@junghanacs/entwurf 0.12.0

package/scripts/resolve-acp-bridge.ts

@@ -0,0 +1,25 @@
+/**
+ * resolve-acp-bridge — print the bridge extension path entwurf-core's
+ * getRegistryRouting() would inject for a provider=entwurf spawn under the
+ * CURRENT environment (PI_CODING_AGENT_DIR + settings.json package sources).
+ *
+ * Used by smoke-installed-entwurf-acp so the live smoke drives a real pi child
+ * with the resolver's OWN output: if package-source routing regresses (wrong
+ * path, or unresolved), this either prints the wrong -e or throws
+ * EntwurfRoutingError (non-zero exit), and the smoke fails instead of silently
+ * passing. Prints the `-e` value to stdout on success; throws on unresolved.
+ *
+ * argv[2]: "remote" selects the SSH remote path; anything else is local.
+ */
+
+import type { ResolvedTarget } from "../pi-extensions/lib/entwurf-core.ts";
+import { getRegistryRouting } from "../pi-extensions/lib/entwurf-core.ts";
+
+const isRemote = process.argv[2] === "remote";
+const target: ResolvedTarget = { provider: "entwurf", model: "claude-sonnet-4-6", explicitOnly: false };
+
+// Throws EntwurfRoutingError (non-zero exit) when the bridge cannot be resolved —
+// exactly the fail-fast the smoke wants to observe as a failure, not a pass.
+const routing = getRegistryRouting(target, isRemote);
+const i = routing.args.indexOf("-e");
+process.stdout.write(i >= 0 ? routing.args[i + 1] : "");

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -0,0 +1,292 @@
+// S2g LIVE 3 (axis 3) — the BUNDLED entwurf-bridge reaches the live ACP session
+// via the 0.11.0 resident/RPC circuit. LIVE-gated, OUT of `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-bundled-mcp-live
+//
+// WHY a separate axis. smoke-acp-mcp-live proves the generic passthrough with a
+// TINY isolated probe MCP (so a failure isolates to "did mcpServers reach
+// newSession" without identity/env coupling). This smoke proves the LAST mile that
+// probe deliberately skips: the operator's REAL bundled `entwurf-bridge` — the one
+// that needs PI_SESSION_ID/PI_AGENT_ID envelope injection (enrichMcpServersWithEnvelope)
+// to answer entwurf_self — reaches the live ACP session and can be CALLED by the model.
+// GLG verified this by hand (entwurf_self → sessionId/agentId/socketState alive); this
+// codifies that hand-check into a repeatable gate.
+//
+// WHY resident/RPC, not `pi -p` one-shot. A `pi -p` one-shot + bundled tool-call
+// hangs on closeSession/teardown — that hang is diagnostic backlog, NOT this smoke's
+// subject, and NOT the 0.11.0 release circuit (whose bundled-MCP evidence was always
+// resident/RPC). So this smoke RESTORES the 0.11.0 circuit: it drives the bundled
+// bridge through a long-lived `pi --entwurf-control --mode rpc` resident, the same
+// stdin-RPC / stdout-event-stream driver as scripts/gnew-rpc-drive.ts.
+//
+// METHOD (gnew-rpc-drive shape): launch a real resident on an ACP model, send one
+// `{type:"prompt"}` over stdin asking the model to call mcp__entwurf-bridge__entwurf_self,
+// and capture — DIRECTLY from the stdout RPC event stream — the identity envelope
+// (the resident's own freshly-minted gid, agentId entwurf/<model>, socketState
+// alive) plus `agent_end`. The gid is never told to the model: it lives only as the
+// resident's PI_SESSION_ID, injected into the bridge env, so the model can surface it
+// ONLY by actually calling the tool. JSONL is an L3 backstop, never the primary proof.
+//
+// The bundled bridge is supplied by the operator's REAL
+// entwurfProvider.mcpServers.entwurf-bridge (global ~/.pi/agent/settings.json) —
+// this is the operator circuit, not a scratch-isolated probe. If the operator has not
+// wired it, the smoke fails loud (the circuit is not installed).
+//
+// LIVE-only — kept OUT of `pnpm check`; honest skip when LIVE!=1 (skip = CI safety,
+// NOT an acceptance PASS). Model override: ENTWURF_ACP_PROVIDER_MODEL (default sonnet).
