@junghanacs/entwurf 0.12.6 → 0.12.7

package/scripts/smoke-agy-native-push-live.ts

@@ -0,0 +1,243 @@
+/**
+ * smoke-agy-native-push-live — the 봉인 8 LIVE acceptance gate for the native-push (agy /
+ * Antigravity) delivery rail. It drives the PRODUCTION code path — the real antigravity
+ * adapter (pgrep/ss/`agentapi get-conversation-metadata`+`send-message`), the register core,
+ * and `runEntwurfV2` with production deps — against a REAL, already-running agy conversation,
+ * and asserts the rail end to end: probe finds the volatile route, register create/re-attach is
+ * idempotent, a fire-and-forget dispatches over native-push (delivered), an owned-outcome is
+ * rejected (no resume authority), and a bogus conversation is rejected (probe-indeterminate).
+ *
+ * This automates what the GPT manual L1~L5 pass proved by hand (register create/attach, v2
+ * native-push delivered ×2, owned reject, mailbox/marker/pi-domain non-intrusion) — same
+ * production MCP surface, now a repeatable gate.
+ *
+ * STORE ISOLATION (페블-approved): only the agy CONVERSATION round-trip is real (that is the
+ * LIVE essence). The meta-record register + v2 write to a TEMP store via the production
+ * dir-resolution env (`ENTWURF_META_SESSIONS_DIR` → `defaultMetaSessionsDir()`) + explicit
+ * `sessionsDir`/`mailboxDir`/`lockDir` opts — NO test-only fork in the register/decider code,
+ * just the natural env/opt seam. The temp store is removed in `finally`, so no real-store
+ * meta-record residue is ever left (this structurally closes NEXT ⑥'s "leftover meta-record"
+ * class; the one pre-existing record 20260704T201811-071ba8 is a separate one-shot prune).
+ *
+ * REQUIRES `AGY_CONVERSATION_ID` — a live agy conversation the operator points at (the proven
+ * L1~L5 path). Optional `AGY_BIN`, `AGY_SMOKE_CWD` (a scratch cwd to record; default a temp).
+ *   LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+ * Honest SKIP when LIVE!=1 (touches a real agy → out of `pnpm check`).
+ *
+ * SEQUENCING: the doctor-static preflight runs FIRST — before ③ (agent-config drops the agy
+ * mcp_config symlink so install-agy-bridge records the bare `entwurf-bridge`) the agy config
+ * still points at a dangling path, so this smoke honestly FAILs at preflight. That is the gate:
+ * the canonical run lands only after ③ wires the bridge. (The deterministic non-LIVE checks —
+ * SKIP, typecheck, and an isolated preflight-FAIL via AGY_MCP_CONFIG — validate the scaffold now.)
+ *
+ * CANONICAL-GATED (deferred to the post-③ live run, marked honestly rather than faked here):
+ *   - a smoke-OWNED agy launched via tmux + conversationId extraction (so `AGY_CONVERSATION_ID`
+ *     could be optional) — v1 requires the operator's conversation instead of killing theirs;
+ *   - the `native-push-target-dead` reject (needs the agy process ABSENT — i.e. a smoke-owned
+ *     agy we may kill; v1 covers the sibling `native-push-probe-indeterminate` instead, which
+ *     needs only a bogus conv while agy is alive);
+ *   - full CONTENT receipt (that the delivered text is visible IN the conversation transcript) —
+ *     v1 asserts delivery via the production send + a post-send liveness re-probe (D7 partial,
+ *     matching DELIVERY.md's honest label); the manual tmux capture-pane observation stands as
+ *     the D7 evidence until an `agentapi`-level transcript read is wired.
+ */
+
+import { spawnSync } from "node:child_process";
+import * as fsp from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { SenderEnvelope } from "../pi-extensions/lib/entwurf-control-rpc.ts";
+import { makeProductionEntwurfV2Deps } from "../pi-extensions/lib/entwurf-v2-production.ts";
+import type { EntwurfV2RunResult } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import { upsertMetaSession } from "../pi-extensions/lib/meta-session.ts";
+import { antigravityAdapter } from "../pi-extensions/lib/native-push/adapter.ts";
+import { registerNativeConversation } from "../pi-extensions/lib/native-push/register.ts";
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+let passed = 0;
+const artifacts: Record<string, string> = {};
+
+function ok(label: string, cond: boolean): void {
+	if (!cond) throw new Error(`SMOKE FAIL: ${label}`);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+function smokeSender(gardenId: string, cwd: string): SenderEnvelope {
+	return {
+		sessionId: gardenId,
+		agentId: "smoke/agy-native-push-live",
+		cwd,
+		timestamp: new Date(0).toISOString(),
+		origin: "pi-session",
+		replyable: false,
+	};
+}
+
+async function main(): Promise<void> {
+	if (process.env.LIVE !== "1") {
+		console.log(
+			"[smoke-agy-native-push-live] skipped — set LIVE=1 (+ AGY_CONVERSATION_ID) to run (sends into a real agy conversation).",
+		);
+		return;
+	}
+
+	// ── doctor-static preflight (runs FIRST; a dangling agy config FAILs here — the ③ gate) ──
+	// Uses the SAME env the operator set (AGY_MCP_CONFIG[_ALT] pin the candidates), so an
+	// isolated dangling config reproduces the FAIL deterministically without touching real agy.
