@junghanacs/entwurf 0.12.10 → 0.13.1

package/scripts/mutants/release-gate.json

@@ -0,0 +1,105 @@
+{
+	"schemaVersion": 1,
+	"lane": "release-gate",
+	"mutants": [
+		{
+			"claim": "SKIP-EXIT-ONE-PROTOCOL",
+			"title": "the shell and TS halves name different skip codes — every honest skip silently reclassifies, and the summary says nothing",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["ENTWURF_STEP_SKIP_EXIT=97"],
+			"replace": ["ENTWURF_STEP_SKIP_EXIT=96"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:SKIP-EXIT-ONE-PROTOCOL]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "STEP-OUTCOME-SKIP-NOT-PASS",
+			"title": "the classifier rounds a skip up to PASS — the pre-P1 defect restored at its source: a step that declined is reported as acceptance",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\t\t\"$ENTWURF_STEP_SKIP_EXIT\") printf 'SKIP\\n' ;;"],
+			"replace": ["\t\t\"$ENTWURF_STEP_SKIP_EXIT\") printf 'PASS\\n' ;;"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:STEP-OUTCOME-SKIP-NOT-PASS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CUT-REFUSES-SKIP",
+			"title": "--cut stops refusing a MUST SKIP — the release procedure goes back to prose and a 14-SKIP run can be quoted as acceptance",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\tif [ \"$cut\" = \"1\" ] && [ \"$skipc\" -gt 0 ]; then"],
+			"replace": ["\tif [ \"$cut\" = \"1\" ] && [ \"$skipc\" -lt 0 ]; then"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CUT-REFUSES-SKIP]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "NO-SMOKE-SKIPS-WITH-ZERO",
+			"title": "one LIVE smoke goes back to exiting 0 on its skip — the hole re-opens for that lane alone, which is how it survived unnoticed",
+			"subject": "scripts/smoke-acp-mcp-live.ts",
+			"find": ["\tskipLive(\"smoke-acp-mcp-live\", \"set LIVE=1 to run the real pi provider turn.\");"],
+			"replace": [
+				"\tconsole.error(\"[smoke-acp-mcp-live] skipped — set LIVE=1 to run the real pi provider turn.\");",
+				"\tprocess.exit(0);"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:NO-SMOKE-SKIPS-WITH-ZERO]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "LIVE-SKIP-IS-PROTOCOL-EXIT",
+			"title": "skipLive exits 0 — every smoke still LOOKS converted (imports, no old shape) while the aggregate reads all of them as PASS",
+			"subject": "scripts/lib/live-skip.ts",
+			"find": ["\tprocess.exit(LIVE_SKIP_EXIT);"],
+			"replace": ["\tprocess.exit(0);"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LIVE-SKIP-IS-PROTOCOL-EXIT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "WRAPPER-SKIP-IS-PROTOCOL-EXIT",
+			"title": "a run.sh smoke wrapper returns 0 on a missing prerequisite — the second skip surface, where cortex/matrix/spawn decline before their .ts is ever reached",
+			"subject": "run.sh",
+			"find": [
+				"    echo \"[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run.\"",
+				"    return \"$ENTWURF_STEP_SKIP_EXIT\""
+			],
+			"replace": [
+				"    echo \"[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run.\"",
+				"    return 0"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:WRAPPER-SKIP-IS-PROTOCOL-EXIT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CUT-VERDICT-NAMES-CAUSE",
+			"title": "a cut blocked only by SKIP reports itself as a FAIL block — the record can no longer tell a broken call from an absent prerequisite",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\t\tprintf 'cut: BLOCKED (MUST SKIP)\\n'"],
+			"replace": ["\t\tprintf 'cut: BLOCKED (MUST FAIL)\\n'"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CUT-VERDICT-NAMES-CAUSE]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "NO-SILENT-AGGREGATE-OMISSION",
+			"title": "the cross-harness delivery chain drops out of the aggregate — a green cut goes back to saying nothing about multi-harness delivery, with no doc stating the exclusion",
+			"subject": "run.sh",
+			"find": [
+				"  run_live_step \"smoke-entwurf-chain-live (P3: Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox, identity + receipt)\" gate bash \"$self\" smoke-entwurf-chain-live"
+			],
+			"replace": ["  : # the chain quietly dropped from the aggregate"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:NO-SILENT-AGGREGATE-OMISSION]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -7,16 +7,13 @@
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY (do not \" +",
-				"\t\t\"over-generalize it): the per-target lock is taken for a control-socket-DOMAIN dispatch, which is \" +",
-				"\t\t\"both the live send AND the dormant cell's spawn-bg resume — spawn-bg is a separate relaunch \" +",
-				"\t\t\"transport yet it still runs under that domain's lock. The mailbox and native-push rails are \" +",
-				"\t\t\"lock-free: the mailbox is guarded instead by active-receiver deliverability, and native-push by \" +",
