@junghanacs/entwurf 0.12.6 → 0.12.7

package/README.md

@@ -10,7 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped through the meta-bridge; pi is shipped through the control-socket adapter. Codex and Antigravity (`agy`) have verified delivery probes documented per launch mode in [DELIVERY.md](./DELIVERY.md); shipped adapter/install lanes are tracked separately. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped as a mailbox-backed meta-session; Antigravity (`agy`) is shipped as a native-push citizen with automatic `PreInvocation` birth, ambient garden-id status, and a managed MCP/permission install surface. Codex has a launch-mode-specific verified delivery probe documented in [DELIVERY.md](./DELIVERY.md), but no managed native-citizen install lane yet. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
 
 <details>
 <summary>Watch archived pre-0.12 demo (2131×1142 GIF, click to expand)</summary>
@@ -25,10 +25,10 @@ Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@jung
 Claude Code / Codex / agy / pi
   → garden id
     → entwurf_v2
-      → control-socket | spawn-bg resume | meta-mailbox
+      → control-socket | spawn-bg resume | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send (including record-less socket-only pi sessions), spawn-bg resume, and meta-mailbox enqueue. The v1 entwurf verbs are gone. Fresh sibling minting and non-Claude ACP backends are deferred lanes.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send (including record-less socket-only pi sessions), spawn-bg resume, meta-mailbox enqueue, and native-push into a live Antigravity conversation. The v1 entwurf verbs are gone. Fresh sibling minting and non-Claude ACP backends are deferred lanes.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -43,17 +43,26 @@ pi --entwurf-control
       → Claude backend under the operator's local auth
 ```
 
-**The meta-bridge reaches beyond ACP transport.** A global `SessionStart` hook registers native Claude Code sessions as **garden-native meta-sessions** with a garden id, a mailbox, and a trusted sender marker. That makes an already-running Claude Code terminal addressable through `entwurf_v2` (the mailbox path), self-identifying through `entwurf_self`, and replyable by garden id — without turning pi into a second harness or importing Claude's transcript.
+**Native bridges reach beyond ACP transport.** A global `SessionStart` hook registers native Claude Code sessions as **garden-native meta-sessions** with a garden id, a mailbox, and a trusted sender marker. That makes an already-running Claude Code terminal addressable through `entwurf_v2` (the mailbox path), self-identifying through `entwurf_self`, and replyable by garden id — without turning pi into a second harness or importing Claude's transcript.
 
