@junghanacs/entwurf 0.12.0 → 0.12.2

package/pi/meta-bridge/.claude-plugin/marketplace.json

@@ -1,7 +1,6 @@
 {
 	"name": "meta-bridge-local",
 	"owner": { "name": "junghan0611" },
-	"description": "Local marketplace for the entwurf garden-native meta-bridge. Shipped in-repo (repo-stable, NOT /tmp — an ephemeral source breaks `claude plugin marketplace update`). The installer (./run.sh install-meta-bridge) assembles a self-contained copy under .assembled/ (entry + lib + node-path-baked hooks) and runs `marketplace add` + `install --scope user`.",
 	"plugins": [
 		{
 			"name": "entwurf-meta-receive",

package/pi-extensions/lib/entwurf-v2-contract-schema.ts

@@ -0,0 +1,101 @@
+/**
+ * entwurf-v2-contract-schema — the pi-side TypeBox REPRESENTATION of the frozen
+ * `entwurf_v2` contract. This module exists ONLY to carry the pi-ai TypeBox
+ * schema builders (`StringEnum`, `Type`) out of the pi-free core
+ * (`entwurf-v2-contract.ts`); the constants/types/decision logic live there.
+ *
+ * ⚠️ pi LANE ONLY — the MCP bridge (`mcp/entwurf-bridge/src/index.ts`) MUST NOT
+ * import this module. It value-imports `@earendil-works/pi-ai`, so reaching it
+ * from the bridge boot closure would re-couple the harness-neutral meta-bridge to
+ * pi (the `check-entwurf-bridge-pi-free` gate fails if it does). The bridge needs
+ * the contract CONSTANTS + `resolveDispatch` (pi-free core), never these schemas.
+ * Consumers: the pi MCP-tool param surface and `check-entwurf-v2-contract`.
+ *
+ * StringEnum (typebox 1.x) inside Type.Object (typebox 0.34) — the same mix the
+ * existing entwurf tools use. The logic types in the core are hand-written unions,
+ * NOT `Static<>` inferences, so the 0.34/1.x widening caveat does not touch them;
+ * `check-entwurf-v2-contract` keeps these schemas and the core types in lockstep.
+ */
+
+import { StringEnum, Type } from "@earendil-works/pi-ai";
+import {
+	ENTWURF_INTENTS,
+	ENTWURF_V2_ACTIONS,
+	ENTWURF_V2_MODES,
+	ENTWURF_V2_OWNERSHIPS,
+	ENTWURF_V2_REJECT_REASONS,
+	ENTWURF_V2_TRANSPORTS,
+	FACT_LIVENESSES,
+} from "./entwurf-v2-contract.ts";
+import { SESSION_ID_RE } from "./session-id.js";
+
+export const EntwurfV2InputSchema = Type.Object(
+	{
+		// R2/F6 executable: the garden-id shape is enforced by pattern, not prose —
+		// a malformed/typo gid fails the schema (→ bad-target) and can never reach a
+		// spawn. SSOT regex = SESSION_ID_RE (pi-extensions/lib/session-id.js).
+		target: Type.String({
+			pattern: SESSION_ID_RE.source,
+			description:
+				"garden-id of an EXISTING citizen (pattern-enforced). spawn-new is out of v2 scope (legacy entwurf keeps it); a malformed/typo gid is bad-target.",
+		}),
+		intent: StringEnum(ENTWURF_INTENTS, {
+			description:
+				"caller's declared outcome contract (F1): fire-and-forget = ack only, owned-outcome = caller owns completion.",
+		}),
+		mode: Type.Optional(
+			StringEnum(ENTWURF_V2_MODES, {
+				description:
+					"delivery mode (steer = interrupt current turn, follow_up = queue) — NOT the ownership axis (F1) nor liveness routing. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
+			}),
+		),
+		wantsReply: Type.Optional(
+			Type.Boolean({
+				description: "conversation etiquette only — NOT ownership; never triggers an auto-send (Q2).",
+			}),
+		),
+		// `additionalProperties: false` — a frozen contract input is exact; an unknown
+		// key is a caller error, not silently ignored.
+	},
+	{ additionalProperties: false },
+);
+
+// Receipt = a DISCRIMINATED union on `ok` (R3/F6) — NOT one flat object with
+// optionals. Each branch is EXACT (`additionalProperties: false`): without it,
+// JSON Schema's default admits extra keys, so an illegal receipt like
+// {ok:true, ..., reason:"bad-target"} would validate against the success branch.
+// With it, success carries action/transport/ownership and rejects a stray reason;
+// reject carries reason and rejects any allow facet — the branches are mutually
+// exclusive at the schema level, not merely by declared-property convention.
+export const EntwurfV2ReceiptSuccessSchema = Type.Object(
+	{
+		ok: Type.Literal(true),
+		action: StringEnum(ENTWURF_V2_ACTIONS),
+		transport: StringEnum(ENTWURF_V2_TRANSPORTS),
+		ownership: StringEnum(ENTWURF_V2_OWNERSHIPS),
+		observedLiveness: StringEnum(FACT_LIVENESSES, {
+			description: "the 4-value fact liveness the verdict was computed from (R1/R3).",
+		}),
+	},
+	{ additionalProperties: false },
+);
+
+export const EntwurfV2ReceiptRejectSchema = Type.Object(
+	{
+		ok: Type.Literal(false),
+		reason: StringEnum(ENTWURF_V2_REJECT_REASONS),
+		// ？6: required-nullable, NOT optional — a reject branch ALWAYS carries the
+		// key, and it is `null` for the pre-probe rejects (PRE_PROBE_REJECT_REASONS)
+		// and a real FactLiveness otherwise. Optional would lose the "key always
+		// present, value may be null" shape and weaken the discriminated union; the
+		// reason-dependent null/non-null rule is enforced semantically (the gate's
+		// rejectObservedLivenessWellFormed fixture), not by this blanket union.
+		observedLiveness: Type.Union([StringEnum(FACT_LIVENESSES), Type.Null()], {
+			description:
+				"the 4-value fact liveness the reject was computed from (R1/R3); null for the pre-probe rejects (bad-target / target-locked / target-address-conflict) where no probe ran.",
+		}),
+	},
+	{ additionalProperties: false },
+);
+
+export const EntwurfV2ReceiptSchema = Type.Union([EntwurfV2ReceiptSuccessSchema, EntwurfV2ReceiptRejectSchema]);

