@junghanacs/entwurf 0.12.6 → 0.12.7

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -24,9 +24,22 @@
  *                 caller passes watchArmed=false, so meta-self is intentionally
  *                 FAIL-CLOSED until slice 2. Slices 1 and 2 close in the SAME release
  *                 block, so no intermediate "meta self all-false" state is ever pushed.
+ *  - meta-session (native-push backend, e.g. antigravity): replyable ⟺ recordBacked AND
+ *                 probeAlive — the SEPARATE native-push axis (봉인 6 / 보정①). A reply to
+ *                 an agy citizen is a direct injection into a live app-server conversation,
+ *                 so what makes it land is an adapter probe finding that conversation, NOT a
+ *                 mailbox watch. Reusing the receiver atom here would smuggle `watchArmed`
+ *                 (a mailbox-only signal) into a domain with no mailbox, and an agy sender
+ *                 — which never arms a watch — would report replyable:false forever.
  *  - external-mcp: never replyable — no authoritative reply address.
+ *
+ * `origin` stays identity PROVENANCE (where the sender identity came from), never a rail.
+ * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
+ * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
+ * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is
+ * not replyable.
  */
-import { computeMetaReceiverActive } from "./entwurf-deliverability.js";
+import { computeMetaReceiverActive, nativePushDeliverable } from "./entwurf-deliverability.js";
 /**
  * Decide whether a reply to this session is actually deliverable, from injected
  * facts only. Pure: no env reads, no fs, no probing — the caller gathers the facts
@@ -53,18 +66,41 @@ export function computeSelfAddressability(facts) {
             };
         }
         case "meta-session": {
-            // Share the active-receiver atom with the deliverability predicate (one
-            // source of truth for "record backed AND owner alive AND watch armed").
-            const recv = computeMetaReceiverActive({
-                recordBacked: facts.recordBacked,
-                ownerAlive: facts.ownerAlive,
-                watchArmed: facts.watchArmed,
-            });
-            return {
-                replyable: recv.active,
-                socketState: "none",
-                reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
-            };
+            // TWO rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
+            // axis — the mailbox receiver atom and the native-push predicate share nothing, so a
+            // mailbox liveness fact can never leak into a backend that has no mailbox.
+            switch (facts.metaDeliveryDomain) {
+                case "native-push": {
+                    const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
+                    return {
+                        replyable: push.deliverable,
+                        socketState: "none",
+                        reason: push.deliverable
+                            ? `native-push reachable (${push.reason})`
+                            : `native-push unreachable — ${push.reason}`,
+                    };
+                }
+                case "self-fetch": {
+                    // Share the active-receiver atom with the deliverability predicate (one
+                    // source of truth for "record backed AND owner alive AND watch armed").
+                    const recv = computeMetaReceiverActive({
+                        recordBacked: facts.recordBacked,
+                        ownerAlive: facts.ownerAlive,
+                        watchArmed: facts.watchArmed,
+                    });
+                    return {
+                        replyable: recv.active,
+                        socketState: "none",
+                        reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
+                    };
+                }
+                default:
+                    return {
+                        replyable: false,
+                        socketState: "none",
+                        reason: "meta delivery domain not supplied — cannot say which rail a reply would ride (fail-closed)",
+                    };
+            }
         }
         case "external-mcp":
             return {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -58,16 +58,35 @@ export const FACT_LIVENESSES = ["alive", "dead", "indeterminate", "unsupported"]
 // handled by the domain guard before the table is consulted.
 export const DISPATCH_LIVENESSES = ["live", "dormant", "indeterminate"];
 // ── Backend liveness domain (R1 + F4) ──────────────────────────────────────
-// Backends whose liveness predicate is DEFINED. Initial = pi only (control-socket
-// connect + RPC `get_info`, entwurf-control.ts). claude-code (self-fetch, no
-// socket) and codex/antigravity (direct-inject without a probe surface yet) are
-// OUT of domain → `unsupported`. Widening this set is a deliberate future
-// decision (Stage 1+), gated by a REAL liveness predicate for that backend —
-// never by silently mapping its sessions to dead/indeterminate (R1 핵심).
