machine-bridge-mcp 3.0.0-beta.21 → 3.0.0-beta.26

package/CHANGELOG.md

@@ -1,5 +1,139 @@
 # Changelog
 
+## 3.0.0-beta.26 - 2026-07-29
+
+### Explicit GitHub publication ownership
+
+- Require GitHub tag, Release, prerelease, and backfill writes to present TTY-backed stdin/stdout/stderr plus the explicit `--owner-terminal-confirm` flag. Background MCP calls, managed jobs, CI, redirected sessions, and ordinary automation fail before repository fetch, verification, tag creation, or remote mutation. This is an anti-accident workflow boundary, not cryptographic human-presence proof against arbitrary same-user code.
+- Serialize GitHub publication through an owner-only process-identity lock at the common Git state path, so the main checkout and linked worktrees share one owner. A second publication attempt fails while the first process is alive, and a stale lock is reclaimed only after PID/start-time verification.
+- Convert release-script failures to exceptions so the publication lock is released on every ordinary failure path instead of being abandoned by `process.exit()`.
+- Add deterministic guard, non-interactive rejection, linked-worktree path, live contention, stale-owner reclamation, callback-failure release, package-manifest, architecture, and critical-coverage tests. npm publication remains a separate owner operation and is not attempted by this change.
+- Label top-level local self-test phases so a transient process, service, shell, or Worker-source failure identifies its causal test boundary instead of surfacing only a low-level timeout stack.
+- Keep the fail-closed common-Git-directory probe bounded but raise its local metadata deadline from 5 to 30 seconds, and give self-test process/CLI success fixtures scheduler-tolerant 30–60 second budgets; explicit timeout/cancellation tests retain their short deadlines.
+- Make the managed-job descendant cleanup test wait for the fixture PID checkpoint before judging timeout cleanup, and use bounded scheduler-tolerant observation windows; this preserves the production timeout/tree-kill contract while eliminating an ENOENT race.
+- Give `diagnose_runtime` direct-process and shell health probes an explicit 30-second diagnostic budget, separate from user command deadlines and from the short timeout/cancellation fixtures, so temporary scheduler starvation is reported only after a meaningful bounded observation window.
+- Remove the hidden 10-second Git repository-root subdeadline beneath 30-60 second Git operations: read-only `rev-parse --show-toplevel` metadata detection and runtime Git success fixtures now use a bounded 30-second budget, while command failure remains fail-closed.
+- Make the shell process-tree cleanup fixture observe a descendant-PID readiness checkpoint before its timeout path, with bounded 25-30 second coverage-tolerant windows; the separate 50 ms timeout fixture still verifies immediate timeout classification.
+- Give the direct-argv isolation success fixture a named 30-second process budget so V8 coverage and host scheduling cannot turn an argv/shell-boundary assertion into an unrelated 10-second timeout; dedicated timeout tests remain unchanged.
+- Replace the maintenance-lock test's 1.2-second time-based holder with a parent-controlled stdin handshake. The child holds the lock until assertions finish and releases on explicit `release` or pipe closure, so scheduler delay cannot erase the contention state under test.
+- Prevent V8 coverage from recursively instrumenting process-lock helper processes. Node propagates `NODE_V8_COVERAGE` to children even when the variable is deleted, so the fixture spawn boundary now sets it explicitly to an empty value and verifies the helpers remain uninstrumented; only the top-level test contributes coverage.
+- Keep the atomic-exclusive process test cross-process but use four simultaneous contenders instead of twelve. Four independently spawned processes are sufficient to prove the single-winner invariant, while avoiding a 3x Node cold-start amplification that can dominate the test under unrelated host saturation.
+- Apply the same explicit coverage isolation to daemon-takeover fixtures and give readiness plus successful stop/takeover paths a named 30-second budget. The 100 ms foreground-owner refusal and 20 ms force-escalation trigger remain intentionally short and independently asserted.
+- Keep managed-job runner coverage intact while explicitly disabling profiler inheritance for trivial marker-writing business steps. Those success fixtures now use a named 120-second step budget; the independent timeout, cancellation, and process-tree tests keep their short semantic deadlines.
+- Apply the same named 120-second success-step budget across managed-job approval markers, resource validation/redaction, bounded-output, discard-output, and cleanup/recovery markers. The managed-job process-tree fixture uses a 180-second timeout and a 150-second descendant-readiness window so the resistant descendant exists before timeout/tree-kill is judged; cancellation behavior remains independently asserted; the aggregate-output fixture uses four steps and a 600-second observer, exceeding its legal plan upper bound without multiplying cold starts.
+- Raise the ordinary managed-job test observer to 480 seconds so it exceeds the longest three-phase 3×120-second success/cleanup plan plus startup margin. This changes only test observation; production timeout semantics, the 180-second managed-job tree timeout, and cancellation behavior remain independently tested.
+- Give managed-job CLI list/inspect/submit/read success and rejection fixtures a separate 120-second subprocess budget and structured status/signal/error diagnostics. Their purpose is CLI/state validation, not a 60-second latency contract; production job step deadlines and explicit timeout tests remain unchanged.
+- Prevent those local-self managed-job CLI subprocesses from inheriting V8 coverage. The top-level local-self remains instrumented, while dedicated CLI-entrypoint and managed-job fixtures provide the relevant module evidence without recursively profiling each detached CLI probe.
+- Treat a POSIX zombie child as exited-but-awaiting-event-drain instead of timing it out. Managed-job settlement now re-reads the real exit code during the bounded fallback, preventing scheduler-starved `exit`/`close` delivery from converting a completed cleanup step into a false timeout.
+- Close a managed-job launch/recovery race: the parent now publishes an owner-only provisional PID plus one-time launch token immediately after spawn, and the runner must verify that claim before executing or atomically upgrading it to an exact start-time identity. A queued job can no longer be misclassified as interrupted merely because V8 startup exceeds the ten-second recovery grace period; conflicting claims fail closed and terminate the unowned child.
+- Give browser-broker fixture HTTP, WebSocket open/message/close, rejection, handshake, and state-convergence observations a named 30-second scheduler-tolerant budget. Product request deadlines remain unchanged, including the one-second timeout regression and the normalized two/four-second browser operation parameters.
+
+## 3.0.0-beta.25 - 2026-07-29
+
+### MCP 2026-07-28 dual-era protocol architecture
+
+- Make MCP `2026-07-28` the primary protocol while retaining `2025-11-25` behind an explicit legacy adapter. Modern requests are stateless, carry protocol version and client capabilities in every request `_meta`, use `server/discover`, never mint `Mcp-Session-Id`, and do not enter the legacy resumable-SSE store.
+- Split Worker and stdio dispatch into modern and legacy paths. Per-request metadata takes precedence over method names when selecting the era, so a modern `initialize` request is rejected with HTTP 404 / JSON-RPC `-32601` instead of accidentally entering the legacy handshake.