 ```text
 native Claude Code
   → SessionStart hook
-    → meta-session <garden-id>
+    → mailbox-backed meta-session <garden-id>
       → entwurf-bridge MCP
         → entwurf_self | entwurf_v2 | entwurf_inbox_read
 ```
 
-This meta-bridge installer/doctor is **Claude Code only** in the current shipped surface. Codex and Antigravity delivery probes are recorded in [DELIVERY.md](./DELIVERY.md) as verified adapter evidence, not yet shipped install surfaces.
+Antigravity uses a separate shipped rail. Its `PreInvocation` hook births or re-attaches the conversation by native `conversationId`, writes a record-backed sender marker, and leaves delivery to the live native LS gRPC route. There is no mailbox or receiver marker on this rail: `entwurf_v2` probes the conversation and direct-injects with native-push.
+
+```text
+native Antigravity / agy
+  → PreInvocation imprint → meta-session <garden-id>
+  → entwurf-bridge MCP sender identity
+  ↔ entwurf_v2 native-push
+```
+
+Claude's `install-meta-bridge` and agy's `install-agy-{bridge,statusline,hooks}` are distinct managed install surfaces because their lifecycle and delivery transports are genuinely different. Codex remains verified probe evidence, not a shipped managed native-citizen lane; see [DELIVERY.md](./DELIVERY.md).
 
 > **Direction.** Inverse of [`pi-acp`](https://github.com/svkozak/pi-acp). `pi-acp` lets external ACP clients talk *to* pi; `entwurf` lets garden citizens talk across harness boundaries — with pi as one adapter, not the center.
 
@@ -68,7 +77,7 @@ This meta-bridge installer/doctor is **Claude Code only** in the current shipped
 A few words that look unusual for a coding tool.
 
 - **Entwurf** (기투, projection-of-self) — sibling sessions with their own runtime boundary. Not "delegate," not "worker," not "sub-agent." Spawn, resume, and live peer messaging are first-class.
-- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted by the `SessionStart` hook). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, or a mailbox-backed native session, so callers discover facts with `entwurf_peers` and deliver with `entwurf_v2` instead of choosing a transport by hand.
+- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted from an authoritative lifecycle hook — Claude `SessionStart`, agy `PreInvocation`). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, a mailbox-backed native session, or a native-push conversation, so callers discover facts with `entwurf_peers` and deliver with `entwurf_v2` instead of choosing a transport by hand.
 - **Engraving** — optional short operator text delivered through each backend's native identity carrier. Not a giant hidden prompt, not a tool catalog.
 - **MCP** — in this repo, MCP is just the transport by which ACP-backed sessions receive pi capabilities that native pi exposes directly as extensions. It is not a general MCP platform. Explicit `entwurfProvider.mcpServers` only; no ambient `~/.mcp.json` scanning, no automatic retrieval. The same `entwurf-bridge` entry can also be wired into another host's MCP catalog (Claude Code, Codex, Antigravity, …) when the operator chooses. `entwurf_self` returns an authoritative pi-session or trusted meta-session identity envelope; `entwurf_v2` can deliver from plain external MCP hosts, but only pi-session and trusted meta-session senders are replyable.
 - **Session persistence** — re-attaches pi to the same remote ACP session. Does not hydrate backend transcripts into pi history.
@@ -80,15 +89,19 @@ A few words that look unusual for a coding tool.
 adapter that hosts the ACP plugin and live control-socket surface, but the base
 install is **not** `pi install npm:...` anymore.
 
-The package exposes three bins:
+The package exposes five bins:
 
-- `entwurf` → `run.sh` (installer, checks, meta-bridge doctor/install)
+- `entwurf` → `run.sh` (installer, checks, native-bridge doctors/installers)
 - `entwurf-bridge` → the MCP stdio launcher (`mcp/entwurf-bridge/start.sh`)
-- `entwurf-statusline` → the Claude Code statusline renderer (`scripts/meta-bridge-statusline.sh`); a stable bin shim so a package upgrade tracks the current version without rewriting Claude settings
+- `entwurf-statusline` → the Claude Code statusline renderer (`scripts/meta-bridge-statusline.sh`)
+- `entwurf-agy-statusline` → the Antigravity garden-id statusline renderer (`scripts/agy-statusline.sh`)
+- `entwurf-agy-imprint` → the Antigravity `PreInvocation` birth/sender hook (`scripts/agy-imprint.sh`)
 
-The bridge does not provide Claude credentials, tokens, or subscription access,
+The bridge/renderers/hook use stable bin names so package upgrades do not bake versioned package-store paths into native-harness settings.
+
+The bridge does not provide backend credentials, tokens, or subscription access,
 and does not bypass any backend auth. Whatever the operator's local `claude` /
-`codex` / pi runtime already trusts is what entwurf can use.
+`codex` / `agy` / pi runtime already trusts is what entwurf can use.
 
 ### From npm — user/global install
 
@@ -188,12 +201,21 @@ raw `.ts` helpers under `node_modules`. If the doctor reports
 `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`, reinstall a current package before
 trusting the floor result.
 
-After upgrading a globally installed package, run `entwurf install-meta-bridge`
-again before trusting native Claude Code sessions. The installed statusline and
-MCP entries use stable bin shims, and the marketplace source uses a version-stable
-operator data dir, but the Claude plugin bundle/cache still has to be
-re-materialized for the new package writer. Existing Claude Code sessions should
-be restarted after reinstall.
+After upgrading a globally installed package, reinstall the native-harness surface you use before trusting it:
+
+```bash
+entwurf install-meta-bridge
+entwurf doctor-meta-bridge
+
+entwurf install-agy-bridge
+entwurf install-agy-statusline
+entwurf install-agy-hooks
+entwurf doctor-agy-bridge
+entwurf doctor-agy-statusline
+entwurf doctor-agy-hooks
+```
+
+The installed entries use stable bin shims, but Claude's plugin bundle/cache still has to be re-materialized and agy's three ownership records must be refreshed by their idempotent installers. Restart existing Claude Code and agy processes after reinstall.
 
 For manual configuration, [`pi/settings.reference.json`](./pi/settings.reference.json)
 shows the pi adapter settings shape, and the external-host examples below show
@@ -273,11 +295,11 @@ Reference shape lives in [`pi/settings.reference.json`](./pi/settings.reference.
 `entwurf-bridge` can also be registered in a separate MCP-aware harness (Claude Code, Codex CLI, Antigravity/`agy`, …). That host does **not** become a pi session and does **not** need to be ACP-backed. There are now two honest cases:
 
 - **plain external MCP host**: no garden meta-record / sender marker. It can call tools, but its sender envelope is external/non-replyable.
-- **garden-native meta-session**: the native `SessionStart` hook minted a garden id and wrote a trusted sender marker. It is not a pi control-socket session, but it **is replyable by garden id**.
+- **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads the target's type (live pi vs. dormant pi vs. Claude Code meta-session, which a bare garden id does not reveal) and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, and drain your mailbox with `entwurf_inbox_read`. Fresh sibling creation from nothing is a deferred lane. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone — the bridge wires only the v2 dispatch surface.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Fresh sibling creation from nothing is a deferred lane. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
-Observed: Claude Code, Codex CLI, and Antigravity CLI all reach garden citizens through this MCP bridge from a plain external host; sync result delivery is the baseline, and a garden-native meta-session is symmetric/replyable over the mailbox once sender identity is proven.
+Observed: Claude Code, Codex CLI, and Antigravity CLI all reach garden citizens through this MCP bridge from a plain external host. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex remains a plain external/probe lane until it has a managed citizen lifecycle.
 
 Prerequisites on the host running the external MCP client:
 
@@ -359,29 +381,27 @@ command = "/absolute/path/to/entwurf/mcp/entwurf-bridge/start.sh"
 
 #### Antigravity CLI (`agy`)
 
-Documented global config path:
+Use the managed install surface rather than editing agy's files by hand:
 
-```text
-~/.gemini/antigravity-cli/mcp_config.json
+```bash
+entwurf install-agy-bridge
+entwurf install-agy-statusline
+entwurf install-agy-hooks
+
+entwurf doctor-agy-bridge
+entwurf doctor-agy-statusline
+entwurf doctor-agy-hooks
 ```
 
-Current runtime-compatible path also observed:
+The three adapters deliberately own different atoms:
 
-```text
-~/.gemini/config/mcp_config.json
-```
+- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus exactly one permission string — `mcp(entwurf-bridge/entwurf_v2)` — in `~/.gemini/antigravity-cli/settings.json`;
+- statusline: the complete `statusLine` subtree pointing at the bare stable bin `entwurf-agy-statusline`;
+- hooks: one named `PreInvocation` hook pointing at the bare stable bin `entwurf-agy-imprint`.
 
