machine-bridge-mcp v3.0.0-beta.26

Explicit GitHub publication ownership

• Require GitHub tag, Release, prerelease, and backfill writes to present TTY-backed stdin/stdout/stderr plus the explicit --owner-terminal-confirm flag. Background MCP calls, managed jobs, CI, redirected sessions, and ordinary automation fail before repository fetch, verification, tag creation, or remote mutation. This is an anti-accident workflow boundary, not cryptographic human-presence proof against arbitrary same-user code.
• Serialize GitHub publication through an owner-only process-identity lock at the common Git state path, so the main checkout and linked worktrees share one owner. A second publication attempt fails while the first process is alive, and a stale lock is reclaimed only after PID/start-time verification.
• Convert release-script failures to exceptions so the publication lock is released on every ordinary failure path instead of being abandoned by process.exit().
• Add deterministic guard, non-interactive rejection, linked-worktree path, live contention, stale-owner reclamation, callback-failure release, package-manifest, architecture, and critical-coverage tests. npm publication remains a separate owner operation and is not attempted by this change.
• Label top-level local self-test phases so a transient process, service, shell, or Worker-source failure identifies its causal test boundary instead of surfacing only a low-level timeout stack.
• Keep the fail-closed common-Git-directory probe bounded but raise its local metadata deadline from 5 to 30 seconds, and give self-test process/CLI success fixtures scheduler-tolerant 30–60 second budgets; explicit timeout/cancellation tests retain their short deadlines.
• Make the managed-job descendant cleanup test wait for the fixture PID checkpoint before judging timeout cleanup, and use bounded scheduler-tolerant observation windows; this preserves the production timeout/tree-kill contract while eliminating an ENOENT race.
• Give diagnose_runtime direct-process and shell health probes an explicit 30-second diagnostic budget, separate from user command deadlines and from the short timeout/cancellation fixtures, so temporary scheduler starvation is reported only after a meaningful bounded observation window.
• Remove the hidden 10-second Git repository-root subdeadline beneath 30-60 second Git operations: read-only rev-parse --show-toplevel metadata detection and runtime Git success fixtures now use a bounded 30-second budget, while command failure remains fail-closed.
• Make the shell process-tree cleanup fixture observe a descendant-PID readiness checkpoint before its timeout path, with bounded 25-30 second coverage-tolerant windows; the separate 50 ms timeout fixture still verifies immediate timeout classification.
• Give the direct-argv isolation success fixture a named 30-second process budget so V8 coverage and host scheduling cannot turn an argv/shell-boundary assertion into an unrelated 10-second timeout; dedicated timeout tests remain unchanged.
• Replace the maintenance-lock test's 1.2-second time-based holder with a parent-controlled stdin handshake. The child holds the lock until assertions finish and releases on explicit release or pipe closure, so scheduler delay cannot erase the contention state under test.
• Prevent V8 coverage from recursively instrumenting process-lock helper processes. Node propagates NODE_V8_COVERAGE to children even when the variable is deleted, so the fixture spawn boundary now sets it explicitly to an empty value and verifies the helpers remain uninstrumented; only the top-level test contributes coverage.
• Keep the atomic-exclusive process test cross-process but use four simultaneous contenders instead of twelve. Four independently spawned processes are sufficient to prove the single-winner invariant, while avoiding a 3x Node cold-start amplification that can dominate the test under unrelated host saturation.
• Apply the same explicit coverage isolation to daemon-takeover fixtures and give readiness plus successful stop/takeover paths a named 30-second budget. The 100 ms foreground-owner refusal and 20 ms force-escalation trigger remain intentionally short and independently asserted.
• Keep managed-job runner coverage intact while explicitly disabling profiler inheritance for trivial marker-writing business steps. Those success fixtures now use a named 120-second step budget; the independent timeout, cancellation, and process-tree tests keep their short semantic deadlines.
• Apply the same named 120-second success-step budget across managed-job approval markers, resource validation/redaction, bounded-output, discard-output, and cleanup/recovery markers. The managed-job process-tree fixture uses a 180-second timeout and a 150-second descendant-readiness window so the resistant descendant exists before timeout/tree-kill is judged; cancellation behavior remains independently asserted; the aggregate-output fixture uses four steps and a 600-second observer, exceeding its legal plan upper bound without multiplying cold starts.
• Raise the ordinary managed-job test observer to 480 seconds so it exceeds the longest three-phase 3×120-second success/cleanup plan plus startup margin. This changes only test observation; production timeout semantics, the 180-second managed-job tree timeout, and cancellation behavior remain independently tested.
• Give managed-job CLI list/inspect/submit/read success and rejection fixtures a separate 120-second subprocess budget and structured status/signal/error diagnostics. Their purpose is CLI/state validation, not a 60-second latency contract; production job step deadlines and explicit timeout tests remain unchanged.
• Prevent those local-self managed-job CLI subprocesses from inheriting V8 coverage. The top-level local-self remains instrumented, while dedicated CLI-entrypoint and managed-job fixtures provide the relevant module evidence without recursively profiling each detached CLI probe.
• Treat a POSIX zombie child as exited-but-awaiting-event-drain instead of timing it out. Managed-job settlement now re-reads the real exit code during the bounded fallback, preventing scheduler-starved exit/close delivery from converting a completed cleanup step into a false timeout.
• Close a managed-job launch/recovery race: the parent now publishes an owner-only provisional PID plus one-time launch token immediately after spawn, and the runner must verify that claim before executing or atomically upgrading it to an exact start-time identity. A queued job can no longer be misclassified as interrupted merely because V8 startup exceeds the ten-second recovery grace period; conflicting claims fail closed and terminate the unowned child.
• Give browser-broker fixture HTTP, WebSocket open/message/close, rejection, handshake, and state-convergence observations a named 30-second scheduler-tolerant budget. Product request deadlines remain unchanged, including the one-second timeout regression and the normalized two/four-second browser operation parameters.