+	const doctor = spawnSync("bash", [path.join(REPO_ROOT, "run.sh"), "doctor-agy-bridge"], {
+		encoding: "utf8",
+		env: process.env,
+	});
+	if (doctor.status !== 0) {
+		console.error("[smoke-agy-native-push-live] doctor-static preflight FAILED — the agy bridge is not wired.");
+		console.error("  This is expected before ③ (agent-config drops the mcp_config symlink so install-agy-bridge");
+		console.error("  can record the bare `entwurf-bridge`). Wire it, then re-run. doctor output:");
+		console.error((doctor.stdout ?? "").replace(/^/gm, "    "));
+		console.error((doctor.stderr ?? "").replace(/^/gm, "    "));
+		throw new Error("smoke-agy-native-push-live: doctor-static preflight FAILED (agy bridge not wired — see above).");
+	}
+	console.log("  ok    doctor-static preflight PASS (agy bridge wired)");
+	passed++;
+
+	const conversationId = process.env.AGY_CONVERSATION_ID?.trim();
+	if (!conversationId) {
+		throw new Error(
+			"smoke-agy-native-push-live: AGY_CONVERSATION_ID is required — point it at a LIVE agy conversation " +
+				"(open agy, take its conversationId). A smoke-owned agy launch is a canonical follow-up.",
+		);
+	}
+	artifacts["conversationId"] = conversationId;
+
+	// ── temp world: the meta-record store is isolated; only the agy round-trip is real ──
+	const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "agy-np-"));
+	const sessionsDir = path.join(tmp, "meta-sessions");
+	const mailboxDir = path.join(tmp, "mailbox");
+	const lockDir = path.join(tmp, "locks");
+	const controlDir = path.join(tmp, "control"); // native-push never touches it; kept off the real dir for hygiene
+	for (const d of [sessionsDir, mailboxDir, lockDir, controlDir]) await fsp.mkdir(d, { recursive: true });
+	process.env.ENTWURF_META_SESSIONS_DIR = sessionsDir;
+	process.env.ENTWURF_META_MAILBOX_DIR = mailboxDir;
+	const recordCwd = process.env.AGY_SMOKE_CWD?.trim() || tmp;
+	let succeeded = false;
+
+	try {
+		// ── 1. probe the REAL conversation directly (route diagnostics; proves the live host) ──
+		const probe = await antigravityAdapter.probe(conversationId);
+		if (probe.status === "alive") {
+			artifacts["route"] = probe.route.lsAddress;
+			console.log(`  ..    probe: alive via ${probe.route.lsAddress}`);
+		} else {
+			artifacts["probe"] = `${probe.status}: ${probe.reason}`;
+		}
+		ok("probe finds the conversation LIVE (agy host + LS port serve it)", probe.status === "alive");
+
+		// ── 2. register create → gardenId; re-register → attach the SAME gardenId (idempotent) ──
+		const reg1 = await registerNativeConversation(
+			{ backend: "antigravity", nativeSessionId: conversationId, cwd: recordCwd },
+			{ sessionsDir },
+		);
+		artifacts["gardenId"] = reg1.gardenId;
+		ok("register create: new garden citizen minted", reg1.action === "create");
+		ok("register create: backend is antigravity", reg1.backend === "antigravity");
+		const reg2 = await registerNativeConversation(
+			{ backend: "antigravity", nativeSessionId: conversationId, cwd: recordCwd },
+			{ sessionsDir },
+		);
+		ok("re-register: attaches (does not duplicate)", reg2.action === "attach");
+		ok("re-register: same gardenId (idempotent identity)", reg2.gardenId === reg1.gardenId);
+
+		// ── production v2 deps: the REAL native-push adapter drives decide-probe AND executor send ──
+		const prodDeps = makeProductionEntwurfV2Deps({
+			senderProvider: () => smokeSender(reg1.gardenId, recordCwd),
+			sessionsDir,
+			mailboxDir,
+			lockDir,
+			controlSocketDir: controlDir,
+		});
+
+		// ── 3. fire-and-forget → native-push delivered (production send into the live conv) ──
+		const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`;
+		artifacts["nonce"] = nonce;
+		const fire: EntwurfV2RunResult = await runEntwurfV2(
+			{
+				target: reg1.gardenId,
+				intent: "fire-and-forget",
+				message: `[entwurf smoke-agy-native-push-live] delivery probe ${nonce} — no reply needed.`,
+			},
+			prodDeps,
+		);
+		ok(
+			"fire-and-forget executed over native-push (delivered)",
+			fire.kind === "executed" && fire.transport === "native-push",
+		);
+		if (fire.kind === "executed" && fire.outcome.transport === "native-push") {
+			ok(
+				"native-push delivery is lock-free/first-try (retried flag present)",
+				typeof fire.outcome.retried === "boolean",
+			);
+		}
+
+		// ── 4. receipt (D7 partial): re-probe shows the target still reachable post-send ──
+		// Full CONTENT receipt (the text visible in the transcript) is the canonical follow-up —
+		// here we assert the delivery target stayed live through the send, matching DELIVERY.md's
+		// honest D7-partial label (the manual capture-pane observation is the standing D7 evidence).
