@junghanacs/entwurf 0.12.6 → 0.12.7

package/mcp/entwurf-bridge/dist/scripts/meta-bridge-prune.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+/**
+ * meta-bridge-prune — LISTING-ONLY hygiene surface for the meta-session store.
+ *
+ * 1.0.0 policy (GLG + GPT힣, 2026-06-06): list candidates, NEVER delete. The
+ * store is the native→garden lookup authority, so this surface is deliberately
+ * conservative:
+ *   - orphan (transcript gone) / stale (recordUpdatedAt older than ttl) are
+ *     SUGGESTED for manual prune with the exact rm command printed — but removed
+ *     by no one here. transcript-gone is a strong abandonment signal, not proof; a
+ *     backend path migration / cleanup / config-dir change can also vacate it. A
+ *     NULL transcriptPath (v2 nullable-at-birth, e.g. pi) is "unknown", NOT gone —
+ *     never orphan on null; only a non-empty string path that no longer exists.
+ *   - corrupt JSON / body↔filename drift / duplicate nativeSessionId are
+ *     AMBIGUOUS / manual-only: the operator decides which authority survives.
+ *     Never blindly rm a duplicate pair.
+ * No --apply in 1.0.0. The script prints, the operator removes. doctor stays the
+ * fail-loud surface (store-doctor reds on corrupt/duplicate/drift); prune is the
+ * separate janitor LISTING that keeps a green store from silently bloating with
+ * transcript-gone records — which doctor intentionally does NOT fail on.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { defaultMetaSessionsDir, parseMetaIdentity } from "../pi-extensions/lib/meta-session.js";
+/** POSIX single-quote a path so the printed rm command survives spaces/specials. */
+function shellQuote(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function usage(code) {
+    console.error("usage: node --experimental-strip-types scripts/meta-bridge-prune.ts [meta-sessions-dir] [--ttl-days N]");
+    process.exit(code);
+}
+let dirArg;
+let ttlDays = 30;
+for (let i = 2; i < process.argv.length; i++) {
+    const a = process.argv[i];
+    if (a === "--ttl-days") {
+        const v = process.argv[++i];
+        const n = Number(v);
+        if (!Number.isFinite(n) || n < 0)
+            usage(2);
+        ttlDays = n;
+    }
+    else if (a.startsWith("--ttl-days=")) {
+        const n = Number(a.slice("--ttl-days=".length));
+        if (!Number.isFinite(n) || n < 0)
+            usage(2);
+        ttlDays = n;
+    }
+    else if (a === "-h" || a === "--help") {
+        usage(0);
+    }
+    else if (a.startsWith("-")) {
+        console.error(`unknown flag: ${a}`);
+        usage(2);
+    }
+    else if (dirArg === undefined) {
+        dirArg = a;
+    }
+    else {
+        usage(2);
+    }
+}
+const dir = dirArg ?? defaultMetaSessionsDir();
+const ttlMs = ttlDays * 24 * 60 * 60 * 1000;
+const now = Date.now();
+console.log("meta-bridge prune candidates");
+console.log(`store: ${dir}`);
+console.log(`ttl: ${ttlDays}d (stale threshold)`);
+console.log("");
+if (!fs.existsSync(dir)) {
+    console.log(`store does not exist yet (0 records).`);
+    console.log("");
+    console.log("No files removed.");
+    process.exit(0);
+}
+const goodByNative = new Map();
+const ambiguous = [];
+let scanned = 0;
+for (const filename of fs.readdirSync(dir).sort()) {
+    if (!filename.endsWith(".meta.json"))
+        continue;
+    scanned += 1;
+    const file = path.join(dir, filename);
+    // dual-read (3D-4 commit1): parseMetaIdentity reads v1 AND v2, normalizing to
+    // identity (transcriptPath nullable, lastSeen → recordUpdatedAt).
+    let id;
+    try {
+        id = parseMetaIdentity(fs.readFileSync(file, "utf8"));
+    }
+    catch (err) {