+- Implement modern Streamable HTTP mirrored-header validation for `MCP-Protocol-Version`, `Mcp-Method`, `Mcp-Name`, and schema-declared `Mcp-Param-*` values, including Base64 sentinel decoding, case-sensitive value comparison, required dual-media `Accept`, and `-32020 HeaderMismatch` precedence over unsupported-version handling.
+- Add modern `subscriptions/listen` acknowledgment, subscription-ID correlation, strict notification-filter validation, and graceful completion. The server advertises no dynamic list notifications and therefore acknowledges only the supported subset rather than fabricating capability.
+- Separate modern request-scoped streams from legacy durable recovery. Modern response streams have no event IDs or `Last-Event-ID` replay. The outer Worker makes one direct Durable Object request, forwards bounded SSE heartbeats, and uses a stream-scoped private cancellation control when the public response closes; it never creates a prepare/subscribe descriptor or retains a cross-event terminal Promise. Legacy session-bound GET recovery remains compatibility-only.
+- Remove token-wide modern JSON-RPC request identity. Two clients sharing one OAuth token may concurrently reuse the same request ID without collision; request IDs remain scoped to the individual modern request/stream, while legacy and stdio cancellation retain their transport-appropriate indexes.
+
+### Capability routing and context efficiency
+
+- Add bounded set-level execution routing to `resolve_task_capabilities`. It ranks compatible route bundles—registered commands, direct Bash/argv, interactive processes, durable jobs, workspace/Git operations, browser, applications, protected resources, and diagnostics—rather than pretending every tool is an independent island. The output includes a primary route, alternatives, ambiguity, fallback routes, and failure-aware guidance. It is advisory only: `exec_command` remains the convenient general escape hatch whenever the effective policy allows shell execution.
+- Fix an account-authority privacy gap in capability discovery. Application inventory and browser metadata now use the authenticated account/daemon policy intersection rather than the daemon's global ceiling; a reviewer connected to a full daemon can no longer learn or receive recommendations for application, browser, shell, or write surfaces outside the role-visible catalog.
+- Add conditional capability-context reuse. A caller may return `refresh.fingerprint` as `known_refresh_fingerprint`; when the target, scope, instruction provenance/precedence, skills, and complete registered-command definitions are unchanged, the resolver still recomputes task-specific matches and routing but omits the repeated static instruction payload. Calls that omit the fingerprint retain the previous complete response.
+- Rewrite the highest-collision tool descriptions with explicit positive selection boundaries: registered project command versus direct argv versus Bash composition; raw DOM source versus semantic browser inspection; tab inventory versus tab mutation; repository overview versus live relay/authority status; context inventory versus task-specific routing.
+- Extend privacy-safe routing telemetry with only the primary route, ambiguity class, and score gap. Raw task text remains absent and the existing runtime-keyed HMAC fingerprint remains the only task correlation value.
+- Add bilingual routing regression cases and critical coverage for shell, registered commands, interactive processes, managed jobs, Git, workspace edits, browser, applications, diagnostics, and protected resources. Package checks require the new routing module. Route envelopes are schema-versioned and state that scores are relative ranks, not probabilities or cross-version metrics.
+- Keep per-task routing lightweight: it reads frozen name/title/description records from the policy-visible catalog instead of deep-cloning all 51 input schemas on every resolver call. Architecture tests reject reintroducing the full-catalog clone.
+
+### Protocol and schema correctness
+
+- Require `resultType` and server identity metadata on every modern successful result. Preserve `structuredContent` for every JSON value, including arrays, strings, numbers, booleans, and `null`, instead of silently discarding non-object values.
+- Add a bounded shared JSON Schema 2020-12 argument validator. Worker dispatch and the local runtime enforce the same catalog constraints before side effects; unsupported dialects or keywords, including automatic network `$ref` dereference, fail at catalog compilation instead of being ignored.
+- Bound schema depth, node count, validation issue count, regular-expression length, and total runtime validation work. Array items and every own object property consume the same budget, so a high-cardinality object cannot force an unbounded `Object.keys()` allocation or traversal. Validation errors expose only instance paths, keywords, and constraint messages—never argument values.
+- Move one shared role-aware tool-call inspection boundary ahead of both modern and legacy dispatch. Missing/hidden tools, non-object arguments, and schema-invalid values return protocol-level `-32602` with `side_effects_started=false`; legacy SSE rejects them before allocating resumable state or contacting the daemon.
+- Validate modern `_meta` key syntax, client capability objects, extension identifiers/settings, progress tokens, log levels, optional client identity/icon URIs, subscription filters, strict HTTP quality values, and header/body version ordering. Open metadata/extension trees share a fixed 4,096-node, 32-level, bounded-key structure budget; resource subscriptions are capped at 256 bounded strings. Header mismatch and unknown-input errors no longer reflect caller-controlled names, URIs, metadata keys, or parameter values.
+- Validate `Origin` on actual `/mcp` requests as required by Streamable HTTP while leaving OAuth navigation semantics unchanged. CORS preflight allows only the fixed protocol headers plus exact catalog-declared `Mcp-Param-*` names, with bounded count/bytes instead of reflecting arbitrary parameter headers.
+- Treat the random private modern stream ID as an internal cancellation capability. The outer Worker strips caller-supplied control headers, the Durable Object handles cancel before OAuth/DPoP replay validation, and the internal cancel request carries no Authorization or DPoP header; closing a DPoP-bound stream therefore cannot fail because its original proof JTI was already consumed.
+
+### Conformance and verification
+
+- Add protocol-contract, tool-schema, modern stdio, modern Worker, same-ID concurrency, malformed-call non-dispatch, subscription validation, arbitrary structured-content, and request-scoped stream-cancellation coverage while preserving the complete legacy integration suite.
+- Make the process-tree timeout fixture readiness-driven under coverage load. The test starts the real timeout operation, waits within a fixed bound for a valid descendant PID publication, then verifies the timeout result and descendant exit; it no longer assumes Node startup and child creation finish within 200 ms. Add direct valid/invalid/unknown-tool coverage for the Worker catalog validator rather than lowering its 95% function threshold; the module now reaches 100% function coverage.
+- Derive the resistant-descendant escalation assertion from the exported two-second graceful-termination interval and three-second ownership-verification budget, plus a bounded scheduling margin. The former exact five-second assertion could race the final identity probe under release-candidate load even though the forced kill was still pending; production termination timing is unchanged.