+		const post = await antigravityAdapter.probe(conversationId);
+		ok("post-send re-probe still alive (delivery target reachable, D7 partial)", post.status === "alive");
+
+		// ── 5. owned-outcome → rejected: a native-push backend has no resume authority ──
+		const owned: EntwurfV2RunResult = await runEntwurfV2(
+			{ target: reg1.gardenId, intent: "owned-outcome", message: "should be rejected" },
+			prodDeps,
+		);
+		ok(
+			"owned-outcome rejected as native-push-no-resume-authority",
+			owned.kind === "rejected" && owned.receipt.reason === "native-push-no-resume-authority",
+		);
+		ok(
+			"owned reject stamped observedLiveness (post-probe, non-null)",
+			owned.kind === "rejected" && owned.receipt.observedLiveness !== null,
+		);
+
+		// ── 6. bogus conversation → rejected native-push-probe-indeterminate ──
+		// agy is alive but no LS port serves this fabricated conv id → INDETERMINATE (never coerced
+		// to dead). A meta-record is upserted DIRECTLY (register would refuse a non-live probe), so
+		// the decider/executor still run the production path over a real (indeterminate) probe.
+		const bogusConv = `entwurf-smoke-bogus-${nonce}`;
+		const bogus = upsertMetaSession({
+			input: { backend: "antigravity", nativeSessionId: bogusConv, cwd: recordCwd, model: null, transcriptPath: null },
+			dir: sessionsDir,
+		});
+		const indeterminate: EntwurfV2RunResult = await runEntwurfV2(
+			{ target: bogus.record.gardenId, intent: "fire-and-forget", message: "into the void" },
+			prodDeps,
+		);
+		ok(
+			"bogus-conv fire rejected as native-push-probe-indeterminate (agy live, no port serves it)",
+			indeterminate.kind === "rejected" && indeterminate.receipt.reason === "native-push-probe-indeterminate",
+		);
+		ok(
+			"indeterminate reject stamped observedLiveness=indeterminate",
+			indeterminate.kind === "rejected" && indeterminate.receipt.observedLiveness === "indeterminate",
+		);
+
+		succeeded = true;
+		console.log(`\nsmoke-agy-native-push-live: ${passed} checks passed (real agy round-trip; isolated meta-store)`);
+	} catch (err) {
+		console.error("\n[smoke-agy-native-push-live] FAILED — diagnostic artifacts:");
+		for (const [k, v] of Object.entries(artifacts)) console.error(`  ${k} = ${v}`);
+		throw err;
+	} finally {
+		// Remove the ENTIRE temp meta-store — no real-store residue (NEXT ⑥ structural close).
+		await fsp.rm(tmp, { recursive: true, force: true }).catch(() => {});
+		if (!succeeded) console.error(`[smoke-agy-native-push-live] (temp store ${tmp} removed)`);
+	}
+}
+
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});

package/scripts/smoke-agy-statusline-state.sh

@@ -0,0 +1,300 @@
+#!/usr/bin/env bash
+# smoke-agy-statusline-state — regression gate for the agy statusLine install adapter (#46 Task
+# 1). Runs install → doctor → uninstall in an ISOLATED HOME + XDG_DATA_HOME with a fake stable
+# bin (entwurf-agy-statusline) + fake `pgrep` (no real ~/.gemini, no real agy). Asserts:
+#   - adopt a regular file: statusLine subtree OWNED WHOLE ({type:custom, command:bare bin,
+#     enabled:true}), UNRELATED settings keys (model/permissions/…) preserved, state written with
+#     the STABLE command (never a repo/checkout path), prior subtree captured as preimage.
+#   - doctor STATIC clean + LIVE SKIP with no agy; LIVE consistent (not overclaimed) with a fake agy.
+#   - state-drift (state present, statusLine changed away OR removed from existing settings) → doctor FAILS.
+#   - uninstall honest-inverse: statusLine preimage restored, unrelated keys survive, state removed.
+#   - SYMLINK target → install REFUSES + writes NO state (someone else's SSOT).
+#   - DANGLING SYMLINK (departed owner) → install REFUSES the same, NO state, link left intact.
