@junghanacs/entwurf 0.12.10 → 0.13.0

package/run.sh

@@ -130,6 +130,8 @@ Usage:
   ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
   ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
+  ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; kill-proofed via scripts/mutants/probe-ordering.json
+  ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; kill-proofed via scripts/mutants/probe-ordering.json
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
   ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
@@ -1177,6 +1179,40 @@ smoke_acp_rgg_live() {
   (cd "$REPO_DIR" && ENTWURF_LIVE_TARGET="$target" SMOKE_RGG_POSITIVE=0 bash scripts/smoke-resident-garden-guard.sh)
 }
 
+smoke_acp_cortex_live() {
+  # On-demand LIVE smoke for the Cortex (Snowflake Cortex Code) ACP backend — the
+  # first NON-claude adapter on the rail (docs/acp-backend-rail.md §6). OUT of
+  # `pnpm check` AND OUTSIDE the claude-only aggregate LIVE floor (capability
+  # dignity, invariant #7): a host with no cortex install / no Snowflake auth must
+  # not redden a release for a backend it does not run, so this is deliberately
+  # absent from release-gate's 11-smoke ACP acceptance floor. That is a WIRING
+  # decision, not a lower evidence bar — a cut that SHIPS cortex still owes a
+  # deliberate run of this smoke, and the aggregate gate's silence is not a pass
+  # (rail §11-8 tail). Drives one real
+  # cortex ACP turn through the entwurf provider path (outbound entwurf_v2 +
+  # dual-HOME overlay facts + process-group reclaim — CP2, rail §11-8).
+  # HONEST-SKIP (exit 0) when LIVE!=1 OR `cortex` is not on PATH OR no
+  # connection is pinned — the live turn needs `cortex` installed with the
+  # operator's own web-login auth already present (there is no `cortex auth`
+  # subcommand — CP0 D6), reached through the overlay's narrow credential
+  # symlinks — narrow in WHICH paths are reachable (D5), not read-only: a symlink
+  # carries no write protection (AGENTS §ACP Plugin Boundary: entwurf never
+  # provides/proxies the Snowflake credential). The connection must ride the adapter seam
+  # (ENTWURF_ACP_CORTEX_CONNECTION) because the dual-HOME overlay denies the
+  # operator settings.json where a default would live. PR #40 called this
+  # `smoke-cortex`; the canonical family name is smoke-acp-cortex-live.
+  #   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
+  if [ "${LIVE:-}" != "1" ]; then
+    echo "[smoke-acp-cortex-live] skipped — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run."
+    return 0
+  fi
+  if ! command -v cortex >/dev/null 2>&1; then
+    echo "[smoke-acp-cortex-live] skipped — cortex not on PATH (install Snowflake Cortex Code and complete its own login flow)."
+    return 0
+  fi
+  run_ts scripts/smoke-acp-cortex-live.ts
+}
+
 smoke_entwurf_v2_matrix_live() {
   # LIVE sentinel for 0.11 Stage 0 step 5d-5 (D4-b) — kept OUT of `pnpm check`. The deterministic
   # sibling (check-entwurf-v2-matrix) fixes every (target kind → transport → lock) cell over fakes
@@ -2211,12 +2247,16 @@ EOF
 }
 
 check_acp_provider_surface() {
-  # Deterministic gate for the S0 ACP provider loader/fence slice. Loads the REAL
-  # provider lib modules and asserts the registration surface: one surface name,
-  # curated Claude anchor present with full ProviderModelConfig rows, no-auth
-  # sentinel shape, and a FAIL-LOUD streamSimple (calling it throws — no native
-  # fallback, no empty-but-successful stream). Pure, no pi runtime, no API.
-  section "ACP provider surface (S0 loader/fence)"
+  # Deterministic gate for the ACP provider registration surface. Loads the REAL
+  # provider lib modules AND compiles + drives the REAL entry against a fake pi,
+  # asserting: one surface name, the no-auth sentinel shape, full
+  # ProviderModelConfig rows on the curated claude anchor, the EXACT curated model
+  # set both adapters contribute (claude 2 + cortex 4 —
+  # [QK:CORTEX-PROVIDER-SIX-ROW-SURFACE], the claim that catches an entry which
+  # silently drops a whole backend), and that streamSimple is the real
+  # streamShellAcp backend (checked BY NAME, never invoked — invoking spawns an
+  # ACP child). Pure, no pi runtime, no API.
+  section "ACP provider surface (registration + both-adapter model set)"
   run_ts scripts/check-acp-provider-surface.ts
 }
 
@@ -2340,6 +2380,33 @@ check_acp_carrier_augment() {
   run_ts scripts/check-acp-carrier-augment.ts
 }
 
