@junghanacs/entwurf 0.12.0 → 0.12.2

package/scripts/check-entwurf-bridge-pi-free.ts

@@ -0,0 +1,146 @@
+// check-entwurf-bridge-pi-free (0.12.1 A-gate, static half)
+//
+// INVARIANT: the entwurf-bridge MCP server must boot WITHOUT any pi package
+// (`@earendil-works/pi-*`). entwurf is a harness-neutral npm package; pi is one
+// optional adapter lane, not a boot dependency. A plain `npm install
+// @junghanacs/entwurf` (no pi peers) must still stand `entwurf-bridge` up and
+// answer MCP `tools/list`.
+//
+// This gate is the STATIC half of that contract: it walks the EAGER static
+// value-import closure of the bridge entry (`mcp/entwurf-bridge/src/index.ts`)
+// and fails if any reachable module statically value-imports `@earendil-works/*`.
+//
+// "Eager static value-import" is the precise boundary (GPT-agreed):
+//   - `import type …`               → erased by strip-types        → NOT followed
+//   - `import { type A, type B }`    → all-type, erased            → NOT followed
+//   - `import { type A, b }`         → has a value binding, kept    → followed
+//   - `import x` / `import * as x`   → value                        → followed
+//   - `import "x"` (side-effect)     → value                        → followed
+//   - `export { a } from "x"`        → value re-export              → followed
+//   - `export type { a } from "x"`   → type re-export, erased       → NOT followed
+//   - `await import("x")` (dynamic)  → INTENDED lazy boundary       → NOT followed
+//
+// The dynamic-import exemption is deliberate: B-2 makes the pi-coding-agent
+// `preflight` a lazy `await import("./entwurf-preflight.ts")` reached ONLY on an
+// owned-outcome spawn-bg resume, so it is allowed to pull pi at runtime in that
+// one branch. The runtime boot smoke (separate half) is the final authority that
+// peers/self/list/mailbox-deliver come up pi-free.
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+
+const REPO = resolve(import.meta.dirname, "..");
+const ENTRY = resolve(REPO, "mcp/entwurf-bridge/src/index.ts");
+const PI_SPECIFIER = /^@earendil-works\/pi-(ai|coding-agent|tui)(\/|$)/;
+
+/** Strip line + block comments so a commented-out import never registers. */
+function stripComments(src: string): string {
+	return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1");
+}
+
+/** Is every named binding in a `{ … }` clause a `type` binding? (→ import erased) */
+function allNamedAreType(clause: string): boolean {
+	const parts = clause
+		.split(",")
+		.map((p) => p.trim())
+		.filter(Boolean);
+	if (parts.length === 0) return false; // `import {} from` is odd; treat as value.
+	return parts.every((p) => /^type\s/.test(p));
+}
+
+/**
+ * Return the runtime-loaded (non-type, non-dynamic) module specifiers of `src`.
+ * Only static `import …`/`export … from` whose effect survives strip-types.
+ */
+function runtimeSpecifiers(src: string): string[] {
+	const clean = stripComments(src);
+	const specs: string[] = [];
+	// import … from "spec"  |  import "spec"
+	const importRe = /\bimport\b([^"'`;]*?)\bfrom\b\s*["'`]([^"'`]+)["'`]|\bimport\s*["'`]([^"'`]+)["'`]/g;
+	for (let m = importRe.exec(clean); m !== null; m = importRe.exec(clean)) {
+		const sideEffect = m[3];
+		if (sideEffect) {
+			specs.push(sideEffect);
+			continue;
+		}
+		const clause = (m[1] ?? "").trim();
+		const spec = m[2];
+		if (/^type\b/.test(clause)) continue; // `import type …`
+		const braced = clause.match(/\{([^}]*)\}/);
+		// A pure `{ … }` clause (no default/namespace) that is all-type is erased.
+		if (braced && !/^[A-Za-z0-9_$]/.test(clause) && allNamedAreType(braced[1])) continue;
+		specs.push(spec);
+	}
+	// export … from "spec"  (value re-export);  export type … from → skip
+	const reexportRe = /\bexport\b([^"'`;]*?)\bfrom\b\s*["'`]([^"'`]+)["'`]/g;
+	for (let m = reexportRe.exec(clean); m !== null; m = reexportRe.exec(clean)) {
+		const clause = (m[1] ?? "").trim();
+		const spec = m[2];
+		if (/^type\b/.test(clause)) continue; // `export type … from`
+		const braced = clause.match(/\{([^}]*)\}/);
+		if (braced && allNamedAreType(braced[1])) continue;
+		specs.push(spec);
+	}
+	return specs;
+}
+
+/** Resolve a relative specifier to an on-disk source file, or null if external. */
+function resolveLocal(fromFile: string, spec: string): string | null {
+	if (!spec.startsWith(".")) return null; // bare/external — handled by caller
+	const base = resolve(dirname(fromFile), spec);
+	const candidates = [
+		base,
+		`${base}.ts`,
+		`${base}.js`,
+		`${base}.mjs`,
+		resolve(base, "index.ts"),
+		resolve(base, "index.js"),
+	];
+	for (const c of candidates) if (existsSync(c)) return c;
+	return null;
+}
+
+// BFS over the eager static value-import closure.
+const visited = new Set<string>();
+const violations: Array<{ chain: string[]; specifier: string }> = [];
+const queue: Array<{ file: string; chain: string[] }> = [{ file: ENTRY, chain: [relative(REPO, ENTRY)] }];
+
+while (queue.length > 0) {
+	const { file, chain } = queue.shift()!;
+	if (visited.has(file)) continue;
+	visited.add(file);
+	let src: string;
+	try {
+		src = readFileSync(file, "utf8");
+	} catch {
+		continue;
+	}
+	for (const spec of runtimeSpecifiers(src)) {
+		if (PI_SPECIFIER.test(spec)) {
+			violations.push({ chain, specifier: spec });
+			continue;
+		}
+		const local = resolveLocal(file, spec);
+		if (local && !visited.has(local)) {
+			queue.push({ file: local, chain: [...chain, relative(REPO, local)] });
+		}
+	}
+}
+
+if (violations.length > 0) {
+	console.error("[check-entwurf-bridge-pi-free] FAIL: bridge boot closure statically value-imports pi:");
+	for (const v of violations) {
+		console.error(`  - ${v.specifier}`);
+		console.error(`      via ${v.chain.join(" -> ")}`);
+	}
+	console.error(
+		"\n  The entwurf-bridge MCP server must boot pi-free. Move the pi value-import behind a\n" +
+			"  type-only import, a pi-side module the bridge does not reach, or a lazy `await import()`\n" +
+			"  on the owned-outcome resume branch only.",
+	);
+	process.exit(1);
+}
+
+console.log(
+	`[check-entwurf-bridge-pi-free] ok — bridge boot closure is pi-free (${visited.size} modules walked, no static @earendil-works/pi-* value-import)`,
+);

