deadbyte-mcp 0.9.0 → 0.11.0

package/docs/superpowers/plans/2026-09-18-r36-zero-loss-autonomy.md

@@ -0,0 +1,739 @@
+# DEADBYTE MCP R36 Zero-Loss Autonomy Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ship DEADBYTE MCP `0.10.0 / R36` with zero-loss compact remote capability reachability, broader production coding autonomy, RDC-style live activity, evidence-backed semantic/topology/process workflows, and exact npm publication of the verified artifact.
+
+**Architecture:** Preserve the R35 typed/evidence-first runtime and add a canonical capability ledger plus compact typed gateways so the actual remote connector can reach every production non-host capability while staying at or below the observed 42-tool ceiling. Upgrade inspection, semantic rename, topology transactions, process/planner reachability, and live activity without introducing raw shell or arbitrary stdin; release remains manifest-bound, rollback-proven, independently verified, and byte-identical through npm publication.
+
+**Tech Stack:** Node.js >=22, ESM, `@modelcontextprotocol/server` 2.0.0, `@modelcontextprotocol/client` 2.0.0, Zod 4.4.3, TypeScript language service 5.9.3, Windows PowerShell 5.1/7, existing C++ native process/containment components, Ed25519 receipts, SHA-256 content identity.
+
+**Spec:** `docs/superpowers/specs/2026-09-18-r36-zero-loss-autonomy-design.md`
+
+## Global Constraints
+
+- R36 public identity is `0.10.0 / R36`.
+- R35 `0.9.0` frozen source root `D:\Projects\deadbyte-mcp-r35-release-v0.9.0-r2` and manifest `b95e1ec1d9a7e26a96ef492306c1be4df18c883ff03ab3b6015f677d7429ec8d` are immutable.
+- R35 npm tarball SHA-256 `b9f1b6652f4c70ab9ab515908355a00fa1a84d1f4cb9fc8d4055de41a4f1e805` is immutable and remains available after R36 release.
+- Process, coding, autonomous, and host authority remain independently revocable; R36 remote MUST NOT auto-arm Host.
+- No raw shell string, arbitrary executable dispatch, raw arbitrary stdin, or generic `tool_name + JSON` gateway is introduced.
+- Full profile preserves direct typed tools; compact profile is <=42 tools and must reach 100% of declared production non-host capability ids.
+- Every mutation keeps stale-state/precondition semantics and existing receipt/audit requirements.
+- All behavior changes use RED -> GREEN TDD; full regression and Windows/release gates run only after focused slices are green.
+- Workspace is NON-GIT. Do not invent commits. Every task ends with fresh tests plus a hash/evidence checkpoint.
+- Frozen candidates are never edited. A post-freeze defect creates a successor candidate root (`r1`, `r2`, ...).
+- npm publication uses the exact already-verified tarball; browser/2FA confirmation is the only operator-local step if npm requires it.
+
+---
+
+### Task 1: Canonical Capability Ledger and Surface Profiles
+
+**Files:**
+- Create: `src/capability-ledger.mjs`
+- Create: `test/capability-ledger-r36.test.mjs`
+- Modify: `src/tool-surface-ledger.mjs`
+- Modify: `src/mcp-server.mjs`
+- Modify: `src/operator-surface.mjs`
+- Test: `test/tool-surface-ledger.test.mjs`
+- Test: `test/package-boundary.test.mjs`
+
+**Interfaces:**
+- Produces `createCapabilityLedger(entries)` returning an immutable ledger keyed by stable capability id.
+- Produces `capabilityProfileFromEnv(env)` returning `'full' | 'compact'`.
+- Produces `assertCapabilityClosure({ledger, fullToolSnapshot, compactToolSnapshot})`.
+- Later tasks register direct/full and gateway/compact routes against this ledger.
+
+- [ ] **Step 1: Write failing ledger/profile tests**
+
+Add tests that require duplicate capability ids to fail, require each production non-host capability to have both a full route and compact route, allow host-only capabilities to omit compact routing, and enforce compact tool count <=42.
