@junghanacs/entwurf 0.12.2 → 0.12.3

package/AGENTS.md

@@ -217,8 +217,8 @@ Code-level invariants pinned at the same time:
 
 ## Runtime Dependencies
 
-- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.50.0`), `@agentclientprotocol/sdk` (`0.29.0`), `@anthropic-ai/sdk` (`0.100.1`). The Codex/Gemini ACP packages stay out of scope (native already reaches Codex; Gemini/major tools use native).
-- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.80.2 < 0.81` — devDep exact `0.80.2` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT the 0.80 provider-factory `providers/anthropic` subpath: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only the bare root, `/compat`, and `/oauth` for extensions — a `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.81` ceiling guards it; when 0.81 changes `compat` or the loader alias map, re-evaluate against whatever root/loader surface 0.81 then exposes.
+- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.54.1`), `@agentclientprotocol/sdk` (`1.1.0`), `@anthropic-ai/sdk` (`0.100.1`). The Codex/Gemini ACP packages stay out of scope (native already reaches Codex; Gemini/major tools use native).
+- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.80.3 < 0.81` — devDep exact `0.80.3` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT the 0.80 provider-factory `providers/anthropic` subpath: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only the bare root, `/compat`, and `/oauth` for extensions — a `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.81` ceiling guards it; when 0.81 changes `compat` or the loader alias map, re-evaluate against whatever root/loader surface 0.81 then exposes.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.3 — 2026-07-01
+
+### Changed
+
+- **Claude ACP dependency lane refreshed for Sonnet 5.** The ACP runtime pins now use `@agentclientprotocol/claude-agent-acp@0.54.1` with `@agentclientprotocol/sdk@1.1.0`, while keeping the direct `@anthropic-ai/sdk@0.100.1` peer-resolution pin. The pi adapter floor is now `@earendil-works/pi-* >=0.80.3 <0.81`, matching the runtime catalog that exposes `claude-sonnet-5`.
+- **Curated Claude surface moves from Sonnet 4.6 to Sonnet 5.** `claude-sonnet-5` replaces `claude-sonnet-4-6` across the ACP provider, demo/default smoke targets, pi target registry, and release docs. The Sonnet-specific 200K cap was removed; Sonnet 5 now surfaces the verified 1M context window like the Opus anchor, with a 1M ceiling guard to prevent silent future inflation.
+- **Release and backend docs are version-neutral where the repo shape is stable.** The README now describes the durable repository shape instead of a point-in-time `0.12.x` state, and the clean-host/demo/verification docs reflect the current pi floor and Sonnet 5 defaults.
+- **Cortex and fresh-spawn planning docs realigned to the 0.12 substrate.** The ACP backend rail documentation and NEXT/ROADMAP planning notes now describe the as-built adapter seam and the mux-visible fresh-sibling lane without re-centering old v1/fat-bridge assumptions.
+
+### Fixed
+
+- **Live ACP smoke timeout cleanup no longer leaves stale timers after PASS.** Raw-turn, overlay, memory-containment, and session-reuse live smokes now clear their timeout handles when the awaited operation wins, so a successful live check exits promptly instead of lingering until the old timeout expires.
+- **Session-reuse live smoke now preserves its success evidence.** The two-turn reuse smoke no longer calls `process.exit(0)` on success, allowing the turn-2/PASS log and cleanup to drain naturally while the retained ACP child is still handled by the backend exit cleanup.
+- **Claude Code meta-bridge install state also disables workflow surfaces.** `enableWorkflows` and `workflowKeywordTriggerEnabled` are now managed false alongside the existing auto-memory, compaction, prompt-suggestion, progress, and auto-mode settings.
+- **Unsupported ACP Codex targets are not advertised.** The target registry keeps Codex on the native `openai-codex` provider only; `entwurf/gpt-5.4` and `entwurf/gpt-5.5` are removed until an ACP Codex backend exists.
+
+### Verification
+
+- `pnpm check` passed on 2026-07-01 after the dependency/model/doc updates; prep log `/tmp/pi-tmux-entwurf-prep-check-0123.log` ended with `EXIT=0`.
+- `LIVE=1 ./run.sh smoke-acp-raw-turn-live` passed with `claude-sonnet-5` and exited promptly after PASS.
+- `LIVE=1 ./run.sh smoke-acp-provider-live` passed with `claude-sonnet-5` through the pi provider path.