+check_acp_cortex() {
+  # Deterministic gate for the Cortex (Snowflake Cortex Code) ACP backend — the
+  # first non-claude adapter on the rail, landed 0.13.0 on the CP0-measured
+  # contract (docs/acp-backend-rail.md §4/§6/§11-8). The cortex source is one
+  # `cortexAdapter` object (backend-adapter.ts) + its curated surface (models.ts)
+  # + the dual-HOME overlay (overlay.ts); the 결합 규칙 requires the gate to land
+  # WITH it, and §6 said EXTEND the check-acp-* family, so cortex's whole
+  # deterministic axis lives here. Locks (each §11-8 D-pinned): the GLG-decided
+  # 4-row curation rides real registry bases and the `cortex-` prefix routes to
+  # cortexAdapter; launch is `cortex acp serve` with NO -m — the model is
+  # enforced per turn via session/set_config_option with the native id (E);
+  # CORTEX_HOME presence (empty included) refuses the spawn (D3); the dual-HOME
+  # overlay isolates HOME+SNOWFLAKE_HOME per session key (P0-1: scope =
+  # backend-passed resolveSessionKey, never ambient), passes through only
+  # connections.toml / optional config.toml / credential_cache (D5/F — never the
+  # whole cache, never skills; symlink-through, no copies — AGENTS §ACP Plugin
+  # Boundary), authors autoUpdate:false (D4), and projects envelope-enriched
+  # explicit servers into cortex/mcp.json with the real HOME restored on
+  # entwurf-bridge alone (D9/D10), non-stdio failing loud; the
+  # CORTEX_ACP_COMMAND override single-quotes shell-metachar connection tokens.
+  # The gate self-manages the tsc-emit layer for the .js-suffixed backend-adapter
+  # imports; no auth, no spawn, no live cortex needed. Kill-qualified via the
+  # `acp-cortex` mutant lane under check-gate-qualification.
+  section "ACP cortex backend (Snowflake Cortex Code — 1st non-claude adapter)"
+  run_ts scripts/check-acp-cortex.ts
+}
+
 check_pack() {
   # Dry-run tarball invariant gate for the public npm surface.
   #
@@ -2824,18 +2891,45 @@ _check_pack_install_impl() {
     echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
     return 1
   fi
-  # Verify the full curated Claude surface is visible: the Sonnet row AND the
-  # opus anchor (CURATED_ANCHOR_MODEL_ID in lib/acp/models.ts — the model whose
-  # absence is a hard registry regression). Checking only one would let half the
-  # surface drop silently.
-  for anchor in "claude-sonnet-5" "claude-opus-5"; do
-    if ! grep -q "$anchor" <<<"$loader_out"; then
-      fail "[check-pack-install] pi loader output missing curated Claude model $anchor:"
-      echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
-      return 1
-    fi
-  done
-  echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-5 + claude-opus-5 anchor)"
+  # Verify the EXACT curated surface the installed package registers — both
+  # backends (claude 2 rows + cortex 4 rows = 6), as a SET, not as anchors.
+  #
+  # Why exact-set and not `grep -q <id>`: the cortex ids CONTAIN the claude ids
+  # as substrings (`cortex-claude-sonnet-5` matches a bare `claude-sonnet-5`
+  # grep), so a substring probe could go green on a surface that dropped every
+  # unprefixed Claude row. And an anchor-only probe cannot see a MISSING cortex
+  # row at all — that is exactly the installed-consumer gap this assertion
+  # closes: the source-side sets are pinned by check-acp-cortex /
+  # check-acp-provider-surface, but only THIS gate proves the ids survive the
+  # pack → install → pi-loader path into a real consumer's model list.
+  #
+  # Parse rows whose FIRST field is the provider `entwurf` (pi prints a
+  # `provider model context …` table; the header row's first field is
+  # `provider`, so it drops out) and take the second field as the model id.
+  local loader_ids loader_expected
+  loader_ids=$(awk '$1 == "entwurf" { print $2 }' <<<"$loader_out" | LC_ALL=C sort)
+  loader_expected=$(printf '%s\n' \
+    claude-opus-5 \
+    claude-sonnet-5 \
+    cortex-auto \
+    cortex-claude-opus-5 \
+    cortex-claude-sonnet-5 \
+    cortex-openai-gpt-5.4 | LC_ALL=C sort)
+  if [ "$loader_ids" != "$loader_expected" ]; then
+    fail "[check-pack-install] installed provider model set drifted — expected exactly 6 curated ids (claude 2 + cortex 4):"
+    echo "  expected:" >&2
+    echo "$loader_expected" | sed 's/^/    /' >&2
+    echo "  actual (entwurf rows):" >&2
+    echo "${loader_ids:-<none>}" | sed 's/^/    /' >&2
+    echo "  raw loader output:" >&2
+    echo "$loader_out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  # Name the set on SUCCESS too, not only in the failure branch — same principle as
+  # the pinned-pi version assert above: a gate that cannot name what it proved has
+  # proved nothing, and "6 rows" without the ids cannot be audited from a CI log.
+  echo "[check-pack-install] pi loader smoke pass (entwurf registered; exact 6-row curated set: claude 2 + cortex 4):"
+  echo "$loader_ids" | sed 's/^/    /'
 