+
+```js
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createCapabilityLedger, assertCapabilityClosure } from '../src/capability-ledger.mjs';
+
+test('R36 capability ledger rejects duplicate ids', () => {
+  assert.throws(() => createCapabilityLedger([
+    {id:'coding.search', full_tool:'coding_search', compact_tool:'coding_inspect', compact_op:'search', production:true, host_only:false},
+    {id:'coding.search', full_tool:'x', compact_tool:'y', compact_op:'z', production:true, host_only:false}
+  ]), /duplicate capability id/);
+});
+
+test('R36 compact closure covers every production non-host capability', () => {
+  const ledger=createCapabilityLedger([
+    {id:'coding.search', full_tool:'coding_search', compact_tool:'coding_inspect', compact_op:'search', production:true, host_only:false},
+    {id:'host.exec', full_tool:'host_exec', compact_tool:null, compact_op:null, production:false, host_only:true}
+  ]);
+  assert.equal(assertCapabilityClosure({ledger, fullTools:['coding_search','host_exec'], compactTools:['coding_inspect']}), true);
+});
+```
+
+- [ ] **Step 2: Run focused tests and confirm RED**
+
+Run:
+
+```powershell
+node --test test/capability-ledger-r36.test.mjs
+```
+
+Expected: FAIL because `src/capability-ledger.mjs` does not exist.
+
+- [ ] **Step 3: Implement canonical ledger/profile primitives**
+
+Implement immutable normalized entries with these required fields:
+
+```js
+{
+  id, full_tool, compact_tool, compact_op,
+  runtime_flag, authority,
+  mutating, receipt_class,
+  production, host_only
+}
+```
+
+Reject unknown authority values; allowed authorities are `none`, `process`, `coding`, `autonomous`, `host`. Canonically sort by `id` before hashing with SHA-256.
+
+- [ ] **Step 4: Bind MCP server profile selection**
+
+In `src/mcp-server.mjs`, resolve:
+
+```js
+const surfaceProfile = capabilityProfileFromEnv(process.env);
+```
+
+Local stdio default is `full`; remote Bridge will later set compact explicitly. Registration must preserve existing full tool behavior.
+
+- [ ] **Step 5: Run focused ledger/surface tests**
+
+Run:
+
+```powershell
+node --test test/capability-ledger-r36.test.mjs test/tool-surface-ledger.test.mjs test/package-boundary.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 6: Evidence checkpoint**
+
+Record SHA-256 for `src/capability-ledger.mjs`, `src/mcp-server.mjs`, and the focused test output in an external `D:\Projects\deadbyte-r36-evidence\task-01.json`; do not write mutable evidence into a future frozen candidate.
+
+---
+
+### Task 2: Compact Typed Gateways and Actual <=42 Tool Surface
+
+**Files:**
+- Create: `src/compact-gateway-mcp-tools.mjs`
+- Create: `src/compact-gateway-output-contracts.mjs`
+- Create: `test/compact-gateway-r36.test.mjs`
+- Modify: `src/mcp-server.mjs`
+- Modify: `src/coding-mcp-tools.mjs`
+- Modify: `src/machine-fs-mcp-tools.mjs`
+- Modify: `src/process-mcp-tools.mjs`
+- Modify: `src/observation-mcp-tools.mjs`
+- Modify: `src/machine-mcp-tools.mjs`
+- Modify: `test/remote-r24-catalog.test.mjs`
+- Modify: `test/output-schema.test.mjs`
+
+**Interfaces:**
+- Produces compact tools `capability_manifest`, `coding_inspect`, `machine_fs`, `process_session`, `machine_observe`.
+- Each tool uses a Zod discriminated union; no generic arbitrary dispatch field is accepted.
+- Gateway handlers call runtime methods directly, not MCP-to-MCP recursion.
+
+- [ ] **Step 1: Write RED schema tests for five compact gateways**
+
+Require unknown ops to fail schema validation and verify that representative operations preserve required preconditions, for example:
+
+```js
+const codingInspectInput = z.discriminatedUnion('op', [
+  z.strictObject({op:z.literal('stat'), root_id:id, path:relPath, hash:z.boolean().default(false)}),
+  z.strictObject({op:z.literal('search'), root_id:id, path:relPath.default('.'), query:searchQuery}),
+  z.strictObject({op:z.literal('files_read'), root_id:id, files:fileList, max_total_bytes:byteBound}),
+  z.strictObject({op:z.literal('symbol_outline'), root_id:id, path:relPath, max_symbols:symbolBound}),
+  z.strictObject({op:z.literal('symbol_definition'), root_id:id, path:relPath, line:nonneg, column:nonneg}),
+  z.strictObject({op:z.literal('symbol_references'), root_id:id, path:relPath, line:nonneg, column:nonneg}),
+  z.strictObject({op:z.literal('symbol_diagnostics'), root_id:id, path:relPath}),
+  z.strictObject({op:z.literal('symbol_implementations'), root_id:id, path:relPath, line:nonneg, column:nonneg}),
+  z.strictObject({op:z.literal('symbol_rename_preview'), root_id:id, path:relPath, line:nonneg, column:nonneg, new_name:symbolName})
+]);
+```
+
+- [ ] **Step 2: Run gateway tests and confirm RED**
+
+```powershell
+node --test test/compact-gateway-r36.test.mjs
+```
+
+Expected: FAIL because gateway module is absent.