+        ambiguous.push(`${filename}: corrupt — ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+    }
+    const expectedFilename = `${id.gardenId}.meta.json`;
+    if (filename !== expectedFilename) {
+        ambiguous.push(`${filename}: body/filename drift — body gardenId=${id.gardenId}, expected ${expectedFilename}`);
+        continue;
+    }
+    const list = goodByNative.get(id.nativeSessionId) ?? [];
+    list.push({
+        file: filename,
+        gardenId: id.gardenId,
+        backend: id.backend,
+        nativeSessionId: id.nativeSessionId,
+        transcriptPath: id.transcriptPath,
+        recordUpdatedAt: id.recordUpdatedAt,
+    });
+    goodByNative.set(id.nativeSessionId, list);
+}
+const orphan = [];
+const stale = [];
+let keep = 0;
+for (const [nativeSessionId, list] of goodByNative.entries()) {
+    if (list.length > 1) {
+        // Authority ambiguity — operator must choose which survives. Never auto-pick.
+        ambiguous.push(`duplicate nativeSessionId ${JSON.stringify(nativeSessionId)} in ${list.map((g) => g.file).join(", ")} — manual-only, do not blindly remove`);
+        continue;
+    }
+    const g = list[0];
+    // G2 (3D-4): null transcriptPath is NOT orphan. v2 (pi nullable-at-birth) leaves
+    // it null = "unknown / not yet known", which is not "the file went away". Orphan
+    // is ONLY a non-empty string path that no longer exists on disk. A null path
+    // falls through to the recordUpdatedAt staleness check like any live record.
+    const tp = g.transcriptPath;
+    if (typeof tp === "string" && tp !== "" && !fs.existsSync(tp)) {
+        orphan.push(g);
+        continue;
+    }
+    // recordUpdatedAt is only proven a non-empty string by the parser, not a real
+    // date. KEEP means live + RECENT; an unparseable recordUpdatedAt cannot prove
+    // recency, so it is not a silent keep — it goes manual-only like any defect.
+    const updatedMs = Date.parse(g.recordUpdatedAt);
+    if (!Number.isFinite(updatedMs)) {
+        ambiguous.push(`${g.file}: unparseable recordUpdatedAt ${JSON.stringify(g.recordUpdatedAt)} — cannot prove recent, manual-only`);
+        continue;
+    }
+    if (now - updatedMs > ttlMs)
+        stale.push(g);
+    else
+        keep += 1;
+}
+const ageDays = (iso) => {
+    const ms = now - Date.parse(iso);
+    if (!Number.isFinite(ms))
+        return "?";
+    return String(Math.floor(ms / (24 * 60 * 60 * 1000)));
+};
+console.log(`ORPHAN transcript-gone (${orphan.length}):`);
+for (const g of orphan) {
+    console.log(`- ${g.gardenId} ${g.backend} native=${g.nativeSessionId} transcript=${g.transcriptPath ?? "(null)"}`);
+}
+console.log("");
+console.log(`STALE recordUpdatedAt>${ttlDays}d (${stale.length}):`);
+for (const g of stale) {
+    console.log(`- ${g.gardenId} ${g.backend} recordUpdatedAt=${g.recordUpdatedAt} age=${ageDays(g.recordUpdatedAt)}d`);
+}
+console.log("");
+console.log(`AMBIGUOUS manual-only (${ambiguous.length}):`);
+for (const reason of ambiguous) {
+    console.log(`- ${reason}`);
+}
+console.log("");
+console.log(`KEEP (live/recent): ${keep} record(s)`);
+console.log(`scanned: ${scanned} record(s)`);
+console.log("");
+console.log("No files removed.");
+const removable = [...orphan, ...stale];
+if (removable.length > 0) {
+    console.log("To prune an orphan/stale candidate, inspect it then remove its file manually:");
+    for (const g of removable) {
+        console.log(`  rm -- ${shellQuote(path.join(dir, `${g.gardenId}.meta.json`))}`);
+    }
+}
+if (ambiguous.length > 0) {
+    console.log("AMBIGUOUS records are NOT listed as rm commands — inspect each and decide which authority survives.");
+}
+process.exit(0);