+// Backends whose SOCKET liveness predicate is DEFINED — the pi control-socket
+// domain ONLY (connect + RPC `get_info`, entwurf-control.ts). It stays ["pi"].
+// claude-code (self-fetch, no socket) has no liveness predicate at all → `unsupported`.
+// codex/antigravity are direct-inject; antigravity's liveness IS measured, but by the
+// SEPARATE native-push adapter rail (a live app-server conversation probe), NOT this
+// pi-socket domain — so it must NEVER be added here. Adding it would pull agy into the
+// pi socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
+// reporting agy `unsupported` = "outside the pi-socket liveness domain", NOT
+// unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
+// THIS set is a deliberate future decision (Stage 1+), gated by a REAL pi-shaped
+// control-socket predicate — never by silently mapping sessions to dead/indeterminate
+// (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
+// domain is disjoint from it.
 export const LIVENESS_DOMAIN_BACKENDS = ["pi"];
 export function isLivenessSupported(backend) {
     return LIVENESS_DOMAIN_BACKENDS.includes(backend);
 }
+// ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
+// A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
+// live app-server conversation probe — antigravity's LS gRPC), NOT the pi control
+// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS (pi socket): an agy
+// session is `unsupported` at the pi-socket FACT level (entwurf_peers) yet fully
+// measured + deliverable on the native-push axis. The two are separate rails on
+// purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
+// (a backend can never be in both a socket-liveness domain and a native-push domain).
+export const NATIVE_PUSH_BACKENDS = ["antigravity"];
+export function nativePushSupported(backend) {
+    return NATIVE_PUSH_BACKENDS.includes(backend);
+}
 /**
  * Compose the 4-value FACT liveness from a backend and its socket probe.
  * Out-of-domain backend → `unsupported` (NOT dead/indeterminate, R1). An
@@ -93,6 +112,9 @@ export const ENTWURF_V2_REJECT_REASONS = [
     "owned-live-no-autosend", // Q2/F1: owned-outcome to a live target is not an auto-send
     "backend-liveness-unsupported", // R1: backend has no liveness predicate (e.g. claude-code) — owned-outcome only
     "mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
+    "native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead. NOT `backend-liveness-unsupported` — a native-push backend IS measured, so that name would be a lie.
+    "native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never spawns, never coerced to dead.
+    "native-push-no-resume-authority", // 봉인 1: owned-outcome to a native-push target (any liveness — single, state-independent). A native-push backend has no resume/spawn authority (there is no pi-child to own), so the caller cannot own its completion; use fire-and-forget. Post-probe; observedLiveness = the measured value.
     "bad-target", // R2: absent/typo garden-id (no existing citizen); spawn-new out of v2 scope
     "untrusted-fail-fast", // 동결결정 5: controlled launch into an untrusted cwd
     "socket-only-no-resume-authority", // A1: a record-less socket-only endpoint resolved to a resume verdict (owned-outcome × dormant), but spawn-bg cannot open into it — no trusted cwd/resume authority. Post-probe guard reject (NOT pre-probe, NOT a table resolver cell): the in-domain probe ran and measured the liveness, then `allowResume:false` refused the resume. Carries the honest measured FactLiveness (non-null), unlike the pre-probe `bad-target` it replaces here — a live/addressable socket-only citizen must NEVER be mislabeled absent.
@@ -160,7 +182,18 @@ export const RESOLVER_REJECT_REASONS = [
 // `meta-mailbox` (F-mailbox) = liveness-free delivery via the 0.10.0 meta-bridge
 // mailbox + doorbell. The ack is "enqueued + doorbell rung", NOT a read and NOT a
 // turn injection — so `mode` (steer/follow_up) is meaningless on this transport.