+
+import { type ChildProcess, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as readline from "node:readline";
+import { fileURLToPath } from "node:url";
+import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensions/lib/entwurf-control-rpc.ts";
+import { generateSessionId } from "../pi-extensions/lib/entwurf-core.ts";
+import { terminateChild } from "./lib/acp-child-cleanup.ts";
+
+const ACP_PROVIDER = "entwurf";
+const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-4-6";
+
+const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
+const SOCKET_SUFFIX = ".sock";
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+// Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+
+const BOOT_TIMEOUT_MS = 30_000;
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
+const POLL_MS = 100;
+
+const STUB_PATTERN = /AcpBackendNotImplementedError|not implemented in S0/i;
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	if (!cond) throw new Error(`SMOKE FAIL: ${label}`);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+function sleep(ms: number): Promise<void> {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForSocket(sockPath: string, timeoutMs: number): Promise<boolean> {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (existsSync(sockPath)) return true;
+		await sleep(POLL_MS);
+	}
+	return false;
+}
+
+async function waitForGone(sockPath: string, timeoutMs: number): Promise<boolean> {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (!existsSync(sockPath)) return true;
+		await sleep(POLL_MS);
+	}
+	return !existsSync(sockPath);
+}
+
+interface TurnCapture {
+	agentStartSeen: boolean;
+	agentEndSeen: boolean;
+	extensionErrors: Array<{ path: unknown; event: unknown; error: unknown }>;
+	promptAccepted: boolean;
+	// Every line the resident emitted AFTER the prompt was sent — the envelope (a tool
+	// result embedded as an escaped string) and the assistant's reply both land here.
+	stream: string;
+}
+
+// Drive exactly one model turn over the resident's stdin RPC and capture the stdout
+// event stream until `agent_end` (or a hard turn timeout). Mirrors gnew-rpc-drive.ts.
+function driveSelfTurn(child: ChildProcess, prompt: string): Promise<TurnCapture> {
+	return new Promise((resolve) => {
+		const cap: TurnCapture = {
+			agentStartSeen: false,
+			agentEndSeen: false,
+			extensionErrors: [],
+			promptAccepted: false,
+			stream: "",
+		};
+		let settled = false;
+		const finish = (): void => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			rl.close();
+			resolve(cap);
+		};
+		const timer = setTimeout(finish, TURN_TIMEOUT_MS);
+		// If the resident dies before agent_end, settle now instead of burning the full
+		// turn timeout — a dead child can never emit agent_end (the assertions then fail loud).
+		child.once("exit", finish);
+
+		const rl = readline.createInterface({ input: child.stdout! });
+		rl.on("line", (line: string) => {
+			const trimmed = line.trim();
+			if (!trimmed) return;
+			cap.stream += `${trimmed}\n`;
+			let evt: Record<string, unknown>;
+			try {
+				evt = JSON.parse(trimmed) as Record<string, unknown>;
+			} catch {
+				return;
+			}
+			if (evt.type === "agent_start") cap.agentStartSeen = true;
+			if (evt.type === "extension_error") {
+				cap.extensionErrors.push({ path: evt.extensionPath, event: evt.event, error: evt.error });
+			}
+			if (evt.type === "response" && evt.command === "prompt") cap.promptAccepted = evt.success === true;
+			if (evt.type === "agent_end") {
+				cap.agentEndSeen = true;
+				finish();
+			}
+		});
+
+		child.stdin?.write(`${JSON.stringify({ type: "prompt", message: prompt, id: "self" })}\n`);
+	});
+}
+
+async function main(): Promise<void> {
+	if (process.env.LIVE !== "1") {
+		console.log(
+			"[smoke-acp-bundled-mcp-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
+		);
+		return;
+	}
+
+	const gid = generateSessionId();
+	const sockPath = path.join(REAL_CONTROL_DIR, `${gid}${SOCKET_SUFFIX}`);
+	const tmp = os.tmpdir();
+
+	// A fresh gid must not collide with a pre-existing socket (else teardown deletes
+	// someone else's live socket). Fail loud rather than risk it.