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -1,8 +1,11 @@
 /**
  * entwurf-v2-contract — the FROZEN contract surface for the unified `entwurf_v2`
- * verb (0.11 Stage 0 step 4-pre / 동결결정 10). PURE: TypeBox schemas + the
+ * verb (0.11 Stage 0 step 4-pre / 동결결정 10). PURE pi-FREE core: the
  * intent×liveness decision table + the reject taxonomy + a pure resolver.
  * NO runtime dispatch, NO spawn/send, NO I/O — step 5 wires this to transports.
+ * The pi-ai TypeBox REPRESENTATION of this contract lives in the separate
+ * `entwurf-v2-contract-schema.ts` (0.12.1 B-1) so this module — which the
+ * harness-neutral MCP bridge reaches at boot — carries no pi dependency.
  *
  * Why a frozen contract BEFORE the fact-provider (step 4): with the legacy
  * 3-verb surface (`entwurf`/`entwurf_resume`/`entwurf_send`) still live, building
@@ -41,8 +44,6 @@
  * not prose.
  */
 
-import { StringEnum, Type } from "@earendil-works/pi-ai";
-import { SESSION_ID_RE } from "./session-id.js";
 import type { SocketLiveness } from "./socket-probe.ts";
 
 // ── Caller-declared intent (F1) ────────────────────────────────────────────
@@ -350,78 +351,9 @@ export function resolveDispatch(
 	};
 }
 