-export const ENTWURF_V2_TRANSPORTS = ["control-socket", "spawn-bg", "tmux-live", "meta-mailbox"];
+// `native-push` (봉인 1) = direct injection into a LIVE native app-server conversation
+// (antigravity `agentapi send-message`). Like meta-mailbox it is a fire-and-forget
+// send arm (ack-only), but it requires a live-probe (NATIVE_PUSH_DISPATCH_TABLE),
+// where meta-mailbox is liveness-free. It is NOT a mailbox enqueue and NOT a pi socket
+// send — it is its own rail.
+export const ENTWURF_V2_TRANSPORTS = [
+    "control-socket",
+    "spawn-bg",
+    "tmux-live",
+    "meta-mailbox",
+    "native-push",
+];
 // Allow-branch facets (exported so the schema↔types gate asserts every enum).
 export const ENTWURF_V2_ACTIONS = ["send", "resume"];
 export const ENTWURF_V2_OWNERSHIPS = ["ack-only", "owned"];
@@ -188,10 +221,13 @@ export const DISPATCH_TABLE = {
     },
 };
 // ── The unsupported-backend mailbox mini-table (F-mailbox) ─────────────────
-// SEPARATE from the in-domain 6-cell DISPATCH_TABLE (Fable (i)): an `unsupported`
-// backend (claude-code self-fetch, codex/agy without a probe surface) has NO
-// liveness predicate, so it never enters the liveness-keyed table. Instead the
-// domain guard routes it here, keyed on intent alone:
+// SEPARATE from the in-domain 6-cell DISPATCH_TABLE (Fable (i)): a backend with no
+// pi-socket liveness predicate never enters the liveness-keyed table. Instead the
+// domain guard routes it here, keyed on intent alone. Reaches here: claude-code
+// (self-fetch mailbox) and codex (no adapter yet). Does NOT reach here: antigravity —
+// the decider intercepts a native-push backend in its own rail BEFORE this mailbox
+// mini-table (entwurf-v2-decider.ts), so agy is `unsupported` at the fact level yet
+// never falls through to a mailbox it does not have. The cells, keyed on intent alone:
 //  - fire-and-forget needs no liveness — the 0.10.0 meta-bridge mailbox delivers
 //    to any DELIVERABLE citizen. This cell is the deliverable path; resolveDispatch
 //    downgrades it to `mailbox-undeliverable` when the separate mailboxDeliverable
@@ -282,6 +318,63 @@ export function resolveDispatch(intent, liveness, mailboxDeliverable) {
         observedLiveness: liveness,
     };
 }
+// ── The native-push dispatch table (봉인 1/2/4) ─────────────────────────────
+// A THIRD table, distinct from both the pi 6-cell DISPATCH_TABLE and the unsupported
+// mailbox mini-table. Keyed intent × NativePushLiveness (NOT intent-only): a
+// native-push backend (antigravity) IS measured by its adapter probe, so the
+// send/reject decision depends on the probed liveness. The decider intercepts a
+// native-push backend in its own rail (nativePushSupported → probe → this table)
+// BEFORE the unsupported branch, so agy never falls through to a mailbox it lacks.
+//
+//   fire-and-forget × alive         → native-push send (the ONE allow cell)
+//   fire-and-forget × dead          → reject native-push-target-dead
+//   fire-and-forget × indeterminate → reject native-push-probe-indeterminate
+//   owned-outcome  × *              → reject native-push-no-resume-authority (state-
+//                                     independent: no pi-child to own; `backend-
+//                                     liveness-unsupported` is NOT reused — false name).
+export const NATIVE_PUSH_DISPATCH_TABLE = {
+    "fire-and-forget": {
+        alive: { action: "send", transport: "native-push", ownership: "ack-only" },
+        dead: { action: "reject", reason: "native-push-target-dead" },
+        indeterminate: { action: "reject", reason: "native-push-probe-indeterminate" },
+    },
+    "owned-outcome": {
+        alive: { action: "reject", reason: "native-push-no-resume-authority" },
+        dead: { action: "reject", reason: "native-push-no-resume-authority" },
+        indeterminate: { action: "reject", reason: "native-push-no-resume-authority" },
+    },
+};
+// The reasons the native-push resolver emits — a THIRD post-probe reject set, parallel
+// to RESOLVER_REJECT_REASONS (pi/mailbox). All post-probe: resolveNativePushDispatch
+// always has a real probed liveness in hand, so observedLiveness is non-null. None may
+// be pre-probe (they are never in PRE_PROBE_REJECT_REASONS).
