@junghanacs/entwurf 0.12.10 → 0.13.1

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/tool-surface.js

@@ -10,10 +10,18 @@
 //      if pi has excluded a built-in the backend will still expose, the declared
 //      surface diverges from the actual one — we fail fast rather than lie.
 //
-// Claude-only scope (NEXT §스코프). The function keeps a `backend` field so the
-// honest-divergence logic stays explicit and the matrix gate can exercise both
-// the "claude narrows via tools" and "native always exposes" branches, but the
-// only backend this lane supplies is claude.
+// The module's TWO jobs have different backend scopes — do not collapse them:
+//   - `buildClaudeSessionMeta` is claude-only by CONSTRUCTION, with exactly one
+//     caller (`claudeAdapter.buildSessionMeta`). Cortex exposes no
+//     `_meta.systemPrompt` and no tools/permission declaration surface (native
+//     tools + its own overlay mcp.json projection), so its adapter returns
+//     `undefined` and that function is never reached for a cortex turn.
+//   - `assertExcludeToolsHonored` is BACKEND-INVARIANT: backend.ts runs it for
+//     every adapter before any spawn, passing `backend: adapter.backend` and the
+//     resolved `config.tools`. A cortex turn DOES enter this module through it.
+// That split is why the `backend` field exists: the honest-divergence logic stays
+// explicit and the matrix gate can exercise both the "claude narrows via tools"
+// and "native always exposes" branches.
 //
 // Carrier guard (NEXT §S2-scout 핀1): `buildClaudeSessionMeta` only attaches
 // `_meta.systemPrompt` when a caller passes one. The shipped S2d path passes the

package/mcp/entwurf-bridge/src/index.ts

@@ -344,54 +344,27 @@ function abbreviateHomeMcp(cwd: string): string {
 // sender replyability).
 server.tool(
 	"entwurf_v2",
-	"CANONICAL DELIVERY SURFACE for garden ids. When you have a garden id and want to reach " +
-		"whoever it names — message / reply / hand-off — use THIS verb. A garden id alone does " +
-		"not tell you which rail that citizen answers on — a live socket citizen, a dormant one, a " +
-		"mailbox-backed self-fetch session, or a native-push session — and entwurf_v2 is the one " +
-		'surface that reads that for you and routes correctly (so "when unsure which transport, use ' +
-		'entwurf_v2"). You give the target ' +
-		"garden id + your intent; the decider picks the transport from the target's liveness " +
-		"(live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; active " +
-		"deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct " +
-		"injection into its live conversation) under the v2 lock policy, and reports ONE outcome " +
-		"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY (do not " +
-		"over-generalize it): the per-target lock is taken for a control-socket-DOMAIN dispatch, which is " +
-		"both the live send AND the dormant cell's spawn-bg resume — spawn-bg is a separate relaunch " +
-		"transport yet it still runs under that domain's lock. The mailbox and native-push rails are " +
-		"lock-free: the mailbox is guarded instead by active-receiver deliverability, and native-push by " +
-		"its adapter probe. The decider — not the " +
-		"caller — chooses the transport. Note: entwurf_v2 dispatches to EXISTING targets; " +
-		"brand-new sibling creation is deferred to a later v2 lane. " +
-		"CHOOSING INTENT (read this — picking wrong is rejected, never auto-fixed): to message / " +
-		"reply / hand off a peer that entwurf_peers shows as liveness=alive (a live socket citizen, " +
-		"currently backend pi) use intent: fire-and-forget — it routes to the live control-socket; set " +
-		"wants_reply:true if you need an answer (wants_reply is NOT owned-outcome). Replies to a citizen " +
-		"with NO socket liveness (liveness=unsupported) are ALSO fire-and-forget, and the decider picks " +
-		"that citizen's own rail: a self-fetch backend (e.g. Claude Code) gets the meta-bridge mailbox, " +
-		"while a native-push backend (e.g. Antigravity) gets direct injection into its live conversation " +
-		"and has NO mailbox at all — do not assume mailbox semantics for every unsupported citizen. A " +
-		"native-push target IS measured by its own adapter probe, and that probe is THREE-valued, so " +
-		"the send is never silently queued: alive → injected; dead → rejected as " +
-		"native-push-target-dead; indeterminate → rejected as native-push-probe-indeterminate. " +
-		"Those two rejects stay distinct because 'we could not establish it' is not 'it is gone' — " +
-		"collapsing them reports a guess as a fact. THERE IS A " +
-		"THIRD RESULT, so do not read liveness=unsupported as 'reachable by some rail': the mailbox path " +
-		"delivers only to a DELIVERABLE citizen (a self-fetch backend whose receiver is live and armed), " +
-		"so a terminated Claude Code session — and any record whose backend has no adapter on this lane, " +
-		"e.g. codex — is rejected as mailbox-undeliverable rather than queued into an inbox nobody drains. " +
-		"unsupported means only 'this backend has no control-socket probe'. " +
-		"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently " +
-		"backend pi); on a live target it is rejected as owned-live-no-autosend. Neither self-fetch nor " +
-		"native-push has resume authority, but they reject under DIFFERENT reasons — self-fetch as " +
-		"backend-liveness-unsupported, native-push as native-push-no-resume-authority. " +
-		"It is NEVER auto-converted — so pick the right intent up front. " +
-		"mode applies to a CONTROL-SOCKET send only — it is the injection style for a live pi turn, and " +
-		"the mailbox, native-push, and spawn-bg plans carry no mode at all, so setting it for those " +
-		"targets changes nothing (a native-push send IS live and still ignores it). wants_reply rides " +
-		"every rail. Use entwurf_peers to discover targets. " +
-		"Payload guidance: message hard cap 16000 chars. For larger reviews/logs, write an " +
-		"artifact and dispatch its path plus a short digest; avoid multi-part sends because " +
-		"mailbox doorbells may coalesce.",
+	"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id " +
+		"alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
+		"from liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; " +
+		"deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection " +
+		"into its conversation) and reports ONE outcome (delivered / rejected / lock-retained / " +
+		"delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is " +
+		"rejected, never auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
+		"citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
+		'"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
+		"gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
+		"all. THERE IS A THIRD RESULT: the mailbox delivers only to a DELIVERABLE citizen, so a terminated " +
+		"session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
+		"inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
+		"native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
+		"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → " +
+		"owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → " +
+		"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND " +
+		"the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The " +
+		"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode " +
+		"applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message " +
+		"caps at 16000 chars; send an artifact path + digest for more.",
 	{
 		target: z.string().min(1).describe("Target garden id (use entwurf_peers to discover)"),
 		intent: z