-Use the same server entry in either file:
+Unrelated servers, permissions, settings, and hooks are preserved; every adapter has a state-backed honest inverse and refuses symlink-owned SSOTs. The installer never grants broad `command(*)`, `unsandboxed(*)`, or other YOLO policy — those remain operator decisions.
 
-```json
-{
-  "mcpServers": {
-    "entwurf-bridge": {
-      "command": "/absolute/path/to/entwurf/mcp/entwurf-bridge/start.sh"
-    }
-  }
-}
-```
+The **global** MCP config live agy reads is `~/.gemini/config/mcp_config.json`. `~/.gemini/antigravity-cli/mcp_config.json` is not the global MCP root; the bridge installer one-way cleans only a stale entwurf-owned entry there. After the first model invocation, the imprint hook binds the native `conversationId` to a garden id, the statusline shows `🪛 <garden-id> agy`, and sends from that MCP child carry `agentId=meta-session/antigravity` with `replyable:true` only when the record exists and the live native-push probe succeeds.
 
 #### External-host skills and commands
 
@@ -397,6 +417,8 @@ The Claude ACP backend keeps its native model / API / tools; entwurf shapes only
 
 (Codex is *not* an ACP backend here — it reaches the garden natively. Vendor / governed CLIs are a later ACP backend lane.)
 
+Antigravity is also not an ACP backend. It is a native-push citizen: `PreInvocation` supplies birth/sender identity, `entwurf_v2` probes and direct-injects replies into the live conversation, and no mailbox/receiver marker is involved.
+
 Pi is the canonical memory authority (semantic-memory + Denote llmlog); Claude's native memory layer is pinned off.
 