+	ok("fresh gid has no pre-existing control socket", !existsSync(sockPath));
+
+	console.error(`[smoke-acp-bundled-mcp-live] repo:  ${REPO_ROOT}`);
+	console.error(
+		`[smoke-acp-bundled-mcp-live] gid:   ${gid} (never told to the model — only the bridge env carries it)`,
+	);
+	console.error(`[smoke-acp-bundled-mcp-live] model: ${ACP_PROVIDER}/${ACP_MODEL}`);
+
+	let stderrTail = "";
+	let resident: ChildProcess | null = null;
+	let cap: TurnCapture | null = null;
+	try {
+		resident = spawn(
+			"pi",
+			[
+				...REPO_EXTENSION_ARGS,
+				"--session-id",
+				gid,
+				"--entwurf-control",
+				"--provider",
+				ACP_PROVIDER,
+				"--model",
+				ACP_MODEL,
+				"--mode",
+				"rpc",
+			],
+			{ cwd: tmp, stdio: ["pipe", "pipe", "pipe"], detached: false },
+		);
+		resident.stderr?.on("data", (b: Buffer) => {
+			stderrTail = (stderrTail + b.toString()).slice(-4000);
+		});
+
+		// The resident stands its control socket up (turn-free citizenship — S1).
+		const up = await waitForSocket(sockPath, BOOT_TIMEOUT_MS);
+		ok(`ACP-model resident stood up a control socket (${ACP_PROVIDER}/${ACP_MODEL})`, up);
+
+		// Citizen fact: get_info answers and reports the un-reverted ACP model (QM1).
+		const info = await fetchControlSocketRuntimeInfo(sockPath, { timeout: 3_000 });
+		ok(
+			`get_info reports the ACP model, not reverted (got ${formatRuntimeModel(info) ?? "none"})`,
+			info.modelProvider === ACP_PROVIDER && info.modelId === ACP_MODEL,
+		);
+
+		// Drive ONE model turn over the stdin RPC: call the BUNDLED bridge's entwurf_self.
+		const prompt =
+			"Call the mcp__entwurf-bridge__entwurf_self tool now. Then reply with exactly the " +
+			"sessionId, agentId, and socketState values it returned, one per line, and nothing else. " +
+			"Do not paraphrase or invent values — copy them verbatim from the tool result.";
+		// The prompt must NOT leak the gid — the gid in the envelope is the proof the bridge
+		// answered, so a gid in the prompt would make that proof circular (the model could echo
+		// the prompt). Assert it at the source, not just by convention.
+		ok("the prompt does not leak the resident gid (envelope-gid proof stays non-circular)", !prompt.includes(gid));
+		cap = await driveSelfTurn(resident, prompt);
+
+		// A real model turn ran AND completed over RPC — no hang (the whole point of the
+		// resident circuit vs. the deferred `pi -p` one-shot teardown hang).
+		ok("a real model turn ran over the stdin RPC (agent_start)", cap.agentStartSeen);
+		ok("the turn completed cleanly over RPC (agent_end — no hang)", cap.agentEndSeen);
+		ok("the prompt RPC command was accepted", cap.promptAccepted);
+
+		// No extension blew up, the S0 fail-loud stub never fired (the provider path is real).
+		ok("no extension_error during the turn", cap.extensionErrors.length === 0);
+		ok("S0 fail-loud backend stub did NOT fire", !STUB_PATTERN.test(`${cap.stream}\n${stderrTail}`));
+
+		// PRIMARY proof — narrow to the ENVELOPE lines, then assert the three identity
+		// values appear TOGETHER inside them. Asserting against the whole stream is weak:
+		// readline attaches before the prompt, so startup/buffered events could carry a
+		// stray match. The envelope is the entwurf_self tool result (carried in the
+		// [tool:done] notice and echoed in the assistant reply), so it is the lines bearing
+		// the envelope markers — restrict the match to those.
+		const envelopeText = cap.stream
+			.split("\n")
+			.filter((l) => /socketState|agentId|sessionId|entwurf_self/i.test(l))
+			.join("\n");
+
+		// The resident's OWN freshly-minted gid appears in the envelope. The gid is never
+		// told to the model (asserted above); it lives only as PI_SESSION_ID inside the
+		// bridge env. So its presence in the envelope proves entwurf_self was CALLED and its
+		// operator-injected identity reached the model — the bundled bridge's last mile.