-// ── TypeBox schemas (for step 5 MCP tool params + the gate's structural assert) ──
-// StringEnum (typebox 1.x) inside Type.Object (typebox 0.34) — same mix the
-// existing entwurf tools use (entwurf-control.ts:92-95). The logic types above
-// are hand-written unions, NOT `Static<>` inferences, so the 0.34/1.x widening
-// caveat does not touch them; the gate keeps schema ↔ types in lockstep.
-export const EntwurfV2InputSchema = Type.Object(
-	{
-		// R2/F6 executable: the garden-id shape is enforced by pattern, not prose —
-		// a malformed/typo gid fails the schema (→ bad-target) and can never reach a
-		// spawn. SSOT regex = SESSION_ID_RE (pi-extensions/lib/session-id.js).
-		target: Type.String({
-			pattern: SESSION_ID_RE.source,
-			description:
-				"garden-id of an EXISTING citizen (pattern-enforced). spawn-new is out of v2 scope (legacy entwurf keeps it); a malformed/typo gid is bad-target.",
-		}),
-		intent: StringEnum(ENTWURF_INTENTS, {
-			description:
-				"caller's declared outcome contract (F1): fire-and-forget = ack only, owned-outcome = caller owns completion.",
-		}),
-		mode: Type.Optional(
-			StringEnum(ENTWURF_V2_MODES, {
-				description:
-					"delivery mode (steer = interrupt current turn, follow_up = queue) — NOT the ownership axis (F1) nor liveness routing. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
-			}),
-		),
-		wantsReply: Type.Optional(
-			Type.Boolean({
-				description: "conversation etiquette only — NOT ownership; never triggers an auto-send (Q2).",
-			}),
-		),
-		// `additionalProperties: false` — a frozen contract input is exact; an unknown
-		// key is a caller error, not silently ignored.
-	},
-	{ additionalProperties: false },
-);
-
-// Receipt = a DISCRIMINATED union on `ok` (R3/F6) — NOT one flat object with
-// optionals. Each branch is EXACT (`additionalProperties: false`): without it,
-// JSON Schema's default admits extra keys, so an illegal receipt like
-// {ok:true, ..., reason:"bad-target"} would validate against the success branch.
-// With it, success carries action/transport/ownership and rejects a stray reason;
-// reject carries reason and rejects any allow facet — the branches are mutually
-// exclusive at the schema level, not merely by declared-property convention.
-export const EntwurfV2ReceiptSuccessSchema = Type.Object(
-	{
-		ok: Type.Literal(true),
-		action: StringEnum(ENTWURF_V2_ACTIONS),
-		transport: StringEnum(ENTWURF_V2_TRANSPORTS),
-		ownership: StringEnum(ENTWURF_V2_OWNERSHIPS),
-		observedLiveness: StringEnum(FACT_LIVENESSES, {
-			description: "the 4-value fact liveness the verdict was computed from (R1/R3).",
-		}),
-	},
-	{ additionalProperties: false },
-);
-
-export const EntwurfV2ReceiptRejectSchema = Type.Object(
-	{
-		ok: Type.Literal(false),
-		reason: StringEnum(ENTWURF_V2_REJECT_REASONS),
-		// ？6: required-nullable, NOT optional — a reject branch ALWAYS carries the
-		// key, and it is `null` for the pre-probe rejects (PRE_PROBE_REJECT_REASONS)
-		// and a real FactLiveness otherwise. Optional would lose the "key always
-		// present, value may be null" shape and weaken the discriminated union; the
-		// reason-dependent null/non-null rule is enforced semantically (the gate's
-		// rejectObservedLivenessWellFormed fixture), not by this blanket union.
-		observedLiveness: Type.Union([StringEnum(FACT_LIVENESSES), Type.Null()], {
-			description:
-				"the 4-value fact liveness the reject was computed from (R1/R3); null for the pre-probe rejects (bad-target / target-locked / target-address-conflict) where no probe ran.",
-		}),
-	},
-	{ additionalProperties: false },
-);
-
-export const EntwurfV2ReceiptSchema = Type.Union([EntwurfV2ReceiptSuccessSchema, EntwurfV2ReceiptRejectSchema]);
+// ── TypeBox schemas ────────────────────────────────────────────────────────
+// MOVED to `entwurf-v2-contract-schema.ts` (0.12.1 B-1): the pi-ai TypeBox
+// builders (StringEnum/Type) are a pi-lane dependency, so they cannot live in
+// this pi-free core — the MCP bridge reaches this module at boot and must stay
+// harness-neutral (check-entwurf-bridge-pi-free). The schemas import the
+// constants/types above; pi-side consumers import the schemas from there.