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.10",
+	"version": "0.13.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -42,6 +42,9 @@
 		"demo/demo.sh",
 		"demo/demo-baseline.sh",
 		"docs/setup-clean-host.md",
+		"docs/external-mcp-host.md",
+		"docs/fresh-cut-policy.md",
+		"docs/acp-backend-rail.md",
 		"docs/assets/entwurf-hero.jpg",
 		"docs/assets/entwurf-demo.gif",
 		"docs/assets/entwurf-doomemacs.gif",
@@ -71,23 +74,23 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.62.0",
+		"@agentclientprotocol/claude-agent-acp": "0.64.0",
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.82.1 <0.83",
-		"@earendil-works/pi-coding-agent": ">=0.82.1 <0.83",
-		"@earendil-works/pi-tui": ">=0.82.1 <0.83",
+		"@earendil-works/pi-ai": ">=0.83.0 <0.84",
+		"@earendil-works/pi-coding-agent": ">=0.83.0 <0.84",
+		"@earendil-works/pi-tui": ">=0.83.0 <0.84",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.82.1",
-		"@earendil-works/pi-coding-agent": "0.82.1",
-		"@earendil-works/pi-tui": "0.82.1",
+		"@earendil-works/pi-ai": "0.83.0",
+		"@earendil-works/pi-coding-agent": "0.83.0",
+		"@earendil-works/pi-tui": "0.83.0",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"typescript": "^6.0.2"
@@ -121,6 +124,8 @@
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
 		"check-agy-permission-matrix": "./run.sh check-agy-permission-matrix",
 		"check-gate-qualification": "./run.sh check-gate-qualification",
+		"check-probe-ordering": "./run.sh check-probe-ordering",
+		"check-probe-cli-shim": "./run.sh check-probe-cli-shim",
 		"check-pack": "./run.sh check-pack",
 		"check-pack-install": "./run.sh check-pack-install",
 		"check-install-container": "./run.sh check-install-container",
@@ -130,7 +135,7 @@
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",
 		"check-package-source-routing": "./run.sh check-package-source-routing",
-		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-install-surface && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh check-meta-doctor-oracle && ./run.sh smoke-agy-install-state && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-agy-sender-identity && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-gate-qualification && ./run.sh check-pack"
+		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-install-surface && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh check-meta-doctor-oracle && ./run.sh smoke-agy-install-state && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-agy-sender-identity && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-gate-qualification && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [

package/pi/settings.reference.json

@@ -32,7 +32,7 @@
 			"WebFetch",
 			"WebSearch"
 		],
-		"codexDisabledFeatures": ["image_generation", "tool_suggest", "tool_search", "multi_agent", "apps", "memories"],
+		"cortexConnection": "MY_SNOWFLAKE_CONNECTION",
 		"mcpServers": {
 			"entwurf-bridge": {
 				"command": "/path/to/entwurf/mcp/entwurf-bridge/start.sh",

package/pi-extensions/acp-provider.ts

@@ -2,11 +2,19 @@
 //
 // This is the pi-extension entry point that registers `entwurf` as a pi
 // session provider/model. It is intentionally THIN: it stands up the provider
-// surface (curated Claude anchor + no-auth sentinel) and wires streamSimple to
-// the real ACP backend (lib/acp/backend.ts — spawn-per-turn claude-agent-acp).
-// It does NOT build a socket/peers/citizen protocol or touch the v2 core —
-// socket-citizenship is supplied by the host `--entwurf-control` pi session
-// (AGENTS §ACP Plugin Boundary).
+// surface (every registered adapter's curated rows + the no-auth sentinel) and
+// wires streamSimple to the real ACP backend (lib/acp/backend.ts — a
+// spawn-per-turn ACP child, `claude-agent-acp` or `cortex acp serve` depending
+// on which adapter the model id routes to). It does NOT build a
+// socket/peers/citizen protocol or touch the v2 core — socket-citizenship is
+// supplied by the host `--entwurf-control` pi session (AGENTS §ACP Plugin
+// Boundary).
+//
+// The model set comes from `allCuratedModels()` — the union across the adapter
+// registry (backend-adapter.ts), NOT a per-backend list spelled here. Adding a
+// backend therefore never edits this file. check-acp-provider-surface pins that
+// the compiled entry really registers the EXACT union
+// ([QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]).
 //
 // Fence: this entry rides the emit-capable root tsconfig (it is not in the root
 // `exclude` list); its lib modules are imported with `.js` suffixes (the root
@@ -49,14 +57,16 @@ export default function (pi: ExtensionAPI) {
 		apiKey: ENTWURF_ACP_NO_AUTH_SENTINEL,
 		api: "entwurf",
 		models: allCuratedModels(),
-		// S2c: real ACP backend. Spawn-per-turn claude-agent-acp drive + event
-		// mapping (lib/acp/backend.ts). The S0 fail-loud stub is gone — the
-		// provider path is open. Backend auth still belongs to the operator's own
-		// Claude CLI child (no-auth sentinel above); this plugin only orchestrates.
+		// S2c: real ACP backend. Spawn-per-turn ACP child + event mapping
+		// (lib/acp/backend.ts); the routed adapter decides WHICH child. The S0
+		// fail-loud stub is gone — the provider path is open. Backend auth still
+		// belongs to the operator's own backend CLI child (no-auth sentinel above);
+		// this plugin only orchestrates.
 		streamSimple: streamShellAcp,
 	});
 
-	// Mark only AFTER a successful registration. If curatedClaudeModels() (a
+	// Mark only AFTER a successful registration. If allCuratedModels() (which
+	// fail-fasts on an unowned/duplicate curated id, and whose claude rows carry a
 	// fail-loud anchor check) or registerProvider throws, the runtime is not left
 	// poisoned with a "registered" marker — a retry can register cleanly.
 	markRegisteredOnRuntime(pi);