machine-bridge-mcp v3.0.0-beta.24

Candidate activation authentication convergence

• Treat a current-version Worker health response and successful upload as necessary but insufficient activation evidence. The exact candidate must also complete device preflight, challenge authentication, and end-to-end relay readiness before service handoff.
• Recover one explicit candidate device-authentication rejection by redeploying the same Worker exactly once with the already selected device identity. The repair never rotates credentials, never changes the Worker name, and is bounded to three candidate starts with exponential delay.
• Prevent split-version recovery after a remote transition. If remote preparation has changed or verified the candidate Worker but activation later fails, cleanup installs and starts the compatible candidate service definition instead of reviving an older daemon that cannot authenticate to the current Worker. Failures remain explicit, and cleanup errors are aggregated rather than hidden.
• Report whether activation used the authentication-repair deployment in structured output. The operator warning contains only the failure class and repair action; it does not expose device identifiers, public keys, Worker endpoints, or credentials.
• Require persistent-service state, not merely a successful service-manager command. Candidate activation now consumes verified stop/restore evidence on launchd, systemd, and Windows; systemd activating/reloading states retain restoration intent while unknown/maintenance states fail before mutation, and a Windows task that exits successfully without remaining active is reported as completed_without_persistence.
• Bind the machine-global service definition to an owner-only service-owner.json record containing the canonical workspace, state root, exact runtime entrypoint, and package version. Installation writes pending before provider mutation and commits only after the definition succeeds; ambiguous or partial installation remains pending so start/restart fail closed instead of trusting an obsolete owner.
• Make daemon readiness a token-protected, monotonic checkpoint in the daemon process lock. A login service is accepted only after the exact service-mode process completes device authentication, relay probe, and ready_ack; provider-active samples alone are no longer treated as runtime truth.
• Serialize every machine-global service mutation with one fixed user-level lock and acquire it before any workspace startup lock. Foreground takeover releases the machine-service lock after service/daemon ownership is established, while activation retains it through the complete persistent handoff; daemon-only service children never re-enter the parent transaction lock.
• Keep the ordinary profile state root and machine-service control root distinct on every platform. POSIX defaults to ~/.local/state/machine-bridge-mcp, while the global service lock/owner ledger uses the sibling machine-bridge-mcp-control; XDG and Windows APPDATA preserve the same application-versus-control separation. This prevents the standard candidate command from installing its runtime into the control directory and then failing state-schema initialization.
• Reject a foreground or unverifiable daemon before any launchd/systemd/Task Scheduler mutation. Pre-remote recovery of an older compatible service also requires the same version and entrypoint to reappear as a verified service daemon; post-remote recovery continues forward with the candidate owner/readiness contract.
• Remove the candidate wrapper's outer hard kill around the activation transaction. Deployment, health, relay, service-manager, and convergence stages retain their own bounded deadlines, while service-manager commands now have an explicit 30-second hard boundary; the wrapper cannot bypass lock release and compensation with an unrelated global timeout.
• Fail closed before POSIX forced escalation when no process ownership snapshot was captured, and require exact process start-time continuity instead of accepting adjacent-second identities. This favors a diagnosable surviving descendant over signaling a possibly reused process group.
• Make synchronous helper deadlines real. Process-tree and process-identity probes, delegated sandbox checks, macOS trust-broker commands, candidate activation, published-prerelease installation, and synchronous verification helpers now use SIGKILL on spawnSync timeout; the Node default SIGTERM can otherwise be ignored while the caller remains blocked indefinitely. Trust-broker ETIMEDOUT is classified before signal-based signing diagnostics.
• Bound managed-job and foreground-shell process-tree shutdown under macOS process-table stalls. Darwin ownership capture and revalidation now query only the target process group with ps -g <PGID> instead of scanning the complete process table; other full and targeted probes still share one three-second monotonic budget instead of multiplying a three-second timeout by every captured descendant. This prevents an overloaded full-table snapshot from yielding empty fail-closed ownership and leaving an anti-SIGTERM descendant alive. If libuv reports exit but omits the final close event, the runner waits one second for output drain, then destroys residual stream handles and settles through the same terminal path.