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -195,7 +195,11 @@ export interface DispatchDeciderDeps {
 	releaseLock: (claim: LockClaim) => unknown;
 	inspectSocket: (gardenId: string) => Promise<TargetSocketInspection>;
 	probeSocket: (socketPath: string) => Promise<SocketLiveness>;
-	preflightForCwd: (cwd: string) => PreflightOutcome;
+	// MaybePromise (0.12.1 B-2): production lazy-imports the pi-coding-agent-backed
+	// preflight via `await import()` so the harness-neutral bridge boots pi-free;
+	// only the owned-outcome resume branch (below) awaits it. Sync test fakes that
+	// return a plain PreflightOutcome still satisfy this.
+	preflightForCwd: (cwd: string) => PreflightOutcome | Promise<PreflightOutcome>;
 	/**
 	 * SE-2 slice 2d-3: the REQUIRED mailbox-deliverability seam (no default). The decider
 	 * does NOT judge deliverability itself — it asks this injected fn, which combines the
@@ -392,7 +396,7 @@ async function decideInDomain(
 			// 1B: preflight runs ONLY here (the sole branch that launches a child into a
 			// target cwd). deny → nonce-owned release → untrusted-fail-fast, with the
 			// honest measured liveness (dormant = the `dead` we just probed).
-			const outcome = deps.preflightForCwd(resume.cwd);
+			const outcome = await deps.preflightForCwd(resume.cwd);
 			if (outcome.kind === "deny") {
 				return rejectAfterRelease(makeRejectReceipt("untrusted-fail-fast", liveness));
 			}

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -39,7 +39,12 @@ import {
 	receiverMarkerMatchesIdentity,
 } from "./entwurf-deliverability.ts";
 import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.ts";
-import { type PreflightInput, type PreflightOutcome, preflight as realPreflight } from "./entwurf-preflight.ts";
+// 0.12.1 B-2: TYPE-ONLY import — `entwurf-preflight.ts` value-imports
+// `@earendil-works/pi-coding-agent` (ProjectTrustStore), so a static value-import
+// here would re-couple the harness-neutral MCP bridge to pi at boot
+// (check-entwurf-bridge-pi-free). The real preflight is reached ONLY via the lazy
+// `await import()` in `lazyProductionPreflight`, on the owned-outcome resume branch.
+import type { PreflightInput, PreflightOutcome } from "./entwurf-preflight.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type DispatchDeciderDeps,
@@ -109,7 +114,10 @@ export interface ProductionEntwurfV2Seams {
 	releaseLock: (claim: LockClaim, deps: { dir?: string }) => unknown;
 	inspectSocket: (gid: string, dir: string) => Promise<TargetSocketInspection>;
 	probeSocket: (socketPath: string) => Promise<SocketLiveness>;
-	preflight: (input: PreflightInput) => PreflightOutcome;
+	// MaybePromise (0.12.1 B-2): the production default is the lazy wrapper, which
+	// `await import()`s the pi-coding-agent-backed preflight only on a resume verdict.
+	// A deterministic gate may still inject a sync spy returning a plain PreflightOutcome.
+	preflight: (input: PreflightInput) => PreflightOutcome | Promise<PreflightOutcome>;
 	classifyConnect: (code: string | undefined) => "dead" | "indeterminate";
 	sendRpc: (socketPath: string, command: RpcCommand, options?: RpcClientOptions) => Promise<{ response: RpcResponse }>;
 	enqueue: (opts: EnqueueMetaMessageOptions) => EnqueueMetaMessageResult;
@@ -138,6 +146,20 @@ export interface ProductionEntwurfV2Opts {
 	seams?: Partial<ProductionEntwurfV2Seams>;
 }
 