+
+- [ ] **Step 3: Implement runtime-direct gateways**
+
+Build operation tables as closed objects keyed only by validated discriminated-union ops. Do not accept an arbitrary tool name string. Preserve underlying result structures and `isError` semantics.
+
+- [ ] **Step 4: Register compact profile**
+
+When `surfaceProfile==='compact'`, register the essential direct control tools plus five gateways while omitting redundant direct inspection/machine-fs/process/observation names. Keep direct Host tools only if host policy is configured; Host remains disarmed unless operator arms it locally.
+
+- [ ] **Step 5: Add exact compact catalog test**
+
+Negotiate a real stdio server in compact mode and assert:
+
+```js
+assert.ok(toolNames.length <= 42);
+assert.deepEqual(new Set(requiredGatewayNames), new Set(toolNames.filter(x => requiredGatewayNames.includes(x))));
+assert.equal(assertCapabilityClosure(...), true);
+```
+
+- [ ] **Step 6: Run focused surface tests**
+
+```powershell
+node --test test/compact-gateway-r36.test.mjs test/remote-r24-catalog.test.mjs test/output-schema.test.mjs test/tool-surface-ledger.test.mjs
+```
+
+Expected: 0 failures and compact catalog <=42.
+
+- [ ] **Step 7: Evidence checkpoint**
+
+Emit full and compact canonical tool snapshots plus capability closure SHA-256 to `D:\Projects\deadbyte-r36-evidence\task-02.json`.
+
+---
+
+### Task 3: Production Search, Rich Stat, and Multi-Read Observation Identity
+
+**Files:**
+- Modify: `src/coding-search.mjs`
+- Modify: `src/coding-plane.mjs`
+- Modify: `src/coding-mcp-tools.mjs`
+- Modify: `src/coding-output-contracts.mjs`
+- Create: `src/search-cursor.mjs`
+- Create: `test/coding-search-r36.test.mjs`
+- Modify: `test/coding-runtime.test.mjs`
+- Modify: `test/multi-file-read.test.mjs`
+
+**Interfaces:**
+- Search query supports `target:'content'|'path'`, `mode:'literal'|'regex'`, deterministic paging cursor, multiple matches per file, scan-byte bounds, result digests.
+- `codingRuntime.stat()` returns reparse classification and `observation_sha256`.
+- Multi-read returns `observation_sha256` over ordered `(path,sha256,bytes,encoding)`.
+
+- [ ] **Step 1: Write RED search tests**
+
+Cover literal content, regex content, path search, multiple matches per file, deterministic ordering, binary skip/classification, stale cursor rejection, cursor query binding, and scan-byte truncation.
+
+```js
+const first = await search({rootId:'core', path:'.', target:'content', mode:'regex', pattern:'foo\\d+', pageSize:2});
+assert.equal(first.matches.length, 2);
+assert.match(first.query_sha256, /^[0-9a-f]{64}$/);
+assert.match(first.page_sha256, /^[0-9a-f]{64}$/);
+assert.ok(first.next_cursor);
+await assert.rejects(() => search({...differentQuery, cursor:first.next_cursor}), /cursor.*query/i);
+```
+
+- [ ] **Step 2: Run RED test**
+
+```powershell
+node --test test/coding-search-r36.test.mjs
+```
+
+Expected: FAIL because R35 search only accepts literal mode and has no cursor identity.
+
+- [ ] **Step 3: Implement `search-cursor.mjs`**
+
+Cursor body contains schema, query SHA-256, ordered snapshot/file identities or durable observation search id, next offset, and HMAC/signature binding using the existing authenticated state/evidence convention. Foreign/stale cursor must fail closed.
+
+- [ ] **Step 4: Upgrade search implementation**
+
+Use deterministic path sorting; for content search collect multiple line/column matches until page/scan bounds. Compile regex once with bounded pattern length; invalid regex fails before repository scan. Do not lossy-decode binary files.
+
+- [ ] **Step 5: Upgrade stat and multi-read identities**
+
+Add `normalized_path`, `type`, `bytes`, `mtime_utc`, optional file SHA, reparse classification, policy root, and `observation_sha256`. Multi-read aggregate digest is computed from ordered metadata, not raw secret content.