-				"\t\t\"its adapter probe. The decider — not the \" +"
+				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +",
+				"\t\t\"the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The \" +",
+				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
 			],
 			"replace": [
-				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY: socket paths \" +",
-				"\t\t\"take a per-target lock; the mailbox path does not. The decider — not the \" +"
+				"\t\t\"native-push-no-resume-authority. LOCK POLICY: socket paths take a per-target lock; the mailbox path \" +",
+				"\t\t\"does not. mode \" +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -68,20 +65,34 @@
 			"title": "MCP long description merges the two owned rejects back under backend-liveness-unsupported",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
-				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend. Neither self-fetch nor \" +",
-				"\t\t\"native-push has resume authority, but they reject under DIFFERENT reasons — self-fetch as \" +",
-				"\t\t\"backend-liveness-unsupported, native-push as native-push-no-resume-authority. \" +"
+				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
+				"\t\t\"owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → \" +",
+				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
 			],
 			"replace": [
-				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
-				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend, and on self-fetch and \" +",
-				"\t\t\"native-push alike it is rejected as backend-liveness-unsupported. \" +"
+				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
+				"\t\t\"owned-live-no-autosend, and on self-fetch and native-push alike it is rejected as \" +",
+				"\t\t\"backend-liveness-unsupported. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MERGED-REJECT]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-DESC-FITS-HOST-CAP",
+			"title": "the v2 tool description grows back past the host's 2048-char cap — the INTENT contract is silently cut off before the model that must choose an intent ever reads it",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
+			],
+			"replace": [
+				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-DESC-FITS-HOST-CAP]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		}
 	]
 }

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -52,6 +52,7 @@ import * as readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensions/lib/entwurf-control-rpc.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
@@ -160,10 +161,10 @@ function driveSelfTurn(child: ChildProcess, prompt: string): Promise<TurnCapture
 
 async function main(): Promise<void> {
 	if (process.env.LIVE !== "1") {
-		console.log(
-			"[smoke-acp-bundled-mcp-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
+		skipLive(
+			"smoke-acp-bundled-mcp-live",
+			"set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
 		);
-		return;
 	}
 
 	const tmp = os.tmpdir();

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -45,6 +45,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -57,8 +58,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-carrier-augment-live] skipped — set LIVE=1 to run the real pi provider turn.");
-	process.exit(0);
+	skipLive("smoke-acp-carrier-augment-live", "set LIVE=1 to run the real pi provider turn.");
 }
 
 // Billing-reclassification canaries (핀1). The empty carrier must NOT trip metered

package/scripts/smoke-acp-cortex-live.ts

@@ -0,0 +1,386 @@
+// CP2 LIVE — the cortex ACP citizen path, end to end: a REAL `cortex acp serve`
+// child behind the entwurf provider carries a model to outbound sibling
+// dispatch, under the dual-HOME overlay, and is reclaimed by process-group
+// teardown afterwards.
+//
+//   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
+//
+// WHY this exact axis. The CP0 audit (docs/acp-backend-rail.md, Cortex D1–D10) measured
+// three things no offline gate can prove:
+//   - D9/D10: cortex ignores the wire `mcpServers` param, so the bundled
+//     entwurf-bridge reaches a cortex session ONLY through the overlay-private
+//     mcp.json projection — and only the dual-HOME env restore keeps the bridge
+//     child's garden store real (an isolated-HOME bridge saw "(none)" citizens).
+//     The CP0 LIVE run proved tool exposure + entwurf_peers; the outbound
+//     `entwurf_v2` send was DELIBERATELY not exercised there ("흉내내지 않았다")
+//     and is owed to THIS smoke.
+//   - CP0-M: set-model is accepted live, but "the prompt actually runs on the
+//     selected model" needed a model turn — this smoke drives one.
+//   - teardown: an MCP-configured cortex child does NOT exit on stdin EOF
+//     (measured twice); only process-group signalling reclaims it. This smoke
+//     asserts the reclaim actually happens after the resident dies.