+/**
+ * 0.12.1 B-2: the production `preflight` seam default. preflight value-imports
+ * `@earendil-works/pi-coding-agent` (ProjectTrustStore), so importing it eagerly
+ * would pull pi into the harness-neutral MCP bridge's boot closure. This wrapper
+ * defers that to a lazy `await import()` reached ONLY on the owned-outcome resume
+ * branch (the decider awaits it). peers/self/list/mailbox-deliver therefore boot
+ * with no pi package present; a pi-less environment that DOES hit a spawn-bg resume
+ * surfaces an honest module-not-found at that point rather than failing boot.
+ */
+async function lazyProductionPreflight(input: PreflightInput): Promise<PreflightOutcome> {
+	const { preflight } = await import("./entwurf-preflight.ts");
+	return preflight(input);
+}
+
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
  * `isNonPiGardenIdSocketConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
@@ -185,7 +207,7 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: s.releaseLock ?? realReleaseLock,
 		inspectSocket: s.inspectSocket ?? inspectTargetControlSocket,
 		probeSocket: s.probeSocket ?? probeSocketLiveness,
-		preflight: s.preflight ?? realPreflight,
+		preflight: s.preflight ?? lazyProductionPreflight,
 		classifyConnect: s.classifyConnect ?? classifyConnectError,
 		sendRpc: s.sendRpc ?? realSendRpc,
 		enqueue: s.enqueue ?? enqueueMetaMessage,
@@ -265,7 +287,7 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: release,
 		inspectSocket,
 		probeSocket,
-		preflightForCwd: (cwd: string): PreflightOutcome =>
+		preflightForCwd: (cwd: string): PreflightOutcome | Promise<PreflightOutcome> =>
 			io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
 		mailboxDeliverabilityFor,
 		mailboxDir,

package/run.sh

@@ -13,7 +13,16 @@
 #
 set -euo pipefail
 
-REPO_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+SOURCE="${BASH_SOURCE[0]}"
+while [ -L "$SOURCE" ]; do
+  DIR="$(cd -P -- "$(dirname -- "$SOURCE")" && pwd)"
+  TARGET="$(readlink "$SOURCE")"
+  case "$TARGET" in
+    /*) SOURCE="$TARGET" ;;
+    *) SOURCE="$DIR/$TARGET" ;;
+  esac
+done
+REPO_DIR=$(cd -P -- "$(dirname -- "$SOURCE")" && pwd)
 PROJECT_DIR_DEFAULT=$(pwd)
 TARGET_PROJECT_DIR=${2:-$PROJECT_DIR_DEFAULT}
 # npm publish identity. Scoped 2026-05-18 — bare `entwurf` was not on npm
@@ -36,6 +45,7 @@ Usage:
   ./run.sh release-gate [project-dir] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm check) + the v2-native live gates (v2 matrix/spawn-resume-live, check-bridge, retargeted smoke-session-id-name, RGG) + the ACP plugin acceptance floor (11 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). LIVE-gated MUST steps HONEST-SKIP when LIVE!=1 (a CUT needs LIVE=1, SKIP=0). --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b, IN pnpm check): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 registered/schema; tools/list only, no auth/side-effect
+  ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
   ./run.sh check-model-lock           # deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)
   ./run.sh check-shell-quote          # POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH
   ./run.sh check-entwurf-session-identity # deterministic gate for locked garden session identity & name grammar (sessionId/buildSessionName/parse/collision), no API
@@ -83,6 +93,7 @@ Usage:
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
+  ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
   ./run.sh install-meta-bridge        # 1.0.0 meta-bridge Phase 2: stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
@@ -785,6 +796,17 @@ check_entwurf_bridge_boot() {
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-bridge-boot.ts)
 }
 
+check_entwurf_bridge_pi_free() {
+  # 0.12.1 A-gate (static half): the entwurf-bridge MCP server must boot WITHOUT any
+  # pi package. entwurf is a harness-neutral npm package; pi is one optional adapter
+  # lane, not a boot dependency. Walks the EAGER static value-import closure of
+  # mcp/entwurf-bridge/src/index.ts and fails if any reachable module statically
+  # value-imports @earendil-works/pi-*. Type-only imports and dynamic `await import()`
+  # (the intended lazy preflight boundary) are excluded — the runtime boot smoke is the
+  # final authority that peers/self/list/mailbox-deliver come up pi-free.
+  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-bridge-pi-free.ts)
+}
+
 check_entwurf_v2_production() {
   # Deterministic gate for 0.11 Stage 0 step 5d-2b: makeProductionEntwurfV2Deps — the ctx-free
   # PRODUCTION assembly of runEntwurfV2's deps. Proves the wiring over fake leaf-IO spies (no
@@ -1650,7 +1672,11 @@ check_pack() {
   section "pack invariants (dry-run)"
 