package/scripts/check-entwurf-v2-contract.ts

@@ -41,10 +41,6 @@ import {
 	ENTWURF_V2_OWNERSHIPS,
 	ENTWURF_V2_REJECT_REASONS,
 	ENTWURF_V2_TRANSPORTS,
-	EntwurfV2InputSchema,
-	EntwurfV2ReceiptRejectSchema,
-	EntwurfV2ReceiptSchema,
-	EntwurfV2ReceiptSuccessSchema,
 	FACT_LIVENESSES,
 	type FactLiveness,
 	factLivenessOf,
@@ -57,6 +53,12 @@ import {
 	resolveDispatch,
 	UNSUPPORTED_DISPATCH_TABLE,
 } from "../pi-extensions/lib/entwurf-v2-contract.ts";
+import {
+	EntwurfV2InputSchema,
+	EntwurfV2ReceiptRejectSchema,
+	EntwurfV2ReceiptSchema,
+	EntwurfV2ReceiptSuccessSchema,
+} from "../pi-extensions/lib/entwurf-v2-contract-schema.ts";
 import { SESSION_ID_RE } from "../pi-extensions/lib/session-id.js";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
 

package/scripts/check-meta-manifest-schema.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+# check-meta-manifest-schema — deterministic, CLI-version-INDEPENDENT guard for the
+# meta-bridge plugin manifests + the installed-vs-clone MCP wiring decision.
+#
+# Why this exists (0.12.2): `claude plugin validate` is a CLOSED schema — it REJECTS
+# unrecognized keys, and the allowed keyset differs by Claude Code version. 0.12.1
+# shipped a marketplace.json carrying a root `description`; Claude 2.1.195 (the dev
+# box) accepted it, Claude 2.1.97 (the install floor) rejected it with
+# `Unrecognized key: "description"`, so `entwurf install-meta-bridge` died on the
+# floor host while the release looked green. The lesson: a "nice to have" decorative
+# key in a closed-schema manifest is a future regression surface. This guard pins the
+# committed manifests to the MINIMAL keyset confirmed to validate on the lowest
+# supported Claude, independent of whatever CLI version happens to run here.
+#
+# It also asserts meta-bridge-state.py::desired_mcp() picks the stable `entwurf-bridge`
+# bin for an installed package and the clone's start.sh for a dev clone (the other
+# 0.12.1 install-surface fragility: baking the pnpm store path goes stale on peer bumps).
+#
+# Offline / hermetic. Deps: python3 only.
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REPO = HERE.parent
+MB = REPO / "pi" / "meta-bridge"
+STATE = HERE / "meta-bridge-state.py"
+
+fail = 0
+
+
+def ok(msg: str) -> None:
+    print(f"  ok    {msg}")
+
+
+def bad(msg: str) -> None:
+    global fail
+    print(f"  FAIL  {msg}")
+    fail = 1
+
+
+def load(path: Path):
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except Exception as exc:  # noqa: BLE001
+        bad(f"cannot parse {path}: {exc}")
+        return None
+
+
+def subset(label: str, got, allowed: set[str]) -> None:
+    if not isinstance(got, dict):
+        bad(f"{label}: expected an object, got {type(got).__name__}")
+        return
+    extra = set(got) - allowed
+    if extra:
+        bad(f"{label}: keys {sorted(extra)} outside minimal allowed set {sorted(allowed)} "
+            f"(closed-schema risk: an older Claude may reject them)")
+    else:
+        ok(f"{label}: keys ⊆ {sorted(allowed)}")
+
+
+# --- marketplace.json --------------------------------------------------------
+mkt = load(MB / ".claude-plugin" / "marketplace.json")
+if mkt is not None:
+    subset("marketplace root", mkt, {"name", "owner", "plugins"})
+    subset("marketplace.owner", mkt.get("owner", {}), {"name"})
+    plugins = mkt.get("plugins")
+    if not isinstance(plugins, list) or not plugins:
+        bad("marketplace.plugins must be a non-empty array")
+    else:
+        for i, p in enumerate(plugins):
+            subset(f"marketplace.plugins[{i}]", p, {"name", "source", "description"})
+
+# --- plugin.json -------------------------------------------------------------