Verification

• Add fault-injection coverage for service-stop refusal, ambiguous provider results, daemon-lock takeover denial, malformed version/wait/repair inputs, missing lock-release contracts, invalid retry budgets, first-attempt authentication rejection, exactly one same-identity repair deployment, bounded repeated rejection, compatible-service forward recovery, cleanup aggregation, normal foreground-to-service convergence, and cross-platform separation of default profile state from the machine-service control root.
• Keep the runtime-diagnostics composition test platform-correct: macOS must classify the injected utun route as VPN/TUN interception, while Linux and Windows must skip the macOS-only fixed route probe with unsupported_platform. Dedicated route tests cover both contracts independently.
• Canonicalize service-owner workspace, state-root, and entrypoint paths with the native filesystem resolver used by the state layer. This prevents Windows 8.3 short-path aliases such as RUNNER~1 from diverging from long-path state identity while retaining exact real-file ownership.
• Remove a service-platform test lifecycle race: create owner-test directories synchronously before canonicalization instead of starting unawaited mkdir() promises that could race both owner creation and teardown. Temporary-tree cleanup also uses a fixed retry budget and still fails closed after that budget.
• Make the Worker integration daemon-message waiter protocol-aware: while waiting for a subsequent tool_call or cancel_call, it may skip an asynchronously interleaved tool_result_ack; handshake, error, and every other unexpected message remain strict failures.
• Track every Worker integration HTTP request from creation through settlement. Deferred requests receive an immediate rejection observer, successful completion requires the request set to drain to zero, and failure cleanup closes Wrangler before a bounded all-settled drain; a late connection refusal can no longer bypass the test error path as a process-level unhandled rejection.
• Add deterministic child-settlement tests, process-snapshot budget accounting, repeated managed-job timeout/descendant termination runs, and an explicit assertion that the detached runner exits after terminal persistence.
• Reject non-numeric, fractional, zero, negative, non-finite, or over-limit remote timeout_seconds values before daemon dispatch; generated schemas and runtime enforcement now share the exact 1–85 second integer contract.
• Add strict checked-JavaScript contracts for child settlement, process-tree ownership, and system-route classification, plus a dedicated child-settlement coverage threshold of 100% functions and 85% branches.
• Add runtime-activation.mjs to the critical coverage gate. The module reaches 100% function coverage and 80% branch coverage in the current suite.
• Block beta.23 from acceptance, publication, or promotion because owner-machine activation exposed the authentication-convergence and split-version recovery defects after the Worker had already advanced.