package/mcp/entwurf-bridge/dist/scripts/new-session-id.js

@@ -0,0 +1,24 @@
+/**
+ * new-session-id — print one fresh garden-native sessionId and exit.
+ *
+ * The garden launcher (operator alias / wrapper) calls this so every
+ * `--entwurf-control` session is born a garden citizen:
+ *
+ *   pi --session-id "$(./run.sh new-session-id)" --entwurf-control \
+ *      --emacs-agent-socket server …
+ *
+ * The id is `generateSessionId()` from entwurf-core — the single SSOT for the
+ * locked `YYYYMMDDTHHMMSS-[0-9a-f]{6}` grammar. Do NOT reimplement the format in
+ * the shell (it would drift from the validator the resident guard enforces).
+ *
+ * Stdout is the id and nothing else (no trailing prose), so `$(…)` captures a
+ * clean value. Errors go to stderr with a nonzero exit.
+ */
+import { generateSessionId } from "../pi-extensions/lib/entwurf-core.js";
+try {
+    process.stdout.write(`${generateSessionId()}\n`);
+}
+catch (err) {
+    process.stderr.write(`new-session-id failed: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+}

package/mcp/entwurf-bridge/src/index.ts

@@ -52,18 +52,19 @@ import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwur
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.ts";
+import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.ts";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.ts";
+import {
+	probeNativeSenderAlive,
+	resolveTrustedMetaSenderIdentity,
+} from "../../../pi-extensions/lib/meta-sender-identity.ts";
 import {
 	defaultMetaMailboxDir,
 	defaultMetaSessionsDir,
-	type MetaIdentity,
-	type MetaSenderMarker,
-	parentPid,
-	readMetaIdentityByGardenId,
 	readMetaInbox,
 	readMetaReceiverMarker,
-	readMetaSenderMarker,
 } from "../../../pi-extensions/lib/meta-session.ts";
+import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.ts";
 
 const HOME = os.homedir();
 const DEFAULT_ENTWURF_DIR = path.join(HOME, ".pi", "entwurf-control");
@@ -150,22 +151,6 @@ class EntwurfSenderIdentityError extends Error {
 	}
 }
 
-// Resolve the meta-sender marker for THIS MCP process. ENTWURF_META_SENDER_MARKER is an
-// explicit override (test / wiring). Otherwise try the shared ancestor: process.ppid
-// first, then one step up (Claude may run the hook through a shell wrapper, shifting
-// the shared ancestor). readMetaSenderMarker's pid+start-key guard rejects a
-// dead/reused owner, so a wrong marker is never trusted on any candidate.
-function resolveMetaSenderMarker(): MetaSenderMarker | null {
-	const explicit = process.env.ENTWURF_META_SENDER_MARKER?.trim();
-	if (explicit) return readMetaSenderMarker({ markerPath: explicit });
-	const candidates = [process.ppid, parentPid(process.ppid)].filter((p): p is number => typeof p === "number" && p > 0);
-	for (const ownerPid of candidates) {
-		const marker = readMetaSenderMarker({ backend: "claude-code", ownerPid });
-		if (marker) return marker;
-	}
-	return null;
-}
-
 function buildStrictPiSenderEnvelope(): SenderEnvelope {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
@@ -195,47 +180,49 @@ function buildStrictPiSenderEnvelope(): SenderEnvelope {
 	};
 }
 