+export const NATIVE_PUSH_REJECT_REASONS = [
+    "native-push-target-dead",
+    "native-push-probe-indeterminate",
+    "native-push-no-resume-authority",
+];
+/**
+ * PURE native-push dispatch decision (봉인 4). Given the caller intent and the adapter
+ * probe's 3-value liveness, mint the receipt from NATIVE_PUSH_DISPATCH_TABLE. Mirrors
+ * resolveDispatch's shape; observedLiveness is ALWAYS the probed value (non-null,
+ * post-probe). The decider calls this only AFTER nativePushSupported(backend) gates the
+ * backend and the adapter probe returns a liveness — it never touches the pi socket
+ * table or the mailbox mini-table (those are other domains). No IO here (the probe is
+ * the decider's injected dep); this only maps (intent, liveness) → verdict.
+ */
+export function resolveNativePushDispatch(intent, liveness) {
+    const cell = NATIVE_PUSH_DISPATCH_TABLE[intent][liveness];
+    if (cell.action === "reject") {
+        return makeRejectReceipt(cell.reason, liveness);
+    }
+    return {
+        ok: true,
+        action: cell.action,
+        transport: cell.transport,
+        ownership: cell.ownership,
+        observedLiveness: liveness,
+    };
+}
 // ── TypeBox schemas ────────────────────────────────────────────────────────
 // MOVED to `entwurf-v2-contract-schema.ts` (0.12.1 B-1): the pi-ai TypeBox
 // builders (StringEnum/Type) are a pi-lane dependency, so they cannot live in

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -44,7 +44,7 @@
  * be bypassed.
  */
 import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.js";
-import { isLivenessSupported, makeRejectReceipt, resolveDispatch, } from "./entwurf-v2-contract.js";
+import { isLivenessSupported, makeRejectReceipt, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, metaCapabilityFor, } from "./meta-session.js";
 import { isValidSessionId } from "./session-id.js";
 import { controlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
@@ -131,6 +131,35 @@ export async function decideDispatch(input, deps) {
         return reject(makeRejectReceipt("target-address-conflict", null));
     }
     const identity = resolution.identity;
+    // 2d. native-push rail (봉인 4): a native-push backend (antigravity) is measured by its
+    // adapter probe, NOT the pi socket and NOT the mailbox. Intercept it HERE — after identity
+    // resolution + the address-conflict guard, but BEFORE the unsupported mailbox branch — so
+    // agy routes to native-push and never falls through to a mailbox it does not have. This
+    // branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
+    // volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
+    if (nativePushSupported(identity.backend)) {
+        const probe = await deps.nativePushProbe(identity);
+        const receipt = resolveNativePushDispatch(input.intent, probe.status);
+        if (!receipt.ok)
+            return reject(receipt);
+        // The ONLY allow cell is fire-and-forget × alive, so an ok receipt ⟹ the probe is
+        // alive and carries a route. The narrow is defensive: a contract-breaking probe/table
+        // mismatch fails loud rather than planting a routeless send plan.
+        if (probe.status !== "alive") {
+            throw new Error("entwurf_v2 decider: native-push send verdict without an alive probe route (contract invariant broken).");
+        }
+        const plan = {
+            transport: "native-push",
+            action: "send",
+            targetGardenId: gardenId,
+            backend: identity.backend,
+            nativeSessionId: identity.nativeSessionId,
+            route: probe.route,
+            wantsReply,
+            message: input.message,
+        };
+        return { kind: "execute", receipt, plan, lock: null };
+    }
     // 3. backend.
     if (!isLivenessSupported(identity.backend)) {
         // 6. unsupported path — NO lock (？7). Deliverability comes from the REQUIRED seam

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-native-push.js

@@ -0,0 +1,57 @@
+/**
+ * entwurf-v2-native-push — the native-push SEND hand (봉인 3/4, the executor half of the
+ * native-push rail). It takes the `native-push` ExecutionPlan the 5b decider ALREADY chose
+ * and direct-injects the message into the live conversation via the adapter. It DECIDES NO
+ * ROUTING (the NATIVE_PUSH_DISPATCH_TABLE did) and carries NO release seam — a native-push
+ * plan is the LOCK-FREE path (봉인 4), so a lock leak is structurally impossible here.