+#   - DANGLING command (bin not on PATH) → doctor FAILS (the stable-bin resolvability gate).
+#   - NOT-OURS (statusLine still the prior/agent-config command, no state) → doctor is an honest
+#     "never installed" note, NOT a pass-in-disguise and NOT a hard fail.
+#   - CREATE-NEW → uninstall removes the file it created.
+#   - SETUP INTEGRATION: the wire-agy-statusline wrapper — agy absent → honest skip + NO state;
+#     agy present + regular → idempotent install + state; agy present + symlink/corrupt →
+#     NON-FATAL WARN + continue (exit 0, reason-specific, no clobber, no state).
+#   - checkout stays byte-identical (nothing written under $REPO).
+# Offline + deterministic (deps: bash + python3).
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BRIDGE="$REPO_DIR/scripts/agy-statusline-bridge.sh"
+
+pass=0
+ok()   { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die()  { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+SET="$HOME/.gemini/antigravity-cli/settings.json"
+STATE="$XDG_DATA_HOME/entwurf/agy-statusline/install-state.json"
+mkdir -p "$(dirname "$SET")" "$SB/bin"
+
+# fake stable bin (on PATH) — the renderer the statusLine command resolves to.
+printf '#!/usr/bin/env bash\necho fake-agy-statusline\n' > "$SB/bin/entwurf-agy-statusline"
+chmod +x "$SB/bin/entwurf-agy-statusline"
+# Keep THIS fake authoritative: drop the dir holding a REAL entwurf-agy-statusline (a dev host
+# that ran setup exposes one at ~/.local/bin) so the dangling-command test is not masked by it.
+_real_sl="$(command -v entwurf-agy-statusline 2>/dev/null || true)"
+_real_sl_dir="${_real_sl%/*}"
+if [ -n "$_real_sl_dir" ]; then
+  PATH="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vFx "$_real_sl_dir" | paste -sd: -)"
+fi
+export PATH="$SB/bin:$PATH"
+export AGY_SETTINGS_CONFIG="$SET"
+
+fake_agy() { # install/remove a fake `pgrep` that reports (or not) a live agy
+  if [ "$1" = "on" ]; then
+    printf '#!/usr/bin/env bash\n[ "$2" = agy ] && { echo 4242; exit 0; }\nexit 1\n' > "$SB/bin/pgrep"
+  else
+    printf '#!/usr/bin/env bash\nexit 1\n' > "$SB/bin/pgrep"
+  fi
+  chmod +x "$SB/bin/pgrep"
+}
+fake_agy off
+
+# The prior (agent-config) statusLine we must capture + restore, alongside unrelated keys.
+PRIOR='"/home/junghan/repos/gh/agent-config/antigravity/statusline.sh"'
+write_settings() { # $1 = statusLine command (or "" to omit statusLine)
+  if [ -z "$1" ]; then
+    printf '{\n  "model": "Gemini 3.1 Pro (Low)",\n  "permissions": { "allow": ["mcp(*)"] }\n}\n' > "$SET"
+  else
+    printf '{\n  "model": "Gemini 3.1 Pro (Low)",\n  "permissions": { "allow": ["mcp(*)"] },\n  "statusLine": { "type": "custom", "command": %s, "enabled": true }\n}\n' "$1" > "$SET"
+  fi
+}
+
+# ── NOT-OURS: statusLine still the prior command, no state → doctor note, not a fail ──
+write_settings "$PRIOR"
+DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?
+want "not-ours: doctor exits 0 (statusLine present but not ours is not a hard fail)" "[ '$DOC_RC' -eq 0 ]"
+want "not-ours: doctor says NOT entwurf-owned (honest, not a pass)" "printf '%s' \"\$DOC_OUT\" | grep -q 'NOT entwurf-owned'"
+want "not-ours: doctor names the '?' never-installed case" "printf '%s' \"\$DOC_OUT\" | grep -q 'never installed'"
+
+# ── A: adopt a regular file — own the subtree WHOLE + preserve unrelated + capture preimage ──
+bash "$BRIDGE" install >/dev/null
+want "install: statusLine command is our stable bin" \
+  "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if d[\"statusLine\"][\"command\"]==\"entwurf-agy-statusline\" else 1)' '$SET'"
+want "install: statusLine subtree owned whole (type=custom, enabled=true)" \
+  "python3 -c 'import json,sys; s=json.load(open(sys.argv[1]))[\"statusLine\"]; sys.exit(0 if s[\"type\"]==\"custom\" and s[\"enabled\"] is True else 1)' '$SET'"
+want "install: unrelated keys preserved (model + permissions)" \
+  "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if d.get(\"model\") and d.get(\"permissions\") else 1)' '$SET'"
+want "install: state written under XDG" "[ -f '$STATE' ]"
+want "install: state records the STABLE command (not a repo/checkout path)" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"command\"])' '$STATE' | grep -qx entwurf-agy-statusline"
+want "install: settings has NO repo path in statusLine" "! grep -q '$REPO_DIR' '$SET'"
+want "install: preimage captured the prior (agent-config) subtree" \
+  "python3 -c 'import json,sys; p=json.load(open(sys.argv[1]))[\"preimage\"]; sys.exit(0 if p and p.get(\"command\")==\"/home/junghan/repos/gh/agent-config/antigravity/statusline.sh\" else 1)' '$STATE'"
+
+# ── B: doctor — static clean, live SKIP (no agy), state-evidence confirms ──
+DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?