+		ok(
+			"the entwurf_self envelope carried the resident's own gid (bundled bridge reached the session)",
+			envelopeText.includes(gid),
+		);
+
+		// socketState alive — entwurf_self computes this from the live --entwurf-control socket.
+		ok("the envelope reported socketState alive", /socketState[\\":\s]*"?alive/i.test(envelopeText));
+
+		// agentId is the ACP model identity, not reverted/blank.
+		ok(
+			`the envelope reported agentId ${ACP_PROVIDER}/${ACP_MODEL}`,
+			envelopeText.includes(`${ACP_PROVIDER}/${ACP_MODEL}`),
+		);
+
+		// SUPPLEMENTARY (not a hard gate) — the ACP event mapper emits a tool notice when
+		// showToolNotifications is on. S2g lets operator config turn notices OFF, in which
+		// case the tool can succeed with no notice — so the envelope above is the real proof
+		// and the notice is only corroborating. Log it; do not fail on its absence.
+		const sawToolCall = /\[tool:(start|running|done)\][^\n]*entwurf_self/i.test(cap.stream);
+		console.log(
+			`  info  tool-call notice ${sawToolCall ? "observed" : "not observed (notices may be off; envelope is the proof)"}`,
+		);
+
+		// Still alive after the turn (a live socket-citizen, not a one-shot that exits).
+		ok(
+			"resident still alive after the turn (live socket-citizen)",
+			resident.exitCode === null && resident.signalCode === null,
+		);
+	} catch (err) {
+		if (cap)
+			console.error(`[smoke-acp-bundled-mcp-live] stream tail:\n${cap.stream.split("\n").slice(-30).join("\n")}`);
+		if (stderrTail)
+			console.error(`[smoke-acp-bundled-mcp-live] stderr tail:\n${stderrTail.split("\n").slice(-20).join("\n")}`);
+		throw err;
+	} finally {
+		if (resident) await terminateChild(resident);
+	}
+
+	// Hygiene: after teardown the control socket file is gone — no process/socket residue.
+	// (The session JSONL is the denote-id memory layer and is intentionally NOT scrubbed.)
+	ok("control socket file removed after teardown (no socket residue)", await waitForGone(sockPath, 5_000));
+
+	console.log(
+		`[smoke-acp-bundled-mcp-live] PASS — ${passed} checks (bundled entwurf-bridge reaches the live ACP session via the 0.11.0 resident/RPC circuit)`,
+	);
+}
+
+await main();

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -0,0 +1,192 @@
+// S2e-1 — carrier/augment live acceptance. LIVE-gated, OUT of `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-carrier-augment-live
+//
+// S2d-1c shipped the billing carrier (engraving) + the rich first-user augment,
+// but only the deterministic gate (check-acp-carrier-augment) proved their SHAPE.
+// This is the S2e-1 live half: it drives the REAL pi provider path and proves the
+// two 핀1-critical behaviors the gate cannot observe on a real model turn:
+//
+//   1. the augment reaches the model — a unique secret written ONLY into the
+//      scratch cwd's AGENTS.md (NEVER into the user prompt) comes back in the
+//      reply, so buildPiContextAugment's "## <cwd>/AGENTS.md" section actually rode
+//      the wire to the live model via streamShellAcp.
+//   2. the default (EMPTY) carrier does not trip subscription billing — the turn
+//      exits 0 with no HTTP-400 / "extra usage" billing error. This is the 핀1
+//      live check: a carrier-absent run must bill like a normal subscription call.
+//
+// Read-tool caveat (deliberate — GPT c32a6c8 Q1): Claude ACP exposes Read, so a
+// model COULD read AGENTS.md directly instead of answering from the augment. We do
+// not forbid that at the wire — the deterministic gate already locks the augment
+// SHAPE; this smoke asks the model to answer WITHOUT tools and treats the secret
+// in the reply as evidence that the augment+provider path is live AND billing-
+// clean. The honest claim is "the augment rode the live provider path and the
+// empty-carrier turn billed fine", NOT "the model was physically unable to read
+// the file". A wire-dump would over-build for this cut's purpose.
+//
+// Optional carrier-present path (SMOKE_ACP_CARRIER_PRESENT=1, non-blocking — GPT
+// c32a6c8 Q2): a second turn with a TINY engraving via ENTWURF_ACP_ENGRAVING_PATH
+// proves a small _meta.systemPrompt carrier also exits 0 (carrier present ≠ 400).