-function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): SenderEnvelope | null {
-	// No pi-session identity. Try the meta-sender marker: a native backend that
-	// minted a garden-id via its SessionStart hook. The marker is keyed by the
-	// shared parent pid — this MCP child's process.ppid IS the Claude Code process
-	// the hook ran under (NOT cwd inference). ENTWURF_META_SENDER_MARKER overrides the
-	// lookup for explicit wiring / tests. A trusted marker promotes this process to
-	// a REPLYABLE meta-session sender addressed by its garden-id.
-	const marker = resolveMetaSenderMarker();
-	if (!marker) return null;
-
-	// Validate the marker against its backing meta-record: a stale marker (record
-	// deleted, or backend/nativeSessionId drift) must NOT grant a replyable
-	// identity. The record store is the authority; the marker is only a pid→garden
-	// hint.
-	let identity: MetaIdentity | null = null;
-	try {
-		// dual-read (3D-4 commit1): identity-only check (backend/nativeSessionId), so
-		// it survives the v2 cut. Reads both v1 and v2 records.
-		const id = readMetaIdentityByGardenId(marker.gardenId);
-		if (id.backend === marker.backend && id.nativeSessionId === marker.nativeSessionId) identity = id;
-	} catch {
-		identity = null;
-	}
-	if (!identity) return null;
-
-	// SE-2 slice 2e-b: identity is trusted, but `replyable` is a SEPARATE fact — can THIS
-	// session's own receiver inbox actually wake? Read the receiver presence marker (slice
-	// 2b) and require it to match the identity (the same SSOT helper the mailbox guard uses).
-	// recordBacked is true here by construction; ownerAlive+watchArmed BOTH come from the
-	// matched receiver marker (readMetaReceiverMarker's verifyOwner folds a dead/reused owner
-	// to null, so a match means a live, armed receiver — the sender marker only proves
-	// identity, not an armed watch). Inactive → the meta identity is STILL returned (who-sent
-	// must survive; degrading to null would erase the sender) but with replyable:false.
-	const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-	const active = receiverMarkerMatchesIdentity(receiver, identity);
-	const self = computeSelfAddressability({
-		origin: "meta-session",
-		recordBacked: true,
-		ownerAlive: active,
-		watchArmed: active,
+async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Promise<SenderEnvelope | null> {
+	// No pi-session identity. Try the meta-sender marker: a native backend that minted a
+	// garden-id from its own hook (Claude SessionStart / agy PreInvocation). The marker is
+	// keyed by the shared parent pid — this MCP child's process.ppid IS the native host the
+	// hook ran under (NOT cwd inference). A trusted marker promotes this process from
+	// anonymous external-mcp to a meta-session sender addressed by its garden-id.
+	const trusted = resolveTrustedMetaSenderIdentity({
+		markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
 	});
+	if (!trusted) return null;
+	const { marker, identity } = trusted;
+
+	// Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
+	// rail a reply would ride (보정①). The domain comes from nativePushSupported(backend), not
+	// from wakeMode: `direct-inject` also covers codex/pi, which have no native-push adapter.
+	//   self-fetch (claude-code): can this citizen's own inbox wake? → the receiver presence
+	//     marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match means a
+	//     live, ARMED receiver — the sender marker proves identity, never an armed watch).
+	//   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
+	//     live app-server conversation, so only an adapter probe can answer. Composing the
+	//     receiver atom here would demand `watchArmed` from a backend that never arms one, and
+	//     every agy citizen would report replyable:false forever.
+	// Either way an inactive/unreachable citizen STILL returns its identity (who-sent must
+	// survive; degrading to null would erase the sender) — only with replyable:false.
+	const facts = nativePushSupported(identity.backend)
+		? {
+				origin: "meta-session" as const,
+				metaDeliveryDomain: "native-push" as const,
+				recordBacked: true,
+				probeAlive: await probeNativeSenderAlive(identity),
+			}
+		: (() => {
+				const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
+				const active = receiverMarkerMatchesIdentity(receiver, identity);
+				return {
+					origin: "meta-session" as const,
+					metaDeliveryDomain: "self-fetch" as const,
+					recordBacked: true,
+					ownerAlive: active,
+					watchArmed: active,
+				};
+			})();
+	const self = computeSelfAddressability(facts);
 
 	return {
 		sessionId: identity.gardenId,
@@ -247,13 +234,15 @@ function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): SenderEnve
 	};
 }
 
-function buildAuthoritativeSelfEnvelope(): SenderEnvelope {
+// async only for the native-push branch's adapter probe: a pi sender and a claude-code
+// sender still resolve from files alone, so their cost is unchanged.
+async function buildAuthoritativeSelfEnvelope(): Promise<SenderEnvelope> {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
 	const cwd = process.cwd();
 	if (sessionId && agentId && cwd) return buildStrictPiSenderEnvelope();
 
-	const meta = buildTrustedMetaSenderEnvelope(cwd);
+	const meta = await buildTrustedMetaSenderEnvelope(cwd);
 	if (meta) return meta;
 
 	const missing: string[] = [];
@@ -263,13 +252,13 @@ function buildAuthoritativeSelfEnvelope(): SenderEnvelope {
 	throw new EntwurfEnvelopeWiringError(missing);
 }
 
-function buildSendSenderEnvelope(): SenderEnvelope {
+async function buildSendSenderEnvelope(): Promise<SenderEnvelope> {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
 	const cwd = process.cwd();
 	if (sessionId && agentId && cwd) return buildStrictPiSenderEnvelope();
 
-	const meta = buildTrustedMetaSenderEnvelope(cwd);
+	const meta = await buildTrustedMetaSenderEnvelope(cwd);
 	if (meta) return meta;
 
 	// No marker. Anonymous external is allowed ONLY when not explicitly forbidden.
@@ -364,7 +353,7 @@ server.tool(
 		try {
 			// Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
 			// + the mailbox body sender share one envelope. No replyability gate (see above).
-			const sender = buildSendSenderEnvelope();
+			const sender = await buildSendSenderEnvelope();
 			const rendered = await runAndRenderEntwurfV2FromSurface(
 				{ target, intent, message, mode, wants_reply },
 				// agentDir / prefixRoots intentionally omitted: runAndRenderEntwurfV2FromSurface falls
@@ -389,7 +378,7 @@ server.tool(
 	{},
 	async () => {
 		try {
-			const sender = buildAuthoritativeSelfEnvelope();
+			const sender = await buildAuthoritativeSelfEnvelope();
 			const kst = formatKstTimestamp(sender.timestamp);
 			const extra: Record<string, string> = {};
 			const lines = [
@@ -498,6 +487,51 @@ server.tool(
 	},
 );
 