+- Make managed-job integration waits distinguish the persisted terminal checkpoint from confirmed private-artifact cleanup. A terminal status with `artifact_cleanup_pending=true` is intentionally recoverable but does not yet prove that runtime resource copies, temporary files, the plan, or PID claim are gone; deterministic boundary assertions and ten repeated integration runs cover the distinction without changing the production two-phase protocol.
+- Add an opt-in driver for the official MCP conformance checkout. It uses a test-only loopback proxy to inject a short-lived test bearer token without weakening production OAuth or adding the alpha conformance package to the project dependency graph. The proxy accepts only its relative `/mcp` endpoint, maps it to the exact configured upstream path, rejects absolute/scheme-relative or alternate same-origin targets, bounds request bodies, settles aborted uploads, and reclaims the complete child process tree on timeout.
+- Pass the official `http-header-validation` scenario. Pass `server-stateless` and `caching` with check-scoped expected-failure entries only for production capabilities the server intentionally does not expose: conformance-only diagnostic tools and absent prompt/resource feature families. Any unrelated failure or stale baseline still fails the run.
+- Advance the exact production Wrangler runtime from `4.114.0` to `4.115.0` and Miniflare from `4.20260722.0` to `4.20260722.1`. The reviewed workerd build remains `1.20260722.1`, so its exact lifecycle-script allowlist does not change. Wrangler now applies bounded `429` retry handling, honors reasonable `Retry-After` values, and exposes `retry_after_ms` in its machine-readable failure record, improving candidate deployment diagnosis without adding an unbounded wait.
+- Make candidate activation compare the pending manifest's promotion-content digest with the current source before tarball verification, npm installation, Worker deployment, or service mutation. A candidate becomes unusable immediately after any packaged-source change instead of remaining internally self-consistent but stale.
+- Add the modern protocol, shared subscriptions, bounded schema validator, role-aware tool input boundary, modern proxy/controller, and candidate-source guard to fast/full behavior and critical coverage gates. The npm package manifest now requires every new shared and Worker protocol module and still excludes tests, generated Worker types, local candidates, logs, and secret-shaped artifacts.
+- Add a first-party `sbom:test` release gate that invokes the pinned npm CLI directly, validates bounded CycloneDX 1.5 JSON, confirms the current package identity and root dependency graph, and rejects local filesystem paths. This avoids ambiguous unscoped helper packages and makes SBOM generation part of candidate verification rather than an operator-only command.
+- Advance the unreleased working version to `3.0.0-beta.25`; immutable beta.24 GitHub artifacts are not reused. No npm package is published by this change.
+
+## 3.0.0-beta.24 - 2026-07-28
+
+### Candidate activation authentication convergence
+
+- Treat a current-version Worker health response and successful upload as necessary but insufficient activation evidence. The exact candidate must also complete device preflight, challenge authentication, and end-to-end relay readiness before service handoff.
+- Recover one explicit candidate device-authentication rejection by redeploying the same Worker exactly once with the already selected device identity. The repair never rotates credentials, never changes the Worker name, and is bounded to three candidate starts with exponential delay.
+- Prevent split-version recovery after a remote transition. If remote preparation has changed or verified the candidate Worker but activation later fails, cleanup installs and starts the compatible candidate service definition instead of reviving an older daemon that cannot authenticate to the current Worker. Failures remain explicit, and cleanup errors are aggregated rather than hidden.
+- Report whether activation used the authentication-repair deployment in structured output. The operator warning contains only the failure class and repair action; it does not expose device identifiers, public keys, Worker endpoints, or credentials.
+- Require persistent-service state, not merely a successful service-manager command. Candidate activation now consumes verified stop/restore evidence on launchd, systemd, and Windows; systemd activating/reloading states retain restoration intent while unknown/maintenance states fail before mutation, and a Windows task that exits successfully without remaining active is reported as `completed_without_persistence`.
+- Bind the machine-global service definition to an owner-only `service-owner.json` record containing the canonical workspace, state root, exact runtime entrypoint, and package version. Installation writes `pending` before provider mutation and commits only after the definition succeeds; ambiguous or partial installation remains pending so start/restart fail closed instead of trusting an obsolete owner.
+- Make daemon readiness a token-protected, monotonic checkpoint in the daemon process lock. A login service is accepted only after the exact service-mode process completes device authentication, relay probe, and `ready_ack`; provider-active samples alone are no longer treated as runtime truth.
+- Serialize every machine-global service mutation with one fixed user-level lock and acquire it before any workspace startup lock. Foreground takeover releases the machine-service lock after service/daemon ownership is established, while activation retains it through the complete persistent handoff; daemon-only service children never re-enter the parent transaction lock.
+- Keep the ordinary profile state root and machine-service control root distinct on every platform. POSIX defaults to `~/.local/state/machine-bridge-mcp`, while the global service lock/owner ledger uses the sibling `machine-bridge-mcp-control`; XDG and Windows APPDATA preserve the same application-versus-control separation. This prevents the standard candidate command from installing its runtime into the control directory and then failing state-schema initialization.
+- Reject a foreground or unverifiable daemon before any launchd/systemd/Task Scheduler mutation. Pre-remote recovery of an older compatible service also requires the same version and entrypoint to reappear as a verified service daemon; post-remote recovery continues forward with the candidate owner/readiness contract.
+- Remove the candidate wrapper's outer hard kill around the activation transaction. Deployment, health, relay, service-manager, and convergence stages retain their own bounded deadlines, while service-manager commands now have an explicit 30-second hard boundary; the wrapper cannot bypass lock release and compensation with an unrelated global timeout.
+- Fail closed before POSIX forced escalation when no process ownership snapshot was captured, and require exact process start-time continuity instead of accepting adjacent-second identities. This favors a diagnosable surviving descendant over signaling a possibly reused process group.
+- Make synchronous helper deadlines real. Process-tree and process-identity probes, delegated sandbox checks, macOS trust-broker commands, candidate activation, published-prerelease installation, and synchronous verification helpers now use `SIGKILL` on `spawnSync` timeout; the Node default `SIGTERM` can otherwise be ignored while the caller remains blocked indefinitely. Trust-broker `ETIMEDOUT` is classified before signal-based signing diagnostics.