machine-bridge-mcp v3.0.0-beta.22

ChatGPT call continuity and terminal delivery

• Add an explicit daemon-result acknowledgement. The local runtime retains every terminal result after WebSocket queueing, replays unacknowledged results after reconnect and on heartbeat, and removes them only after the Worker confirms that the generation-guarded terminal transaction committed. This closes the loss window between local send() acceptance and Durable Object persistence that could leave a completed local command as a ghost Worker call.
• Make durable settlement fail closed. A terminal-storage exception is observable and retryable instead of being reported as a completed call; stale connection generations remain unacknowledged, while duplicate results for an already terminal call are acknowledged idempotently so replay converges.
• Stop treating one tool deadline as proof that the complete daemon socket is dead. Tool timeout now cancels only that call; the independent 90-second daemon-liveness alarm remains the sole connection-invalidating authority.
• Bound remote foreground execution to 85 seconds plus five seconds of relay overhead, below the observed hosted-client request ceiling. The local process APIs retain their 600-second schema range, but work expected to exceed the interactive budget must use process sessions or managed jobs rather than one foreground ChatGPT call.
• Tail-trim background daemon logs every 15 minutes as well as before startup, reusing the existing owner-only, no-follow, single-link, schema-checked, UTF-8 line-safe maintenance path.

Verification

• Add acknowledgement-loss/replay, persistent-terminal-write failure, stale generation, hosted-client deadline, runtime log-maintenance, and real Wrangler acknowledgement coverage. Type checking, lint, architecture, privacy, structured logging, security properties, SARIF, critical coverage, local self-test, Worker infrastructure, and Worker OAuth/MCP integration pass.

machine-bridge-mcp v3.0.0-beta.21

Relay continuity and stable MCP catalog

• Keep tools/list stable for an authenticated account role instead of withdrawing almost every tool whenever the local relay is briefly unavailable. The Worker still fails every execution closed against the live daemon capability ceiling, and server_info now distinguishes the stable advertised catalog from the currently effective daemon/account intersection.
• Persist streamed daemon-call ownership, request correlation, operation deadlines, reconnect deadlines, and result transformation metadata in Durable Object storage. A hibernated or restarted Worker can recover the active call, a verified same-instance daemon can reclaim it, and a per-WebSocket connection generation prevents stale close events or delayed results from mutating the rebound call. Active-record expiry advances monotonically across repeated detach/rebind cycles instead of being capped by the original single-reconnect window.
• Make Durable Object alarms the sole deadline owner for persisted streamed calls while retaining the existing Promise/timer path for bounded JSON-only calls. A FIFO admission gate computes one combined 32-call ceiling across both paths. Cancellation, send failure, operation timeout, reconnect-grace expiry, daemon replacement, and successful completion all converge through one guarded terminal write.
• Classify Worker-requested transport and liveness invalidation as retryable relay recovery instead of a permanent protocol mismatch. The daemon now terminates only the affected socket, preserves ordinary disconnect cleanup, and reconnects automatically; Worker transient invalidation uses WebSocket 1012, while unknown protocol messages, authentication failure, and identity/version mismatch remain fatal. Close-only delivery is also classified from bounded reasons so loss of the preceding error frame cannot restart the daemon. A failed daemon hello send and a readiness-probe result lost to an ending relay generation are likewise transport races, not authentication or protocol violations.
• Add red-green persistence, stale-generation, exactly-once, stable-catalog, disconnected-execution, reconnect, cancellation, timeout, transient Worker-error/close-only recovery, and real Wrangler OAuth/MCP integration coverage.
• Repair POSIX process-tree escalation after workflow-level repeated full verification exposed a surviving anti-SIGTERM descendant. Ownership is refreshed immediately after graceful termination, and escalation falls back to targeted PID/start-time/PGID checks when a full process-table snapshot is unavailable under load; PID reuse still fails closed.
• Extend post-deployment Worker health convergence for edge propagation, and treat an already recorded current deployment fingerprint as verification-only unless --force-worker is explicitly supplied. Persistent candidate activation now compensates an early failure by restarting a service that was active before the transaction, after candidate and lock cleanup; restoration failures remain aggregated with the primary failure.