   local json
-  json=$(cd "$REPO_DIR" && npm pack --dry-run --json 2>/dev/null) || {
+  # --silent so the `prepack` build (pnpm --silent run build-bridge → tsc) and
+  # npm's own lifecycle banner stay off stdout; otherwise they pollute the --json
+  # payload this parses. prepack runs on dry-run too, which is how dist lands in
+  # this gate's file list.
+  json=$(cd "$REPO_DIR" && npm pack --dry-run --json --silent 2>/dev/null) || {
     fail "[check-pack] npm pack --dry-run failed"
     return 1
   }
@@ -1701,6 +1727,10 @@ check_pack() {
     "pi-extensions/entwurf-control.ts"
     "pi-extensions/model-lock.ts" "pi-extensions/lib/entwurf-core.ts"
     "mcp/entwurf-bridge/src/index.ts"
+    # 0.12.1 C — the prepack-built node_modules-safe boot artifact. start.sh runs
+    # this dist JS when present (the .ts source can't strip-types under
+    # node_modules). prepack runs on `npm pack --dry-run`, so it is in this gate.
+    "mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -1796,6 +1826,15 @@ check_pack_install() {
   tgz_path="${REPO_DIR}/${tgz_name}"
   rm -f "$tgz_path"
 
+  # 0.12.1 C — stale-dist guard. `tsc` emit does NOT prune orphaned files from
+  # outDir, and `files: ["mcp/"]` would carry any leftover dist file into the
+  # tarball. build-bridge therefore `rm -rf`s dist before emit. Prove it: plant a
+  # sentinel in dist, then assert the pack's prepack (build-bridge) wiped it so it
+  # never reaches the tarball. Without the clean step this sentinel ships.
+  local stale_probe="${REPO_DIR}/mcp/entwurf-bridge/dist/__stale_probe__.js"
+  mkdir -p "$(dirname "$stale_probe")"
+  printf 'module.exports = "stale";\n' > "$stale_probe"
+
   echo "[check-pack-install] npm pack -> ${tgz_name}"
   (cd "$REPO_DIR" && npm pack --dry-run=false 2>&1 | tail -1) || {
     fail "[check-pack-install] npm pack failed"
@@ -1814,6 +1853,15 @@ check_pack_install() {
   local tar_files pass=1 f pat
   tar_files=$(tar -tf "$tgz_path" | sed 's|^package/||' | grep -v '/$' || true)
 
+  # 0.12.1 C — the planted stale sentinel must NOT have survived into the tarball.
+  # If it did, build-bridge's `rm -rf dist` clean step regressed and stale/orphan
+  # emit can ship. (See the plant just before npm pack above.)
+  if grep -qxF "mcp/entwurf-bridge/dist/__stale_probe__.js" <<<"$tar_files"; then
+    rm -f "$tgz_path"
+    fail "[check-pack-install] stale dist file shipped — build-bridge did not clean dist before emit (orphan-emit publish risk)"
+    return 1
+  fi
+
   # Required tarball contents. The old 0.11.0 ACP root files (index.ts,
   # acp-bridge.ts, event-mapper.ts, engraving.ts, pi-context-augment.ts,
   # pi-extensions/entwurf.ts) were removed on v2-only and are GONE — keeping them
@@ -1830,6 +1878,8 @@ check_pack_install() {
     "pi-extensions/entwurf-control.ts"
     "pi-extensions/model-lock.ts" "pi-extensions/lib/entwurf-core.ts"
     "mcp/entwurf-bridge/src/index.ts"
+    # 0.12.1 C — prepack-built node_modules-safe boot artifact (see check-pack).
+    "mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -1959,26 +2009,25 @@ check_pack_install() {
   done
   echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-4-6 + claude-opus-4-8 anchor)"
 