+ *
+ * This is where the 1-shot retry lives — NOT in the adapter leaf (봉인 3). The decider
+ * probed a fresh route and planted it in the plan; the executor sends over it, and on a
+ * failure it re-probes ONCE (the volatile LS port may have shifted between decide and
+ * execute) and re-sends. A second failure is fail-loud (no infinite loop). This mirrors the
+ * control-socket send-fallback pattern: the decider stays pure, the hand owns the retry.
+ *
+ * A native-push send has NO in-band refuse (there is no live receiver to answer
+ * success:false) — like a mailbox enqueue, it either succeeds or THROWS. The hand never
+ * folds a throw into {success:false}; the runner maps a thrown error to execution-failed.
+ */
+import { resolveNativePushAdapter } from "./native-push/adapter.js";
+/**
+ * Deliver `content` into the conversation, owning the 1-shot retry (봉인 3). Send over the
+ * planted (decider-probed) route first; on failure re-probe ONCE and re-send over the fresh
+ * route; a second failure PROPAGATES (fail-loud). If the re-probe finds the target no longer
+ * alive, throw — a failed send into a now-dead conversation is an honest non-delivery, never
+ * a silent success. The re-probe is the ONLY re-derivation of the volatile route.
+ */
+export async function deliverViaNativePush(adapter, route, nativeSessionId, content) {
+    try {
+        await adapter.send(route, nativeSessionId, content);
+        return { success: true, retried: false };
+    }
+    catch (firstErr) {
+        // 1-shot re-probe → re-send: the volatile LS route may have shifted since the decider
+        // probed it. Re-discover it fresh and retry exactly once.
+        const reprobe = await adapter.probe(nativeSessionId);
+        if (reprobe.status !== "alive") {
+            throw new Error(`native-push deliver: first send failed and re-probe found target ${reprobe.status} (${reprobe.reason}) — not retried`, { cause: firstErr });
+        }
+        // A second failure THROWS out of this call (fail-loud) — no third attempt.
+        await adapter.send(reprobe.route, nativeSessionId, content);
+        return { success: true, retried: true };
+    }
+}
+/**
+ * Build the production `sendNativePush(plan, lock)` adapter the runner consumes. It IGNORES
+ * `lock` entirely (a native-push plan is lock-free, 봉인 4) — the field exists only to match
+ * the DispatchExecutorDeps hand signature. It resolves the adapter from the plan's backend
+ * and delivers with the 1-shot retry. A delivery throw surfaces as a REJECTED promise (the
+ * runner's try/catch maps it to execution-failed).
+ */
+export function makeNativePushSend(deps = {}) {
+    const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+    // `_lock` is named for the hand contract but NEVER read — native-push owns/releases no lock.
+    return async (plan, _lock) => {
+        const adapter = resolveAdapter(plan.backend);
+        return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, plan.message);
+    };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -32,11 +32,13 @@ import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { decideDispatch, } from "./entwurf-v2-decider.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
 import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.js";
+import { makeNativePushSend } from "./entwurf-v2-native-push.js";
 import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
 import { executeSpawnBgResume } from "./entwurf-v2-spawn.js";
 import { makeProductionSpawnBgResumeDeps } from "./entwurf-v2-spawn-production.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readMetaIdentityByGardenId, readMetaReceiverMarker, } from "./meta-session.js";
+import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isSocketOnlyPiCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
 /**
@@ -96,6 +98,7 @@ export function makeProductionEntwurfV2Deps(opts) {
         classifyConnect: s.classifyConnect ?? classifyConnectError,
         sendRpc: s.sendRpc ?? realSendRpc,
         enqueue: s.enqueue ?? enqueueMetaMessage,
+        resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
         spawnOverrides: s.spawnOverrides ?? {},
     };
     // ── ONE lock domain (Q2/QB3): a single lockDir-bound release for ALL hands ─
@@ -168,6 +171,10 @@ export function makeProductionEntwurfV2Deps(opts) {
         probeSocket,
         preflightForCwd: (cwd) => io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
         mailboxDeliverabilityFor,
+        // 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
+        // Only reached on a nativePushSupported backend (the decider gates it), so the resolver
+        // never throws for a non-native-push backend here.