Audit and documentation

• Re-audit the relay lifecycle, tool-advertisement contract, pending-call accounting, storage validation, state-machine boundaries, privacy-safe diagnostics, and obsolete event-settlement code. Synchronize architecture, operations, logging, testing, security, privacy, upgrading, and audit documentation with the implemented continuity model and its residual failure boundaries.

machine-bridge-mcp v3.0.0-beta.20

Fixed

• Rewrite the bounded Worker error-cause traversal with an explicit object type guard and WeakSet<object> cycle tracking. This preserves the eight-level/cycle-safe classification behavior while eliminating the CodeQL js/comparison-between-incompatible-types finding; the existing cyclic-cause regression test continues to enforce non-duplication.

machine-bridge-mcp v3.0.0-beta.17

Fixed

• Serve /healthz, /, and CORS preflight from the outer Worker so activation and doctor checks no longer consume Durable Object free-tier request volume. Durable Object free-tier exhaustion now returns a structured 503 durable_object_quota_exceeded instead of Cloudflare error 1101.

Durable Object stream request amplification fix

• Replace the outer Worker's time-proportional internal Durable Object poll loop with a fixed two-request terminal path: one authenticated descriptor prepare, then one hibernatable WebSocket subscribe.
• Add mcp-stream-channel.ts so BridgeRoom accepts a single stream subscriber through DurableObjectState.acceptWebSocket(), replaces stale resume subscribers, rechecks storage after registration to close the completion race, and pushes exactly one terminal JSON-RPC message.
• Persist-ready notifications are fire-and-forget from McpResumptionStore; if persistence fails, the current online subscriber can still receive the transient terminal result while recovery storage keeps failure semantics.
• Keep daemon candidate cleanup from treating stream-subscriber sockets as daemon candidates, and reject client-to-DO data on receive-only stream subscribers.
• Fix the outer subscription waiter so invalid terminal payloads reject instead of leaving the SSE completion Promise permanently unsettled.
• Extend deterministic infrastructure coverage for the fixed two-request budget, obsolete poll-mode rejection, subscriber replacement, registration races, immediate-completion paths, protocol errors, and non-daemon socket isolation. Update architecture, engineering, testing, audit, and operations contracts to describe subscribe push delivery instead of short pending/terminal polls.

machine-bridge-mcp v3.0.0-beta.16

Pending-call recovery and verified handover

• Separate the upstream MCP host/connector shard-mapper incident from Machine Bridge evidence. The exact temporary-keyspace error never appeared in Worker or daemon diagnostics and did not increment Worker server-error counters, so it is documented as an external boundary failure with unknown platform ownership rather than misclassified as a local daemon, OAuth, Git, or Cloudflare defect.
• Close the Machine Bridge failure-amplification path discovered after recovery. Pending calls now retain monotonic operation and reconnect deadlines, schedule the earliest deadline through the Durable Object alarm, and run a compensating overdue sweep on every HTTP/WebSocket event. In-memory timers remain the fast path; a transient alarm-storage error is observable without converting already-dispatched work into a false terminal failure.
• Make verified same-instance daemon handover atomic with respect to in-flight calls. Both attached and detached records move to the replacement before the incumbent closes, the complete resume_calls set is sent, remaining operation timeout is preserved, and failed replacement acknowledgement restores ownership to a still-open incumbent.
• Add deterministic disabled-timer deadline tests, direct runtime-alarm scheduling/failure tests, and a real Wrangler/workerd race regression that connects a same-instance replacement while the incumbent still owns an active call. The call remains active rather than detached and completes through the verified replacement.
• Use null-prototype dictionaries for managed-job env and env_resources, so valid variable names such as __proto__, constructor, toString, and valueOf remain ordinary own data instead of mutating JavaScript object prototypes. Add behavior coverage without weakening duplicate-variable rejection.
• Correct architecture and operations documentation that still described Durable Object waitUntil ownership or direct rejection during socket replacement. Document the three deadline enforcement paths, stale-pending diagnosis, host/connector internal-storage error triage, and the exact test evidence.