+- Bound managed-job and foreground-shell process-tree shutdown under macOS process-table stalls. Darwin ownership capture and revalidation now query only the target process group with `ps -g <PGID>` instead of scanning the complete process table; other full and targeted probes still share one three-second monotonic budget instead of multiplying a three-second timeout by every captured descendant. This prevents an overloaded full-table snapshot from yielding empty fail-closed ownership and leaving an anti-`SIGTERM` descendant alive. If libuv reports `exit` but omits the final `close` event, the runner waits one second for output drain, then destroys residual stream handles and settles through the same terminal path.
+
+### Verification
+
+- Add fault-injection coverage for service-stop refusal, ambiguous provider results, daemon-lock takeover denial, malformed version/wait/repair inputs, missing lock-release contracts, invalid retry budgets, first-attempt authentication rejection, exactly one same-identity repair deployment, bounded repeated rejection, compatible-service forward recovery, cleanup aggregation, normal foreground-to-service convergence, and cross-platform separation of default profile state from the machine-service control root.
+- Keep the runtime-diagnostics composition test platform-correct: macOS must classify the injected `utun` route as VPN/TUN interception, while Linux and Windows must skip the macOS-only fixed route probe with `unsupported_platform`. Dedicated route tests cover both contracts independently.
+- Canonicalize service-owner workspace, state-root, and entrypoint paths with the native filesystem resolver used by the state layer. This prevents Windows 8.3 short-path aliases such as `RUNNER~1` from diverging from long-path state identity while retaining exact real-file ownership.
+- Remove a service-platform test lifecycle race: create owner-test directories synchronously before canonicalization instead of starting unawaited `mkdir()` promises that could race both owner creation and teardown. Temporary-tree cleanup also uses a fixed retry budget and still fails closed after that budget.
+- Make the Worker integration daemon-message waiter protocol-aware: while waiting for a subsequent `tool_call` or `cancel_call`, it may skip an asynchronously interleaved `tool_result_ack`; handshake, error, and every other unexpected message remain strict failures.
+- Track every Worker integration HTTP request from creation through settlement. Deferred requests receive an immediate rejection observer, successful completion requires the request set to drain to zero, and failure cleanup closes Wrangler before a bounded all-settled drain; a late connection refusal can no longer bypass the test error path as a process-level unhandled rejection.
+- Add deterministic child-settlement tests, process-snapshot budget accounting, repeated managed-job timeout/descendant termination runs, and an explicit assertion that the detached runner exits after terminal persistence.
+- Reject non-numeric, fractional, zero, negative, non-finite, or over-limit remote `timeout_seconds` values before daemon dispatch; generated schemas and runtime enforcement now share the exact 1–85 second integer contract.
+- Add strict checked-JavaScript contracts for child settlement, process-tree ownership, and system-route classification, plus a dedicated child-settlement coverage threshold of 100% functions and 85% branches.
+- Add `runtime-activation.mjs` to the critical coverage gate. The module reaches 100% function coverage and 80% branch coverage in the current suite.
+- Block beta.23 from acceptance, publication, or promotion because owner-machine activation exposed the authentication-convergence and split-version recovery defects after the Worker had already advanced.
+
+## 3.0.0-beta.23 - 2026-07-28
+
+### Workflow closeout continuity
+
+- Correct the remote foreground timeout contract instead of silently shortening a caller-declared 120–600 second operation. The Worker-specific catalog now advertises an 85-second maximum while preserving 30- or 60-second tool defaults for configurable foreground process, shell, browser, and application tools. A larger request is rejected before daemon dispatch with `side_effects_started=false`, so a mutation cannot complete locally and then appear to fail only when validation loses its response.
+- Direct long work to process sessions or managed jobs. Initialization instructions now require mutation and validation to be independently terminal, and describe a bounded output/status-file fallback for hosts that omit durable tools.
+- Add a fixed macOS default-route diagnostic. `diagnose_runtime` and `doctor` report only a coarse `tunnel-or-vpn`, `physical-or-other`, `loopback`, or `other` route class plus an interception boolean; they never return interface names, addresses, DNS answers, proxy endpoints, or credentials. This distinguishes application proxy selection from an operating-system VPN/TUN that Machine Bridge cannot repair.
+- Preserve architecture limits by extracting route inspection into its own boundary module, then add line budgets and critical coverage thresholds for the new route module and the Worker timeout/catalog projection.
+
+### Verification
+
+- Add direct timeout-unit tests and a real Wrangler integration proving an over-limit request produces no daemon `tool_call`. Add macOS-route success, unsupported-platform, and fixed-command failure coverage. Refresh architecture, operations, logging, threat-model, client, testing, upgrading, and audit contracts.
+- Refresh the exact development-only pins for `@types/node`, ESLint, and `globals` to their current patch releases; the production dependency graph is unchanged and `npm audit` reports zero known vulnerabilities.
+
+## 3.0.0-beta.22 - 2026-07-28
+
+### ChatGPT call continuity and terminal delivery
+
+- Add an explicit daemon-result acknowledgement. The local runtime retains every terminal result after WebSocket queueing, replays unacknowledged results after reconnect and on heartbeat, and removes them only after the Worker confirms that the generation-guarded terminal transaction committed. This closes the loss window between local `send()` acceptance and Durable Object persistence that could leave a completed local command as a ghost Worker call.
+- Make durable settlement fail closed. A terminal-storage exception is observable and retryable instead of being reported as a completed call; stale connection generations remain unacknowledged, while duplicate results for an already terminal call are acknowledged idempotently so replay converges.
+- Stop treating one tool deadline as proof that the complete daemon socket is dead. Tool timeout now cancels only that call; the independent 90-second daemon-liveness alarm remains the sole connection-invalidating authority.
+- Bound remote foreground execution to 85 seconds plus five seconds of relay overhead, below the observed hosted-client request ceiling. The local process APIs retain their 600-second schema range, but work expected to exceed the interactive budget must use process sessions or managed jobs rather than one foreground ChatGPT call.
+- Tail-trim background daemon logs every 15 minutes as well as before startup, reusing the existing owner-only, no-follow, single-link, schema-checked, UTF-8 line-safe maintenance path.
+
+### Verification
+
+- Add acknowledgement-loss/replay, persistent-terminal-write failure, stale generation, hosted-client deadline, runtime log-maintenance, and real Wrangler acknowledgement coverage. Type checking, lint, architecture, privacy, structured logging, security properties, SARIF, critical coverage, local self-test, Worker infrastructure, and Worker OAuth/MCP integration pass.
+
 ## 3.0.0-beta.21 - 2026-07-27
 