+want "doctor(no-agy): exits 0 (static clean)" "[ '$DOC_RC' -eq 0 ]"
+want "doctor(no-agy): configured → resolvable" "printf '%s' \"\$DOC_OUT\" | grep -q \"configured → 'entwurf-agy-statusline' (resolvable)\""
+want "doctor(no-agy): live tier is an honest SKIP" "printf '%s' \"\$DOC_OUT\" | grep -q 'live: SKIP'"
+want "doctor(no-agy): SKIP is not disguised as a pass" "! printf '%s' \"\$DOC_OUT\" | grep -q 'consistent with runtime wiring'"
+want "doctor(installed): state-evidence confirms still configured" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'still configure entwurf-agy-statusline'"
+
+# ── C: doctor with a fake agy present → live is CONSISTENT (honest, not overclaimed) ──
+fake_agy on
+DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?
+want "doctor(agy-live): exits 0" "[ '$DOC_RC' -eq 0 ]"
+want "doctor(agy-live): live says consistent-with-wiring (not SKIP)" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'consistent with runtime wiring'"
+want "doctor(agy-live): does NOT overclaim statusline-read as proven" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'statusline read NOT proven'"
+fake_agy off
+
+# ── C2 (drift): install-state present but statusLine changed away → doctor FAILS ──
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["statusLine"]={"type":"custom","command":"someone-elses","enabled":True}; json.dump(d,open(p,"w"))' "$SET"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "drift: doctor should FAIL (state present, statusLine changed)"; fi
+ok "drift: doctor FAILS on state-present + statusLine-changed (installed-then-loosened)"
+bash "$BRIDGE" install >/dev/null   # restore our command
+want "drift: re-install restores our command" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"statusLine\"][\"command\"]==\"entwurf-agy-statusline\" else 1)' '$SET'"
+
+# ── C2b (drift): settings file exists but statusLine was removed → FAIL, NOT orphan auto-clean ──
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d.pop("statusLine", None); json.dump(d,open(p,"w"))' "$SET"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "drift-absent-key: doctor should FAIL (state present, settings exists, statusLine removed)"; fi
+ok "drift-absent-key: doctor FAILS on state-present + settings-exists + statusLine-removed"
+want "drift-absent-key: state is NOT auto-cleaned" "[ -f '$STATE' ]"
+bash "$BRIDGE" install >/dev/null   # restore our command/state for the orphan case
+want "drift-absent-key: re-install restores our command" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"statusLine\"][\"command\"]==\"entwurf-agy-statusline\" else 1)' '$SET'"
+
+# ── C3 (ORPHANED): install-state present but managed config is completely ABSENT → Auto-clean ──
+rm -f "$SET"
+DOC_OUT="$(bash "$BRIDGE" doctor 2>&1)"; DOC_RC=$?
+want "orphan: doctor exits 0 when config is completely absent (HOME wiped)" "[ '$DOC_RC' -eq 0 ]"
+want "orphan: doctor logs ORPHANED and auto-cleans" "printf '%s' \"\$DOC_OUT\" | grep -q 'ORPHANED'"
+want "orphan: state file is removed automatically" "[ ! -f '$STATE' ]"
+bash "$BRIDGE" uninstall >/dev/null  # clear the drift-polluted preimage before the honest-inverse check
+
+
+# ── D: uninstall — honest inverse (FRESH install so preimage is the true prior, not C2's drift) ──
+write_settings "$PRIOR"
+bash "$BRIDGE" install >/dev/null
+bash "$BRIDGE" uninstall >/dev/null
+want "uninstall: statusLine restored to the prior (agent-config) command" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"statusLine\"][\"command\"]==\"/home/junghan/repos/gh/agent-config/antigravity/statusline.sh\" else 1)' '$SET'"
+want "uninstall: unrelated keys survived (model)" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1])).get(\"model\") else 1)' '$SET'"
+want "uninstall: state file removed" "[ ! -f '$STATE' ]"
+
+# ── E: SYMLINK target → install REFUSES + writes NO state ──
+rm -f "$SET"
+printf '{"model":"x"}\n' > "$SB/real_settings.json"
+ln -s "$SB/real_settings.json" "$SET"
+if bash "$BRIDGE" install >/dev/null 2>&1; then die "symlink: install should have REFUSED"; fi
+ok "symlink: install refused (nonzero exit)"
+want "symlink: NO state written on refusal" "[ ! -f '$STATE' ]"
+want "symlink: the linked SSOT was NOT clobbered (no statusLine written into it)" \
+  "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if \"statusLine\" not in d else 1)' '$SB/real_settings.json'"
+rm -f "$SET"
+
+# ── E2: DANGLING SYMLINK (departed owner) → install REFUSES + NO state, link intact ──
+DEPARTED="$SB/departed-owner/settings.json"   # target does NOT exist (departed owner)