+        nativePushProbe: (identity) => Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
         mailboxDir,
         sessionsDir,
         observeTimeoutMs: opts.observeTimeoutMs,
@@ -210,6 +217,9 @@ export function makeProductionEntwurfV2Deps(opts) {
             releaseFn: release,
         })),
         sendMailbox: (plan, _lock) => sendViaMailbox(plan, _lock),
+        // native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
+        // so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).
+        sendNativePush: makeNativePushSend({ resolveAdapter: io.resolveNativePushAdapter }),
     };
     return {
         decide: (input) => decideDispatch(input, deciderDeps),

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-release.js

@@ -62,6 +62,15 @@ export function decideReleasePolicy(plan, lock) {
                 throw new Error("entwurf-v2-release: a meta-mailbox plan must carry no lock (？7 invariant violated).");
             }
             return { kind: "no-lock" };
+        case "native-push":
+            // Native-push is the other lock-free rail (봉인 4) — like meta-mailbox it holds no
+            // lock, so a non-null lock is a decider contract violation. (The native-push hand
+            // never actually routes through this reducer; the case keeps the switch exhaustive
+            // and pins the lock-free invariant.)
+            if (lock !== null) {
+                throw new Error("entwurf-v2-release: a native-push plan must carry no lock (봉인 4 lock-free rail violated).");
+            }
+            return { kind: "no-lock" };
         case "control-socket":
             assertInDomainLock(plan, lock);
             return { kind: "release-after-send-final" };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -98,6 +98,27 @@ export async function executeDispatch(decision, deps) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
             }
         }
+        case "native-push": {
+            try {
+                // lock is null here (lock-free rail, 봉인 4) — passed verbatim; the hand ignores it.
+                const r = await deps.sendNativePush(plan, lock);
+                // Like meta-mailbox, native-push has NO in-band reject (no live receiver answers
+                // success:false). A `success:false` is therefore a CONTRACT VIOLATION — fail loud
+                // rather than render a non-delivery as delivered ("Never warn. Throw.").
+                if (r.success !== true) {
+                    throw new Error("entwurf-v2-runner: native-push send returned success:false (contract violation; native-push has no in-band reject).");
+                }
+                return {
+                    kind: "executed",
+                    receipt,
+                    transport,
+                    outcome: { transport: "native-push", success: true, retried: r.retried },
+                };
+            }
+            catch (err) {
+                return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
+            }
+        }
     }
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -132,6 +132,11 @@ async function driveDeadFallback(plan, lock, deps) {
             // contract violation (a send and a spawn are different actions), so fail loud
             // rather than silently mis-execute.
             throw new Error("entwurf-v2-send: re-resolve returned a spawn-bg plan for a send fallback (contract violation).");
+        case "native-push":
+            // The dead-control-socket fallback re-resolves only the pi socket domain
+            // (control-socket / mailbox / spawn); it never routes the native-push rail. A
+            // native-push rePlan here is structurally impossible — fail loud.
+            throw new Error("entwurf-v2-send: re-resolve returned a native-push plan for a send fallback (contract violation).");
     }
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -71,6 +71,16 @@ export function actionableRejectHint(reason) {
         case "owned-live-no-autosend":
             // A live target is reachable, but owned-outcome is not an auto-send (Q2/F1).
             return "target is live — owned-outcome never auto-sends. Use intent: fire-and-forget (with wants_reply if you need a reply).";
+        case "native-push-no-resume-authority":
+            // A native-push backend (antigravity) has no pi-child to own, so owned-outcome has
+            // nothing to own. Delivery is a direct inject via fire-and-forget.
