativePath,encoding,bytes:bytes.length,sha256:(await import('node:crypto')).createHash('sha256').update(bytes).digest('hex'),content:encoding==='base64'?bytes.toString('base64'):bytes.toString('utf8')};
+  };
+  const cursorCodec=createSearchCursorCodec({signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const search=createCodingSearch({tree,fileRead,cursorCodec});
+  return {temp,state,search,get reads(){return reads;},cleanup:()=>rm(temp,{recursive:true,force:true})};
+}
+
+test('R36 regex search returns multiple matches per file with deterministic signed paging',async()=>{
+  const f=await fixture();
+  try{
+    const first=await f.search({rootId:'core',path:'.',target:'content',mode:'regex',pattern:'foo\\d',caseSensitive:false,pageSize:2,maxResults:20});
+    assert.equal(first.matches.length,2);
+    assert.deepEqual(first.matches.map(x=>[x.path,x.line,x.column]),[['src/a.txt',1,1],['src/a.txt',1,6]]);
+    assert.match(first.query_sha256,/^[0-9a-f]{64}$/);
+    assert.match(first.snapshot_sha256,/^[0-9a-f]{64}$/);
+    assert.match(first.page_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(first.next_cursor);
+    const second=await f.search({rootId:'core',path:'.',target:'content',mode:'regex',pattern:'foo\\d',caseSensitive:false,pageSize:2,maxResults:20,cursor:first.next_cursor});
+    assert.equal(second.matches.length,2);
+    assert.deepEqual(second.matches.map(x=>x.path),['src/a.txt','src/b.txt']);
+    assert.notEqual(second.page_sha256,first.page_sha256);
+  } finally {await f.cleanup();}
+});
+
+test('R36 path search does not decode file content and is deterministic',async()=>{
+  const f=await fixture();
+  try{
+    const result=await f.search({rootId:'core',target:'path',mode:'literal',pattern:'foo-file',pageSize:10,maxResults:20});
+    assert.equal(result.matches.length,1);
+    assert.equal(result.matches[0].path,'src/foo-file.js');
+    assert.equal(result.matches[0].line,null);
+    assert.equal(result.bytes_scanned,0);
+    assert.equal(f.reads,0);
+  } finally {await f.cleanup();}
+});
+
+test('R36 search cursor is query-bound and stale snapshot fails closed',async()=>{
+  const f=await fixture();
+  try{
+    const first=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:1,maxResults:20});
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'literal',pattern:'bar',pageSize:1,maxResults:20,cursor:first.next_cursor}),/cursor.*query/i);
+    f.state.set('src/a.txt',Buffer.from('foo1 changed same workflow\n','utf8'));
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:1,maxResults:20,cursor:first.next_cursor}),/cursor.*stale|snapshot/i);
+  } finally {await f.cleanup();}
+});
+
+test('R36 invalid regex fails before repository file reads and binary is classified',async()=>{
+  const f=await fixture();
+  try{
+    await assert.rejects(()=>f.search({rootId:'core',target:'content',mode:'regex',pattern:'[unterminated'}),/regex/i);
+    assert.equal(f.reads,0);
+    const result=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',pageSize:20,maxResults:20});
+    assert.equal(result.binary_files_skipped,1);
+    assert.ok(result.matches.length>=5);
+  } finally {await f.cleanup();}
+});
+
+test('R36 scan-byte bound truncates deterministically',async()=>{
+  const f=await fixture();
+  try{
+    const result=await f.search({rootId:'core',target:'content',mode:'literal',pattern:'foo',maxScanBytes:10,pageSize:20,maxResults:20});
+    assert.equal(result.truncated,true);
+    assert.equal(result.truncation_reason,'scan_byte_limit');
+    assert.ok(result.bytes_scanned<=10);
+  } finally {await f.cleanup();}
+});

package/test/compact-catalog-r36.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const gatewayNames=['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'];
+
+test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
+  const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(tool=>tool.name).sort();
+    assert.ok(names.length<=42,`compact tool count ${names.length} exceeds 42`);
+    for(const name of gatewayNames) assert.ok(names.includes(name),`missing ${name}`);
+    for(const legacy of ['workspace_open','file_read','proof_execute','contained_transform']) assert.equal(names.includes(legacy),false,`legacy full-only tool leaked: ${legacy}`);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    assert.equal(manifest.structuredContent.status,'ok');
+    assert.equal(manifest.structuredContent.result.profile,'compact');
+    assert.match(manifest.structuredContent.result.ledger_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(manifest.structuredContent.result.capabilities.length>40);
+  } finally {await client.close().catch(()=>{});}
+});