+//
+// METHOD — mirrors smoke-acp-v2-send-live: seed an isolated garden world (store
+// + mailbox + receivers) with ONE armed self-fetch receiver, launch a real
+// `pi --entwurf-control --mode rpc` resident on entwurf/cortex-claude-sonnet-5
+// with that world in env, drive one turn telling the model to call
+// `mcp__entwurf-bridge__entwurf_v2` at the seeded receiver with a nonce, then
+// assert ON DISK: the landed .msg, the envelope naming the resident's own gid +
+// entwurf/<cortex model>, the overlay scope dir + its mcp.json projection, and
+// (after teardown) that no process still lives inside this run's overlay.
+//
+// LIVE-only and OUTSIDE the claude-only AGGREGATE release floor (capability
+// dignity): a host that runs no cortex must not redden a claude release. That is
+// a wiring decision — shipping cortex still owes a deliberate run of this smoke,
+// and the aggregate gate's silence is not a pass (ACP rail verification boundary).
+// Honest skip when LIVE!=1, when `cortex` is not on PATH, or when
+// ENTWURF_ACP_CORTEX_CONNECTION is unset — the overlay denies the operator's
+// cortex settings.json (where a default connection would live), so the
+// connection must arrive through the adapter's own env/settings seam, and
+// running without one would measure a config hole, not the rail. This gate
+// touches the real host exactly where LIVE gates may: the operator's real
+// cortex auth (read-only through symlinks) and ~/.pi/agent/cortex-overlays.
+//
+// Model override: ENTWURF_ACP_CORTEX_MODEL (default cortex-claude-sonnet-5).
+
+import { type ChildProcess, spawn } from "node:child_process";
+import * as crypto from "node:crypto";
+import { existsSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as readline from "node:readline";
+import { fileURLToPath } from "node:url";
+import { upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
+import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
+import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+
+const ACP_PROVIDER = "entwurf";
+const ACP_MODEL = process.env.ENTWURF_ACP_CORTEX_MODEL?.trim() || "cortex-claude-sonnet-5";
+
+const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
+const CORTEX_OVERLAYS_ROOT = path.join(os.homedir(), ".pi", "agent", "cortex-overlays");
+const SOCKET_SUFFIX = ".sock";
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+// Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+
+const BOOT_TIMEOUT_MS = 30_000;
+// The cortex CLI self-extracts on first launch and its newSession alone is
+// ~2.5 s; keep the generous default of the sibling smoke.
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_CORTEX_TIMEOUT_MS) || 300_000;
+const RECLAIM_TIMEOUT_MS = 20_000;
+const POLL_MS = 100;
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	if (!cond) throw new Error(`SMOKE FAIL: ${label}`);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+async function writeFailureArtifact(cap: { stream: string } | null, stderrTail: string, err: unknown): Promise<void> {
+	try {
+		const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+		const file = path.join(os.tmpdir(), `entwurf-smoke-acp-cortex-live-FAIL-${stamp}.log`);
+		await fsp.writeFile(
+			file,
+			`# smoke-acp-cortex-live FAILURE\n# ${err instanceof Error ? err.message : String(err)}\n` +
+				`# model: ${ACP_PROVIDER}/${ACP_MODEL}\n\n` +
+				`## event stream\n${cap?.stream ?? "(no turn captured)"}\n\n` +
+				`## resident stderr tail\n${stderrTail || "(empty)"}\n`,
+			"utf8",
+		);
+		console.error(`[smoke-acp-cortex-live] FAILURE transcript: ${file}`);
+	} catch {
+		console.error("[smoke-acp-cortex-live] could not write the failure transcript (reporting the original error)");
+	}
+}
+
+function sleep(ms: number): Promise<void> {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForSocket(sockPath: string, timeoutMs: number): Promise<boolean> {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (existsSync(sockPath)) return true;
+		await sleep(POLL_MS);
+	}
+	return false;
+}
+
+/** pids (other than ours) whose environ carries `needle` — the overlay scope
+ *  path is unique per run, so this finds exactly the cortex child + its
+ *  grandchildren, never an unrelated operator cortex. Foreign-user /proc
+ *  entries EACCES-skip (they cannot be our children). */
+async function pidsWithEnvNeedle(needle: string): Promise<number[]> {
+	const hits: number[] = [];
+	const entries = await fsp.readdir("/proc").catch(() => [] as string[]);
+	for (const entry of entries) {
+		if (!/^\d+$/.test(entry)) continue;
+		const pid = Number(entry);
+		if (pid === process.pid) continue;
+		try {
+			const environ = await fsp.readFile(path.join("/proc", entry, "environ"), "utf8");
+			if (environ.includes(needle)) hits.push(pid);
+		} catch {
+			// gone or not ours — either way not a leak we own
+		}
+	}
+	return hits;
+}
+
+interface TurnCapture {
+	agentStartSeen: boolean;
+	agentEndSeen: boolean;
+	extensionErrors: Array<{ path: unknown; event: unknown; error: unknown }>;
+	promptAccepted: boolean;
+	stream: string;
+}
+
+// Drive exactly one model turn over the resident's stdin RPC and capture the
+// stdout event stream until `agent_end` (or the hard turn timeout).