+- `LIVE=1 ./run.sh smoke-acp-session-reuse-live` passed with a two-turn reused ACP child; turn 2 recalled the turn-1 codeword from delta-only prompt scope.
+- `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.3.ZcRc8w` passed on 2026-07-01 with `MUST: PASS=17 FAIL=0 SKIP=0` and `BEHAVIOR: PASS=1 FAIL=0`; log `/tmp/pi-tmux-entwurf-release-gate-0123.log`.
+
 ## 0.12.2 — 2026-06-29
 
 ### Fixed

package/README.md

@@ -10,9 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Public, active development.** Real working code, still young. Verify it in your own workflow before relying on it all day. Evidence calibration: [VERIFY.md](./VERIFY.md); native async-delivery capability levels: [DELIVERY.md](./DELIVERY.md).
-
-> **Current state for 0.12.1.** This repo is **entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped through the meta-bridge; pi is shipped through the control-socket adapter; Codex and Antigravity (`agy`) reach the garden with verified delivery probes, documented per launch mode in [DELIVERY.md](./DELIVERY.md), with shipped adapter/install lanes landing after the 0.12.0 doc cut. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped through the meta-bridge; pi is shipped through the control-socket adapter. Codex and Antigravity (`agy`) have verified delivery probes documented per launch mode in [DELIVERY.md](./DELIVERY.md); shipped adapter/install lanes are tracked separately. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
 
 <details>
 <summary>Watch archived pre-0.12 demo (2131×1142 GIF, click to expand)</summary>
@@ -55,7 +53,7 @@ native Claude Code
         → entwurf_self | entwurf_v2 | entwurf_inbox_read
 ```
 
-This meta-bridge installer/doctor is **Claude Code only** in the shipped 0.12.0 surface. Codex and Antigravity delivery probes are recorded in [DELIVERY.md](./DELIVERY.md) as verified adapter evidence, not yet shipped install surfaces.
+This meta-bridge installer/doctor is **Claude Code only** in the current shipped surface. Codex and Antigravity delivery probes are recorded in [DELIVERY.md](./DELIVERY.md) as verified adapter evidence, not yet shipped install surfaces.
 
 > **Direction.** Inverse of [`pi-acp`](https://github.com/svkozak/pi-acp). `pi-acp` lets external ACP clients talk *to* pi; `entwurf` lets garden citizens talk across harness boundaries — with pi as one adapter, not the center.
 
@@ -147,7 +145,7 @@ because Node refuses to strip `.ts` files under `node_modules`.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.80.2 <0.81`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.80.3 <0.81`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash

package/VERIFY.md

@@ -44,7 +44,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 ### Verifying the two capabilities a gate cannot fully judge
 
 - **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for a live/replyable or meta-session target, `owned-outcome` only to wake a dormant record-backed pi citizen. Picking the wrong intent is rejected, never auto-fixed.
-- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-4-6` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
+- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
 
 ### What NOT to do — bypassing the operational path
 
@@ -102,7 +102,7 @@ pi install git:github.com/junghan0611/entwurf          # pi auto-clones + instal
 cd /path/to/consumer-project
 ~/.pi/agent/git/github.com/junghan0611/entwurf/run.sh install .   # wire bundled mcpServers
 pi --list-models entwurf                               # curated model surface
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"   # one-turn smoke
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
 ```
 
 Expected: the package appears under pi's `User packages`; `install .` logs `added entwurfProvider.mcpServers.entwurf-bridge` + `updated <project>/.pi/settings.json`; the smoke returns a one-word reply (full bootstrap → ACP session → bridge → clean shutdown). Note: `~/.pi/agent/git/.../entwurf` is pi-managed — do not edit it (a `pi update` overwrites). Step 2 is still required after `pi install git:…`.
@@ -115,7 +115,7 @@ pnpm install                                   # pnpm is the pinned packageManag
 pi install ./
 ./run.sh install /path/to/consumer-project
 pnpm check                                     # full deterministic floor
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
 LIVE=1 ./run.sh release-gate /path/to/consumer-project
 ```
 
@@ -140,7 +140,7 @@ Compare a fresh self-awareness report across axes: (1) same backend, different i
 
 ## 1A. Main Agent Evaluation — Is `entwurf` Claude strong enough?
 
-Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-4-6` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
+Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-5` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
 
 ### 1A.0 Two carrier surfaces — engraving vs pi-context-augment (load-bearing)
 

package/demo/README.md

@@ -17,7 +17,7 @@ Historical pre-0.12 demo, still linked from the top-level `README.md` as archive
    tools, names the carrier surface for each cited piece of
    information, and admits unknowns instead of fabricating.