package/test/compact-gateway-r36.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  codingInspectInputSchema,
+  machineFsGatewayInputSchema,
+  processSessionGatewayInputSchema,
+  machineObserveInputSchema,
+  registerCompactGatewayTools
+} from '../src/compact-gateway-mcp-tools.mjs';
+
+const fakeServer=()=>{
+  const tools=new Map();
+  return {
+    tools,
+    registerTool(name,definition,handler){
+      if(tools.has(name)) throw new Error(`duplicate ${name}`);
+      tools.set(name,{definition,handler});
+    }
+  };
+};
+
+test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
+  assert.equal(codingInspectInputSchema.safeParse({op:'call',tool_name:'host_exec',args:{}}).success,false);
+  assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
+});
+
+test('R36 compact schemas preserve representative preconditions',()=>{
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:'a'.repeat(64)
+  }).success,true);
+  assert.equal(machineFsGatewayInputSchema.safeParse({
+    op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt'
+  }).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
+});
+
+test('R36 registers exactly five compact gateway names',()=>{
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  assert.deepEqual([...server.tools.keys()].sort(),[
+    'capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'
+  ]);
+});
+
+test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',async()=>{
+  const calls=[];
+  const codingRuntime={
+    stat:async args=>{calls.push(['stat',args]);return {status:'ok',root_id:args.rootId,path:args.relativePath,type:'file'};}
+  };
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+  });
+  const tool=server.tools.get('coding_inspect');
+  const result=await tool.handler({op:'stat',root_id:'core',path:'src/a.mjs',hash:false});
+  assert.deepEqual(calls,[['stat',{rootId:'core',relativePath:'src/a.mjs',hash:false}]]);
+  assert.equal(result.structuredContent.status,'ok');
+  assert.equal(result.structuredContent.op,'stat');
+  assert.equal(result.structuredContent.result.path,'src/a.mjs');
+});

package/test/contained.test.mjs

@@ -364,7 +364,7 @@ test('contained execution source has a compile-time worker registry and no user
   assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
   assert.doesNotMatch(server, /executable:\s*z\./);
   assert.doesNotMatch(executor, /--worker/);
-  assert.doesNotMatch(server, /command_run|shell_execute|powershell_run/);
+  assert.doesNotMatch(server, /registerTool\(\s*['"](?:command_run|shell_execute|powershell_run)['"]/);
 });
 
 test('contained launcher imports by stdin/profile copy and never mounts a host workspace', async () => {

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.9.0');
+  assert.equal(result.receipt.runtime.package_version, '0.11.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/deferred-slot-operation.test.mjs

@@ -12,6 +12,15 @@ test('R34 deferred slot operation preserves supervisor bootstrap across rollback
   assert.match(source,/verifySlotUpdateEnvelope/);
   assert.match(source,/runSlotUpdateCli\(args,\{stateRoot\}\)/);
   assert.match(source,/--enable-autonomous-supervisor/);
+  assert.match(source,/loadPowerShellDataFile/);
+  assert.match(source,/active-release\.json/);
+  assert.match(source,/Bridge\.WorkingDirectory/);
+  assert.match(source,/src['"],['"]bridge\.mjs/);
+  assert.match(source,/--bridge-root/);
+  assert.match(source,/--bridge-script-sha256/);
+  assert.match(source,/explicitBridgeRoot/);
+  assert.match(source,/explicitBridgeSha256/);
+  assert.match(source,/bridge override requires exact root \+ SHA pair/i);
   assert.match(source,/detached:true/);
   assert.match(source,/rdc_operation_count:0/);
   assert.doesNotMatch(source,/shell:\s*true/);