 ## Smoke commands
@@ -404,6 +426,13 @@ Pi is the canonical memory authority (semantic-memory + Denote llmlog); Claude's
 ```bash
 pnpm check                              # full deterministic floor (all check-* gates, incl. check-acp-*)
 ./run.sh check-bridge                   # entwurf-bridge direct MCP smoke (no backend auth)
+./run.sh smoke-agy-install-state        # agy MCP + exact permission ownership (120 checks)
+./run.sh smoke-agy-statusline-state     # agy ambient garden-id install surface (62 checks)
+./run.sh smoke-agy-hooks-state          # agy PreInvocation birth hook (37 checks)
+./run.sh check-agy-sender-identity      # record-backed pid/start-key sender identity (28 checks)
+
+# agy LIVE acceptance — requires an already-running conversation:
+LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 
 # ACP plugin LIVE acceptance — need the operator's local Claude auth/credit:
 LIVE=1 ./run.sh smoke-acp-socket-citizen-live   # turn-free socket citizenship (S1)
@@ -449,9 +478,9 @@ For a real consumer arranging many skills, see [agent-config](https://github.com
 
 ## Entwurf orchestration
 
-**Entwurf is a pi capability with two surfaces.** Native pi exposes it directly as an extension tool; ACP-backed sessions reach the same capability through entwurf's MCP/Unix-socket bridge. The purpose is not to invent a different sub-agent system, but to preserve the same sibling-based model across backends.
+**Entwurf is one dispatch capability with native-pi and MCP surfaces.** Native pi exposes it directly as extension tools; ACP-backed and external native-harness sessions reach it through `entwurf-bridge`. The purpose is not to invent a different sub-agent system, but to preserve the same sibling-based model across harnesses.
 
-A sibling has its own runtime boundary and its own provider/model identity — not a worker, delegate, or sub-agent. Minting a brand-new sibling from nothing is a deferred v2 lane (`spawn-fresh`); today every transport targets an *existing* garden citizen. `entwurf_v2` dispatches over those: it reads the target's liveness as a fact and routes a `fire-and-forget` send (live pi), an `owned-outcome` spawn-bg resume (dormant pi, a real `pi --entwurf-control` child), or a meta-mailbox enqueue (active self-fetch receiver) — under a per-target lock, reporting one honest outcome.
+A sibling has its own runtime boundary and its own provider/model identity — not a worker, delegate, or sub-agent. Minting a brand-new sibling from nothing is a deferred v2 lane (`spawn-fresh`); today every transport targets an *existing* garden citizen. `entwurf_v2` routes from rail-specific liveness + intent: live pi fire-and-forget → control socket; dormant pi owned-outcome → spawn-bg resume; active self-fetch → meta-mailbox; probe-alive agy → native-push. Pi paths use the per-target lock; mailbox/native-push use their own deliverability evidence and remain lock-free.
 
 A two-pane recording covers the surface end-to-end — sibling resume, cross-process MCP dispatch across a different cwd, and a live peer greeting:
 
@@ -464,11 +493,11 @@ A two-pane recording covers the surface end-to-end — sibling resume, cross-pro
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable; garden-native meta-sessions carry a trusted `meta-session` envelope and are replyable by garden id. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling — and is rejected only from non-replyable external senders.
 
-In ACP-backed sessions, agent tools (`entwurf_v2`, `entwurf_peers`, `entwurf_self`, `entwurf_inbox_read`) auto-attach through `entwurf-bridge`; in native pi sessions the same capability is available directly through the extension surface (`entwurf_v2`, `entwurf_peers` tools + `/entwurf-sessions`, `/gnew` commands). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / dormant-resume / Claude-Code-meta-mailbox. Fresh sibling creation from nothing is a deferred lane. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone — replaced by the v2 dispatch surface.) Garden-native operator commands require `--entwurf-control`. The spawn target allowlist is [`pi/entwurf-targets.json`](./pi/entwurf-targets.json).
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes five tools: `entwurf_v2`, `entwurf_peers`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers` tools + `/entwurf-sessions`, `/gnew` commands). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / dormant-resume / Claude-Code-meta-mailbox / Antigravity-native-push. Fresh sibling creation from nothing is a deferred lane. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. The spawn target allowlist is [`pi/entwurf-targets.json`](./pi/entwurf-targets.json).
 
 ### `entwurf_v2` — canonical dispatch verb
 
-`entwurf_v2` / `runEntwurfV2` is the canonical v2 dispatch verb over **existing** garden targets — record-backed citizens plus live socket-only `pi` endpoints (a record-less but live `pi --entwurf-control` peer is a *target*, intentionally **not** an owned citizen). You give a target garden id plus an intent (`fire-and-forget` or `owned-outcome`); one decider reads the target's liveness as a fact (via the `entwurf_peers` fact surface) and picks the transport from a frozen table keyed on **both** the target's state **and** the intent — never on state alone — then reports one outcome under the v2 lock policy (the pi control-socket and spawn-bg paths take a per-target lock; the meta-mailbox path is lock-free but guarded by active-receiver deliverability):
+`entwurf_v2` / `runEntwurfV2` is the canonical v2 dispatch verb over **existing** garden targets — record-backed citizens plus live socket-only `pi` endpoints (a record-less but live `pi --entwurf-control` peer is a *target*, intentionally **not** an owned citizen). You give a target garden id plus an intent (`fire-and-forget` or `owned-outcome`); one decider reads the target's liveness as a fact and picks the transport from a frozen table keyed on **both** the target's state **and** the intent — never on state alone — then reports one outcome under the v2 lock policy. Pi control-socket and spawn-bg paths take a per-target lock; mailbox and native-push are lock-free, with deliverability guarded by their own receiver/probe evidence:
 
 | target state | intent | transport |
 |---|---|---|
@@ -479,10 +508,13 @@ In ACP-backed sessions, agent tools (`entwurf_v2`, `entwurf_peers`, `entwurf_sel
 | active self-fetch receiver | fire-and-forget | meta-mailbox enqueue + doorbell |
 | inactive / terminated self-fetch receiver | fire-and-forget | **reject** (`mailbox-undeliverable` — no `.msg`, no doorbell) |
 | self-fetch | owned-outcome | **reject** (no owned result over a mailbox) |
+| live native-push conversation | fire-and-forget | native-push direct injection |
+| dead / indeterminate native-push conversation | fire-and-forget | **reject** (`native-push-target-dead` / `native-push-probe-indeterminate`) |
+| native-push | owned-outcome | **reject** (`native-push-no-resume-authority`) |
 
-**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is a live pi session, a dormant pi session, or a Claude Code meta-session (they look alike) and routes correctly; *when unsure which transport, use `entwurf_v2`*. This is exactly what prevents an agent from poking a live-socket transport at a Claude Code meta-session that needs the mailbox.
+**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, under a per-target lock, with an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. What it does **not** do is **fresh sibling creation** — minting a brand-new sibling from a provider/model/prompt is a deferred lane (the `dormant pi → spawn-bg resume` row above resumes an *already-identified* citizen, it does not mint a new one). The meta-mailbox row requires an **active** self-fetch receiver; Claude↔Claude / Claude tmux-live transport is a later lane (the contract enum names `tmux-live` but no production path executes it).
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. What it does **not** do is **fresh sibling creation** — minting a brand-new sibling from a provider/model/prompt is a deferred lane (the `dormant pi → spawn-bg resume` row above resumes an *already-identified* citizen, it does not mint one). The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. Claude↔Claude / Claude tmux-live transport is a later lane (the contract enum names `tmux-live` but no production path executes it).
 
 A live pi target is addressed by its **control socket**, so a record-less but live `pi --entwurf-control` session (an operator-greeted peer with no meta-record) is accepted as a `fire-and-forget` control-send target, matching what `entwurf_peers` lists as alive. An `owned-outcome` resume, however, needs a record-backed citizen (its cwd/launch authority); a record-less endpoint is a socket-only fire-and-forget target only — record-less dormant resume is a later lane.
 
@@ -524,7 +556,7 @@ Enforcement (no uuid / back-compat path): a `--entwurf-control` session whose id
 
 The human-greeted 담당자 pattern is first-class: the operator opens a entwurf session in repo B, greets it directly, then passes that `sessionId` to another session, which reaches it via `entwurf_v2`. Resumed citizens and human-opened peers share the same messaging semantics; only how they came to exist differs.
 
-**Mitsein over MCP** (공존) — the cross-harness counterpart. Pi may collaborate with an external interactive coding session (Claude Code, Codex, Antigravity used as a human terminal) without spawning it. A plain external host is one-directional in shape: outbound `pi → external` rides whatever the operator already uses (tmux send-keys, manual paste, any interactive input path), while inbound `external → pi` returns through this bridge's `entwurf_v2`. A garden-native meta-session closes that gap — both sides are addressable by garden id through the mailbox, and `wants_reply` is allowed when the sender marker proves the native session identity, so send/inbox is symmetric. The one remaining asymmetry is the followUp channel: async owned-outcome delivery still needs a pi control socket, which a meta-session does not have. This is still not a second harness — no control daemon and no transcript scraping are introduced; the bridge only fronts the mailbox/dispatch surface.
+**Mitsein over MCP** (공존) — the cross-harness counterpart. Pi may collaborate with an external interactive coding session (Claude Code, Codex, Antigravity used as a human terminal) without spawning it. A plain external host is one-directional in shape: inbound `external → pi` returns through this bridge's `entwurf_v2`, but the host has no reply address. A garden-native native session closes that gap on its own rail: Claude Code through mailbox self-fetch, agy through probe-alive native-push. `wants_reply` is allowed only when the sender marker and rail-specific evidence prove replyability. Async `owned-outcome` still needs a dormant pi citizen with spawn authority; neither mailbox nor native-push has it. This is still not a second harness — no control daemon and no transcript scraping are introduced.
 
 After a session is anchored, entwurf locks its model identity: switches that touch `entwurf` are reverted; native-to-native and pre-turn selection remain free. `ensureBridgeSession` refuses direct reuse-path mismatches before backend handoff.
 

package/VERIFY.md

@@ -1,8 +1,8 @@
 # VERIFY.md
 
-Agent-driven verification guide for `entwurf` (0.12.0 surface).
+Agent-driven verification guide for the current `entwurf` 0.12.x surface.
 
-> **Current surface.** The live release surface is one bundled MCP server, `entwurf-bridge`, exposing four tools: `entwurf_v2`, `entwurf_peers`, `entwurf_self`, `entwurf_inbox_read`. The shipped ACP backend is **Claude**; Codex is pi-native by default (`ENTWURF_ACP_FOR_CODEX=1` opts a Codex target into ACP), and Gemini is a **non-goal/probe** on 0.12 — historical Gemini rows are kept for context, not as a current expectation. The 0.4.x `session-bridge` adapter, the 0.11.0 fat-bridge (`acp-bridge.ts` / `ensureBridgeSession`), and the v1 `entwurf` / `entwurf_resume` / `entwurf_send` verbs are **retired** — rows mentioning them survive in CHANGELOG/git as historical baseline, never as a runnable recipe.
+> **Current surface.** The bundled MCP server, `entwurf-bridge`, exposes five tools: `entwurf_v2`, `entwurf_peers`, `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native` (an explicit/manual fallback for binding an already-running native conversation). The shipped ACP backend is **Claude**. Antigravity (`agy`) is a separate shipped **native-push citizen** lane, not an ACP backend: automatic `PreInvocation` birth + sender identity + live probe/direct injection. Codex is pi-native by default and has native delivery probe evidence; Gemini is a non-goal/historical ACP probe on 0.12. The 0.4.x `session-bridge` adapter, the 0.11.0 fat-bridge (`acp-bridge.ts` / `ensureBridgeSession`), and the v1 `entwurf` / `entwurf_resume` / `entwurf_send` verbs are **retired** — rows mentioning them survive in CHANGELOG/git as historical baseline, never as a runnable recipe.
 
 This is a **working document, not a metrics document**. The deterministic and live gates carry the machine-checkable invariants; this file carries only what a gate cannot judge — the human/agent reading of *whether the bridge is honestly itself*. Where a former manual procedure is now a gate, it is named as a pointer rather than re-spelled as a runnable script.
 
@@ -39,12 +39,15 @@ Verification here is not a benchmark. In production we exchange short turns and
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**.
   - LIVE-gated MUST steps honest-skip when `LIVE!=1`; a real cut needs `LIVE=1` with `SKIP=0`. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
 
-> The authoritative per-cut counts live in BASELINE.md's HISTORY and CHANGELOG/git, not inline here (they drift against `run.sh`). Most recent recorded floor: **2026-06-27 — MUST 17/0/0 + BEHAVIOR 1/0**.
+> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm check`; do not misreport the aggregate gate as live agy evidence.
+>
+> The authoritative per-cut counts live in BASELINE.md's HISTORY and CHANGELOG/git, not inline here (they drift against `run.sh`). Most recent recorded aggregate floor: **2026-06-27 — MUST 17/0/0 + BEHAVIOR 1/0**.
 
 ### Verifying the two capabilities a gate cannot fully judge
 
-- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for a live/replyable or meta-session target, `owned-outcome` only to wake a dormant record-backed pi citizen. Picking the wrong intent is rejected, never auto-fixed.
+- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for live pi, mailbox-backed meta, or native-push targets; `owned-outcome` only to wake a dormant record-backed pi citizen. Picking the wrong intent is rejected, never auto-fixed.
 - **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
+- **agy citizenship:** in a fresh agy conversation, the first `PreInvocation` must yield a garden id, `entwurf_self` must report `agentId=meta-session/antigravity` and `replyable:true` only while the native probe is alive, and a reply to that same garden id must direct-inject into the same conversation. No mailbox/receiver-marker evidence counts on this rail.
 
 ### What NOT to do — bypassing the operational path
 
@@ -92,8 +95,9 @@ The goal is not merely "invoke Claude Code." We want:
 
 1. `pnpm install` — bundles pi (a dev/peer dependency; no separate `pi install` step) and builds the bridge
 2. project wiring → `<project>/.pi/settings.json` `entwurfProvider.mcpServers.entwurf-bridge`
-3. meta-bridge global plugin — only when a native harness (`claude`) is on PATH; a pi-only host skips it cleanly
-4. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
+3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
+4. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
+5. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
 