+function driveTurn(child: ChildProcess, prompt: string): Promise<TurnCapture> {
+	return new Promise((resolve) => {
+		const cap: TurnCapture = {
+			agentStartSeen: false,
+			agentEndSeen: false,
+			extensionErrors: [],
+			promptAccepted: false,
+			stream: "",
+		};
+		let settled = false;
+		const finish = (): void => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			rl.close();
+			resolve(cap);
+		};
+		const timer = setTimeout(finish, TURN_TIMEOUT_MS);
+		child.once("exit", finish);
+
+		const rl = readline.createInterface({ input: child.stdout! });
+		rl.on("line", (line: string) => {
+			const trimmed = line.trim();
+			if (!trimmed) return;
+			cap.stream += `${trimmed}\n`;
+			let evt: Record<string, unknown>;
+			try {
+				evt = JSON.parse(trimmed) as Record<string, unknown>;
+			} catch {
+				return;
+			}
+			if (evt.type === "agent_start") cap.agentStartSeen = true;
+			if (evt.type === "extension_error") {
+				cap.extensionErrors.push({ path: evt.extensionPath, event: evt.event, error: evt.error });
+			}
+			if (evt.type === "response" && evt.command === "prompt") cap.promptAccepted = evt.success === true;
+			if (evt.type === "agent_end") {
+				cap.agentEndSeen = true;
+				finish();
+			}
+		});
+
+		child.stdin?.write(`${JSON.stringify({ type: "prompt", message: prompt, id: "cortexv2" })}\n`);
+	});
+}
+
+async function main(): Promise<void> {
+	if (process.env.LIVE !== "1") {
+		skipLive("smoke-acp-cortex-live", "set LIVE=1 to run (spawns a real cortex ACP resident + one model turn).");
+	}
+	const connection = process.env.ENTWURF_ACP_CORTEX_CONNECTION?.trim();
+	if (!connection) {
+		skipLive(
+			"smoke-acp-cortex-live",
+			"set ENTWURF_ACP_CORTEX_CONNECTION=<snowflake connection> (the dual-HOME overlay denies the operator cortex settings.json, so the connection must ride the adapter's own seam).",
+		);
+	}
+	if ("CORTEX_HOME" in process.env) {
+		skipLive("smoke-acp-cortex-live", "unset CORTEX_HOME first (the adapter refuses its presence, CP0 D3).");
+	}
+
+	// One temp root holding the whole garden this smoke can see: store, mailbox
+	// and receiver markers. Only these move — the operator's real cortex auth
+	// (via overlay symlinks) and the control dir stay real.