package/test/fixtures/lsp-framed-server.mjs

@@ -18,6 +18,8 @@ function respond(msg){
   if(msg.method==='textDocument/documentSymbol') { if(documentSymbolNullCount>0){documentSymbolNullCount-=1;return send({jsonrpc:'2.0',id:msg.id,result:null});} return send({jsonrpc:'2.0',id:msg.id,result:[{name:'alpha',kind:12,range:{start:{line:0,character:0},end:{line:0,character:26}},selectionRange:{start:{line:0,character:16},end:{line:0,character:21}},children:[]}]}); }
   if(msg.method==='textDocument/definition') { if(!Number.isInteger(msg.params?.position?.character)) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32602,message:'position.character required'}}); if(!ready())return send({jsonrpc:'2.0',id:msg.id,result:null}); if(requiredOpenCount>0&&openedUris.length<requiredOpenCount)return send({jsonrpc:'2.0',id:msg.id,result:null}); const targetUri=requiredOpenCount>0?(openedUris.find(uri=>uri!==msg.params.textDocument.uri)??msg.params.textDocument.uri):msg.params.textDocument.uri; return send({jsonrpc:'2.0',id:msg.id,result:{uri:targetUri,range:{start:{line:0,character:16},end:{line:0,character:21}}}}); }
   if(msg.method==='textDocument/references') { if(!Number.isInteger(msg.params?.position?.character)) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32602,message:'position.character required'}}); if(referencesEmptyCount>0){referencesEmptyCount-=1;return send({jsonrpc:'2.0',id:msg.id,result:[]});} if(requiredOpenCount>0&&openedUris.length<requiredOpenCount)return send({jsonrpc:'2.0',id:msg.id,result:[]}); const uris=requiredOpenCount>0?openedUris:[msg.params.textDocument.uri]; return send({jsonrpc:'2.0',id:msg.id,result:uris.map(uri=>({uri,range:{start:{line:0,character:16},end:{line:0,character:21}}}))}); }
+  if(msg.method==='textDocument/implementation') { if(msg.params?.position?.character===999) return send({jsonrpc:'2.0',id:msg.id,error:{code:-32601,message:'method not found'}}); const uri=openedUris.find(x=>x!==msg.params.textDocument.uri)??msg.params.textDocument.uri; return send({jsonrpc:'2.0',id:msg.id,result:[{uri,range:{start:{line:0,character:16},end:{line:0,character:21}}}]}); }
+  if(msg.method==='textDocument/rename') { if(msg.params?.newName==='UNSUPPORTED') return send({jsonrpc:'2.0',id:msg.id,error:{code:-32601,message:'method not found'}}); const changes={}; for(const uri of (openedUris.length?openedUris:[msg.params.textDocument.uri])) changes[uri]=[{range:{start:{line:0,character:16},end:{line:0,character:21}},newText:msg.params.newName}]; return send({jsonrpc:'2.0',id:msg.id,result:{changes}}); }
   if(msg.method==='textDocument/diagnostic') return send({jsonrpc:'2.0',id:msg.id,result:{kind:'full',items:[{range:{start:{line:0,character:0},end:{line:0,character:5}},severity:1,code:'fixture',message:'fixture diagnostic'}]}});
   if(msg.method==='never') return;
   if(msg.method==='oversize') return send({jsonrpc:'2.0',id:msg.id,result:{blob:'x'.repeat(65536)}});

package/test/helpers/autonomous-r34-fixture.mjs

@@ -4,6 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { generateTrustKeypair } from '../../src/trust.mjs';
 import { createCodingRuntime, loadCodingPolicy } from '../../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../../src/machine-fs.mjs';
 import { loadAutonomousPolicy } from '../../src/autonomous-policy.mjs';
 import { createNativeDiffRuntime } from '../../src/native-diff.mjs';
 import { createAutonomousRuntime } from '../../src/autonomous-runtime.mjs';
@@ -69,12 +70,13 @@ export async function createR34Fixture({authority='armed',withFailingProfile=fal
   if(authority==='armed') await arm();
   const baseCodingRuntime = createCodingRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const codingRuntime = codingRuntimeFactory ? codingRuntimeFactory(baseCodingRuntime) : baseCodingRuntime;
-  const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const machineFsRuntime = createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const nativeDiffRuntime = nativeDiffRuntimeFactory ? nativeDiffRuntimeFactory(baseNativeDiffRuntime) : baseNativeDiffRuntime;
-  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,
+  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
     signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   return {
-    root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
+    root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,machineFsRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
     initial_sha256:sha(await readFile(target)),arm,disarm,
     cleanup:()=>rm(root,{recursive:true,force:true})
   };

package/test/multi-file-read.test.mjs

@@ -35,6 +35,9 @@ test('coding_files_read reads bounded mixed encodings in one MCP call and fails
     assert.ok((await f.client.listTools()).tools.some(t=>t.name==='coding_files_read'));
     const result=structured(await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'b.txt',encoding:'utf8'},{path:'c.bin',encoding:'base64'}],max_total_bytes:64}}));
     assert.equal(result.status,'ok'); assert.equal(result.files.length,3); assert.equal(result.total_bytes,15); assert.equal(result.files[0].content,'alpha\n'); assert.equal(result.files[2].content,Buffer.from([0,1,2,255]).toString('base64'));
+    assert.match(result.observation_sha256,/^[0-9a-f]{64}$/);
+    const repeat=structured(await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'b.txt',encoding:'utf8'},{path:'c.bin',encoding:'base64'}],max_total_bytes:64}}));
+    assert.equal(repeat.observation_sha256,result.observation_sha256);
     const denied=await f.client.callTool({name:'coding_files_read',arguments:{root_id:'project',files:[{path:'a.txt',encoding:'utf8'},{path:'.git/secret',encoding:'utf8'}],max_total_bytes:64}});
     assert.equal(denied.isError,true); assert.equal(denied.structuredContent.status,'failed'); assert.match(denied.structuredContent.error,/denied by policy/);
   } finally {await f.client.close().catch(()=>{}); await rm(f.root,{recursive:true,force:true}).catch(()=>{});}