+plug = load(MB / "entwurf-meta-receive" / ".claude-plugin" / "plugin.json")
+if plug is not None:
+    subset("plugin.json", plug, {"name", "version", "description"})
+
+# --- hooks.json --------------------------------------------------------------
+hooks = load(MB / "entwurf-meta-receive" / "hooks" / "hooks.json")
+if hooks is not None:
+    subset("hooks.json root", hooks, {"hooks"})
+    # Pin the hook EVENT names too — an unrecognized event key is the same closed-schema
+    # risk as an unrecognized field. These four are the meta-bridge's load-bearing events.
+    subset("hooks.json events", hooks.get("hooks") or {},
+           {"SessionStart", "CwdChanged", "UserPromptSubmit", "FileChanged"})
+    for event, entries in (hooks.get("hooks") or {}).items():
+        if not isinstance(entries, list):
+            bad(f"hooks.{event} must be an array")
+            continue
+        for j, entry in enumerate(entries):
+            subset(f"hooks.{event}[{j}]", entry, {"matcher", "hooks"})
+            for k, h in enumerate(entry.get("hooks", []) if isinstance(entry, dict) else []):
+                # asyncRewake/timeout are load-bearing on the FileChanged doorbell —
+                # allowed, NOT decorative. Anything beyond this set must be reviewed.
+                subset(f"hooks.{event}[{j}].hooks[{k}]", h, {"type", "command", "asyncRewake", "timeout"})
+
+# --- desired_mcp() installed-vs-clone dual-mode ------------------------------
+def desired_mcp(repo: str):
+    out = subprocess.run(
+        [sys.executable, str(STATE), "desired-mcp", "--repo", repo],
+        capture_output=True, text=True,
+    )
+    if out.returncode != 0:
+        bad(f"desired-mcp --repo {repo} exited {out.returncode}: {out.stderr.strip()}")
+        return None
+    return json.loads(out.stdout)
+
+
+# Both probes use SYNTHETIC paths that need not exist — never REPO. If this guard ran
+# from an installed package (e.g. `entwurf check-meta-manifest-schema`), REPO would
+# itself end in node_modules/@junghanacs/entwurf and a REPO-based clone probe would
+# wrongly resolve to the installed shape and self-fail. Fixed, installed-vs-clone-shaped
+# literals make the assertion location-independent.
+installed = desired_mcp("/opt/x/node_modules/@junghanacs/entwurf")
+if installed is not None:
+    if installed.get("command") == "entwurf-bridge" and installed.get("args") == []:
+        ok("desired_mcp(installed-shaped) → stable `entwurf-bridge` bin (no store path baked)")
+    else:
+        bad(f"desired_mcp(installed-shaped) should wire the `entwurf-bridge` bin, got {installed.get('command')} {installed.get('args')}")
+
+clone = desired_mcp("/opt/entwurf-dev-clone")
+if clone is not None:
+    args = clone.get("args") or [""]
+    if clone.get("command") == "bash" and str(args[0]).endswith("mcp/entwurf-bridge/start.sh"):
+        ok("desired_mcp(clone-shaped) → that clone's start.sh (not the global bin)")
+    else:
+        bad(f"desired_mcp(clone-shaped) should wire bash start.sh, got {clone.get('command')} {args}")
+
+# both modes must keep the canonical sender env
+for label, entry in (("installed", installed), ("clone", clone)):
+    if entry is None:
+        continue
+    env = entry.get("env", {})
+    if env.get("ENTWURF_BRIDGE_REQUIRE_META_SENDER") == "1" and \
+       env.get("ENTWURF_BRIDGE_EXTERNAL_AGENT_ID") == "external-mcp/claude-code":
+        ok(f"desired_mcp({label}) carries canonical sender env")
+    else:
+        bad(f"desired_mcp({label}) dropped canonical sender env: {env}")
+
+if fail:
+    print("check-meta-manifest-schema FAIL")
+    sys.exit(1)
+print("check-meta-manifest-schema PASS")