+
+- [ ] **Step 6: Run focused inspection tests**
+
+```powershell
+node --test test/coding-search-r36.test.mjs test/coding-runtime.test.mjs test/multi-file-read.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 7: Evidence checkpoint**
+
+Store representative literal/regex/path search page identities and stale-cursor rejection output in external task evidence.
+
+---
+
+### Task 4: Semantic Diagnostics, Implementations, and Transactional Rename Preview
+
+**Files:**
+- Modify: `src/semantic-code.mjs`
+- Modify: `src/semantic-lsp-backend.mjs`
+- Modify: `src/semantic-backend-registry.mjs`
+- Modify: `src/coding-mcp-tools.mjs`
+- Modify: `src/coding-output-contracts.mjs`
+- Modify: `src/native-diff.mjs`
+- Create: `test/semantic-r36-rename.test.mjs`
+- Modify: `test/semantic-code.test.mjs`
+- Modify: `test/semantic-lsp-backend.test.mjs`
+- Modify: `test/semantic-multilang.test.mjs`
+
+**Interfaces:**
+- `semanticRuntime.diagnostics(args)` becomes public/compact reachable.
+- Add `semanticRuntime.implementations(args)` returning normalized locations or explicit unsupported capability.
+- Add `semanticRuntime.renamePreview({rootId,relativePath,line,column,newName})` returning `{diff_id, affected_files, edit_count, backend, preimages}` without mutation.
+
+- [ ] **Step 1: Write RED semantic tests**
+
+Require diagnostics result identity, implementation lookup normalization, and rename preview that does not alter source bytes before `native_diff_apply`.
+
+```js
+const before = await coding.fileRead(...);
+const preview = await semantic.renamePreview({rootId:'core', relativePath:'src/a.ts', line:1, column:10, newName:'renamed'});
+assert.match(preview.diff_id, /^[0-9a-f]{64}$/);
+assert.equal((await coding.fileRead(...)).sha256, before.sha256);
+```
+
+- [ ] **Step 2: Run RED semantic tests**
+
+```powershell
+node --test test/semantic-r36-rename.test.mjs
+```
+
+Expected: FAIL because `implementations` and `renamePreview` are absent.
+
+- [ ] **Step 3: Implement backend capability methods**
+
+TypeScript backend uses language-service implementation/rename APIs. External LSP backends normalize `textDocument/implementation` and rename edits only when backend supports them. Unsupported operations return typed unsupported result instead of grep fallback.
+
+- [ ] **Step 4: Convert rename edits into Native Diff**
+
+Group edits per file, read exact current SHA-256 preimages, generate deterministic replacement operations, preview one content-addressed diff, and return its id. Any overlapping/ambiguous edit set fails before diff creation.
+
+- [ ] **Step 5: Test preview/apply/verify lifecycle**
+
+```powershell
+node --test test/semantic-r36-rename.test.mjs test/semantic-code.test.mjs test/semantic-lsp-backend.test.mjs test/semantic-multilang.test.mjs test/native-diff.test.mjs
+```
+
+Expected: 0 failures; stale preimage apply must reject.
+
+- [ ] **Step 6: Evidence checkpoint**
+
+Capture one cross-file rename preview/apply/verify chain with diff id and receipt ids, plus explicit unsupported-operation evidence for a backend lacking implementations.
+
+---
+
+### Task 5: Native Diff V2 Topology Transactions
+
+**Files:**
+- Modify: `src/native-diff.mjs`
+- Modify: `src/machine-fs.mjs`
+- Modify: `src/machine-fs-output-contracts.mjs`
+- Modify: `src/machine-fs-mcp-tools.mjs`
+- Create: `test/native-diff-topology-r36.test.mjs`
+- Modify: `test/native-diff.test.mjs`
+- Modify: `test/machine-fs-runtime.test.mjs`
+
+**Interfaces:**
+- Native Diff V2 operations add `mkdir`, `move`, and explicit empty-directory delete while preserving V1 read/verify compatibility.
+- `move` requires source identity and destination absence/exact identity.
+- Topology preimage is signed before first mutation; rollback is verified or transaction becomes `conflicted`/`ambiguous`.
+
+- [ ] **Step 1: Write RED topology transaction tests**
+
+Cover mkdir->write->move transaction, later-operation failure rollback, stale source identity, destination collision, reparse denial, and explicit empty-dir delete only.