+//
+// NOT proved here: session reuse (smoke-acp-session-reuse-live) and RGG (S2e-2).
+
+import { strict as assert } from "node:assert";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-4-6";
+const PROVIDER = "entwurf";
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-carrier-augment-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+if (process.env.LIVE !== "1") {
+	console.error("[smoke-acp-carrier-augment-live] skipped — set LIVE=1 to run the real pi provider turn.");
+	process.exit(0);
+}
+
+// Billing-reclassification canaries (핀1). The empty carrier must NOT trip metered
+// billing — if it ever did, the turn would surface one of these. We assert their
+// ABSENCE in the output tail. Kept narrow so a normal reply cannot false-positive.
+const BILLING_FAILURE_PATTERNS = [
+	/out of (extra )?usage/i,
+	/\bHTTP[\s/]*400\b/i,
+	/\b400 Bad Request\b/i,
+	/insufficient (credit|balance|quota)/i,
+	/metered.*(not|unavailable|denied)/i,
+];
+
+// The S0 stub canary — its error means the provider path never opened.
+const STUB_PATTERN = /AcpBackendNotImplementedError|not implemented in S0/i;
+
+/** Run one real `pi` provider turn in `cwd`; return {status, stdout, combinedTail}. */
+function runTurn(
+	cwd: string,
+	prompt: string,
+	extraEnv: Record<string, string>,
+): {
+	status: number | null;
+	stdout: string;
+	combined: string;
+	tail: string;
+} {
+	const args = [
+		"--no-extensions",
+		"-e",
+		REPO_ROOT,
+		"--mode",
+		"text",
+		"-p",
+		"--approve",
+		"--provider",
+		PROVIDER,
+		"--model",
+		MODEL,
+		prompt,
+	];
+	const res = spawnSync("pi", args, {
+		cwd,
+		encoding: "utf8",
+		timeout: TURN_TIMEOUT_MS,
+		env: { ...process.env, ...extraEnv },
+	});
+	const stdout = res.stdout ?? "";
+	const stderr = res.stderr ?? "";
+	const combined = `${stdout}\n${stderr}`;
+	const tail = combined.split("\n").slice(-25).join("\n");
+	if (res.error) {
+		console.error(`[smoke-acp-carrier-augment-live] output tail:\n${tail}`);
+		fail(`pi spawn failed: ${res.error.message}`);
+	}
+	return { status: res.status, stdout, combined, tail };
+}
+
+function assertCleanTurn(label: string, turn: { status: number | null; combined: string; tail: string }): void {
+	assert.ok(!STUB_PATTERN.test(turn.combined), `${label}: S0 stub fired — provider path did not open`);
+	for (const pat of BILLING_FAILURE_PATTERNS) {
+		assert.ok(!pat.test(turn.combined), `${label}: billing-reclassification canary matched ${pat} (핀1 violation?)`);
+	}
+	if (turn.status !== 0) {
+		console.error(`[smoke-acp-carrier-augment-live] ${label} output tail:\n${turn.tail}`);
+		fail(`${label}: pi exited ${turn.status}`);
+	}
+}
+
+const scratch = mkdtempSync(join(tmpdir(), "entwurf-s2e1-"));
+try {
+	// A nonce unique to this run; lives ONLY in the cwd AGENTS.md, never the prompt.
+	const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`;
+	const secret = `SAC_${nonce}`;
+	const agentsPath = join(scratch, "AGENTS.md");
+	writeFileSync(
+		agentsPath,
+		[
+			"# Scratch project — entwurf S2e-1 augment live check",
+			"",
+			`SECRET_PROJECT_CODE: ${secret}`,
+			"",
+			"When asked for the secret project code, reply with the value above.",
+			"",
+		].join("\n"),
+	);
+
+	// The prompt never names the secret; only the cwd AGENTS.md (carried by the
+	// augment) holds it. "Without using any tool" pushes the model to answer from
+	// the provided instructions rather than reading the file (Read-tool caveat).