package/test/native-diff-topology-r36.test.mjs

@@ -0,0 +1,105 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { access, mkdtemp, mkdir, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createCodingRuntime, loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../src/machine-fs.mjs';
+import { loadAutonomousPolicy } from '../src/autonomous-policy.mjs';
+import { createNativeDiffRuntime, NATIVE_DIFF_V2_SCHEMA } from '../src/native-diff.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const exists=file=>access(file).then(()=>true,()=>false);
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r36-topology-'));
+  const project=path.join(root,'project'); const trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  const codingPath=path.join(root,'coding-policy.json');
+  await writeFile(codingPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:path.join(root,'coding-lease.json'),evidence_dir:path.join(root,'coding-evidence'),roots:{project:{path:project,read:true,write:true,exec:false,deny_paths:[]}},commands:{},max_read_bytes:524288,max_write_bytes:2097152}));
+  const codingPolicy=await loadCodingPolicy(codingPath);
+  await writeFile(codingPolicy.lease_file,JSON.stringify({schema:'deadbyte.coding-lease.v1',policy_sha256:codingPolicy.policy_sha256,instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+3600000).toISOString()}));
+  const autoPath=path.join(root,'autonomous-policy.json');
+  await writeFile(autoPath,JSON.stringify({schema:'deadbyte.autonomous-policy.v1',enabled:true,lease_file:path.join(root,'auto-lease.json'),evidence_dir:path.join(root,'auto-evidence'),root_ids:['project'],coding_policy_sha256:codingPolicy.policy_sha256,planner:{backend:'client_sampling',max_tokens:2048},profiles:{},limits:{max_files_per_diff:12,max_diff_bytes:1048576}}));
+  const policy=await loadAutonomousPolicy(autoPath,codingPolicy);
+  await writeFile(policy.lease_file,JSON.stringify({schema:'deadbyte.autonomous-lease.v1',policy_sha256:policy.policy_sha256,instance_nonce:randomBytes(32).toString('hex'),root_ids:['project'],armed_at_utc:new Date().toISOString(),expires_at_utc:new Date(Date.now()+1800000).toISOString()}));
+  const codingRuntime=createCodingRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const machineFsRuntime=createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const nativeDiff=createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  return {root,project,keys,policy,codingRuntime,machineFsRuntime,nativeDiff};
+}
+
+test('R36 Native Diff V2 commits mkdir write move and independently verifies mixed receipts',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'seed.txt'),'seed\n');
+    const seed=await f.machineFsRuntime.stat({rootId:'project',relativePath:'seed.txt',hash:true});
+    const preview=await f.nativeDiff.preview({rootId:'project',title:'topology commit',operations:[
+      {kind:'mkdir',path:'dst'},
+      {kind:'write',path:'dst/new.txt',expected_sha256:'absent',encoding:'utf8',content:'new\n'},
+      {kind:'move',source_path:'seed.txt',destination_path:'dst/seed.txt',expected_source_identity:seed.identity_sha256}
+    ]});
+    assert.equal(preview.schema,NATIVE_DIFF_V2_SCHEMA); assert.equal(preview.operation_count,3);
+    const applied=await f.nativeDiff.apply({diffId:preview.diff_id});
+    assert.equal(applied.status,'committed');
+    assert.equal(await readFile(path.join(f.project,'dst','new.txt'),'utf8'),'new\n');
+    assert.equal(await readFile(path.join(f.project,'dst','seed.txt'),'utf8'),'seed\n');
+    assert.equal(await exists(path.join(f.project,'seed.txt')),false);
+    const verified=await f.nativeDiff.verify({diffId:preview.diff_id});
+    assert.equal(verified.ok,true); assert.equal(verified.current_state_matches,true);
+    assert.equal(verified.operation_receipts_verified,3);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rolls back mkdir/write when later topology operation fails',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'seed.txt'),'seed\n');
+    const seed=await f.machineFsRuntime.stat({rootId:'project',relativePath:'seed.txt',hash:true});
+    const preview=await f.nativeDiff.preview({rootId:'project',title:'topology rollback',operations:[
+      {kind:'mkdir',path:'dst'},