+
+- [ ] **Step 2: Run RED test**
+
+```powershell
+node --test test/native-diff-topology-r36.test.mjs
+```
+
+Expected: FAIL because Native Diff currently accepts only write/replace/delete file operations.
+
+- [ ] **Step 3: Version Native Diff transaction schema**
+
+Keep V1 verifier compatibility. V2 normalized operations must include precondition identity fields and canonical sorting/serialization rules used in `diff_id`.
+
+- [ ] **Step 4: Implement topology preimage/apply/rollback**
+
+Capture parent/source/destination identities before mutation. Roll back in reverse operation order. If rollback verification fails, emit terminal ambiguous/conflicted evidence and never success.
+
+- [ ] **Step 5: Run topology and machine-fs tests**
+
+```powershell
+node --test test/native-diff-topology-r36.test.mjs test/native-diff.test.mjs test/machine-fs-runtime.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 6: Evidence checkpoint**
+
+Persist one successful topology transaction and one induced rollback transaction with independent verification results.
+
+---
+
+### Task 6: Process Reachability and Capability-Aware Autonomous Planner
+
+**Files:**
+- Modify: `src/autonomous-planner-contracts.mjs`
+- Modify: `src/autonomous-planner.mjs`
+- Modify: `src/autonomous-runtime.mjs`
+- Modify: `src/autonomous-context-engine.mjs`
+- Modify: `src/autonomous-progress.mjs`
+- Modify: `src/process-runtime.mjs`
+- Modify: `src/process-output-contracts.mjs`
+- Create: `test/autonomous-capability-r36.test.mjs`
+- Create: `test/process-longrun-r36.test.mjs`
+- Modify: `test/autonomous-loop-v2.test.mjs`
+- Modify: `test/process-runtime.test.mjs`
+
+**Interfaces:**
+- Planner receives canonical configured capability manifest.
+- Typed planner actions include search/stat/multi-read/semantic/native-diff/machine-fs/process/observation/release actions.
+- Legacy generic `delegate` must validate into a typed action or be rejected.
+- Process long-run API remains existing `process_session_*` semantics with ordered cursor and owned logical session identity.
+
+- [ ] **Step 1: Write RED planner contract tests**
+
+Require parsing of first-class `search`, `stat`, `semantic_references`, `semantic_rename_preview`, `process_start/read/status/action/terminate`, `machine_fs_*`, and `observation_*` actions. Assert arbitrary delegate records fail.
+
+- [ ] **Step 2: Write RED long-process tests**
+
+Start an approved fixture profile, return before child exit, read output in multiple monotonic cursor chunks, observe exit, reject stale/foreign session ids, terminate owned session, and reconcile after wrapper restart.
+
+- [ ] **Step 3: Run RED tests**
+
+```powershell
+node --test test/autonomous-capability-r36.test.mjs test/process-longrun-r36.test.mjs
+```
+
+Expected: planner action test fails on missing typed variants; process tests may expose any cursor/reconciliation gaps.
+
+- [ ] **Step 4: Implement typed planner action union and executor mapping**
+
+Map each action to existing runtime primitives; no action may self-arm authority. Capability manifest included in planner prompt/context lists only configured routes and authority class.
+
+- [ ] **Step 5: Strengthen progress identity**
+
+Progress fingerprint must include capability id, observation identity, mutation epoch, evidence ids, and process session/cursor state while excluding rationale prose.
+
+- [ ] **Step 6: Run planner/process focused suites**
+
+```powershell
+node --test test/autonomous-capability-r36.test.mjs test/process-longrun-r36.test.mjs test/autonomous-loop-v2.test.mjs test/process-runtime.test.mjs test/process-supervision.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 7: Evidence checkpoint**
+
+Record an autonomous fixture that searches, inspects symbols, applies a diff, starts a test process, reads incremental output, repairs a failure, and reaches release gate without operator transport commands.
+
+---
+
+### Task 7: Finish and Harden RDC-Style Live Activity
+
+**Files:**
+- Modify: `src/remote-live-log.mjs`
+- Modify: `src/deadbyte-cli.mjs`
+- Modify: `src/remote-result-journal.mjs`
+- Modify: `src/remote-session-guardian.mjs`
+- Modify: `test/remote-live-log-r36.test.mjs`
+- Modify: `test/remote-session-cli.test.mjs`
+- Create: `test/remote-live-log-recovery-r36.test.mjs`
+
+**Interfaces:**
+- Existing precursor `▶ RUN / ✅ OK / ❌ ERR` formatter is retained.
+- Add startup/connect/session/recovery markers `🚀`, `🔌`, `🔐`, `♻️`, `⚠️` with emoji only where semantically useful.