+	const prompt =
+		"Without using any tool or reading any file, reply with exactly the " +
+		"SECRET_PROJECT_CODE value from this project's instructions, and nothing else.";
+
+	console.error(`[smoke-acp-carrier-augment-live] repo:   ${REPO_ROOT}`);
+	console.error(`[smoke-acp-carrier-augment-live] cwd:    ${scratch}`);
+	console.error(`[smoke-acp-carrier-augment-live] model:  ${PROVIDER}/${MODEL}`);
+	console.error(`[smoke-acp-carrier-augment-live] secret: ${secret} (only in cwd AGENTS.md)`);
+
+	// --- MUST: empty (default) carrier + augment behavior ---------------------
+	const turn1 = runTurn(scratch, prompt, {});
+	assertCleanTurn("empty-carrier turn", turn1);
+	assert.ok(
+		turn1.stdout.includes(secret),
+		`empty-carrier turn: reply did not carry the cwd-AGENTS secret ${secret} ` +
+			`(the augment did not reach the model). stdout tail: ${JSON.stringify(turn1.stdout.slice(-300))}`,
+	);
+	console.log("[smoke-acp-carrier-augment-live] PASS (MUST) — augment delivered the cwd AGENTS.md secret on a");
+	console.log("  live provider turn; the empty default carrier billed clean (exit 0, no 400 canary).");
+	console.log(`  model:  ${PROVIDER}/${MODEL}`);
+	console.log(`  secret: ${secret} present in assistant reply`);
+
+	// --- OPTIONAL (non-blocking): tiny carrier-present billing -----------------
+	if (process.env.SMOKE_ACP_CARRIER_PRESENT === "1") {
+		const carrierMarker = `CARRIER_${nonce}`;
+		const carrierPath = join(scratch, "engraving.md");
+		writeFileSync(carrierPath, `Always end every reply with the exact marker <<${carrierMarker}>>.\n`);
+		const carrierPrompt = "Reply with the single word OK.";
+		const turn2 = runTurn(scratch, carrierPrompt, { ENTWURF_ACP_ENGRAVING_PATH: carrierPath });
+		assertCleanTurn("carrier-present turn", turn2);
+		// The billing claim (exit 0, no 400) is the point. The marker is advisory:
+		// it shows the small _meta.systemPrompt carrier influenced the reply.
+		const carrierFollowed = turn2.stdout.includes(`<<${carrierMarker}>>`);
+		console.log(
+			`[smoke-acp-carrier-augment-live] PASS (optional) — tiny carrier turn billed clean (exit 0); ` +
+				`carrier marker ${carrierFollowed ? "present" : "ABSENT (advisory, not blocking)"}.`,
+		);
+	} else {
+		console.log(
+			"[smoke-acp-carrier-augment-live] optional carrier-present path skipped " +
+				"(set SMOKE_ACP_CARRIER_PRESENT=1 to also check a tiny carrier bills clean).",
+		);
+	}
+} finally {
+	try {
+		rmSync(scratch, { recursive: true, force: true });
+	} catch {
+		// best-effort cleanup
+	}
+}

package/scripts/smoke-acp-mcp-live.ts

@@ -0,0 +1,129 @@
+// S2g LIVE 1 — operator MCP passthrough acceptance. LIVE-gated, OUT of `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-mcp-live
+//
+// THE baseline proof. GLG's baseline finding was: an ACP model booted with
+// `entwurf/<model>` saw 4 tools and NO MCP servers — the operator's
+// `entwurfProvider.mcpServers` never reached the session. S2g wired that
+// passthrough; the deterministic gate (check-acp-config / check-acp-session-reuse
+// Section G) proved the config reaches `newSession` on a FAKE seam. This live
+// smoke proves the LAST mile a fake cannot: a real ACP child spawns the operator
+// MCP server and the live model can actually CALL its tool.
+//
+// Method (GPT `…2f9325` LIVE 1 — a TINY isolated probe, not entwurf-bridge, so a
+// failure isolates to "did mcpServers reach newSession" without identity/env
+// coupling): a scratch `.pi/settings.json` registers ONE stdio MCP server
+// (scripts/fixtures/probe-mcp-server.ts) that exposes a single tool `probe_nonce`
+// returning a per-run secret carried in its env. The prompt asks the model to
+// CALL the tool and echo the nonce. The nonce lives ONLY inside the MCP server's
+// env — the model cannot produce it unless the tool was visible AND callable.