 ### Relay continuity and stable MCP catalog

package/CONTRIBUTING.md

@@ -38,18 +38,18 @@ Repository-only infrastructure changes, such as a `.github/` workflow update, do
 
 1. choose a `dev`, `beta`, or `rc` version; version 3 and later must not begin as stable;
 2. update changelog, audit notes, and documentation;
-3. run targeted and complete checks, dependency audits, Worker dry-run, privacy review, SBOM generation, and package inspection;
+3. run targeted and complete checks, dependency audits, Worker dry-run, privacy review, `npm run sbom:test`, and package inspection;
 4. inspect the complete diff and run `npm run release:candidate`;
 5. give the owner `npm run release:candidate:activate -- --allow-worker-deploy` and stop;
 6. after the owner runs it, verify the Worker, candidate relay, verified service daemon, exact version, representative behavior, and relevant failure paths through Machine Bridge;
 7. only after observed success, record exact candidate acceptance;
 8. commit and push only with `npm run github:push`, then complete review and required checks;
-9. create the GitHub Prerelease with `npm run prerelease:release`;
+9. the repository owner creates the GitHub Prerelease from a real interactive terminal with `npm run prerelease:release -- --owner-terminal-confirm`;
 10. the release operator runs `npm run prerelease:publish` and `npm run prerelease:install -- --allow-worker-deploy`;
 11. use the published prerelease for at least seven days for a major, three days for a minor, or one day for a patch;
 12. every blocking defect increments the prerelease number and restarts the interval;
 13. after explicit owner confirmation, record the soak result; stable promotion must pass `npm run release:soak:verify` and preserve the functional promotion digest;
-14. activate and observe the exact stable candidate, repeat acceptance and review, then run `npm run release`; the owner separately runs `npm run stable:publish`.
+14. activate and observe the exact stable candidate, repeat acceptance and review, then have the repository owner run `npm run release -- --owner-terminal-confirm` from a real interactive terminal; the owner separately runs `npm run stable:publish`.
 