 ```bash
 git clone https://github.com/junghan0611/entwurf /path/to/entwurf && cd $_
@@ -101,7 +105,7 @@ git clone https://github.com/junghan0611/entwurf /path/to/entwurf && cd $_
 # re-run the SAME command any time to repair a broken install
 ```
 
-Expected tail: `DONE: entwurf setup (pi package + meta-bridge + v2 install smoke) green.` On a host with `claude`, verify the native wiring with `./run.sh doctor-meta-bridge`.
+Expected tail: `DONE: entwurf setup (pi adapter + detected native bridges + v2 install smoke) green.` On a host with `claude`, verify `./run.sh doctor-meta-bridge`. On a host with `agy`, verify all three: `doctor-agy-bridge`, `doctor-agy-statusline`, and `doctor-agy-hooks`. Setup keeps optional-harness failures non-fatal so pi/Claude hosts are not bricked; the doctors are the fail-loud acceptance surface.
 
 The wiring / meta-bridge / smoke steps are internal building blocks of `setup` (`install_local_package`, `scripts/meta-bridge-install.sh`, `validate_entwurf_bridge`) — call `setup`, never the parts. Consumers who `npm install @junghanacs/entwurf` get the obvious npm surface; that path is not the developer concern here.
 
@@ -120,11 +124,11 @@ LIVE=1 ./run.sh release-gate /path/to/consumer-project
 pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
 ```
 