+- Correlate request/result by request id and expose bounded sanitized summaries.
+
+- [ ] **Step 1: Extend RED tests before changing precursor code**
+
+Require bridge/cloud connection lifecycle, session restored/new, ONLINE readiness, explicit Host DISARMED, request-before-result, duration, orphan/interrupted request reconciliation, and cleanup visibility.
+
+- [ ] **Step 2: Run live-log tests and confirm only missing R36 behaviors fail**
+
+```powershell
+node --test test/remote-live-log-r36.test.mjs test/remote-live-log-recovery-r36.test.mjs test/remote-session-cli.test.mjs
+```
+
+Expected: existing precursor cases remain green; new lifecycle/recovery cases are RED.
+
+- [ ] **Step 3: Implement lifecycle/recovery lines**
+
+Start watcher baseline before startup. Existing files tail from old EOF; files created after baseline start at byte zero. Compact mode never prints raw content/replacement/token/private-key fields.
+
+- [ ] **Step 4: Verify Host is never auto-armed**
+
+Trace controller commands and assert no `armhost` occurs in bare `remote`; status line must show Host DISARMED. Cleanup may call `disarmhost` fail-safe.
+
+- [ ] **Step 5: Run complete remote integration**
+
+```powershell
+node --test test/remote-live-log-r36.test.mjs test/remote-live-log-recovery-r36.test.mjs test/remote-session-cli.test.mjs test/remote-result-journal.test.mjs
+```
+
+Expected: 0 failures.
+
+- [ ] **Step 6: Evidence checkpoint**
+
+Capture a deterministic sample compact transcript and a verbose transcript with sanitized audit ids; scan both for known fixture secrets and assert zero raw secret matches.
+
+---
+
+### Task 8: R36 Capability/Competitor Benchmark Corpus
+
+**Files:**
+- Modify: `bench/fixtures/corpus.json`
+- Modify: `src/capability-benchmark.mjs`
+- Modify: `src/capability-benchmark-runner.mjs`
+- Create: `bench/fixtures/r36/` fixture tree
+- Create: `test/capability-benchmark-r36.test.mjs`
+- Modify: `test/capability-benchmark.test.mjs`
+- Modify: `test/capability-benchmark-runner.test.mjs`
+- Modify: `README.txt`
+- Create: `docs/R36-CAPABILITY-EVIDENCE.md`
+
+**Interfaces:**
+- Corpus contains the 30 required cases from the R36 spec.
+- Metrics: correctness, round trips, elapsed time, bytes returned, stale-state rejection, duplicate side effects, recovery success, reachability, evidence verify result, release gate result.
+- Competitor matrix separates `documented` from `direct_observation` evidence.
+
+- [ ] **Step 1: Write RED corpus identity tests**
+
+Assert exact case ids and reject duplicate/missing required cases.
+
+- [ ] **Step 2: Run RED benchmark test**
+
+```powershell
+node --test test/capability-benchmark-r36.test.mjs
+```
+
+Expected: FAIL because R35 corpus has only 11 cases.
+
+- [ ] **Step 3: Add hermetic R36 fixtures and runner hooks**
+
+Each case must use local deterministic fixtures. External competitors are not required for PASS; direct competitor runs are optional evidence when service/quota allows. Documented upstream capability references must be dated and sourced.
+
+- [ ] **Step 4: Add anti-marketing assertions**
+
+README/docs may not state blanket superiority or tool-count victory. Comparative claims must reference a benchmark case/evidence id.
+
+- [ ] **Step 5: Run benchmark suite**
+
+```powershell
+node --test test/capability-benchmark-r36.test.mjs test/capability-benchmark.test.mjs test/capability-benchmark-runner.test.mjs
+```
+
+Then run the offline corpus runner and require all required cases correct.
+
+- [ ] **Step 6: Evidence checkpoint**
+
+Write aggregate benchmark evidence outside candidate tree with corpus SHA, fixture SHA, per-case evidence ids, and aggregate identity independent of timing noise.
+
+---
+
+### Task 9: Version 0.10.0, Full Regression, Surface Parity, and Release Candidate Freeze
+
+**Files:**
+- Modify: `package.json`
+- Modify: `src/version.mjs`
+- Modify: release identity tests (`test/release-version.test.mjs`, `test/r33-finalization.test.mjs` or R36 successor equivalent)
+- Modify: `scripts/gate-windows.ps1`
+- Modify: `scripts/windows-gate-evidence.mjs`
+- Modify: `scripts/release-parity.mjs`
+- Modify: `scripts/final-closure.mjs`
+- Modify: `scripts/final-closure-verify.mjs`
+- Create: R36 release-gate tests as needed
+
+**Interfaces:**
+- Package/version identity exactly `deadbyte-mcp@0.10.0` / R36.