+ln -s "$DEPARTED" "$SET"
+want "dangling-symlink: precondition — link is dangling (target absent)" "[ -L '$SET' ] && [ ! -e '$SET' ]"
+set +e; OUT="$(bash "$BRIDGE" install 2>&1)"; RC=$?; set -e
+want "dangling-symlink: install exits nonzero (refused)" "[ '$RC' -ne 0 ]"
+want "dangling-symlink: refusal is the SYMLINK reason (not invalid-json / other)" \
+  "printf '%s' \"\$OUT\" | grep -qi 'refused (symlink)'"
+want "dangling-symlink: NO state written" "[ ! -f '$STATE' ]"
+want "dangling-symlink: link NOT followed — departed target still absent" "[ ! -e '$DEPARTED' ]"
+want "dangling-symlink: the dangling link left intact (specimen, not silently removed)" "[ -L '$SET' ]"
+rm -f "$SET"
+
+# ── F: DANGLING command (bin not on PATH) → doctor FAILS ──
+write_settings ""      # start clean
+bash "$BRIDGE" install >/dev/null
+mv "$SB/bin/entwurf-agy-statusline" "$SB/bin/entwurf-agy-statusline.hidden"   # bin no longer resolvable
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "dangling-cmd: doctor should FAIL (our command not resolvable)"; fi
+ok "dangling-cmd: doctor FAILS when our stable bin is not on PATH (resolvability gate)"
+mv "$SB/bin/entwurf-agy-statusline.hidden" "$SB/bin/entwurf-agy-statusline"
+bash "$BRIDGE" uninstall >/dev/null
+
+# ── G: CREATE-NEW → uninstall removes the file it created ──
+rm -f "$SET" "$STATE"
+bash "$BRIDGE" install >/dev/null
+want "create-new: file created" "[ -f '$SET' ]"
+want "create-new: state detectMode is created-new" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"detectMode\"])' '$STATE' | grep -qx created-new"
+bash "$BRIDGE" uninstall >/dev/null
+want "create-new: uninstall removed the file it created (nothing else remained)" "[ ! -f '$SET' ]"
+want "create-new: state removed" "[ ! -f '$STATE' ]"
+
+# ── H: uninstall with no state is idempotent (a note, not a failure) ──
+bash "$BRIDGE" uninstall >/dev/null 2>&1
+ok "idempotent: uninstall with no state exits 0 (nothing to undo)"
+
+# ── I: setup integration — wire-agy-statusline (detection-gated, NON-FATAL) ──
+rm -f "$SET" "$STATE"
+printf '#!/usr/bin/env bash\necho fake-agy\n' > "$SB/bin/agy"; chmod +x "$SB/bin/agy"
+
+# I-1: agy ABSENT → honest skip, no state, exit 0
+set +e; OUT="$(AGY_BIN="$SB/no-such-agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
+want "wire(no-agy): exits 0 (non-fatal skip)" "[ '$RC' -eq 0 ]"
+want "wire(no-agy): honest skip message" "printf '%s' \"\$OUT\" | grep -q 'skipping agy statusLine wiring'"
+want "wire(no-agy): NO state written" "[ ! -f '$STATE' ]"
+
+# I-2: agy PRESENT + regular settings → idempotent install + state, exit 0
+write_settings "$PRIOR"
+set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
+want "wire(agy+regular): exits 0" "[ '$RC' -eq 0 ]"
+want "wire(agy+regular): statusLine now our command" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"statusLine\"][\"command\"]==\"entwurf-agy-statusline\" else 1)' '$SET'"
+want "wire(agy+regular): state written" "[ -f '$STATE' ]"
+set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
+want "wire(agy+regular, re-run): idempotent exit 0" "[ '$RC' -eq 0 ]"
+bash "$BRIDGE" uninstall >/dev/null; rm -f "$SET"
+
+# I-3: agy PRESENT + SYMLINK settings → NON-FATAL WARN + continue (exit 0), no clobber, no state
+printf '{"model":"x"}\n' > "$SB/real_wire_set.json"
+ln -s "$SB/real_wire_set.json" "$SET"
+set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
+want "wire(agy+symlink): exits 0 (NON-FATAL — setup not bricked)" "[ '$RC' -eq 0 ]"
+want "wire(agy+symlink): reason-specific WARN names the symlink" "printf '%s' \"\$OUT\" | grep -qi 'symlink'"
+want "wire(agy+symlink): linked SSOT NOT clobbered" \
+  "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if \"statusLine\" not in d else 1)' '$SB/real_wire_set.json'"
+want "wire(agy+symlink): NO state written" "[ ! -f '$STATE' ]"
+rm -f "$SET"
+
+# I-4: agy PRESENT + CORRUPT settings (invalid JSON) → NON-FATAL WARN + continue
+printf 'not json{{{' > "$SET"
+set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
+want "wire(agy+corrupt): exits 0 (NON-FATAL)" "[ '$RC' -eq 0 ]"
+want "wire(agy+corrupt): reason-specific WARN flags invalid JSON" "printf '%s' \"\$OUT\" | grep -qi 'invalid JSON'"
+want "wire(agy+corrupt): NO state written" "[ ! -f '$STATE' ]"
+rm -f "$SET" "$SB/bin/agy"
+
+# ── checkout purity: the working tree is byte-identical (nothing under $REPO) ──
+# ── RE-INSTALL PROVENANCE: an installer is re-run on every upgrade ────────────
+# The preimage answers "what was here before US" — a fact about a moment that has already passed.