 2. **Entwurf surface** — the same pane spawns a sibling via the
-   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-4-6`,
+   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-5`,
    sibling `gpt-5.4`), prints the Session ID, and quotes the sibling's
    one-line reply verbatim.
 
@@ -81,7 +81,7 @@ grep -E '(entwurf|model-switch)' demo/sender-debug.log
 | Var | Default | Meaning |
 |---|---|---|
 | `PEER_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | top pane backend (receives greeting) |
-| `SENDER_MODEL` | `entwurf/claude-sonnet-4-6` (≡ `pias`) | bottom pane backend (drives scenes) |
+| `SENDER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | bottom pane backend (drives scenes) |
 | `SCENE_DELAY` | `25` | seconds to wait for each scene's agent work |
 | `WARMUP` | `3` | seconds to wait for both pi banners |
 | `FINAL_PAUSE` | `5` | extra wait after scene 3 (peer reply lag) |
@@ -93,7 +93,7 @@ grep -E '(entwurf|model-switch)' demo/sender-debug.log
 
 | Var | Default | Meaning |
 |---|---|---|
-| `DRIVER_MODEL` | `entwurf/claude-sonnet-4-6` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
+| `DRIVER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
 | `SIBLING_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | cross-backend sibling spawned in scene 2 |
 | `SIBLING_CWD` | repo root | cwd passed to the entwurf sibling (drives `<project-context>` injection) |
 | `SCENE1_DELAY` | `60` | seconds for the long English baseline answer |
@@ -114,7 +114,7 @@ The demo launch lines correspond to your shell aliases:
 | Alias | Model id | Use as |
 |---|---|---|
 | `piao` | `entwurf/claude-opus-4-8` | `SENDER_MODEL` (precision scenes) |
-| `pias` | `entwurf/claude-sonnet-4-6` | `SENDER_MODEL` (default) |
+| `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
 | `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
 | `piat5` | `entwurf/gpt-5.5` | either |
 | `piag` | `entwurf/gemini-3.1-pro-preview` | either |
@@ -137,7 +137,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.80.2)
+- `pi` on PATH (current floor 0.80.3)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo-baseline.sh

@@ -8,7 +8,7 @@
 #      reply in the same pane (cross-model, mode=sync).
 #
 # Layout (tmux, 220x50):
-#   pane 0 (single) — driven pi (claude-sonnet-4-6) — receives both prompts.
+#   pane 0 (single) — driven pi (claude-sonnet-5) — receives both prompts.
 #
 # Recording: asciinema → baseline.cast → agg → baseline.gif
 
@@ -30,7 +30,7 @@ GIF="$PUBLISH_DIR/entwurf-demo.gif"
 DRIVER_LOG="$OUTDIR/baseline-debug.log"
 
 # Driven pi runs the bridge surface and answers both prompts.
-DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-4-6}   # pias
+DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-5}   # pias
 # Sibling spawned via entwurf in scene 2 — different backend for contrast.
 SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat
 SIBLING_CWD=${SIBLING_CWD:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}

package/demo/demo.sh

@@ -3,7 +3,7 @@
 #
 # Layout (tmux, 220x50):
 #   pane 0 (top)    — peer pi (codex, gpt-5.4)       — idle, waits for greeting
-#   pane 1 (bottom) — sender pi (claude-sonnet-4-6)  — driven by send-keys
+#   pane 1 (bottom) — sender pi (claude-sonnet-5)  — driven by send-keys
 #
 # Scenes (driven into sender pane):
 #   1. Spawn a sonnet sibling, store one fact.
@@ -32,7 +32,7 @@ SENDER_LOG="$OUTDIR/sender-debug.log"
 
 # Models match the user's piat / pias aliases.
 PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat
-SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-4-6}  # pias
+SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-5}  # pias
 
 # Pacing in seconds. Tuned from real runs: each scene's actual agent work
 # completes in ~5–15 s (Scene 1 sibling cold-spawn is the slowest; resume +
@@ -134,7 +134,7 @@ sleep "$WARMUP"
 # window/pane base-index configs.
 drive() {
   # Scene 1 — spawn + memory write
-  tmux send-keys -t "$SENDER_PANE" -l 'Demo scene 1. Spawn a claude-sonnet-4-6 sibling via the entwurf tool. provider: entwurf, model: claude-sonnet-4-6, cwd: /home/junghan/repos/gh/entwurf, mode: sync. Task body: "You are a sibling for a recorded demo. Remember one fact only — my favorite forge color is tempered indigo. Reply with one short sentence acknowledging. No tool calls, no repo exploration." After it returns, print only the Session ID line so I can see it.'