+//
+// Pre-S2g (hardcoded `mcpServers:[]`) this smoke FAILS: the tool never exists.
+
+import { strict as assert } from "node:assert";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PROBE_SERVER = join(REPO_ROOT, "scripts", "fixtures", "probe-mcp-server.ts");
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-4-6";
+const PROVIDER = "entwurf";
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-mcp-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+if (process.env.LIVE !== "1") {
+	console.error("[smoke-acp-mcp-live] skipped — set LIVE=1 to run the real pi provider turn.");
+	process.exit(0);
+}
+
+const STUB_PATTERN = /AcpBackendNotImplementedError|not implemented in S0/i;
+
+const scratch = mkdtempSync(join(tmpdir(), "entwurf-s2g-mcp-"));
+try {
+	const nonce = `MCP_${process.pid.toString(36)}${Date.now().toString(36)}`;
+	// Register the probe MCP server in the scratch project settings — the exact
+	// `entwurfProvider.mcpServers` surface `./run.sh install` writes for real.
+	mkdirSync(join(scratch, ".pi"), { recursive: true });
+	writeFileSync(
+		join(scratch, ".pi", "settings.json"),
+		`${JSON.stringify(
+			{
+				entwurfProvider: {
+					mcpServers: {
+						probe: {
+							command: process.execPath,
+							args: ["--experimental-strip-types", PROBE_SERVER],
+							env: { PROBE_NONCE: nonce },
+						},
+					},
+				},
+			},
+			null,
+			2,
+		)}\n`,
+	);
+
+	const prompt =
+		"Call the probe_nonce tool now, then reply with exactly the PROBE_NONCE value it returns " +
+		"(the part after the '=' sign), and nothing else.";
+
+	console.error(`[smoke-acp-mcp-live] repo:   ${REPO_ROOT}`);
+	console.error(`[smoke-acp-mcp-live] cwd:    ${scratch}`);
+	console.error(`[smoke-acp-mcp-live] model:  ${PROVIDER}/${MODEL}`);
+	console.error(`[smoke-acp-mcp-live] nonce:  ${nonce} (only inside the probe MCP server env)`);
+
+	const args = [
+		"--no-extensions",
+		"-e",
+		REPO_ROOT,
+		"--mode",
+		"text",
+		"-p",
+		"--approve",
+		"--provider",
+		PROVIDER,
+		"--model",
+		MODEL,
+		prompt,
+	];
+	const res = spawnSync("pi", args, { cwd: scratch, encoding: "utf8", timeout: TURN_TIMEOUT_MS, env: process.env });
+	const stdout = res.stdout ?? "";
+	const combined = `${stdout}\n${res.stderr ?? ""}`;
+	const tail = combined.split("\n").slice(-30).join("\n");
+	if (res.error) {
+		console.error(`[smoke-acp-mcp-live] output tail:\n${tail}`);
+		fail(`pi spawn failed: ${res.error.message}`);
+	}
+	assert.ok(!STUB_PATTERN.test(combined), "S0 stub fired — provider path did not open");
+	if (res.status !== 0) {
+		console.error(`[smoke-acp-mcp-live] output tail:\n${tail}`);
+		fail(`pi exited ${res.status}`);
+	}
+	// The tool-start notice is corroborating evidence the model invoked the MCP tool.
+	const sawToolCall = /\[tool:(start|running)\]\s+probe_nonce/i.test(combined);
+	assert.ok(
+		stdout.includes(nonce),
+		`reply did not carry the probe nonce ${nonce} — the operator MCP server was not visible/callable ` +
+			`(S2g passthrough failure). tool-call notice ${sawToolCall ? "WAS" : "was NOT"} seen. ` +
+			`stdout tail: ${JSON.stringify(stdout.slice(-300))}`,
+	);
+
+	console.log("[smoke-acp-mcp-live] PASS — the operator-declared MCP server reached the live ACP session: the model");
+	console.log(`  called probe_nonce and returned ${nonce} (the nonce lives only inside the MCP server env).`);
+	console.log(
+		`  model: ${PROVIDER}/${MODEL}; tool-call notice ${sawToolCall ? "observed" : "not observed (reply-only evidence)"}`,
+	);
+} finally {
+	try {
+		rmSync(scratch, { recursive: true, force: true });
+	} catch {
+		// best-effort cleanup
+	}
+}