package/pi-extensions/entwurf-control.ts

@@ -1322,55 +1322,26 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 	registerTool({
 		name: "entwurf_v2",
 		label: "Dispatch (v2)",
-		description: `CANONICAL delivery surface for a garden id. When you have a garden id and want to
-reach whoever it names — message / reply / hand-off — use THIS verb. A garden id alone does not
-reveal which rail that citizen answers on — a live socket session, a dormant one, a mailbox-backed
-self-fetch session, or a native-push session —
-and entwurf_v2 is the one surface that reads that and routes correctly (so "when unsure which
-transport, use entwurf_v2"). It dispatches to EXISTING targets; brand-new sibling creation is deferred
-to a later v2 lane. Dispatch to a garden citizen through the unified entwurf_v2 verb: the 5b decider
-picks the transport (live control-socket send / spawn-bg resume / meta-mailbox enqueue / native-push
-direct injection) from the target's liveness + your intent, runs it under the v2 lock policy, and reports
-one outcome (delivered / rejected / lock-retained / delivered-but-lock-dirty).
-
-LOCK POLICY (do not over-generalize it): the per-target lock is taken for a control-socket-DOMAIN
-dispatch, which is BOTH the live send AND the dormant cell's spawn-bg resume — spawn-bg is a separate
-relaunch transport yet it still runs under that domain's lock. The mailbox and native-push rails are
-lock-free: the mailbox is guarded instead by active-receiver deliverability, and native-push by its
-adapter probe.
-
-- target: the garden id of the citizen to reach (required).
-- intent: fire-and-forget (a send with no owned result) or owned-outcome (you own the result).
-- message: the message/prompt to dispatch (required).
-- mode: steer or follow_up for a CONTROL-SOCKET send (optional). The mailbox, native-push, and
-  spawn-bg plans carry no mode, so it has no effect on those rails — a native-push send IS live and
-  still ignores it.
-- wants_reply: reply hint; it rides every rail (optional, default false).
-
-CHOOSING INTENT (picking wrong is rejected, never auto-fixed): to message / reply / hand off a peer
-that entwurf_peers shows as liveness=alive (a live socket citizen, currently backend pi), use intent:
-fire-and-forget — it routes to the live control-socket; set wants_reply:true if you need an answer
-(wants_reply is NOT owned-outcome). Replies to a citizen with NO socket liveness
-(liveness=unsupported) are ALSO fire-and-forget, and the decider picks that citizen's own rail: a
-self-fetch backend (e.g. Claude Code) gets the meta-bridge mailbox, while a native-push backend
-(e.g. Antigravity) gets direct injection into its live conversation and has NO mailbox at all — do
-not assume mailbox semantics for every unsupported citizen. A native-push target IS measured by its
-own adapter probe, and that probe is THREE-valued, so the send is never silently queued: alive →
-injected; dead → rejected as native-push-target-dead; indeterminate → rejected as
-native-push-probe-indeterminate. Those last two stay separate on purpose — "we could not establish
-it" is not "it is gone". THERE IS A THIRD RESULT, so do not read
-liveness=unsupported as "reachable by some rail": the mailbox path delivers only to a DELIVERABLE
-citizen (a self-fetch backend whose receiver is live and armed), so a terminated Claude Code session —
-and any record whose backend has no adapter on this lane, e.g. codex — is rejected as
-mailbox-undeliverable rather than queued into an inbox nobody drains. unsupported means only "this
-backend has no control-socket probe".
-owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently backend
-pi); on a live target it is rejected as owned-live-no-autosend. Neither self-fetch nor native-push
-has resume authority, but they reject under DIFFERENT reasons — self-fetch as
-backend-liveness-unsupported, native-push as native-push-no-resume-authority.
-It is NEVER auto-converted — so pick the right intent up front.
-
-The decider — not this surface — chooses the transport.`,
+		description: `CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone
+does not say which rail that citizen answers on. Give target + intent; the decider picks transport from
+liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; deliverable
+self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its
+conversation) and reports ONE outcome (delivered / rejected / lock-retained / delivered-but-lock-dirty).
+EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is rejected, never
+auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A citizen with NO socket
+liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only "no control-socket probe" —
+and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) gets the mailbox, a native-push
+backend (e.g. Antigravity) gets direct injection and has NO mailbox at all. THERE IS A THIRD RESULT: the
+mailbox delivers only to a DELIVERABLE citizen, so a terminated session, or a backend with no adapter here
+(e.g. codex), is mailbox-undeliverable, not queued for an inbox nobody drains. The native-push probe is
+3-valued: alive → injected; dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate
+(unestablished ≠ gone). owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live
+target → owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push →
+native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND the
+dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The mailbox
+and native-push rails are lock-free — deliverability and the adapter probe guard them. mode applies to a
+CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000
+chars; send an artifact path + digest for more.`,
 		parameters: entwurfV2Parameters,
 		async execute(
 			_toolCallId: string,