+  tmux send-keys -t "$SENDER_PANE" -l 'Demo scene 1. Spawn a claude-sonnet-5 sibling via the entwurf tool. provider: entwurf, model: claude-sonnet-5, cwd: /home/junghan/repos/gh/entwurf, mode: sync. Task body: "You are a sibling for a recorded demo. Remember one fact only — my favorite forge color is tempered indigo. Reply with one short sentence acknowledging. No tool calls, no repo exploration." After it returns, print only the Session ID line so I can see it.'
   tmux send-keys -t "$SENDER_PANE" Enter
   sleep "$SCENE_DELAY"
 

package/docs/setup-clean-host.md

@@ -30,7 +30,7 @@ ssh cleanhost 'uname -a; whoami; which git node npm pi claude 2>/dev/null'
 | Node | **24** recommended; `>=22.6.0` minimum | `engines.node` (Node strip-types / ESM runtime) |
 | npm | bundled with Node 24 | public package install path |
 | entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf` and `entwurf-bridge` bins |
-| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.2 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
+| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.3 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
 
 ## Stage 0 — Node 24 via nvm
 
@@ -109,7 +109,7 @@ If the host will run pi sessions or the Claude ACP provider through pi, install
 a compatible pi binary separately and wire the target project.
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.80.2
+npm install -g @earendil-works/pi-coding-agent@0.80.3
 pi --version
 
 mkdir -p ~/entwurf-smoke
@@ -126,7 +126,7 @@ Drift points:
   `entwurf-bridge`, and links `~/.pi/agent/entwurf-targets.json` to the package's
   `pi/entwurf-targets.json`.
 - Older pi versions may silently miss the provider/extension surface. Use the
-  pinned floor (`>=0.80.2 <0.81`) for release verification.
+  pinned floor (`>=0.80.3 <0.81`) for release verification.
 - A host that only uses the external MCP bridge can skip this stage until it
   needs `owned-outcome` spawn-bg resume or pi-native control sockets.
 
@@ -157,7 +157,7 @@ source ~/.bashrc
 claude login
 
 cd ~/entwurf-smoke
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
 ```
 
 If the backend CLI fails directly (`claude -p "ping"`), fix that upstream first.
@@ -171,7 +171,7 @@ a raw pi-assigned uuid hard-exits before any model turn.
 
 ```bash
 pi --session-id "$(entwurf new-session-id)" \
-  --entwurf-control --provider entwurf --model claude-sonnet-4-6
+  --entwurf-control --provider entwurf --model claude-sonnet-5
 # control socket: ~/.pi/entwurf-control/<garden-id>.sock
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.2",
+	"version": "0.12.3",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -67,23 +67,23 @@
 	},
 	"packageManager": "pnpm@10.33.0",
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.50.0",
-		"@agentclientprotocol/sdk": "0.29.0",
+		"@agentclientprotocol/claude-agent-acp": "0.54.1",
+		"@agentclientprotocol/sdk": "1.1.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.80.2 <0.81",
-		"@earendil-works/pi-coding-agent": ">=0.80.2 <0.81",
-		"@earendil-works/pi-tui": ">=0.80.2 <0.81",
+		"@earendil-works/pi-ai": ">=0.80.3 <0.81",
+		"@earendil-works/pi-coding-agent": ">=0.80.3 <0.81",
+		"@earendil-works/pi-tui": ">=0.80.3 <0.81",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.80.2",
-		"@earendil-works/pi-coding-agent": "0.80.2",
-		"@earendil-works/pi-tui": "0.80.2",
+		"@earendil-works/pi-ai": "0.80.3",
+		"@earendil-works/pi-coding-agent": "0.80.3",
+		"@earendil-works/pi-tui": "0.80.3",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"typescript": "^6.0.2"

package/pi/entwurf-targets.json

@@ -1,20 +1,17 @@
 {
 	"$comment": "Entwurf Target Registry — exact (provider, model) allowlist. SSOT for what can be spawned via entwurf. See entwurf/AGENTS.md Entwurf Orchestration. Resume path intentionally bypasses this registry per Identity Preservation Rule.",