   # npm-managed neutral install regression — the README's PRIMARY install path is
   # now `npm install @junghanacs/entwurf` (NOT `pi install npm:...`). This layout
@@ -3727,7 +3821,7 @@ wire_agy_bridge() {
   # whatever agy the CI/dev host happens to have — production leaves it unset (= `command -v
   # agy`, no regression). Same override spirit as agy-bridge.sh's AGY_MCP_CONFIG/AGY_BRIDGE_COMMAND.
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
-    echo "[setup] no agy on PATH — skipping agy bridge wiring (no state; pi/Claude-only host)"
+    echo "[setup] no agy on PATH — skipping agy bridge wiring (no state; this host runs no Antigravity)"
     return 0
   fi
   section "agy bridge install (native harness detected: Antigravity)"
@@ -3780,7 +3874,7 @@ wire_agy_bridge() {
 # stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
 wire_agy_statusline() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
-    echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; pi/Claude-only host)"
+    echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; this host runs no Antigravity)"
     return 0
   fi
   section "agy statusLine install (native harness detected: Antigravity)"
@@ -3818,7 +3912,7 @@ wire_agy_statusline() {
 # garden id after the first invocation.
 wire_agy_hooks() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
-    echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; pi/Claude-only host)"
+    echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; this host runs no Antigravity)"
     return 0
   fi
   section "agy hooks install (native harness detected: Antigravity)"
@@ -4320,6 +4414,9 @@ case "$cmd" in
   smoke-acp-rgg-live)
     smoke_acp_rgg_live
     ;;
+  smoke-acp-cortex-live)
+    smoke_acp_cortex_live
+    ;;
   smoke-acp-socket-citizen-live)
     smoke_acp_socket_citizen_live
     ;;
@@ -4452,6 +4549,37 @@ case "$cmd" in
     # control-red/impurity all must classify red before any real manifest counts.
     run_ts scripts/check-gate-qualification.ts
     ;;
+  check-probe-ordering)
+    # §11-7 ordering-probe gate (docs/acp-backend-rail.md §11-7): the raw-client seam is
+    # only admissible "bound by a gate asserting it issues the same calls, arguments, and
+    # order as the backend's real sequence" — this is that gate. Sameness over a recording
+    # fake + backend.ts SOURCE pins (order/clientInfo/timeouts/permission policy), phase
+    # attribution (set-model included), the probe-mode fixture's wire instrumentation
+    # (real child, raw JSON-RPC, no API), the shared log's contract at its door — envelope
+    # (the evidence line's own runId/marker/sort axis cannot be rewritten by a payload) AND
+    # payload (every field the classifier judges on is typed there) — and the PURE
+    # paired-verdict truth table.
+    run_ts scripts/check-probe-ordering.ts
+    ;;
+  check-probe-cli-shim)
+    # §11-7-c producer gate (docs/acp-backend-rail.md §11-7-c condition 5: "Byte-transparency,
+    # backpressure, and exit/signal propagation are proved by a fake-CLI deterministic gate").
+    # The shim sits on the production spawn path of a paid LIVE turn, so this drives it as a
+    # REAL process against fake CLIs and asks what each defect would buy: fabricated absence
+    # evidence (a malformed init reported as an empty name set, a boot report that does not
+    # name what was actually exec'd), a destroyed turn (mangled bytes, a swallowed signal, a
+    # crash reported as exit 0), or leaked operator state (a prefix env scrub, argv/env/prompt
+    # body in the shared log). No API, no network, no cost.
+    run_ts scripts/check-probe-cli-shim.ts
+    ;;
+  smoke-acp-ordering-probe-live)
+    # §11-7 ordering probe — LIVE paired-run instrument, OUT of pnpm check. Control
+    # (delay=0, must be visible AND callable) + interventions D1/D2 against the SAME
+    # pins/config/fixture; classifies A/A-withheld/B/C/D-<phase> or P0/I0, preserves
+    # the shared NDJSON log + classification under .probe-artifacts/ (gitignored).
+    #   LIVE=1 ./run.sh smoke-acp-ordering-probe-live
+    run_ts scripts/smoke-acp-ordering-probe-live.ts
+    ;;
   smoke-agy-statusline-state)
     # #46 Task 1 regression gate for the agy statusLine install adapter: install→doctor→uninstall
     # in an ISOLATED HOME+XDG with a fake stable bin (entwurf-agy-statusline) + fake pgrep —
@@ -4724,6 +4852,9 @@ case "$cmd" in
   check-acp-carrier-augment)
     check_acp_carrier_augment
     ;;
+  check-acp-cortex)
+    check_acp_cortex
+    ;;
   check-fresh-cut-gate)
     # SOURCE cell of the generation-boundary proof: a host whose store the live
     # schema cannot read must be refused BEFORE any write, told the fresh-cut