-`setup` runs `pnpm install` + `install` + meta-bridge (native harness) + the v2 install smoke; a green `setup` implies the settings.json wiring and install surface are healthy. The full live floor is still `LIVE=1 ./run.sh release-gate`.
+`setup` runs `pnpm install` + project/user-scope install + detected native-harness wiring (Claude and/or agy) + the v2 install smoke. A green setup proves the required core path and reports optional-harness degradation; it does **not** replace the native-harness doctors. The full aggregate live floor is still `LIVE=1 ./run.sh release-gate`, with agy's conversation-id-gated round trip verified separately.
 
 ### 1.4 Cross-install / cross-backend parity (optional, high-value)
 
-Compare a fresh self-awareness report across axes: (1) same backend, different install path — answer must be path-invariant; (2) same backend, different machine — identical native tool list + MCP server/tool set; (3) different backend, same bridge — same harness id (`entwurf`) and MCP surface but **different** native tool surface (a Claude session reporting `apply_patch` as native, or normalized cross-backend tools, is a fail); (4) native pi routing vs ACP-bridged, same model — the native target reports **no `entwurf-bridge` MCP** (capability via pi's extension surface) while the ACP target reports it as the single MCP server. Honest "native: I cannot tell" hedging is PASS on the native side. Status: Claude axes 1–4 closed; Gemini is probe-only on 0.12.
+Compare a fresh self-awareness report across axes: (1) same backend, different install path — answer must be path-invariant; (2) same backend, different machine — identical native tool list + MCP server/tool set; (3) different backend, same bridge — same garden capability but **different** native tool surface (a Claude session reporting another backend's native tools is a fail); (4) native pi routing vs ACP-bridged, same model — the native target reports no `entwurf-bridge` MCP (capability via pi's extension surface), while the ACP target reports it as the single MCP server. Honest "native: I cannot tell" hedging is PASS on the native side. Claude axes 1–4 are closed. agy is graded by the separate native-citizen checklist above, not by pretending it has Claude's ACP overlay. Gemini remains probe-only on 0.12.
 
 ---
 
@@ -147,7 +151,7 @@ Pass (carrier honesty): the subject distinguishes engraving from pi-context-augm
 
 - **Layer 0 — self-awareness:** ask environment self-awareness / MCP visibility / upstream-instruction awareness, guessing prohibited. Pass: recognizes native tool family, says "I don't know" honestly, answers MCP visibility only as configured, describes upstream instruction type without reproducing internal prompts. Fail: claims a nonexistent tool, conflates pi-custom and native tools, hallucinates MCP visibility, or conflates the two carriers (§1A.0).
 - **Layer 1 — native tool use:** throw file-reading / structure-analysis / regression-hunting tasks. Pass: Read/Edit/Bash/Grep/Glob selection is natural; no detour through MCP or recursive `pi`. Fail: strange detours for simple reads; speaks from memory without reading.
-- **Layer 2 — MCP boundary:** by default the four v2 MCP tools are not visible (they appear only when `entwurf-bridge` is registered). Pass: says invisible tools are not visible; explains the native-vs-MCP boundary. Fail: pretends to use an unseen tool; mimics entwurf via recursive `pi`.
+- **Layer 2 — MCP boundary:** by default the five entwurf MCP tools are not visible (they appear only when `entwurf-bridge` is registered). Pass: says invisible tools are not visible; explains the native-vs-MCP boundary; treats `entwurf_register_native` as binding an already-running conversation, never as fresh spawn. Fail: pretends to use an unseen tool; mimics entwurf via recursive `pi`.
 - **Layer 3 — focus across turns:** inject a fact, then accumulate turns mixing retrieval/exploration. Pass (post-0.4.1): after **8 turns** holds **3+ early facts** incl. **one verbatim string injected before turn 5**; no repeated exploration, no self-contradiction, no tool-strategy drift. Fail: forgets early reads; paraphrases instead of returning the verbatim string. Note: entwurf exposes no user-facing compaction; use the backend's `usage_update` footer as an overflow-risk signal (it follows the ACP backend's `used/size`, not pi's visible-transcript estimate).
 - **Layer 4 — vs direct Claude Code:** requires a verifier holding **both** the `entwurf` and a direct path (human-in-loop, or both transport handles). Compare latency / native tool accuracy / detours / boundary confusion / quality around turns 10–15. Repeated tool confusion, long-turn forgetting, or boundary workarounds are a fail.
 