 	"$notes": {
-		"gpt-5.5": "High-end frontier target with 400K native codex context. Cost: ~$5 input / $30 output per 1M tokens on this tier — ~6x gpt-5.4. Do not make it the default. Use explicitly for long-context / high-quality work only. ACP-routed entries are `explicitOnly`: caller must pass provider=entwurf to route through the ACP bridge, otherwise bare `gpt-5.5` resolves to native openai-codex.",
-		"bareResolution": "Each bare model id resolves unambiguously because only the native openai-codex entry is non-explicitOnly. Bare `gpt-5.5` -> openai-codex/gpt-5.5. ACP route requires explicit provider.",
+		"gpt-5.5": "High-end frontier target with 400K native codex context. Cost: ~$5 input / $30 output per 1M tokens on this tier — ~6x gpt-5.4. Do not make it the default. Use explicitly for long-context / high-quality work only.",
+		"bareResolution": "Each bare Codex model id resolves through the native openai-codex provider. Bare `gpt-5.5` -> openai-codex/gpt-5.5. ACP Codex is not on this surface until the ACP backend is implemented.",
 		"gemini": "Gemini ACP targets are routed exclusively through entwurf's `gemini --acp` backend; the host pi removed its built-in google provider in v0.71.0. ACP entries are `explicitOnly` to keep the entwurf surface honest — there is currently no native pi alternative to disambiguate against, but the flag keeps the policy stable if pi reintroduces a google provider later. 3.1 Pro is the subscription-backed high-quality ACP target. Flash / 2.5 routing through ACP is intentionally not on this surface."
 	},
 	"entwurfTargets": [
-		{ "provider": "entwurf", "model": "claude-sonnet-4-6", "enabled": true },
+		{ "provider": "entwurf", "model": "claude-sonnet-5", "enabled": true },
 		{ "provider": "entwurf", "model": "claude-opus-4-8", "enabled": true },
 
 		{ "provider": "openai-codex", "model": "gpt-5.4", "enabled": true },
 		{ "provider": "openai-codex", "model": "gpt-5.5", "enabled": true },
 
-		{ "provider": "entwurf", "model": "gpt-5.4", "enabled": true, "explicitOnly": true },
-		{ "provider": "entwurf", "model": "gpt-5.5", "enabled": true, "explicitOnly": true },
-
 		{ "provider": "entwurf", "model": "gemini-3.1-pro-preview", "enabled": true, "explicitOnly": true }
 	]
 }

package/pi-extensions/lib/acp/acp-client.ts

@@ -1,5 +1,5 @@
 // ACP client adapter — the ONE place that touches the @agentclientprotocol/sdk
-// 0.29 fluent surface (`client({ name }).connect(stream)`).
+// 1.1 fluent surface (`client({ name }).connect(stream)`).
 //
 // The wire SDK deprecated the `new ClientSideConnection(toClient, stream)`
 // constructor in favour of the fluent `client()` builder. The two have
@@ -52,7 +52,7 @@ export interface AcpClientHandlers {
 }
 
 /**
- * Production factory — wrap the SDK 0.29 fluent `client()` into the
+ * Production factory — wrap the SDK 1.1 fluent `client()` into the
  * `AcpConnectionLike` seam the backend (and the live smokes) drive.
  *
  * Client-side handlers register by ACP method name; agent-side calls go through

package/pi-extensions/lib/acp/models.ts

@@ -50,18 +50,17 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-4-6", "claude-opus-4-8"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-4-8"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-4-8";
 
-// Anthropic's registry reports 1M for Claude 4.6+ models, but the public
-// entwurf surface deliberately distinguishes Sonnet vs Opus: Sonnet stays
-// at 200K, Opus surfaces at 1M. (The 0.11.0 ENTWURF_ACP_CLAUDE_CONTEXT env
-// override is a behavior-oracle nicety deferred past S0 — the loader/fence
-// slice only needs the anchor present and registered.)