-  # npm-managed `run.sh install` regression — the README's PRIMARY install path,
-  # `pi install npm:@junghanacs/entwurf` then `run.sh install .`. This layout
-  # differs from the pnpm-add smoke above in the exact way that broke the install:
-  # pi installs via npm with --legacy-peer-deps, so the package lands under a
-  # managed prefix (~/.pi/agent/npm/node_modules/@junghanacs/entwurf), runtime deps
-  # HOIST to the sibling node_modules, there is NO package-local node_modules, and
-  # the pi peer trio is absent (loader-provided). The old cwd-relative
-  # preflight_dep_integrity rejected every dep in this layout, so the documented
-  # primary path failed on first use while every dry-run/pnpm-add gate stayed green.
-  # Prove `run.sh install` actually writes settings from the hoisted layout. HOME is
+  # npm-managed neutral install regression — the README's PRIMARY install path is
+  # now `npm install @junghanacs/entwurf` (NOT `pi install npm:...`). This layout
+  # lands the package under node_modules, hoists runtime deps to the sibling
+  # node_modules, has no package-local node_modules, and the pi peer trio must be
+  # absent because pi is an optional adapter lane. The old cwd-relative
+  # preflight_dep_integrity rejected every hoisted-dep npm install; 0.12.0 then
+  # additionally died because start.sh tried strip-types under node_modules.
+  # Prove `entwurf`/`entwurf-bridge` bins exist, `run.sh install` writes settings
+  # from the hoisted layout, and the installed bridge boots from dist. HOME is
   # redirected to a throwaway dir so ensure_agent_dir_symlinks operates on a temp
-  # ~/.pi/agent and never touches (or fails against) the operator's real targets link.
+  # ~/.pi/agent and never touches the operator's real targets link.
   if ! command -v npm >/dev/null 2>&1; then
     fail "[check-pack-install] npm not on PATH — cannot run npm-managed install regression"
     return 1
   fi
   local npmroot="$npm_tmp/npmroot" npmhome="$npm_tmp/npmhome" npmproj="$npm_tmp/npmproj" npm_log npm_pkg wire_log
   mkdir -p "$npmroot" "$npmhome" "$npmproj"
-  npm_log=$(cd "$npmroot" && npm install "$tgz_path" --legacy-peer-deps --no-audit --no-fund 2>&1) || {
-    fail "[check-pack-install] npm-managed install failed:"
+  npm_log=$(cd "$npmroot" && npm install "$tgz_path" --no-audit --no-fund 2>&1) || {
+    fail "[check-pack-install] npm-managed neutral install failed:"
     echo "$npm_log" | tail -10 | sed 's/^/    /' >&2
     return 1
   }
@@ -1987,6 +2036,11 @@ check_pack_install() {
     fail "[check-pack-install] npm-managed layout missing executable run.sh (postinstall-chmod did not run?) at $npm_pkg"
     return 1
   fi
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge)"
+    ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
+    return 1
+  fi
   wire_log=$(HOME="$npmhome" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
     fail "[check-pack-install] npm-managed run.sh install failed (preflight rejected hoisted deps?):"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
@@ -2004,6 +2058,75 @@ check_pack_install() {
   fi
   echo "[check-pack-install] npm-managed install regression pass (hoisted-dep run.sh install wrote settings)"
 