@@ -215,10 +219,11 @@ The minimum passing bar:
 
 1. **Deterministic floor green:** `pnpm check` passes (lint + typecheck + the `check-*` gate set + `check-pack`).
 2. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir>` reports `MUST PASS=N FAIL=0 SKIP=0`; a BEHAVIOR FAIL is advisory, not blocking.
-3. **Honest self-recognition:** the bridged model identifies the harness as `entwurf`, names its backend, lists `entwurf-bridge` as the single MCP server with its four v2 tools, and presents a **backend-native** (not normalized) tool surface.
+3. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its five current tools, and presents a backend-native (not normalized) tool surface.
 4. **Carrier separation honored:** engraving vs pi-context-augment kept distinct (§1A.0); no bridge-identity narrative attributed to the engraving carrier.
-5. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
-6. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
+5. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
+6. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
+7. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
 
 Passing establishes a **release verification floor**, not an 8-hour/day operational guarantee. The floor says: gates hold, the agent honestly recognizes its environment, no tool surface is normalized away, no identity leaks, no orphans. It does **not** say a real-day workload (50–100+ turns, tool bursts, partial MCP failures, auth/version drift) survives — that needs L3–L5 evidence (appendix).
 

package/docs/setup-clean-host.md

@@ -4,11 +4,12 @@ End-to-end install of **entwurf** on a host with only `git` available — no
 node, no npm package, no pi binary, no dotfiles. The point is to validate the
 public install surface as an outside user would experience it.
 
-> **Scope.** This is the entwurf 0.12.5 install recipe. The base package install
-> is **neutral npm**, not `pi install npm:...`. Pi is an optional adapter lane for
-> the ACP provider / control-socket runtime. The 0.12.5 floor fix is explicitly
-> covered here: installed packages under `node_modules` must not run raw `.ts`
-> bridge, doctor, or plugin-hook helpers through Node strip-types.
+> **Scope.** This is the current entwurf 0.12.x install recipe, including the
+> 0.12.7 Antigravity (`agy`) citizen surface. The base package install is
+> **neutral npm**, not `pi install npm:...`. Pi is an optional adapter lane for
+> the ACP provider / control-socket runtime. Installed packages under
+> `node_modules` must not run raw `.ts` bridge, doctor, or native-hook helpers
+> through Node strip-types.
 
 `entwurf` is a garden-citizen dispatch substrate and meta-bridge. It does not
 provide, copy, or mediate backend credentials — it lets the official backend CLI
@@ -21,7 +22,7 @@ Written against a clean Ubuntu / Debian / macOS host reachable via SSH, here
 called `cleanhost`. `nvm` keeps the path identical across them.
 
 ```bash
-ssh cleanhost 'uname -a; whoami; which git node npm pi claude 2>/dev/null'
+ssh cleanhost 'uname -a; whoami; which git node npm pi claude agy 2>/dev/null'
 # expect on a fully clean host: git present, node/npm/pi/claude absent
 ```
 
@@ -31,8 +32,9 @@ ssh cleanhost 'uname -a; whoami; which git node npm pi claude 2>/dev/null'
 |---|---|---|
 | Node | **24** recommended; `>=22.6.0` minimum | `engines.node` (Node strip-types / ESM runtime) |
 | npm | bundled with Node 24 | public package install path |
-| entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf`, `entwurf-bridge`, and `entwurf-statusline` bins |
+| entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf`, `entwurf-bridge`, `entwurf-statusline`, `entwurf-agy-statusline`, and `entwurf-agy-imprint` bins |
 | pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.3 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
+| Antigravity `agy` | **optional**, operator-installed/authenticated native CLI | needed only for the shipped native-push citizen lane; entwurf never moves its auth |
 
 ## Stage 0 — Node 24 via nvm
 
@@ -65,6 +67,8 @@ npm install -g @junghanacs/entwurf
 which entwurf
 which entwurf-bridge
 which entwurf-statusline
+which entwurf-agy-statusline
+which entwurf-agy-imprint
 entwurf --help | head -5
 ```
 
@@ -78,11 +82,12 @@ Prove the installed MCP server answers `tools/list` from inside `node_modules`.
 This is the first `node_modules` strip-types regression fixed in 0.12.0: Node
 refuses `--experimental-strip-types` for `.ts` under `node_modules`, so the
 installed package must boot the prebuilt JS under `mcp/entwurf-bridge/dist/`.
-The same installed-vs-dev split then closes the other two `.ts`-at-runtime
-surfaces on that same fence: the `doctor-meta-bridge` store-scan helper (0.12.4)
-and the plugin `SessionStart`/`UserPromptSubmit` hook (0.12.5, runs the compiled
-`dist/pi-extensions/meta-bridge-hook.js` when installed). Installed packages run
-tsc-emitted JS on every one of these; dev clones keep the `.ts` source.
+The same installed-vs-dev split closes every shipped `.ts`-at-runtime surface on
+that fence: the `doctor-meta-bridge` store-scan helper (0.12.4), the Claude plugin
+hook (0.12.5, compiled `dist/pi-extensions/meta-bridge-hook.js`), and the agy
+`PreInvocation` imprint (0.12.7, compiled `dist/scripts/agy-imprint.js`). Installed
+packages run tsc-emitted JS on these paths; dev clones keep transparent `.ts`
+source execution.
 