+// Anthropic's registry reports 1M for both Sonnet 5 and Opus 4.8, and the
+// entwurf surface now exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// whole point of the 0.12.3 bump — it is the compact-free long-context floor the
+// earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
+// future registry value can't silently inflate the surface past what we verify.
 const CLAUDE_CONTEXT_DEFAULT = 1_000_000;
-const CLAUDE_SONNET_DEFAULT = 200_000;
 
 // `getModels("anthropic")` reads the static builtin model catalog only — no env
 // read, no credential access, no network — preserving the #26 auth-boundary
@@ -79,8 +78,7 @@ function requireRegistryModel(models: readonly RegistryModel[], id: string): Reg
 }
 
 function claudeContextWindow(model: { id: string; contextWindow: number }): number {
-	const cap = model.id === "claude-sonnet-4-6" ? CLAUDE_SONNET_DEFAULT : CLAUDE_CONTEXT_DEFAULT;
-	return Math.min(model.contextWindow, cap);
+	return Math.min(model.contextWindow, CLAUDE_CONTEXT_DEFAULT);
 }
 
 /**

package/run.sh

@@ -2,10 +2,10 @@
 #
 # Model id convention (see AGENTS.md Hard Rule #1):
 #   - User-facing examples use the qualified form `entwurf/<backend-model>`
-#     (e.g. `entwurf/claude-sonnet-4-6`); the prefix routes to this provider
+#     (e.g. `entwurf/claude-sonnet-5`); the prefix routes to this provider
 #     so `--provider` is redundant and is dropped in docs.
 #   - Smoke helpers that feed `ensureBridgeSession({modelId})` directly (cancel,
-#     model-switch) pass BARE backend ids (`claude-sonnet-4-6`, `gpt-5.4`)
+#     model-switch) pass BARE backend ids (`claude-sonnet-5`, `gpt-5.4`)
 #     because the bridge library contract is bare. Smoke helpers that invoke pi
 #     via the CLI still pin `--provider entwurf` and can accept either
 #     bare or qualified model, but we keep bare here to match the bridge-level
@@ -32,7 +32,7 @@ TARGET_PROJECT_DIR=${2:-$PROJECT_DIR_DEFAULT}
 # and install path against the same scope for traceability.
 PACKAGE_NAME="@junghanacs/entwurf"
 # Runtime provider id — DO NOT change. Embedded in model strings
-# (`entwurf/claude-sonnet-4-6`), settings keys (`entwurfProvider`),
+# (`entwurf/claude-sonnet-5`), settings keys (`entwurfProvider`),
 # log prefixes (`[entwurf:bootstrap]`), and the `--provider entwurf`
 # CLI surface. Renaming this would break every consumer transcript and every
 # saved session anchor.
@@ -908,7 +908,7 @@ smoke_acp_raw_turn_live() {
   # plus captured raw NDJSON bytes. NO provider/overlay/streamSimple/_meta — the
   # raw backend pipe only. Launch source must be the package bin (PATH fallback
   # fails acceptance unless ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1, debug).
-  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-raw-turn-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-raw-turn-live.ts)
 }
@@ -926,7 +926,7 @@ smoke_acp_overlay_live() {
   # meta-store for mailbox absence (flaky — concurrent sessions); the honest
   # claim is overlay-supplies-hooks:{}. Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-overlay-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-overlay-live.ts)
 }
@@ -941,7 +941,7 @@ smoke_acp_memory_containment_live() {
   # can stop a memory write is the lever — not us. Fails loud if engraving.md is
   # empty (carrier OFF = no containment). Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-memory-containment-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-memory-containment-live.ts)
 }
@@ -956,7 +956,7 @@ smoke_acp_provider_live() {
   # assistant reply (live model proof) + the removed S0 stub error never appears
   # (provider path actually opened) + pi exits 0. Tool-free prompt; the
   # event-mapper gate owns the tool→notice contract.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-provider-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-provider-live.ts)
 }
@@ -970,7 +970,7 @@ smoke_acp_session_reuse_live() {
   # was reused and the live ACP session kept turn-1 history (a respawn-per-turn
   # backend would forget it). The one-shot exit0 half is owned by
   # smoke-acp-provider-live.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-session-reuse-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-session-reuse-live.ts)