+- Windows gate emits manifest-bound external evidence.
+- Release parity proves both full and compact capability surfaces and rollback/restore.
+
+- [ ] **Step 1: Write RED version/release tests**
+
+Require `package.json.version === '0.10.0'`, `DEADBYTE_VERSION === '0.10.0'`, R36 identity in final closure, and R35 exact predecessor identity.
+
+- [ ] **Step 2: Run version tests and confirm RED**
+
+```powershell
+node --test test/release-version.test.mjs test/r33-finalization.test.mjs
+```
+
+Expected: FAIL while current dev identity is still 0.9.0/R35.
+
+- [ ] **Step 3: Change version identity only after feature slices are green**
+
+Update package/version/release metadata to 0.10.0/R36. Do not change R35 predecessor hashes.
+
+- [ ] **Step 4: Run full source regression**
+
+```powershell
+npm test
+```
+
+Expected: 0 failures; intentional semantic skips are separately reported and must satisfy the R36 semantic tracer gate before Final.
+
+- [ ] **Step 5: Run semantic, compact-closure, benchmark, live-log, process, topology focused gates**
+
+Use explicit commands from Tasks 2-8 and preserve raw outputs externally.
+
+- [ ] **Step 6: Run canonical Windows gate**
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows.ps1
+```
+
+Expected: native build/smokes, source tests, process/machine-fs/observation/remote smokes, manifest write/verify, and R36 gate evidence PASS.
+
+- [ ] **Step 7: Freeze exact candidate**
+
+Copy only manifest-bound package files to a new immutable candidate root, mark it read-only according to existing release procedure, compute manifest SHA-256 and file count, and never edit this root afterward.
+
+- [ ] **Step 8: Adversarial diff against dev root**
+
+Prove candidate contains no live state/private keys/grants/cache/temp evidence and that only declared package files are present.
+
+---
+
+### Task 10: Activate, Roll Back to R35, Restore R36, and Final Closure
+
+**Files:**
+- No source mutation in frozen candidate.
+- External evidence only under `%USERPROFILE%\.deadbyte-mcp\evidence\...` and `D:\Projects\deadbyte-r36-evidence\...`.
+
+**Interfaces:**
+- Activation binds exact candidate manifest.
+- Rollback target is exact R35 `0.9.0` sealed predecessor.
+- Restore target is exact R36 candidate manifest.
+
+- [ ] **Step 1: Activate exact R36 candidate**
+
+Use existing signed immutable-slot activation workflow. Verify active pointer release/version/manifest exactly match candidate.
+
+- [ ] **Step 2: Run public full/compact parity**
+
+Negotiate live HTTPS MCP; verify canonical full surface and compact closure. When the actual ChatGPT connector is available, compare its visible catalog/capability manifest against canonical compact ledger.
+
+- [ ] **Step 3: Verify supervisor**
+
+Require `Loop supervisor: RUNNING [verified]` and stable live runtime identity across repeated probes.
+
+- [ ] **Step 4: Roll back to exact R35**
+
+Use signed predecessor receipt. Verify R35 release id/version/manifest and public smoke while R36 is inactive.
+
+- [ ] **Step 5: Restore exact R36**
+
+Restore the exact frozen R36 slot, not a rebuilt generation. Verify manifest identity and live public surface again.
+
+- [ ] **Step 6: Disarm all authority planes**
+
+Require Process/Coding/Autonomous/Host all DISARMED before closure.
+
+- [ ] **Step 7: Write and independently verify final closure**
+
+Run R36 closure writer and the implementation-independent verifier. Closure must bind candidate manifest, parity evidence, rollback receipt, restore receipt, supervisor proof, authority state, benchmark aggregate, and capability closure proof.
+
+- [ ] **Step 8: Evidence checkpoint**
+
+Record final closure path/SHA and independent verifier PASS. No “Final” claim before this step is green.
+
+---
+
+### Task 11: Exact npm Tarball, Publication, Registry Byte Proof, and Public Live Smoke
+
+**Files:**
+- No mutation to frozen candidate.
+- Create external staging directory such as `D:\Projects\deadbyte-r36-npm-stage\`.
+- Create external publish/verify helper scripts only when needed; hash-pin every helper before execution.