 Automated checks do not authorize candidate acceptance or soak success. The agent observes the live candidate; the owner reports the real soak outcome. Release evidence contains bounded release metadata only and no private user content.
 

package/GOVERNANCE.md

@@ -4,7 +4,7 @@
 
 The project currently has one human maintainer, `@YuLeiFuYun`. Repository automation may complete reviewed source changes under [AGENTS.md](AGENTS.md), but automation is not an independent reviewer and cannot replace accountable human ownership.
 
-The maintainer owns product direction, security policy, repository administration, npm package ownership, Cloudflare deployment decisions, and release credentials. Live npm publication, Worker deployment, credential rotation, and daemon/service replacement remain explicit operator actions.
+The maintainer owns product direction, security policy, repository administration, GitHub tag/Release publication, npm package ownership, Cloudflare deployment decisions, and release credentials. GitHub source publication, live npm publication, Worker deployment, credential rotation, and daemon/service replacement remain explicit operator actions.
 
 ## Decision model
 
@@ -34,7 +34,7 @@ Once a second active maintainer exists, branch protection must require one non-a
 
 ## Release authority
 
-Source release completion requires the exact `main` commit to pass CI, CodeQL, Governance, and OpenSSF Scorecard gates. The annotated Git tag, GitHub Release, release asset, package version, Worker version, and extension version must identify the same source state.
+Source release completion requires the exact `main` commit to pass CI, CodeQL, Governance, and OpenSSF Scorecard gates. The repository owner must start Git tag/GitHub Release publication from a TTY-backed terminal with the explicit confirmation flag; background agents, managed jobs, CI, and redirected sessions are rejected by the supported workflow. This ceremony records accountable operator action but cannot distinguish a human from arbitrary code already running as the same OS user. The annotated Git tag, GitHub Release, release asset, package version, Worker version, and extension version must identify the same source state.
 
 npm publication should move to trusted publishing with GitHub OIDC and a protected release environment. Until the external npm trust relationship is configured, publication remains a deliberate local operator action and no long-lived npm token may be stored in the repository.
 

package/README.md

@@ -45,6 +45,19 @@ Local MCP client
 
 The complete component and trust-boundary diagram is in [docs/OVERVIEW.md](docs/OVERVIEW.md).
 
+## MCP protocol model
+
+Machine Bridge is a dual-era server with a modern core:
+
+- **MCP `2026-07-28` is primary.** Every request carries protocol version and client capabilities in `_meta`; HTTP requests also mirror the version, method, and applicable name/parameter values into validated headers. Clients use `server/discover`; no `initialize` handshake or MCP session is created.
+- **MCP `2025-11-25` is a compatibility adapter.** Legacy clients still use `initialize`, a signed `Mcp-Session-Id`, and the older resumable Streamable HTTP behavior.
+- **Modern HTTP streams are request-scoped and not resumable.** Closing the response stream cancels that request. `Last-Event-ID`, recovery GETs, and session-bound replay exist only in the legacy adapter.
+- **Transport identity is not conversation identity.** Modern stdio and HTTP processes/connections may interleave unrelated requests; state that spans calls must use an explicit tool, job, process-session, or resource identifier.
+
+The Worker validates the actual `/mcp` Origin, mirrored headers, role-filtered tool visibility, and raw arguments before routing, durable stream allocation, or daemon dispatch. Tool arguments use one bounded JSON Schema 2020-12 contract in both Worker and local runtime; validation has fixed schema and runtime-work budgets and never echoes rejected values. Modern stream cancellation uses a private random capability stripped from public requests and forwards no OAuth/DPoP credential.
+
+`resolve_task_capabilities` provides bounded, set-level route advice across registered commands, direct Bash/argv, process sessions, managed jobs, files/Git, browser, applications, resources, and diagnostics. It does not hide or disable tools: Bash through `exec_command` remains the first-class general escape hatch under a shell-capable effective policy. The versioned result is filtered by the authenticated account's effective authority, reports routing ambiguity and fallbacks, and accepts the previous `refresh.fingerprint` to omit unchanged static instructions while still recomputing task-specific matches. Route scores are deterministic relative ranks within one response, not probabilities or cross-version metrics.
+
 ## Requirements
 