package/scripts/meta-bridge-install.sh

@@ -115,9 +115,23 @@ claude mcp remove entwurf-bridge -s user >/dev/null 2>&1 || true
 # 0.11 S2 cutover: drop any stale USER-scope pi-tools-bridge entry written by a
 # prior version (one-shot rename cleanup, not a runtime alias).
 claude mcp remove pi-tools-bridge -s user >/dev/null 2>&1 || true
-claude mcp add -s user entwurf-bridge \
-  -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
-  -- bash "$REPO/mcp/entwurf-bridge/start.sh" >/dev/null
+# 0.12.2 installed-vs-clone dual-mode — MUST mirror meta-bridge-state.py::desired_mcp(),
+# which the trailing `apply` re-asserts as the SSOT. An installed package ($REPO ends
+# in node_modules/@junghanacs/entwurf) wires the STABLE `entwurf-bridge` bin shim; baking
+# the pnpm store path here would go stale on any peer/version bump. A dev clone pins to
+# this clone's start.sh. Both branches carry the same two env vars desired_mcp() writes.
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    claude mcp add -s user entwurf-bridge \
+      -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
+      -e ENTWURF_BRIDGE_REQUIRE_META_SENDER=1 \
+      -- entwurf-bridge >/dev/null ;;
+  *)
+    claude mcp add -s user entwurf-bridge \
+      -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
+      -e ENTWURF_BRIDGE_REQUIRE_META_SENDER=1 \
+      -- bash "$REPO/mcp/entwurf-bridge/start.sh" >/dev/null ;;
+esac
 (cd /tmp && claude mcp get entwurf-bridge 2>/dev/null | grep -q "Scope: User config") || \
   die "post-install: entwurf-bridge is not reachable as USER-scope MCP from /tmp"
 echo "[meta-bridge-install] installed entwurf-bridge MCP (scope: user = global receiver tools)"

package/scripts/meta-bridge-state.py

@@ -264,20 +264,42 @@ def desired_marketplace(asm: Path) -> dict[str, Any]:
     return {"source": {"source": "directory", "path": str(asm.resolve())}}
 