+            return "native-push target (e.g. antigravity) has no resume/spawn authority → owned-outcome is unsupported. Use intent: fire-and-forget to direct-inject into the live conversation.";
+        case "native-push-target-dead":
+            // The adapter probe found no live host process for the conversation.
+            return "native-push conversation is not live (no host process found). Re-open the conversation, then retry — there is nothing to inject into.";
+        case "native-push-probe-indeterminate":
+            // Host up, but no LS port served the conversation — inconclusive, not a hard dead.
+            return "native-push host is up but no port served this conversation (probe inconclusive). Retry once the conversation is loaded, or verify the conversation id.";
         default:
             return undefined;
     }
@@ -127,6 +137,13 @@ export function renderEntwurfV2Result(result) {
                 const exit = res.kind === "child-exited" ? ` exitCode=${res.exitCode}` : "";
                 return { text: `entwurf_v2 spawn-bg → ${res.kind}${pid}${exit}, lock released`, isError: false };
             }
+            if (o.transport === "native-push") {
+                // direct-inject succeeded; note if the 1-shot re-probe retry fired.
+                return {
+                    text: `entwurf_v2 native-push → delivered${o.retried ? " (after a 1-shot re-probe retry)" : ""}`,
+                    isError: false,
+                };
+            }
             // meta-mailbox
             return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
         }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -0,0 +1,125 @@
+/**
+ * meta-sender-identity — WHO is calling this MCP child?
+ *
+ * A native backend (Claude Code, agy) spawns the entwurf-bridge MCP server as a child of the
+ * same process that runs its session hook. The hook writes a sender marker keyed by ITS parent
+ * pid; the child looks a marker up under its own parent. That shared ancestor is the join key —
+ * NOT cwd (one repo can hold many sessions) and not a wire field (neither host carries one).
+ *
+ * Measured 2026-07-13 on both backends: hook.ppid == bridge.ppid == the native host pid, same
+ * start-key. The extra `parentPid(ppid)` candidate covers a host that runs its hook through a
+ * shell wrapper, which shifts the shared ancestor one step up.
+ *
+ * Two guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted after
+ * BOTH pass:
+ *   1. pid + start-key (readMetaSenderMarker): the owner is still the very process that wrote it,
+ *      so a dead session's pid, reused by something else, cannot inherit its garden-id.
+ *   2. the backing meta-record: the record store is the authority — a marker whose record was
+ *      deleted, or whose backend/nativeSessionId drifted from it, names nobody.
+ *
+ * Every candidate is collected and validated BEFORE one is chosen. A first-match loop would make
+ * the answer depend on which pid or backend happened to be read first; here lookup order carries
+ * no meaning, and two live identities are a refusal rather than a race.
+ */
+import { parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
+import { resolveNativePushAdapter } from "./native-push/adapter.js";
+/** Every native backend that mints a garden-id from its own hook and writes a sender marker. */
+export const META_SENDER_BACKENDS = ["claude-code", "antigravity"];
+/**
+ * Two live native sessions claim this MCP process as their own. We can SEE both identities but
+ * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend
+ * priority, or recency would attribute a message to a citizen that did not write it; falling back
+ * to anonymous would hide an identity we already hold. Both are the SE-1 shape — a layer answering
+ * "yes" where the truth is unknown — so this is a hard refusal, not a warning.
+ *
+ * WHAT THIS CAN AND CANNOT SEE. It fires only when the candidate pids yield MORE THAN ONE marker
+ * FILE naming different citizens — two backends on one pid, or the two candidate pids naming
+ * different citizens. It CANNOT see two conversations of the same backend racing under one host
+ * pid: they share the single marker path `<senders>/<backend>/<pid>.json`, so the later hook write
+ * overwrites the earlier one and only one identity is ever on disk. That case is guarded by a
+ * runtime invariant instead (a native host serializes its model invocations), not by this error —
+ * do not read a green resolver as proof that same-process concurrency is safe.