 }
@@ -982,7 +982,7 @@ smoke_acp_carrier_augment_live() {
   # secret (the augment rode the wire to the model) and the EMPTY default carrier
   # must bill clean (exit 0, no HTTP-400 canary — 핀1 live). Optional tiny carrier
   # check via SMOKE_ACP_CARRIER_PRESENT=1 (non-blocking).
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-4-6).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-carrier-augment-live
   (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-carrier-augment-live.ts)
 }
@@ -1040,9 +1040,9 @@ smoke_acp_rgg_live() {
   # surface (plugin stays lightweight, no ambient MCP — S2b/S2d boundary). To
   # observe that boundary directly, run the shared runner with SMOKE_RGG_POSITIVE=1
   # and ENTWURF_LIVE_TARGET set (T3 will report N/A, not a real failure).
-  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-4-6).
+  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-5).
   #   ./run.sh smoke-acp-rgg-live
-  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-4-6}"
+  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-5}"
   (cd "$REPO_DIR" && ENTWURF_LIVE_TARGET="$target" SMOKE_RGG_POSITIVE=0 bash scripts/smoke-resident-garden-guard.sh)
 }
 
@@ -1280,7 +1280,7 @@ assert.equal(peerTui, piAi,
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. Expected
-// shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.80.2 <0.81`).
+// shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.80.3 <0.81`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -1375,7 +1375,7 @@ check_pi_runtime_version() {
   # never statically import a floor-only symbol here, or this guard would crash
   # before it can fail loud.
   (cd "$REPO_DIR" && node --input-type=module <<'EOF'
-const FLOOR = '0.80.2';
+const FLOOR = '0.80.3';
 const cmp = (a, b) => {
   const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
   for (let i = 0; i < 3; i++) { if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0); }
@@ -1393,7 +1393,7 @@ if (typeof VERSION !== 'string') {
   process.exit(1);
 }
 if (cmp(VERSION, FLOOR) < 0) {
-  console.error(`[check-pi-runtime-version] FAIL: pi VERSION ${VERSION} < ${FLOOR} — the bridge is built and tested against the 0.80.2 public/runtime surface (trust exports hasTrustRequiringProjectResources + ProjectTrustStore nearest-ancestor get, the 0.80 model-catalog API getModels reached via the deprecated /compat entrypoint — 0.80 moved the standalone root getModels there, and the extension loader resolves only /compat, NOT the providers/* factory subpath — provider registration surface, compaction semantics) that older pi lacks or behaves differently on. Bump @earendil-works/pi-*.`);
+  console.error(`[check-pi-runtime-version] FAIL: pi VERSION ${VERSION} < ${FLOOR} — the bridge is built and tested against the 0.80.3 public/runtime surface (trust exports hasTrustRequiringProjectResources + ProjectTrustStore nearest-ancestor get, the 0.80 model-catalog API getModels reached via the deprecated /compat entrypoint — 0.80 moved the standalone root getModels there, and the extension loader resolves only /compat, NOT the providers/* factory subpath — provider registration surface, compaction semantics) that older pi lacks or behaves differently on. Bump @earendil-works/pi-*.`);
   process.exit(1);
 }
 console.log(`[check-pi-runtime-version] ok — pi VERSION ${VERSION} >= ${FLOOR}`);
@@ -1536,8 +1536,8 @@ check_acp_provider_surface() {
 
 check_acp_sdk_surface() {
   # Deterministic gate for the S2a ACP SDK dependency surface. Pins the three
-  # ACP runtime deps to the 0.11.0 oracle versions (@agentclientprotocol/sdk
-  # 0.22.1 + claude-agent-acp 0.39.0 + @anthropic-ai/sdk 0.100.1), locks the
+  # ACP runtime deps to the current oracle versions (@agentclientprotocol/sdk
+  # 1.1.0 + claude-agent-acp 0.54.1 + @anthropic-ai/sdk 0.100.1), locks the
   # peer-resolution that keeps claude-agent-sdk satisfiable (0.100.1, not the
   # stale 0.91.1), asserts the wire SDK still value-exports the symbols the raw
   # turn needs (silent-rename gate), and forbids any source-level anthropic SDK
@@ -1946,9 +1946,9 @@ check_pack_install() {
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.80.2" \
-    "@earendil-works/pi-coding-agent@0.80.2" \
-    "@earendil-works/pi-tui@0.80.2" \
+    "@earendil-works/pi-ai@0.80.3" \
+    "@earendil-works/pi-coding-agent@0.80.3" \
+    "@earendil-works/pi-tui@0.80.3" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -2000,14 +2000,14 @@ check_pack_install() {