 
+def is_installed_package(repo: Path) -> bool:
+    # An installed (npm / pnpm) layout always ends in node_modules/@junghanacs/entwurf
+    # (pnpm global nests it under .pnpm/<hash>/node_modules/@junghanacs/entwurf). A dev
+    # clone never lives under node_modules/@junghanacs/entwurf, so the trailing three
+    # path components cleanly distinguish the two WITHOUT a PATH lookup (`command -v
+    # entwurf-bridge` could resolve a stale GLOBAL bin from a clone host and is wrong here).
+    parts = repo.resolve().parts
+    return parts[-3:] == ("node_modules", "@junghanacs", "entwurf")
+
+
 def desired_mcp(repo: Path) -> dict[str, Any]:
+    env = {
+        "ENTWURF_BRIDGE_EXTERNAL_AGENT_ID": "external-mcp/claude-code",
+        # Anonymous sends are forbidden on the Claude Code install path: a send
+        # with no pi-session identity AND no meta-sender marker is refused, not
+        # delivered as an unidentified external. The SessionStart hook writes
+        # the marker (parent-pid keyed), so a normally-opened session always has
+        # an authoritative garden-id sender.
+        "ENTWURF_BRIDGE_REQUIRE_META_SENDER": "1",
+    }
+    if is_installed_package(repo):
+        # Installed package: wire the STABLE `entwurf-bridge` bin shim that npm/pnpm
+        # place on PATH. Baking repo/mcp/entwurf-bridge/start.sh would embed the pnpm
+        # store path (.pnpm/@junghanacs+entwurf@<ver>_<peer-hash>/...), which moves
+        # on any peer/version change and leaves a dead MCP command. The bare bin name
+        # tracks whatever version is currently installed — the right behaviour for a
+        # managed install host. start.sh's own position-based dual-mode then runs the
+        # dist boot under node_modules. (0.12.2 fix; 0.12.1 shipped only the clone path.)
+        return {"type": "stdio", "command": "entwurf-bridge", "args": [], "env": env}
+    # Dev clone: pin to THIS clone's launcher (an absolute resolved path), never the
+    # global bin, so a clone host stays bound to its own source tree.
     return {
         "type": "stdio",
         "command": "bash",
         "args": [str((repo / "mcp" / "entwurf-bridge" / "start.sh").resolve())],
-        "env": {
-            "ENTWURF_BRIDGE_EXTERNAL_AGENT_ID": "external-mcp/claude-code",
-            # Anonymous sends are forbidden on the Claude Code install path: a send
-            # with no pi-session identity AND no meta-sender marker is refused, not
-            # delivered as an unidentified external. The SessionStart hook writes
-            # the marker (parent-pid keyed), so a normally-opened session always has
-            # an authoritative garden-id sender.
-            "ENTWURF_BRIDGE_REQUIRE_META_SENDER": "1",
-        },
+        "env": env,
     }
 
 
@@ -519,7 +541,7 @@ def main() -> int:
     parser = argparse.ArgumentParser(description="entwurf meta-bridge state manager")
     parser.add_argument(
         "command",
-        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys"],
+        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys", "desired-mcp"],
     )
     parser.add_argument("--repo", default=Path(__file__).resolve().parents[1], type=Path)
     parser.add_argument("--asm", default=None, type=Path)
@@ -539,6 +561,11 @@ def main() -> int:
             check(repo, asm)
         elif args.command == "managed-keys":
             print(json.dumps(managed_keys(), indent=2))
+        elif args.command == "desired-mcp":
+            # Debug/guard surface: print the user-scope MCP entry desired_mcp() would
+            # write for --repo. Lets a deterministic guard assert the installed-vs-clone
+            # dual-mode without spinning up a real `claude` CLI. --repo need not exist.
+            print(json.dumps(desired_mcp(repo), indent=2))
     except StateError as exc:
         print(f"meta-bridge-state: {exc}", file=sys.stderr)
         return 1