+      {kind:'write',path:'dst/temp.txt',expected_sha256:'absent',encoding:'utf8',content:'temporary\n'},
+      {kind:'move',source_path:'seed.txt',destination_path:'dst/seed.txt',expected_source_identity:seed.identity_sha256}
+    ]});
+    const sabotaged=Object.freeze({...f.machineFsRuntime,move:async()=>{throw new Error('forced topology failure');}});
+    const runtime=createNativeDiffRuntime({policy:f.policy,codingRuntime:f.codingRuntime,machineFsRuntime:sabotaged,signingKeyPath:f.keys.privateKeyPath,verifyKeyPath:f.keys.publicKeyPath});
+    await assert.rejects(runtime.apply({diffId:preview.diff_id}),/rolled back/i);
+    assert.equal(await exists(path.join(f.project,'dst')),false);
+    assert.equal(await readFile(path.join(f.project,'seed.txt'),'utf8'),'seed\n');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rejects stale move identity and destination collision before mutation',async()=>{
+  const f=await fixture(); try{
+    await writeFile(path.join(f.project,'a.txt'),'one'); await writeFile(path.join(f.project,'b.txt'),'occupied');
+    const state=await f.machineFsRuntime.stat({rootId:'project',relativePath:'a.txt',hash:true});
+    await writeFile(path.join(f.project,'a.txt'),'two');
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'move',source_path:'a.txt',destination_path:'c.txt',expected_source_identity:state.identity_sha256}]}),/identity|precondition/i);
+    const fresh=await f.machineFsRuntime.stat({rootId:'project',relativePath:'a.txt',hash:true});
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'move',source_path:'a.txt',destination_path:'b.txt',expected_source_identity:fresh.identity_sha256}]}),/destination.*absent|collision|precondition/i);
+    assert.equal(await readFile(path.join(f.project,'a.txt'),'utf8'),'two');
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 rmdir accepts only exact empty directory identity',async()=>{
+  const f=await fixture(); try{
+    await mkdir(path.join(f.project,'empty')); await mkdir(path.join(f.project,'nonempty')); await writeFile(path.join(f.project,'nonempty','x.txt'),'x');
+    const empty=await f.machineFsRuntime.stat({rootId:'project',relativePath:'empty'});
+    const nonempty=await f.machineFsRuntime.stat({rootId:'project',relativePath:'nonempty'});
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'nonempty',expected_source_identity:nonempty.identity_sha256}]}),/empty/i);
+    const preview=await f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'empty',expected_source_identity:empty.identity_sha256}]});
+    assert.equal((await f.nativeDiff.apply({diffId:preview.diff_id})).status,'committed');
+    assert.equal(await exists(path.join(f.project,'empty')),false);
+    assert.equal((await f.nativeDiff.verify({diffId:preview.diff_id})).ok,true);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R36 Native Diff V2 denies topology through reparse points',async t=>{
+  const f=await fixture(); try{
+    const outside=path.join(f.root,'outside'); await mkdir(outside);
+    const link=path.join(f.project,'link');
+    try { await symlink(outside,link,process.platform==='win32'?'junction':'dir'); }
+    catch(error){ if(['EPERM','EACCES','ENOSYS'].includes(error?.code)){t.skip(`symlink unavailable: ${error.code}`);return;} throw error; }
+    await assert.rejects(f.nativeDiff.preview({rootId:'project',operations:[{kind:'rmdir',path:'link',expected_source_identity:'0'.repeat(64)}]}),/reparse|symlink/i);
+  } finally {await rm(f.root,{recursive:true,force:true});}
+});

package/test/package-boundary.test.mjs

@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
 const root = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
@@ -22,6 +23,11 @@ function packFiles() {
   return entry.files.map(item => item.path.replaceAll('\\', '/')).sort();
 }
 
+test('R36 successor source root contains no nested npm tarball artifacts',()=>{
+  const tarballs=readdirSync(root,{withFileTypes:true}).filter(item=>item.isFile()&&item.name.endsWith('.tgz')).map(item=>item.name).sort();
+  assert.deepEqual(tarballs,[]);
+});
+
 test('R28 package boundary contains only immutable workspace seed files', () => {
   const files = packFiles();
   const workspacePayload = files.filter(rel => rel.startsWith('workspaces/'));