+  # 0.12.1 C — installed bridge BOOT regression. This is the test whose absence
+  # let the 0.12.0 install bug ship: the README's bridge launcher was
+  # `node --experimental-strip-types src/index.ts`, which Node REFUSES under
+  # node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). Every gate above
+  # wired settings or probed shape but never BOOTED the bridge from its installed
+  # node_modules home, so the dead-on-arrival MCP server passed publish. Here we
+  # boot the installed start.sh and assert it answers MCP tools/list with the v2
+  # surface. Two proofs in one: (1) the prepack dist JS boots under node_modules
+  # with plain node — a strip-types fallback would crash with the exact error
+  # above, so a parseable tools/list IS proof the dist path was taken; (2) the
+  # boot is pi-free — the @earendil-works peer trio is optional and must NOT be
+  # installed by the neutral npm path, so the eager closure stands up with pi absent.
+  local installed_start="$npmroot/node_modules/.bin/entwurf-bridge"
+  local installed_dist="$npm_pkg/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js"
+  if [ ! -f "$installed_dist" ]; then
+    fail "[check-pack-install] installed bridge missing prebuilt dist (prepack did not emit into the tarball?): $installed_dist"
+    return 1
+  fi
+  if [ -d "$npmroot/node_modules/@earendil-works" ]; then
+    fail "[check-pack-install] @earendil-works present in npm-managed node_modules — pi-free boot proof is void (neutral npm install should not install optional pi peers)"
+    return 1
+  fi
+  local boot_out
+  if ! boot_out=$(START_SH="$installed_start" node --input-type=module <<'JS'
+import { spawn } from 'node:child_process';
+const start = process.env.START_SH;
+// Sanitize the child env so the pi-free proof cannot be masked by a leaked
+// module-resolution path: if NODE_PATH (or a stray pi env) pointed at a tree
+// holding @earendil-works, a statically pi-importing eager graph could resolve
+// and boot anyway, turning this gate falsely green. Strip it so "boots with
+// @earendil absent" stays an honest adversarial proof.
+const env = { ...process.env };
+delete env.NODE_PATH;
+const child = spawn(start, { stdio: ['pipe', 'pipe', 'pipe'], env });
+let stdout = '', stderr = '', done = false;
+const timer = setTimeout(() => {
+  child.kill('SIGKILL');
+  console.error('installed bridge boot timeout');
+  if (stderr.trim()) console.error(stderr.trim());
+  process.exit(1);
+}, 5000);
+function finish(trimmed) {
+  if (done) return;
+  done = true;
+  clearTimeout(timer);
+  let msg;
+  try { msg = JSON.parse(trimmed); }
+  catch { console.error('unparseable tools/list:', trimmed.slice(0, 300)); if (stderr.trim()) console.error(stderr.trim()); process.exit(1); }
+  const names = (msg?.result?.tools ?? []).map((t) => t?.name).sort();
+  for (const need of ['entwurf_v2', 'entwurf_peers', 'entwurf_self', 'entwurf_inbox_read']) {
+    if (!names.includes(need)) { console.error('missing MCP tool from installed boot:', need, '— got', names.join(',')); process.exit(1); }
+  }
+  console.log(names.join(','));
+  child.kill('SIGTERM');
+  process.exit(0);
+}
+child.stdout.on('data', (d) => { stdout += d.toString(); const t = stdout.trim(); if (t) finish(t); });
+child.stderr.on('data', (d) => { stderr += d.toString(); });
+child.on('error', (e) => { clearTimeout(timer); console.error('installed bridge spawn error:', String(e)); process.exit(1); });
+child.on('close', () => { if (done) return; clearTimeout(timer); if (stderr.trim()) console.error(stderr.trim()); console.error('installed bridge closed with empty tools/list'); process.exit(1); });
+child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }) + '\n');
+JS
+  ); then
+    fail "[check-pack-install] installed bridge boot FAILED — the npm-installed MCP server does not answer tools/list (the 0.12.0 strip-types-under-node_modules regression):"
+    echo "$boot_out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed bridge boot pass (dist boots under node_modules, pi-free: $boot_out)"
+
   ok "[check-pack-install] publish install smoke pass"
   return 0
 }
@@ -2560,6 +2683,9 @@ case "$cmd" in
   check-entwurf-bridge-boot)
     check_entwurf_bridge_boot
     ;;
+  check-entwurf-bridge-pi-free)
+    check_entwurf_bridge_pi_free
+    ;;
   check-entwurf-v2-spawn)
     check_entwurf_v2_spawn
     ;;
@@ -2678,6 +2804,15 @@ case "$cmd" in
     # Offline/hermetic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-meta-keyset-guard.sh)
     ;;
+  check-meta-manifest-schema)
+    # 0.12.2 meta-bridge: deterministic, CLI-version-INDEPENDENT guard. `claude plugin
+    # validate` is a CLOSED schema whose allowed keyset differs by version, so a
+    # decorative key (0.12.1's root `description`) passed on the dev box but broke
+    # install on the floor Claude. This pins the committed manifests to the minimal
+    # validated keyset and asserts desired_mcp()'s installed-vs-clone dual-mode.
+    # Offline/hermetic (deps: python3).
+    (cd "$REPO_DIR" && python3 scripts/check-meta-manifest-schema.py)
+    ;;
   smoke-meta-install-state)
     # 1.0.0 meta-bridge Phase 2 regression gate: state file captures pre-install
     # values, install/uninstall touches only the managed keyset, uninstall refuses