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -207,9 +207,20 @@ async function main(): Promise<void> {
 		);
 
 		// Drive ONE model turn over the stdin RPC: call the BUNDLED bridge's entwurf_self.
+		// Ask for LABELED lines ("socketState: <value>"), not bare values. The old
+		// "reply with the values ... one per line, and nothing else" prompt contradicted
+		// the assertions below, which match on the FIELD NAME (e.g. /socketState…alive/):
+		// a model that obeyed "values only" replied with a bare "alive" line that the
+		// envelope filter (it keys on field-name tokens) dropped, and the [tool:done]
+		// notice truncates the envelope before socketState — so the gate flaked on the
+		// model's formatting choice. Labeled lines make the three identity fields
+		// deterministically observable in the reply regardless of notice truncation.
 		const prompt =
-			"Call the mcp__entwurf-bridge__entwurf_self tool now. Then reply with exactly the " +
-			"sessionId, agentId, and socketState values it returned, one per line, and nothing else. " +
+			"Call the mcp__entwurf-bridge__entwurf_self tool now. Then reply with exactly these " +
+			"three lines, copying the tool result verbatim and nothing else:\n" +
+			"sessionId: <value>\n" +
+			"agentId: <value>\n" +
+			"socketState: <value>\n" +
 			"Do not paraphrase or invent values — copy them verbatim from the tool result.";
 		// The prompt must NOT leak the gid — the gid in the envelope is the proof the bridge
 		// answered, so a gid in the prompt would make that proof circular (the model could echo

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -7,10 +7,17 @@
 // This is the S2e-1 live half: it drives the REAL pi provider path and proves the
 // two 핀1-critical behaviors the gate cannot observe on a real model turn:
 //
-//   1. the augment reaches the model — a unique secret written ONLY into the
-//      scratch cwd's AGENTS.md (NEVER into the user prompt) comes back in the
-//      reply, so buildPiContextAugment's "## <cwd>/AGENTS.md" section actually rode
-//      the wire to the live model via streamShellAcp.
+//   1. the augment reaches the model — a unique BENIGN factual marker written
+//      ONLY into the scratch cwd's AGENTS.md (NEVER into the user prompt) comes
+//      back in the reply, so buildPiContextAugment's "## <cwd>/AGENTS.md" section
+//      actually rode the wire to the live model via streamShellAcp. The marker is
+//      a plain project fact ("internal build codename: <nonce>") asked back with a
+//      normal "answer from project context" question — NOT a "SECRET ... reply
+//      with the value" directive. The old secret-echo phrasing read as a prompt
+//      injection embedded in a /tmp AGENTS.md, and current Claude correctly
+//      REFUSES it ("typical injection pattern"), which made this MUST gate fail
+//      even though the augment DID ride the wire. Proving delivery must not depend
+//      on the model agreeing to echo an exfil-shaped secret.
 //   2. the default (EMPTY) carrier does not trip subscription billing — the turn
 //      exits 0 with no HTTP-400 / "extra usage" billing error. This is the 핀1
 //      live check: a carrier-absent run must bill like a normal subscription call.
@@ -18,11 +25,13 @@
 // Read-tool caveat (deliberate — GPT c32a6c8 Q1): Claude ACP exposes Read, so a
 // model COULD read AGENTS.md directly instead of answering from the augment. We do
 // not forbid that at the wire — the deterministic gate already locks the augment
-// SHAPE; this smoke asks the model to answer WITHOUT tools and treats the secret
+// SHAPE; this smoke asks the model to answer WITHOUT tools and treats the marker
 // in the reply as evidence that the augment+provider path is live AND billing-
 // clean. The honest claim is "the augment rode the live provider path and the
 // empty-carrier turn billed fine", NOT "the model was physically unable to read
-// the file". A wire-dump would over-build for this cut's purpose.
+// the file". A live wire-dump would over-build for this cut's purpose (the
+// production ACP path has no prompt-capture seam; only the deterministic gate's
+// fake child captures payloads).
 //
 // Optional carrier-present path (SMOKE_ACP_CARRIER_PRESENT=1, non-blocking — GPT
 // c32a6c8 Q2): a second turn with a TINY engraving via ENTWURF_ACP_ENGRAVING_PATH
@@ -122,45 +131,52 @@ function assertCleanTurn(label: string, turn: { status: number | null; combined:
 const scratch = mkdtempSync(join(tmpdir(), "entwurf-s2e1-"));
 try {
 	// A nonce unique to this run; lives ONLY in the cwd AGENTS.md, never the prompt.
+	// The marker is a BENIGN project FACT (an internal build codename) with no
+	// directive attached — not a "SECRET ... reply with the value" instruction.
+	// A factual line cannot read as an embedded user-turn injection, so asking for
+	// it back is a normal "answer from project context" task the model performs
+	// instead of refusing (see header). Its uniqueness still proves delivery: the
+	// codename appears nowhere but the cwd AGENTS.md the augment carries.
 	const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`;
-	const secret = `SAC_${nonce}`;
+	const marker = `nimbus${nonce}`;
 	const agentsPath = join(scratch, "AGENTS.md");
 	writeFileSync(
 		agentsPath,
 		[
-			"# Scratch project — entwurf S2e-1 augment live check",
+			"# Scratch project: entwurf augment live check",
 			"",
-			`SECRET_PROJECT_CODE: ${secret}`,
+			"## Project facts",
 			"",
-			"When asked for the secret project code, reply with the value above.",
+			`- Internal build codename: ${marker}`,
 			"",
 		].join("\n"),
 	);
 