 ```bash
 node --input-type=module <<'JS'
@@ -96,7 +101,7 @@ child.stdout.on('data', d => {
   try {
     const msg = JSON.parse(out.trim());
     const names = (msg.result?.tools ?? []).map(t => t.name).sort();
-    for (const n of ['entwurf_v2','entwurf_peers','entwurf_self','entwurf_inbox_read']) {
+    for (const n of ['entwurf_v2','entwurf_peers','entwurf_self','entwurf_inbox_read','entwurf_register_native']) {
       if (!names.includes(n)) throw new Error(`missing ${n}: ${names.join(',')}`);
     }
     clearTimeout(timer);
@@ -108,8 +113,9 @@ child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }
 JS
 ```
 
-Expected: a comma-separated tool list containing all four `entwurf_*` tools,
-exit code 0, no backend auth required.
+Expected: a comma-separated tool list containing all five current `entwurf_*`
+tools, exit code 0, no backend auth required. `entwurf_register_native` binds an
+already-running native conversation; it is not a fresh-spawn verb.
 
 ## Stage 3 — wire a project for the pi adapter / ACP plugin (optional)
 
@@ -178,7 +184,54 @@ A plain external MCP host can call tools but is non-replyable. A garden-native
 meta-session has a garden id, a mailbox, and a trusted sender marker; it can call
 `entwurf_self`, receive mailbox wakeups, and be replied to by garden id.
 
-## Stage 5 — backend auth and live runtime smoke
+## Stage 5 — Antigravity native citizen (optional)
+
+If `agy` is already installed and authenticated by the operator, wire the three
+separate ownership atoms. Entwurf does not install agy or copy its auth.
+
+```bash
+which agy
+
+entwurf install-agy-bridge
+entwurf install-agy-statusline
+entwurf install-agy-hooks
+
+entwurf doctor-agy-bridge
+entwurf doctor-agy-statusline
+entwurf doctor-agy-hooks
+```
+
+What these commands own:
+
+- `install-agy-bridge`: one MCP server in `~/.gemini/config/mcp_config.json`
+  and exactly `mcp(entwurf-bridge/entwurf_v2)` in
+  `~/.gemini/antigravity-cli/settings.json`'s permission allow-list;
+- `install-agy-statusline`: the `statusLine` subtree only, pointing at
+  `entwurf-agy-statusline`;
+- `install-agy-hooks`: one named plugin `PreInvocation` hook pointing at
+  `entwurf-agy-imprint`.
+
+They preserve unrelated user state, record independent install-state under
+`$XDG_DATA_HOME/entwurf/`, and refuse symlink-owned config instead of writing
+through someone else's SSOT. Broad YOLO rules such as `command(*)` and
+`unsandboxed(*)` are operator policy and are never granted by this package.
+
+Restart agy, open a **fresh conversation**, and make one model invocation. The
+hook's first `PreInvocation` births/attaches the conversation by native
+`conversationId`; after that, the statusline should show `🪛 <garden-id> agy`.
+Verify:
+
+1. `entwurf_self` reports that gid with `agentId=meta-session/antigravity` and
+   `replyable:true` while the native route probes alive;
+2. an `entwurf_v2` send from agy reaches a sibling with that sender gid;
+3. a sibling's `entwurf_v2(..., intent=fire-and-forget)` reply to the same gid
+   direct-injects into the same agy conversation.
+
+This rail has no mailbox/receiver marker and no `owned-outcome` authority.
+Same-pid concurrent conversation invocation is not supported; separate agy
+processes have separate pid/start-key sender markers.
+
+## Stage 6 — backend auth and live ACP runtime smoke
 
 Backend authentication is the operator's responsibility and lives entirely
 outside entwurf. For the Claude ACP lane:
@@ -196,7 +249,7 @@ pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
 If the backend CLI fails directly (`claude -p "ping"`), fix that upstream first.
 `entwurf` surfaces missing auth; it does not repair it.
 
-## Stage 6 — garden/control-socket surface (optional)
+## Stage 7 — garden/control-socket surface (optional)
 
 To address a long-lived pi session from another session or an external MCP host,
 open it with `--entwurf-control`. A garden-native `--session-id` is required —
@@ -210,7 +263,8 @@ pi --session-id "$(entwurf new-session-id)" \
 
 Use `entwurf_peers` to discover citizens and `entwurf_v2` to deliver by garden
 id. Do not choose the transport by hand: the same-looking id may name a live pi
-socket, a dormant pi record, or a mailbox-backed native session.
+socket, a dormant pi record, a mailbox-backed Claude session, or a native-push
+Antigravity conversation.
 
 ## Teardown
 
@@ -218,8 +272,11 @@ socket, a dormant pi record, or a mailbox-backed native session.
 # project wiring
 rm -rf ~/entwurf-smoke/.pi
 
-# meta-bridge plugin (if installed)
+# native-harness surfaces (if installed)
 entwurf uninstall-meta-bridge 2>/dev/null || true
+entwurf uninstall-agy-hooks 2>/dev/null || true
+entwurf uninstall-agy-statusline 2>/dev/null || true
+entwurf uninstall-agy-bridge 2>/dev/null || true
 
 # package and optional pi binary
 npm uninstall -g @junghanacs/entwurf
@@ -231,6 +288,7 @@ rm -rf ~/.nvm
 ```
 
 This walk-through is a verification floor underneath release cuts: neutral npm
-install, installed bridge boot, optional pi adapter registration, and at least
-one authenticated runtime smoke when cutting a live release. GLG owns the
-publish/tag decision.
+install, installed bridge boot, optional pi adapter registration, Claude
+meta-bridge verification where used, all three agy doctors plus a fresh native
+round trip where used, and at least one authenticated ACP runtime smoke. GLG owns
+the publish/tag decision.