machine-bridge-mcp v3.0.0-beta.15

Event-driven streamed-call settlement

• Block 3.0.0-beta.14 after exact owner-machine activation and repeated production verification. Version, launchd identity, private candidate runtime, status, doctor, sequence-zero delivery, session isolation, disconnect recovery, and terminal acknowledgement all converged, but a concurrent server_info still timed out while the original SSE remained open; session-scoped cancellation therefore could not enter. Beta.14 has no acceptance record and must not be pushed, published, or promoted.
• Remove the last cross-event terminal Promise from streamed tools/call initiation. BridgeRoom now commits the recovery record, registers an event-settled pending call, sends the daemon envelope, and returns the descriptor without retaining a Promise for the daemon result. The later daemon WebSocket tool_result, explicit cancellation request, timeout, send failure, or reconnect-grace expiry owns terminal settlement and persistence.
• Preserve ordinary JSON-only calls with the existing Promise-based request path while adding a separate event settlement mode to PendingCallRegistry. Same-instance daemon reconnect still detaches and rebinds both modes; terminal settlement removes request keys, closes observability, and writes exactly one resumable JSON-RPC result.
• Replace the resumption store's live Promise map with an active-stream set plus a bounded transient terminal map used only when persistence fails. A pending persisted record without matching active state still produces the existing restart-ambiguity error instead of inventing completion.
• Add deterministic event-lifecycle regressions that prove stream initiation returns before any terminal event, then exercise success, daemon rejection, cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect. Architecture checks forbid dispatchJsonRpc terminal Promises, resumption.attach, and Durable Object waitUntil from returning to the stream initiation path.

machine-bridge-mcp v3.0.0-beta.12

ChatGPT Streamable HTTP task continuity

• Fix remote tools/call handling so an HTTP/SSE connection closing is no longer interpreted as MCP cancellation. Only an explicit session-scoped notifications/cancelled request may remove the pending request key and send cancel_call to the daemon.
• Negotiate text/event-stream for clients that advertise it, prime the response immediately, send a bounded ten-second keepalive comment while work is active, and deliver the terminal JSON-RPC result as an SSE message. This prevents a long-running local operation from leaving the ChatGPT-to-Worker HTTP path completely idle.
• Preserve the underlying Durable Object operation with waitUntil when the response stream is no longer writable, so transport disposal cannot silently terminate local work. JSON-only clients retain the existing single-response behavior.
• Replace duplicated relay timing literals with one shared contract. Same-daemon reconnect recovery is extended from thirty seconds to two minutes, and the Worker pauses only the remaining normal call deadline while detached, avoiding both premature expiry during recovery and inflated timeouts while the daemon is healthy.
• Add deterministic and live Worker regressions for SSE negotiation, immediate priming, keepalives, terminal result delivery, HTTP abort without cancellation, explicit cancellation after disconnect, shared timeout ceilings, and same-instance recovery timing.

machine-bridge-mcp v3.0.0-beta.11

External-review verification and observability hardening

• Share one portable content-redaction implementation between local and Worker logs. Worker string fields now redact embedded bearer/API tokens, credential URLs, email addresses, private-key headers, and user-home paths even when the field name itself is not sensitive.
• Prevent caller-supplied local or Worker fields from replacing authoritative timestamp, level, component, message, or event metadata, and add regression coverage for both value leakage and metadata forgery.
• Make the automatic execution model explicit in authenticated server_info authority snapshots and machine-mcp doctor: operations inside effective authority do not use per-operation prompts, and remote owner shell/browser/application actions have the daemon OS user's ambient authority.
• Extract local-resource reads and SSH-resource registration into runtime-resource-service.mjs, reducing LocalRuntime from 697 to 653 lines while retaining the existing zero-extra-step browser/application resource path and public result contract.
• Re-verify review claims against the repository invariants. The default full profile, single-maintainer release controls, Node 26/npm 12 baseline, packaged deployment/release helpers, systemd-user support, and cross-platform behavior suites remain intentional; none is weakened or removed merely to reduce surface area or ceremony.
• Refresh the exact Wrangler runtime from 4.112.0 to 4.113.0 and advance the reviewed npm install-script allowlist to its exact workerd 1.20260721.1; a clean install must not depend on an unreviewed or locally cached postinstall.