+# Re-capturing it on each install would record OUR OWN previous subtree as the operator's, and the
+# honest inverse would then faithfully restore us: uninstall leaves behind the very thing it exists
+# to remove. Measured before the fix: install×2 → uninstall left statusLine in the file.
+rm -f "$SET" "$STATE"
+printf '{"model":"x"}\n' > "$SET"
+bash "$BRIDGE" install >/dev/null 2>&1
+bash "$BRIDGE" install >/dev/null 2>&1
+bash "$BRIDGE" install >/dev/null 2>&1
+want "re-install: provenance stays the FIRST install's (preimage still null, not our own subtree)" \
+  "python3 -c \"import json,sys;sys.exit(0 if json.load(open('$STATE'))['preimage'] is None else 1)\""
+bash "$BRIDGE" uninstall >/dev/null 2>&1
+want "re-install: uninstall after install×3 still removes our statusLine (no self-restore)" \
+  "! python3 -c \"import json,sys;sys.exit(0 if 'statusLine' in json.load(open('$SET')) else 1)\""
+want "re-install: the operator's unrelated keys survive the whole cycle" \
+  "[ \"\$(python3 -c \"import json;print(json.load(open('$SET')).get('model'))\")\" = x ]"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+want "purity: checkout unchanged (all writes stayed in the sandbox HOME+XDG)" \
+  "[ \"\$REPO_BEFORE\" = \"\$REPO_AFTER\" ]"
+
+# ── FOREIGN TARGET: state describes a settings file this host does not read ───────────
+# The recorded file is perfectly configured — it is just not OURS. A doctor that only inspects the
+# recorded path blesses a host it owns nothing on, and the damage here is specific: the LIVE
+# statusLine has no recorded preimage, so uninstall would DROP the key instead of restoring the
+# operator's own command. This exact shape was produced on a real host by a verification run that
+# isolated HOME but SHARED XDG_DATA_HOME — sandbox settings, real state. Isolation must move HOME
+# and XDG_DATA_HOME together.
+bash "$BRIDGE" install >/dev/null   # the uninstall cases above left no state; re-own this host first
+FOREIGN_SET="$SB/foreign-settings.json"
+cp "$SET" "$FOREIGN_SET"
+python3 -c "
+import json,sys
+p=sys.argv[1]; d=json.load(open(p)); d['managedSettingsPath']=sys.argv[2]
+json.dump(d, open(p,'w'))" "$STATE" "$FOREIGN_SET"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "foreign-target: doctor FAILS when install-state manages settings this host does not read" "[ '$FT_RC' -ne 0 ]"
+want "foreign-target: the report names both the recorded and the live settings path" \
+  "printf '%s' \"\$FT_OUT\" | grep -q 'FOREIGN TARGET' && printf '%s' \"\$FT_OUT\" | grep -qF '$FOREIGN_SET' && printf '%s' \"\$FT_OUT\" | grep -qF '$SET'"
+want "foreign-target: it names the real damage — the live statusLine has no recorded preimage" \
+  "printf '%s' \"\$FT_OUT\" | grep -qi 'preimage'"
+want "foreign-target: neither the foreign settings nor the state is auto-deleted" "[ -f '$FOREIGN_SET' ] && [ -f '$STATE' ]"
+rm -f "$FOREIGN_SET"
+
+# A present state with invalid JSON or no managed target is corrupt evidence, not "no evidence".
+# The doctor must fail loud instead of parsing to an empty string and skipping the ownership check.
+printf 'not-json{{{' > "$STATE"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "corrupt-state: doctor FAILS on unreadable install-state" "[ '$FT_RC' -ne 0 ]"
+want "corrupt-state: report names CORRUPT instead of silently skipping ownership" \
+  "printf '%s' \"\$FT_OUT\" | grep -q 'state: CORRUPT'"
+
+# A RELATIVE managed path is corrupt too — install records absolute paths only, and resolving a
+# relative one against the doctor's cwd could bless whatever directory it happens to run from.