+ */
+export class EntwurfSenderIdentityAmbiguityError extends Error {
+    gardenIds;
+    constructor(gardenIds) {
+        super("entwurf-bridge refused: ambiguous sender identity. This MCP process's owner pid carries live, " +
+            `record-backed sender markers for MORE than one garden citizen (${gardenIds.join(", ")}), so which ` +
+            "one is calling cannot be determined. A send under the wrong identity is worse than no send — one " +
+            "native host process appears to be driving several sessions at once. Report it; do not work around it.");
+        this.name = "EntwurfSenderIdentityAmbiguityError";
+        this.gardenIds = gardenIds;
+    }
+}
+/** The record store is the authority; the marker is only a pid→garden hint it must agree with. */
+function trustMarker(marker) {
+    try {
+        // dual-read (3D-4 commit1): identity-only check, so it survives the v2 cut.
+        const identity = readMetaIdentityByGardenId(marker.gardenId);
+        if (identity.backend !== marker.backend || identity.nativeSessionId !== marker.nativeSessionId)
+            return null;
+        return { marker, identity };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the ONE identity that owns this MCP process, or refuse.
+ *
+ * 0 trusted → null (anonymous — or a hard refusal upstream under REQUIRE_META_SENDER).
+ * 1 trusted → that identity.
+ * 2+ distinct → throw EntwurfSenderIdentityAmbiguityError.
+ *
+ * Markers that agree on the SAME garden-id are not a conflict: an older release wrote a marker for
+ * the parent AND the grandparent, and both can still sit on disk pointing at one citizen.
+ */
+export function resolveTrustedMetaSenderIdentity(opts = {}) {
+    const markers = [];
+    if (opts.markerPath) {
+        const marker = readMetaSenderMarker({ markerPath: opts.markerPath });
+        if (marker)
+            markers.push(marker);
+    }
+    else {
+        const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter((p) => typeof p === "number" && p > 0);
+        for (const ownerPid of [...new Set(ownerPids)]) {
+            for (const backend of META_SENDER_BACKENDS) {
+                const marker = readMetaSenderMarker({ backend, ownerPid, sendersDir: opts.sendersDir });
+                if (marker)
+                    markers.push(marker);
+            }
+        }
+    }
+    const byGardenId = new Map();
+    for (const marker of markers) {
+        const trusted = trustMarker(marker);
+        if (trusted)
+            byGardenId.set(trusted.identity.gardenId, trusted);
+    }
+    const distinct = [...byGardenId.values()];
+    if (distinct.length === 0)
+        return null;
+    if (distinct.length > 1)
+        throw new EntwurfSenderIdentityAmbiguityError(distinct.map((t) => t.identity.gardenId));
+    return distinct[0];
+}
+/**
+ * Can a reply to THIS native-push citizen actually land? Only an adapter probe can say: a reply is
+ * a direct injection into a live app-server conversation, and the route is re-discovered on every
+ * probe. This is the `replyable` fact for a native-push sender — it must never be inferred from the
+ * mailbox axis, which such a backend has no part in (보정①).
+ *
+ * ERROR POLICY (deliberate, and the reason this is not a `try { … } catch { return false }`): the
+ * adapter already expresses every OPERATIONAL outcome as a value — `dead` (no host) and
+ * `indeterminate` (host up, no port served it). So a THROW out of here is never a fact about the
+ * citizen; it is a defect — an unresolvable adapter for a backend we just confirmed is native-push
+ * (a registry bug), or a probe runner that could not run at all (a wiring bug). Folding those into
+ * `replyable:false` would tell the receiver a lie about this sender AND bury the defect, which is
+ * exactly the Crash-Don't-Warn shape this lane exists to remove. Let them propagate.
+ */
+export async function probeNativeSenderAlive(identity, deps = {}) {
+    const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+    const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
+    return probe.status === "alive";
+}