package/pi-extensions/lib/acp/acp-client.ts

@@ -26,6 +26,17 @@ export interface AcpConnectionLike {
 	newSession(params: unknown): Promise<{ sessionId?: string }>;
 	prompt(params: { sessionId: string; prompt: AcpTextBlock[] }): Promise<{ stopReason?: string }>;
 	setSessionConfigOption?(params: unknown): Promise<unknown>;
+	/**
+	 * ACP `session/cancel` — the PROTOCOL way to end an in-flight prompt turn.
+	 *
+	 * The spec requires the agent to answer the pending `session/prompt` with
+	 * `stopReason: "cancelled"` after this notification, so a user abort ends the
+	 * turn as a protocol event (backend.ts maps cancelled → aborted) instead of a
+	 * signal race. Fire-and-forget by contract: it is a JSON-RPC notification, so
+	 * there is nothing to await and a send failure on an already-closed connection
+	 * must not mask the abort the caller is executing.
+	 */
+	cancel?(params: { sessionId: string }): void;
 	/**
 	 * Closes the underlying SDK connection before child process teardown. With
 	 * the fluent SDK connection this is load-bearing: otherwise a successful
@@ -76,6 +87,17 @@ export function connectAcpClient(stream: Stream, handlers: AcpClientHandlers): A
 		prompt: (params) =>
 			agent.request(AGENT_METHODS.session_prompt, params as never) as Promise<{ stopReason?: string }>,
 		setSessionConfigOption: (params) => agent.request(AGENT_METHODS.session_set_config_option, params as never),
+		cancel: (params) => {
+			// Notification, not a request: nothing resolves it, and the connection
+			// may already be closing when the operator aborts. Swallow both the sync
+			// throw and the rejected send — the caller's abort path continues either
+			// way (it escalates to teardown after a bounded grace).
+			try {
+				void Promise.resolve(agent.notify(AGENT_METHODS.session_cancel, params as never)).catch(() => {});
+			} catch {
+				// connection already closed — the abort path escalates on its own.
+			}
+		},
 		close: (error) => {
 			// Best-effort by contract (see AcpConnectionLike.close): a teardown-path
 			// close that threw would mask the turn's real error and skip the child

package/pi-extensions/lib/acp/augment.ts

@@ -30,14 +30,71 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { ENTWURF_PROJECT_CONTEXT_OPEN_TAG } from "../../../protocol.js";
 import type { AcpTextBlock } from "./context.js";
 
 const MAX_AUGMENT_BYTES = 50 * 1024;
 
+// Carrier-less backends expose no `_meta.systemPrompt` (docs/acp-backend-rail.md,
+// “Cortex Code audit”). claude folds the operator engraving into that carrier; a carrier-less
+// backend (cortex, the first — precisely: SYSTEM-PROMPT-carrier-less, since
+// cortex does read `_meta` for an unpromoted caller-session-id seam)
+// has nowhere to put it — so its operator engraving
+// rides HERE, prepended as the LEADING section of the first-user augment. It
+// travels on the WIRE only (new-only, never the config signature), so an
+// engraving change applies to the NEXT new cortex session rather than
+// invalidating a live reused one — the documented asymmetry vs claude, where the
+// carrier feeds bridgeConfigSignature.
+const CARRIER_LESS_BACKENDS: ReadonlySet<string> = new Set(["cortex"]);
+
+// The one sentence both rails owe the model: WHAT this block is and what it is
+// NOT. Shared so neither rail's frame can quietly lose it (and so the gate has a
+// single anchor to mutate). Everything after it is rail-specific, because the
+// rails really do differ — see the frame in buildPiContextAugment.
+const PROVENANCE_LEAD =
+	"This block is prepended to the FIRST USER MESSAGE of this session. It is not your system prompt.";
+
+// The env var an operator points at a personal engraving file. Shared surface
+// with the claude carrier (engraving.ts) BY NAME, but read INLINE here (not
+// imported): augment.ts is loaded raw by the strip-types carrier-augment gate,
+// which cannot resolve a `.js` VALUE import of the sibling `.ts` engraving
+// module (augment.ts only value-imports real `.js` files). So the carrier-less
+// override read is self-contained. Unlike engraving.ts's shipped-default path,
+// this ONLY ever reads the operator OVERRIDE file: the shipped claude default
+// (a preset-replacement / auto-memory lever) is meaningless for a non-claude
+// backend and is never injected into a carrier-less augment.
+const ENGRAVING_OVERRIDE_ENV = "ENTWURF_ACP_ENGRAVING_PATH";
+
+/**
+ * Render the operator engraving OVERRIDE for a carrier-less backend, or null
+ * when unset / empty / whitespace / unreadable. Pure w.r.t. (override file
+ * contents, backend, sorted mcpServerNames). Mirrors engraving.ts's `{{backend}}`
+ * / `{{mcp_servers}}` token substitution so the operator's file behaves the same
+ * on the augment as it would on the claude carrier.
+ */
+function loadCarrierlessOperatorEngraving(backend: string, mcpServerNames: readonly string[]): string | null {
+	const envPath = process.env[ENGRAVING_OVERRIDE_ENV]?.trim();
+	if (!envPath) return null;
+	let source: string;
+	try {
+		source = readFileSync(resolve(envPath), "utf8");
+	} catch {
+		return null;
+	}
+	const names = [...mcpServerNames].sort();
+	const mcpList = names.length > 0 ? names.join(", ") : "(none registered)";
+	const rendered = source
+		.replace(/\{\{backend\}\}/g, backend)
+		.replace(/\{\{mcp_servers\}\}/g, mcpList)
+		.trim();
+	return rendered.length > 0 ? rendered : null;
+}
+
 export interface PiContextAugmentParams {
-	/** Claude-only this cut; kept as a field so the narrative names the backend. */
+	/** The routed backend ("claude" | "cortex"). Load-bearing, not decorative: the
+	 *  narrative names it AND `CARRIER_LESS_BACKENDS` keys off it to decide whether
+	 *  the operator engraving leads the augment. */
 	backend: string;
 	cwd: string;
 	mcpServerNames: readonly string[];
@@ -58,6 +115,46 @@ export function buildPiContextAugment(params: PiContextAugmentParams): string {
 