+
+**Interfaces:**
+- Exact pre-publish tarball SHA-256 is the release artifact identity for npm transport.
+- Publish `deadbyte-mcp@0.10.0` with dist-tag `latest`.
+- Registry-downloaded tarball SHA-256 must equal pre-publish tarball SHA-256 byte-for-byte.
+
+- [ ] **Step 1: Pack exact frozen candidate outside candidate root**
+
+```powershell
+npm pack "<R36_FROZEN_ROOT>" --pack-destination "D:\Projects\deadbyte-r36-npm-stage"
+```
+
+Compute SHA-256, SHA-1, and SHA-512/SRI. Inspect package identity, bin entry, file count, and forbidden paths.
+
+- [ ] **Step 2: Run local tarball npx smoke**
+
+Use a fresh npm cache and exact `.tgz` path:
+
+```powershell
+npx -y "D:\Projects\deadbyte-r36-npm-stage\deadbyte-mcp-0.10.0.tgz" --help
+npx -y "D:\Projects\deadbyte-r36-npm-stage\deadbyte-mcp-0.10.0.tgz" remote status
+npx -y "D:\Projects\deadbyte-r36-npm-stage\deadbyte-mcp-0.10.0.tgz" supervisor status
+```
+
+Require R36 help surface/live-log wording and successful status commands.
+
+- [ ] **Step 3: Pre-publish registry race check**
+
+Require `0.10.0` absent and record current dist-tags. If version already exists unexpectedly, stop; npm versions are immutable.
+
+- [ ] **Step 4: Publish exact tarball**
+
+```powershell
+npm publish "D:\Projects\deadbyte-r36-npm-stage\deadbyte-mcp-0.10.0.tgz" --access public --tag latest
+```
+
+If npm opens browser/2FA confirmation, operator completes only that npm-owned confirmation locally. Never send token/password/OTP through chat.
+
+- [ ] **Step 5: Wait for registry visibility without republishing**
+
+Poll boundedly until `npm view deadbyte-mcp versions --json` contains `0.10.0` and `npm view deadbyte-mcp dist-tags --json` shows `latest: 0.10.0`. Do not republish during normal propagation delay.
+
+- [ ] **Step 6: Download registry tarball and prove byte identity**
+
+```powershell
+npm pack deadbyte-mcp@0.10.0 --pack-destination "$env:TEMP\deadbyte-r36-registry-verify"
+Get-FileHash "$env:TEMP\deadbyte-r36-registry-verify\deadbyte-mcp-0.10.0.tgz" -Algorithm SHA256
+```
+
+Require exact equality with pre-publish SHA-256 and compare registry `dist.shasum`/`dist.integrity` to locally computed values.
+
+- [ ] **Step 7: Registry-backed public smoke**
+
+Using a fresh npm cache:
+
+```powershell
+npx -y deadbyte-mcp@latest --help
+npx -y deadbyte-mcp@latest remote status
+npx -y deadbyte-mcp@latest supervisor status
+```
+
+Then run real foreground:
+
+```powershell
+npx deadbyte-mcp@latest remote
+```
+
+Require R36 startup live activity (`🚀`, connection state, authority state), tool activity when a remote call arrives, and no Host auto-arm.
+
+- [ ] **Step 8: Final authority cleanup**
+
+Explicitly disarm autonomous, coding, process, and host; verify all four DISARMED after public smoke.
+
+- [ ] **Step 9: Publication evidence checkpoint**
+
+Record npm version, dist-tag, registry integrity/shasum/tarball URL, pre-publish SHA-256, registry-downloaded SHA-256, public smoke output hashes, and final authority state. Only then declare `R36 / 0.10.0 FINAL BASELINE — PUBLIC LIVE`.
+
+---
+
+## Plan Self-Review Checklist
+
+- Every R36 spec requirement maps to Tasks 1-11.
+- No task adds raw shell, generic arbitrary dispatch, arbitrary stdin, or Host auto-arm.
+- Compact surface success is measured by capability closure, not raw tool count.
+- Search/stat/multi-read, semantic diagnostics/implementations/rename, topology transactions, process control, planner parity, live logs, benchmarks, rollback/restore, and npm byte proof each have explicit tests/gates.
+- R35 exact predecessor identities are copied verbatim from the approved spec.
+- R36 version is consistently `0.10.0`.
+- All mutable evidence is external to future frozen candidate roots.
+- NON-GIT workspace uses evidence checkpoints instead of invented commits.
+- npm publication happens only after final closure and independent verification.