   # opus anchor (CURATED_ANCHOR_MODEL_ID in lib/acp/models.ts — the model whose
   # absence is a hard registry regression). Checking only one would let half the
   # surface drop silently.
-  for anchor in "claude-sonnet-4-6" "claude-opus-4-8"; do
+  for anchor in "claude-sonnet-5" "claude-opus-4-8"; do
     if ! grep -q "$anchor" <<<"$loader_out"; then
       fail "[check-pack-install] pi loader output missing curated Claude model $anchor:"
       echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
       return 1
     fi
   done
-  echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-4-6 + claude-opus-4-8 anchor)"
+  echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-5 + claude-opus-4-8 anchor)"
 
   # npm-managed neutral install regression — the README's PRIMARY install path is
   # now `npm install @junghanacs/entwurf` (NOT `pi install npm:...`). This layout

package/scripts/check-acp-backend-preflight.ts

@@ -21,7 +21,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
 
-const model = { id: "claude-sonnet-4-6" } as unknown as Model<Api>;
+const model = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 
 // Declared tools exclude `read`, but the Claude child always exposes Read →
 // declared != actual → the preflight must reject before spawning.

package/scripts/check-acp-config.ts

@@ -58,7 +58,7 @@ function settings(name: string, block: unknown): string {
 function resolveWith(globalPath: string, projectPath: string, adapter: AcpBackendAdapter = claudeLikeFake) {
 	return resolveProviderConfig({
 		cwd: root,
-		modelId: "claude-sonnet-4-6",
+		modelId: "claude-sonnet-5",
 		adapter,
 		globalSettingsPath: globalPath,
 		projectSettingsPath: projectPath,
@@ -291,11 +291,11 @@ try {
 			weather: { type: "http", url: "https://w.test" },
 			other: { command: "x" },
 		}).servers;
-		const enriched = enrichMcpServersWithEnvelope(servers, { modelId: "claude-sonnet-4-6", piSessionId: "LIVE-1" });
+		const enriched = enrichMcpServersWithEnvelope(servers, { modelId: "claude-sonnet-5", piSessionId: "LIVE-1" });
 		const bridge = enriched.find((s) => s.name === "entwurf-bridge") as Extract<AcpMcpServer, { command: string }>;
 		const env = Object.fromEntries(bridge.env.map((e) => [e.name, e.value]));
 		assert.equal(env.PI_SESSION_ID, "LIVE-1", "live PI_SESSION_ID wins over the stale operator value");
-		assert.equal(env.PI_AGENT_ID, "entwurf/claude-sonnet-4-6", "PI_AGENT_ID injected from the model id");
+		assert.equal(env.PI_AGENT_ID, "entwurf/claude-sonnet-5", "PI_AGENT_ID injected from the model id");
 		assert.equal(env.FOO, "bar", "operator env preserved");
 		const weather = enriched.find((s) => s.name === "weather");
 		assert.ok(!("env" in (weather ?? {})), "http server not enriched (no env carrier)");

package/scripts/check-acp-event-mapper.ts

@@ -21,7 +21,7 @@ import {
 	finalizeAcpStreamState,
 } from "../pi-extensions/lib/acp/event-mapper.ts";
 
-const IDENTITY = { api: "entwurf", provider: "entwurf", model: "claude-sonnet-4-6" };
+const IDENTITY = { api: "entwurf", provider: "entwurf", model: "claude-sonnet-5" };
 
 // Drive a set of synthetic updates through a fresh mapper and collect every
 // emitted event (push is synchronous; the terminal done drains the queue).

package/scripts/check-acp-provider-surface.ts

@@ -117,7 +117,7 @@ try {
 	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
 	assert.equal(cap.cfg.api, "entwurf", "entry api field drifted");
 	const capIds = (cap.cfg.models ?? []).map((m) => m.id);
-	for (const want of ["claude-sonnet-4-6", CURATED_ANCHOR_MODEL_ID]) {
+	for (const want of ["claude-sonnet-5", CURATED_ANCHOR_MODEL_ID]) {
 		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
 	}
 	assert.equal(typeof cap.cfg.streamSimple, "function", "entry streamSimple must be a function");