 - Node.js 26 or newer
@@ -110,7 +123,7 @@ Use the printed endpoint in the hosted client:
 https://<worker>.<account>.workers.dev/mcp
 ```
 
-Remote readiness is end-to-end. A daemon becomes available only after a Worker probe traverses the same authenticated local dispatch and session-bound result path used by real tool calls. A replacement daemon is verified before it displaces a healthy incumbent.
+Remote readiness is end-to-end. A daemon becomes available only after a Worker probe traverses the same authenticated local dispatch and result-delivery path used by real tool calls. A replacement daemon is verified before it displaces a healthy incumbent.
 
 For account roles, OAuth lifecycle, supported callback behavior, and tenancy limits, read [docs/GETTING_STARTED.md](docs/GETTING_STARTED.md) and [docs/MULTI_ACCOUNT.md](docs/MULTI_ACCOUNT.md).
 
@@ -155,7 +168,7 @@ The shared source of truth is `src/shared/policy-contract.json`. The generated m
 
 For remote calls, `server_info.authorization.effective_policy` and `effective_tools` are authoritative. Daemon policy and tools describe only the local capability ceiling before account-role and host-side filtering.
 
-`tools/list` is a stable discovery catalog for the authenticated account role. A brief relay interruption does not withdraw tool definitions or require a tools-list-changed notification. Discovery is not authority: every `tools/call` is still intersected with the current end-to-end-ready daemon policy and tool ceiling, and fails retryably with `unavailable` when no daemon is ready. `server_info.tool_delivery` distinguishes the stable advertised catalog from the currently effective daemon/account intersection.
+`tools/list` is a stable discovery catalog for the authenticated account role. A brief relay interruption does not withdraw tool definitions or require a tools-list-changed notification. Discovery is not authority: every `tools/call` is still intersected with the current end-to-end-ready daemon policy and tool ceiling, and fails retryably with `unavailable` when no daemon is ready. `server_info.tool_delivery` distinguishes the stable advertised catalog from the currently effective daemon/account intersection. The remote catalog also narrows configurable foreground timeouts to 85 seconds while preserving each tool’s 30- or 60-second default; larger requests fail before daemon dispatch instead of being silently truncated after side effects may have begun.
 
 `full` is the daemon capability ceiling. An authenticated owner may exercise it without per-operation approval IDs. Delegated reviewer, editor, and operator accounts remain inside immutable role ceilings; out-of-role operations are denied rather than converted into a temporary elevation workflow. Process sessions, retained output, and managed jobs are additionally bound to account, client, and refresh-token family. See [local authorization](docs/LOCAL_AUTHORIZATION.md).
 
@@ -174,7 +187,7 @@ Machine Bridge does not launch or identify a separate browser profile. It contro
 
 ## Durable work and local resources
 
-Interactive process sessions end with the daemon connection. Long, cleanup-sensitive, or remotely initiated workflows should use managed jobs, which persist ordered argv steps and `finally_steps` under owner-only local state.
+Remote foreground process, shell, browser, and application calls are bounded to 85 seconds. Keep mutations and validation in independently terminal calls. Long, cleanup-sensitive, or remotely initiated workflows should use process sessions or managed jobs; managed jobs persist ordered argv steps and `finally_steps` under owner-only local state and continue across an MCP disconnect.
 
 Credentials and files can be registered by alias without returning their contents through MCP:
 
@@ -244,8 +257,13 @@ Version 3 and later use a mandatory prerelease and soak path. Package work start
 npm run release:candidate
 # The owner runs the exact persistent activation command printed above:
 npm run release:candidate:activate -- --allow-worker-deploy
-# After the coding agent verifies the live Worker/daemon and records acceptance:
-npm run prerelease:release
+# Activation requires device-authenticated relay readiness. One explicit authentication rejection may
+# redeploy the same Worker once with the unchanged selected identity; it never rotates credentials.
+# The login service is accepted only after a committed machine owner and the matching daemon
+# publish the post-authentication, post-relay-probe readiness checkpoint.
+# After the coding agent verifies the live Worker/daemon and records acceptance,
+# the owner runs this from a real interactive terminal:
+npm run prerelease:release -- --owner-terminal-confirm
 # Explicit owner registry and live-install steps:
 npm run prerelease:publish
 npm run prerelease:install -- --allow-worker-deploy
@@ -253,7 +271,7 @@ npm run prerelease:install -- --allow-worker-deploy
 
 Formal soak begins only after the exact published prerelease is installed and activated. Minimum soak is seven days for a major release, three days for a minor release, and one day for a patch. Every blocking fix creates a new prerelease and restarts the clock.
 
-Stable promotion must retain the soaked package's functional digest. After the owner reports successful soak, the agent records the soak result, prepares and verifies the stable candidate, and only then completes `npm run release`; npm stable publication is the separate explicit `npm run stable:publish` operation.
+Stable promotion must retain the soaked package's functional digest. After the owner reports successful soak, the agent records the soak result and prepares and verifies the stable candidate. The owner then creates the final GitHub tag and Release from a real interactive terminal with `npm run release -- --owner-terminal-confirm`; npm stable publication is the separate explicit `npm run stable:publish` operation.
 
 See [docs/RELEASING.md](docs/RELEASING.md).
 

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.21",
+  "version_name": "3.0.0-beta.26",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AGENT_CONTEXT.md

@@ -8,13 +8,13 @@ This approximates a local coding agent without pretending that the MCP server ow
 
 - `session_bootstrap` returns built-in working agreements, bounded automatic project facts, explicit instruction text, and a refresh fingerprint.
 - `agent_context` returns the complete target-specific instruction chain, skill summaries, and command registry.
-- `resolve_task_capabilities` rescans default/project context and ranks skills/commands for the current task, optionally loading the best skill; the runtime also adds application and browser capability metadata.
+- `resolve_task_capabilities` rescans default/project context, ranks skills/commands and effective-policy-visible tools, returns bounded set-level execution routes with ambiguity/fallback metadata, and optionally loads the best skill. Direct Bash remains available whenever the effective policy permits it.
 - `list_local_skills` searches discovered `SKILL.md` bundles.
 - `load_local_skill` returns one skill entrypoint and bounded file inventory without execution.
 - `list_local_commands` returns effective registered commands.
 - `run_local_command` executes a registered direct-argv command when policy permits.
 