+printf '{"managedSettingsPath":".gemini/antigravity-cli/settings.json"}' > "$STATE"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "corrupt-state: a relative managedSettingsPath is CORRUPT, never resolved against the doctor's cwd" \
+  "[ '$FT_RC' -ne 0 ] && printf '%s' \"\$FT_OUT\" | grep -q 'state: CORRUPT'"
+
+printf '\nsmoke-agy-statusline-state: %d checks passed\n' "$pass"

package/scripts/smoke-meta-async-drift.sh

@@ -51,8 +51,15 @@ RAW_DIR="$HERE/raw-async-delivery"
 # 1.0 -> 1.1) is the real "re-verify the markers + Gotchas + raw/LIVE probes"
 # trigger and DOES scream.
 PIN_CLAUDE_MINOR="2.1"
-PIN_CODEX_MINOR="0.136"
-PIN_AGY_MINOR="1.0"
+# codex 0.144 (2026-07-14): OBSERVED bump, not a re-verification. Codex is not a shipped
+# native-citizen lane in 0.12.x; the probe evidence in DELIVERY.md §Codex was measured at
+# 0.136.0 and has NOT been re-run on 0.144 — that explicit verdict lives there. Re-run the
+# raw probes before building any codex adapter on this line.
+PIN_CODEX_MINOR="0.144"
+# agy 1.1 (2026-07-14): re-verified live — entwurf_self called without a permission prompt,
+# bidirectional native-push reply on the same gid, LIVE=1 smoke-agy-native-push-live 13/13
+# at agy 1.1.0 (evidence recorded in DELIVERY.md §Antigravity).
+PIN_AGY_MINOR="1.1"
 
 # --- undocumented-behavior identifiers that the delivery path rides on ---------
 # Each MUST stay present in the installed Claude binary. Zero = drift = SCREAM.

package/scripts/smoke-meta-install-state.sh

@@ -519,6 +519,14 @@ valid_record "20260606T120000-eeeeee" "doctor-native" > "$DOC_STORE/20260606T120
 # Fake claude: a healthy toolchain so the doctor sails past every other section.
 cat > "$DOC_BIN/claude" <<'SH'
 #!/usr/bin/env bash
+if [ "${1:-} ${2:-} ${3:-}" = "plugin list --json" ]; then
+  if [ "${FAKE_PLUGIN_CACHE_MISS:-0}" = 1 ]; then
+    printf '%s\n' '[{"id":"entwurf-meta-receive@meta-bridge-local","enabled":true,"errors":["Marketplace meta-bridge-local failed to load: cache-miss"]}]'
+  else
+    printf '%s\n' '[{"id":"entwurf-meta-receive@meta-bridge-local","enabled":true}]'
+  fi
+  exit 0
+fi
 case "$1${2:+ $2}" in
   "--version") echo "2.1.167 (Claude Code)" ;;
   "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
@@ -549,6 +557,18 @@ if printf '%s\n' "$DOC_OUT" | grep -q 'user MCP entwurf-bridge'; then ok "doctor
 if printf '%s\n' "$DOC_OUT" | grep -q '\[plugin install'; then ok "doctor continues to a later section after the drift (no early set -e death)"; else bad "doctor did not reach a later section header after the drift:"$'\n'"$DOC_OUT"; fi
 if printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: FAIL'; then ok "doctor runs the whole chain to its final summary line"; else bad "doctor did not reach its final summary line (mid-run death):"$'\n'"$DOC_OUT"; fi
 
+# A plugin can be configured enabled while Claude refuses to load its missing marketplace
+# source. Text-only `grep enabled` called that healthy and let `🪛 ? cc` look mysterious.
+set +e
+DOC_CACHE_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" FAKE_PLUGIN_CACHE_MISS=1 PATH="$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+DOC_CACHE_CODE=$?
+set -e
+if [ "$DOC_CACHE_CODE" -eq 1 ] && printf '%s\n' "$DOC_CACHE_OUT" | grep -q 'enabled=true but FAILED TO LOAD:.*cache-miss'; then
+  ok "doctor distinguishes configured-enabled from loadable (cache-miss is a hard failure)"
+else
+  bad "doctor did not surface enabled-but-cache-miss as a hard load failure:"$'\n'"$DOC_CACHE_OUT"
+fi
+
 # ⓪ 경계 종료 단언: 이 smoke 전체(install 조립 + state + wrapper-uninstall + doctor)가
 # 끝난 뒤에도 checkout 안에는 live marketplace source가 생기지 않았다 — source
 # origin(repo)과 live artifact(XDG)가 구조적으로 분리됐다는 최종 증명. 미래 회귀가