-	// The prompt never names the secret; only the cwd AGENTS.md (carried by the
+	// The prompt never names the marker; only the cwd AGENTS.md (carried by the
 	// augment) holds it. "Without using any tool" pushes the model to answer from
-	// the provided instructions rather than reading the file (Read-tool caveat).
+	// the provided project context rather than reading the file (Read-tool caveat).
 	const prompt =
-		"Without using any tool or reading any file, reply with exactly the " +
-		"SECRET_PROJECT_CODE value from this project's instructions, and nothing else.";
+		"Based on the project context you were given, what is this project's " +
+		"internal build codename? Reply with just the codename and nothing else, " +
+		"and answer from the provided context without using any tool or reading any file.";
 
 	console.error(`[smoke-acp-carrier-augment-live] repo:   ${REPO_ROOT}`);
 	console.error(`[smoke-acp-carrier-augment-live] cwd:    ${scratch}`);
 	console.error(`[smoke-acp-carrier-augment-live] model:  ${PROVIDER}/${MODEL}`);
-	console.error(`[smoke-acp-carrier-augment-live] secret: ${secret} (only in cwd AGENTS.md)`);
+	console.error(`[smoke-acp-carrier-augment-live] marker: ${marker} (only in cwd AGENTS.md)`);
 
 	// --- MUST: empty (default) carrier + augment behavior ---------------------
 	const turn1 = runTurn(scratch, prompt, {});
 	assertCleanTurn("empty-carrier turn", turn1);
 	assert.ok(
-		turn1.stdout.includes(secret),
-		`empty-carrier turn: reply did not carry the cwd-AGENTS secret ${secret} ` +
+		turn1.stdout.includes(marker),
+		`empty-carrier turn: reply did not carry the cwd-AGENTS marker ${marker} ` +
 			`(the augment did not reach the model). stdout tail: ${JSON.stringify(turn1.stdout.slice(-300))}`,
 	);
-	console.log("[smoke-acp-carrier-augment-live] PASS (MUST) — augment delivered the cwd AGENTS.md secret on a");
+	console.log("[smoke-acp-carrier-augment-live] PASS (MUST) — augment delivered the cwd AGENTS.md marker on a");
 	console.log("  live provider turn; the empty default carrier billed clean (exit 0, no 400 canary).");
 	console.log(`  model:  ${PROVIDER}/${MODEL}`);
-	console.log(`  secret: ${secret} present in assistant reply`);
+	console.log(`  marker: ${marker} present in assistant reply`);
 
 	// --- OPTIONAL (non-blocking): tiny carrier-present billing -----------------
 	if (process.env.SMOKE_ACP_CARRIER_PRESENT === "1") {