 	const sections: string[] = [];
 
+	// System-prompt-carrier-less backend (cortex): the operator engraving leads the augment,
+	// since there is no `_meta.systemPrompt` carrier to hold it. null when no
+	// override is configured — the shipped claude default is never injected here.
+	if (CARRIER_LESS_BACKENDS.has(params.backend)) {
+		const engraving = loadCarrierlessOperatorEngraving(params.backend, params.mcpServerNames);
+		if (engraving) sections.push(engraving);
+	}
+
+	// PROVENANCE FRAME — leads the bridge narrative, and it is not decoration.
+	//
+	// Measured 2026-07-30: asked where its instructions came from, the Claude ACP
+	// model asserted that the two paragraphs below were its system prompt. They
+	// are not — they are text prepended to its FIRST USER MESSAGE. Nothing in the
+	// block said otherwise, and a model has no other way to tell: on the wire a
+	// long first user message and a system prompt read the same. So the block now
+	// states its own provenance, per rail, because the rails genuinely differ
+	// (backend-adapter.ts: claude's buildSessionMeta carries `_meta.systemPrompt`,
+	// cortex's returns undefined so no `_meta` key is sent at all).
+	//
+	// Honest about scope: this makes the boundary STATEABLE, not enforced. It
+	// tells the model what it cannot otherwise observe; it does not stop a model
+	// from guessing anyway.
+	sections.push(
+		CARRIER_LESS_BACKENDS.has(params.backend)
+			? [
+					"# entwurf: where this text comes from",
+					"",
+					PROVENANCE_LEAD,
+					`The ${params.backend} rail carries no system-prompt carrier at all — entwurf sends no \`_meta.systemPrompt\`, so everything entwurf tells you, including any operator engraving above, arrives here as user-message text.`,
+					"If you are asked what your system prompt says, do not quote this block as one.",
+				].join("\n")
+			: [
+					"# entwurf: where this text comes from",
+					"",
+					PROVENANCE_LEAD,
+					`The ${params.backend} rail does have a system-prompt carrier (\`_meta.systemPrompt\`), and entwurf keeps it deliberately tiny: it carries the operator engraving only — never this narrative, never AGENTS.md.`,
+					"So: system prompt = the short engraving; everything below = first-user-message text. If you are asked what your system prompt says, do not quote this block as one.",
+				].join("\n"),
+	);
+
 	// Bridge identity + caller-side sibling stance. The closing line is a
 	// caller-perspective statement: when THIS session throws an entwurf, the peer
 	// on the other end is a sibling, not a worker.