-Both stdio and remote Worker connection initialization attempt `session_bootstrap`. Its instruction text is appended to the MCP `initialize` result. Because a host may reuse one MCP connection across conversations, the explicit tool and per-task `resolve_task_capabilities` call remain necessary to refresh and reapply instructions reliably. `server_info.observability.capability_routing` and `project_overview.capabilityRouting` report whether those calls reached the local runtime, their counts and timestamps, loaded-source flags, selected capability metadata, and a runtime-keyed HMAC task fingerprint. Raw task text is not retained.
+Both stdio and remote Worker connection initialization attempt `session_bootstrap`. Its instruction text is appended to the MCP `initialize` result. Because a host may reuse one MCP connection across conversations, the explicit tool and per-task `resolve_task_capabilities` call remain necessary to refresh and reapply instructions reliably. A host may return the previous `refresh.fingerprint` as `known_refresh_fingerprint`; a match suppresses only unchanged static instruction metadata, not the fresh task-specific scan or routing. `server_info.observability.capability_routing` and `project_overview.capabilityRouting` report whether those calls reached the local runtime, their counts and timestamps, loaded-source flags, selected capability metadata, primary route, ambiguity class, score gap, and a runtime-keyed HMAC task fingerprint. Raw task text is not retained.
 
 ## Useful defaults without configuration
 
@@ -190,15 +190,17 @@ description: Review a release without publishing it.
 
 The entrypoint requires non-empty `name` and `description`. Invalid bundles are skipped with bounded warnings. Symlinked skill directories are followed after canonical policy validation; symbolic-link entrypoint files are rejected. Traversal, depth, entries, summaries, content, and inventory are bounded.
 
-No persistent skill or project-context index is trusted as authoritative. `session_bootstrap`, `agent_context`, and `resolve_task_capabilities` rebuild the relevant context; skill-list/load calls rescan effective roots. The refresh fingerprint changes when built-in/default context, explicit instruction hashes, skill hashes, command definitions, or relevant configuration changes. Newly created or edited files are visible without restarting the daemon or changing the MCP tool catalog.
+No persistent skill or project-context index is trusted as authoritative. `session_bootstrap`, `agent_context`, and `resolve_task_capabilities` rebuild the relevant context; skill-list/load calls rescan effective roots. The refresh fingerprint binds the target/scope, configuration paths, instruction source/precedence/content identity, skill source identity, and complete registered-command definition including cwd and timeout. A matching `known_refresh_fingerprint` permits response compaction only; task ranking, effective-policy filtering, installed-application matching, and route scoring still run. Newly created or edited files are visible without restarting the daemon or changing the MCP tool catalog.
 
 ## Progressive disclosure and task selection
 
-`agent_context` returns bounded skill metadata. `load_local_skill` returns full instructions only for one selected bundle. `resolve_task_capabilities` tokenizes the current task, ranks skill names/descriptions and command names/descriptions/argv, returns matches with scores, and loads the leading skill only when its relevance threshold is met. Under canonical `full`, it also compares the task with installed application names on every call; application discovery is cached briefly and refreshed after a bounded interval.
+`agent_context` returns bounded skill metadata. `load_local_skill` returns full instructions only for one selected bundle. `resolve_task_capabilities` tokenizes the current task, ranks skill names/descriptions, command names/descriptions/argv, and public tool definitions, then scores compatible execution surfaces as sets. It returns a schema-versioned envelope with the primary route, alternatives, ambiguity, fallback routes, ranked tools, and failure-aware guidance. Scores are relative within the current response, not probabilities or values to compare across package versions. Registered commands, direct Bash/argv, interactive sessions, durable jobs, files/Git, browser, applications, protected resources, and diagnostics remain separate choices; the advice does not hide or disable any effective-policy-visible tool.
+
+When the effective policy permits application discovery, the resolver also compares the task with cached installed-application names. Browser/application metadata and every route are filtered through the authenticated account/daemon policy intersection before they are returned. A delegated reviewer connected to a full daemon therefore cannot use capability resolution to inventory hidden applications or receive shell/browser/write recommendations.
 
 Matching remains deterministic and local. Hyphens, underscores, dots, and whitespace are normalized; common English inflections are reduced to a small canonical form; and a bounded Chinese/English workflow vocabulary covers creation, improvement, installation, search, current/official documentation, verification, testing, frontend/design, browser/web, email, performance, and security intents. Capability-name token matches receive more weight than incidental words in a long description. This lets Chinese tasks select English-metadata skills such as `skill-creator`, `web-research-cli`, and `skill-installer`, while avoiding the prior tie where generic “create” wording could select `frontend-design`. An explicitly named skill or registered command still receives the strongest deterministic boost.
 
-This ranking is deterministic local assistance, not semantic certainty. Weak positive matches remain visible for diagnosis, but only a skill meeting the selection threshold is recommended for loading. The model must still evaluate whether the selected skill applies. Machine Bridge does not execute skill scripts implicitly and does not fabricate a dynamically named MCP tool per skill.
+This ranking is deterministic local assistance, not semantic certainty. Weak positive matches remain visible for diagnosis, but only a skill meeting the selection threshold is recommended for loading. A high-ambiguity result tells the host to compare the competing route sets rather than over-trust one name. Fallbacks are recovery alternatives, not permission to evade a host or policy denial. The model must still evaluate whether the selected skill and route apply. Machine Bridge does not execute skill scripts implicitly and does not fabricate a dynamically named MCP tool per skill.
 
 ## Registered and automatic package commands
 
@@ -216,9 +218,10 @@ Directly invoking `npm run`, `pnpm run`, `yarn run`, or `bun run` does not make
 2. call `resolve_task_capabilities` with the complete user task and target path;
 3. apply explicit global/project instructions over lower-precedence defaults;
 4. follow the selected skill only after checking relevance;
-5. prefer registered commands for stable workflows;
+5. use the returned route set as advice: prefer registered commands for stable workflows, direct Bash for efficient ad hoc composition, process sessions for interactive work, and managed jobs for disconnect-surviving multi-step work;
 6. use structured application/browser tools where applicable;
-7. inspect before mutation or submission and report operations performed.
+7. inspect stable state after ambiguous mutation failures before retrying;
+8. inspect before mutation or submission and report operations performed.
 
 Machine Bridge can automatically discover, refresh, rank, and load capabilities. Actual invocation remains a host/model decision. This boundary cannot be removed by server architecture alone.