+	const world = await fsp.mkdtemp(path.join(os.tmpdir(), "acp-cortex-"));
+	const sessionsDir = path.join(world, "sessions");
+	const mailboxDir = path.join(world, "mailbox");
+	const receiversDir = path.join(world, "receivers");
+	for (const d of [sessionsDir, mailboxDir, receiversDir]) await fsp.mkdir(d, { recursive: true });
+
+	const nonce = `CORTEXV2-${crypto.randomBytes(5).toString("hex").toUpperCase()}`;
+
+	console.error(`[smoke-acp-cortex-live] repo:  ${REPO_ROOT}`);
+	console.error(`[smoke-acp-cortex-live] model: ${ACP_PROVIDER}/${ACP_MODEL} (connection ${connection})`);
+	console.error(`[smoke-acp-cortex-live] world: ${world}`);
+
+	// ── the peer: an armed self-fetch citizen, deliverable by the mailbox rail ──
+	const receiver = upsertMetaSession({
+		input: { backend: "claude-code", nativeSessionId: `acp-cortex-${process.pid}`, cwd: world },
+		dir: sessionsDir,
+	});
+	const receiverGid = receiver.record.gardenId;
+	writeMetaReceiverMarker({
+		gardenId: receiverGid,
+		backend: "claude-code",
+		nativeSessionId: receiver.record.nativeSessionId,
+		ownerPid: process.pid,
+		armProvenance: "session-start",
+		receiversDir,
+	});
+	console.error(`[smoke-acp-cortex-live] peer:  ${receiverGid} (armed mailbox receiver)`);
+
+	let senderGid = "";
+	let stderrTail = "";
+	let resident: ChildProcess | null = null;
+	let cap: TurnCapture | null = null;
+	let overlayScopeDir = "";
+	try {
+		resident = spawn(
+			"pi",
+			[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", ACP_PROVIDER, "--model", ACP_MODEL, "--mode", "rpc"],
+			{
+				cwd: world,
+				stdio: ["pipe", "pipe", "pipe"],
+				detached: false,
+				env: {
+					...process.env,
+					ENTWURF_META_SESSIONS_DIR: sessionsDir,
+					ENTWURF_META_MAILBOX_DIR: mailboxDir,
+					ENTWURF_META_RECEIVERS_DIR: receiversDir,
+				},
+			},
+		);
+		resident.stderr?.on("data", (b: Buffer) => {
+			stderrTail = (stderrTail + b.toString()).slice(-4000);
+		});
+
+		const bornGid = await waitForPiRecord(sessionsDir, BOOT_TIMEOUT_MS);
+		ok(`cortex-model resident birthed its own V3 record (${ACP_PROVIDER}/${ACP_MODEL})`, bornGid !== null);
+		senderGid = bornGid as string;
+		console.error(`[smoke-acp-cortex-live] sender:${senderGid} (never told to the model)`);
+		ok("sender and receiver are distinct citizens", senderGid !== receiverGid);
+		const sockPath = path.join(REAL_CONTROL_DIR, `${senderGid}${SOCKET_SUFFIX}`);
+		ok(
+			"resident stood up a control socket keyed on its record gardenId",
+			await waitForSocket(sockPath, BOOT_TIMEOUT_MS),
+		);
+
+		// The prompt names the TARGET but never the sender's own gid — that can
+		// only reach the mailbox via the real envelope the projection carried.
+		const prompt =
+			`Call the mcp__entwurf-bridge__entwurf_v2 tool exactly once with these arguments: ` +
+			`target="${receiverGid}", intent="fire-and-forget", message="${nonce}". ` +
+			`Then reply with ONLY the tool's outcome line.`;
+		cap = await driveTurn(resident, prompt);
+
+		ok("the prompt RPC command was accepted", cap.promptAccepted);
+		ok("a real model turn ran over the stdin RPC (agent_start)", cap.agentStartSeen);
+		ok("the turn completed cleanly over RPC (agent_end — no hang)", cap.agentEndSeen);
+		ok("no extension_error during the turn", cap.extensionErrors.length === 0);
+
+		// ── the dual-HOME overlay is a disk fact, not an implementation detail ──
+		// scope id = `<resident pid>-<hash>` (the resident hosts the ACP spawn).
+		const scopeEntries = (await fsp.readdir(CORTEX_OVERLAYS_ROOT).catch(() => [] as string[])).filter((e) =>
+			e.startsWith(`${resident?.pid}-`),
+		);
+		ok(
+			`the resident materialized exactly one overlay scope dir (got ${scopeEntries.length})`,
+			scopeEntries.length === 1,
+		);
+		overlayScopeDir = path.join(CORTEX_OVERLAYS_ROOT, scopeEntries[0] as string);
+		const ovlCortex = path.join(overlayScopeDir, "home", ".snowflake", "cortex");
+		const ovlSettings = JSON.parse(await fsp.readFile(path.join(ovlCortex, "settings.json"), "utf8"));
+		ok("the overlay pinned autoUpdate:false (D4)", ovlSettings.autoUpdate === false);
+		const ovlMcp = JSON.parse(await fsp.readFile(path.join(ovlCortex, "mcp.json"), "utf8"));
+		const bridge = ovlMcp.mcpServers?.["entwurf-bridge"];
+		ok("the overlay mcp.json projected the entwurf-bridge entry (D9)", Boolean(bridge));
+		ok("the projected bridge entry restored the REAL operator HOME (D10 dual-HOME)", bridge.env?.HOME === os.homedir());
+		ok(
+			"the projected bridge entry carries the live PI_SESSION_ID envelope",
+			typeof bridge.env?.PI_SESSION_ID === "string" && bridge.env.PI_SESSION_ID.length > 0,
+		);
+		ok(
+			`the projected bridge entry carries PI_AGENT_ID=entwurf/${ACP_MODEL}`,
+			bridge.env?.PI_AGENT_ID === `${ACP_PROVIDER}/${ACP_MODEL}`,
+		);
+
+		// ── the outbound proof is on disk, not in the transcript ──
+		const boxDir = path.join(mailboxDir, receiverGid);
+		const entries = await fsp.readdir(boxDir).catch(() => [] as string[]);
+		const msgs = entries.filter((f) => f.endsWith(".msg"));
+		ok(`the model's entwurf_v2 call enqueued exactly one .msg to the peer (got ${msgs.length})`, msgs.length === 1);
+		ok("the doorbell inbox.signal was poked", existsSync(path.join(boxDir, "inbox.signal")));
+
+		const body = await fsp.readFile(path.join(boxDir, msgs[0] as string), "utf8");
+		const SEPARATOR = "────────────────────────────────────────";
+		const sepAt = body.indexOf(`\n${SEPARATOR}\n`);
+		ok("the delivered body carries the rendered envelope separator", sepAt !== -1);
+		const header = body.slice(0, sepAt + 1);
+		const payload = body.slice(sepAt + 1 + SEPARATOR.length + 1);
+
+		const rx = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		ok("the payload is EXACTLY the nonce (no envelope text folded into it)", payload === `${nonce}\n`);
+		ok(
+			"the landed sender agentId is the cortex ACP model (anchored envelope line)",
+			new RegExp(`^ {2}from: {8}${rx(ACP_PROVIDER)}/${rx(ACP_MODEL)} @ \\S`, "m").test(header),
+		);
+		ok(
+			"the landed sender session IS the resident's own garden id, replyable (anchored envelope line)",
+			new RegExp(
+				`^ {2}session: {5}${rx(senderGid)} \\(replyable — reply via entwurf_v2 to this sessionId, intent=fire-and-forget\\)$`,
+				"m",
+			).test(header),
+		);
+		ok("the sender gid appears ONLY in the envelope, never in the payload", !payload.includes(senderGid));
+		ok("the landed sender renders as a pi-session, not a meta-session", !header.includes("(meta-session"));
+
+		// ── process-group reclaim (CP0 teardown finding) ──
+		// While the resident lives, its retained cortex child inhabits this run's
+		// overlay (SNOWFLAKE_HOME env is unique per scope). An MCP-configured
+		// cortex child ignores stdin EOF, so only the resident's process-group
+		// teardown can reclaim it — kill the resident and require extinction.
+		const liveBefore = await pidsWithEnvNeedle(overlayScopeDir);
+		ok(
+			`the cortex child (group) is alive inside this run's overlay pre-teardown (got ${liveBefore.length})`,
+			liveBefore.length > 0,
+		);
+		await terminateChild(resident);
+		resident = null;
+		let leaked: number[] = [];
+		const deadline = Date.now() + RECLAIM_TIMEOUT_MS;
+		for (;;) {
+			leaked = await pidsWithEnvNeedle(overlayScopeDir);
+			if (leaked.length === 0 || Date.now() > deadline) break;
+			await sleep(250);
+		}
+		ok(
+			`process-group teardown reclaimed every process in this run's overlay (leaked: ${leaked.join(",") || "none"})`,
+			leaked.length === 0,
+		);
+	} catch (err) {
+		await writeFailureArtifact(cap, stderrTail, err);
+		throw err;
+	} finally {
+		if (resident) await terminateChild(resident);
+		if (overlayScopeDir) await fsp.rm(overlayScopeDir, { recursive: true, force: true }).catch(() => {});
+		if (process.env.ENTWURF_KEEP_SMOKE_WORLD === "1") {
+			console.error(`[smoke-acp-cortex-live] kept world: ${world}`);
+		} else {
+			await fsp.rm(world, { recursive: true, force: true }).catch(() => {});
+		}
+	}
+
+	if (stderrTail && process.env.ENTWURF_SMOKE_VERBOSE === "1") {
+		console.error(`[smoke-acp-cortex-live] resident stderr tail:\n${stderrTail}`);
+	}
+	console.log(
+		`smoke-acp-cortex-live: PASS (${passed} assertions) — a cortex ACP model delivered to a peer as itself and was reclaimed`,
+	);
+}
+
+await main();