+server.tool(
+	"entwurf_register_native",
+	"Register an ALREADY-RUNNING native conversation as a garden citizen — it does NOT spawn " +
+		"a new one (that is a separate, deferred capability; do not use this to create a sibling). " +
+		"Give the backend + its native conversation id + the cwd, and this binds them to a garden id " +
+		"so entwurf_v2 can reach the conversation (fire-and-forget → native-push). The conversation " +
+		"must be LIVE: it is probed first, and a dead/indeterminate probe is refused (no garden id is " +
+		"minted for a pointer that does not resolve to a real host). Re-registering the same " +
+		"conversation attaches to the SAME garden id and refreshes the cwd. Only 'antigravity' is " +
+		"registerable on this lane. No mailbox receiver marker is written — native-push has no " +
+		"idle-wake watch; the returned garden id is the reply handle.",
+	{
+		backend: z
+			.enum(["antigravity"])
+			.describe("The native backend hosting the conversation. Only 'antigravity' — codex is a separate lane."),
+		nativeSessionId: z
+			.string()
+			.min(1)
+			.describe("The backend's native conversation id (antigravity conversationId) to bind to a garden id."),
+		cwd: z
+			.string()
+			.min(1)
+			.describe(
+				"The working directory to record for this citizen — REQUIRED (a native conversation's metadata cannot confirm it, so you must state it).",
+			),
+	},
+	async ({ backend, nativeSessionId, cwd }) => {
+		try {
+			const result = await registerNativeConversation({ backend, nativeSessionId, cwd });
+			return textOk(
+				`[entwurf register native ⟶]\n` +
+					`  backend:      ${result.backend}\n` +
+					`  conversation: ${result.nativeSessionId}\n` +
+					`  action:       ${result.action}\n` +
+					`  gardenId:     ${result.gardenId}\n` +
+					`  cwd:          ${result.cwd}\n\n` +
+					`Reach it with entwurf_v2 (target=${result.gardenId}, intent=fire-and-forget). No receiver ` +
+					`marker was written (native-push has no idle-wake mailbox watch).`,
+			);
+		} catch (err) {
+			return textErr(`entwurf_register_native error: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	},
+);
+
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/test.sh

@@ -44,7 +44,7 @@ python3 - <<'PY' <<<"$TOOLS_JSON"
 import json, sys
 obj=json.load(sys.stdin)
 names={t['name'] for t in obj['result']['tools']}
-expected={'entwurf_v2','entwurf_self','entwurf_peers','entwurf_inbox_read'}
+expected={'entwurf_v2','entwurf_self','entwurf_peers','entwurf_inbox_read','entwurf_register_native'}
 missing=expected-names
 legacy={'entwurf','entwurf_resume','entwurf_send'} & names
 if missing:

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -52,16 +52,36 @@
 	// Under an installed marketplace source below node_modules that is
 	// ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING — the SAME strip-types fence
 	// start.sh (0.12.1) and the store-doctor (0.12.4) already cross by shipping JS.
-	// The hook was the last `.ts`-at-runtime surface; emitting it here closes that
-	// class for good (installer copies the dist JS when installed, keeps `.ts` for a
-	// dev clone). Its only repo import is meta-session.ts, ALREADY emitted for the
+	// At 0.12.5 this was the last known `.ts`-at-runtime surface; emitting it here
+	// closed that release's set (installer copies dist JS when installed, keeps
+	// `.ts` for a dev clone). Its only repo import is meta-session.ts, ALREADY emitted for the
 	// store-doctor, so this adds ONE leaf JS (dist/pi-extensions/meta-bridge-hook.js)
 	// and ZERO new deps. It is a plugin hook, never in index.ts's boot closure, so
 	// check-entwurf-bridge-pi-free is unaffected.
+	//
+	// WHY agy-imprint rides THIS build (0.12.7): the npm bin resolves to
+	// scripts/agy-imprint.sh under node_modules. Running its raw .ts there hits the
+	// same ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING fence. Emit the hook leaf as
+	// dist/scripts/agy-imprint.js; the stable bin chooses it only when installed and
+	// keeps transparent strip-types source execution in a dev clone.
+	//
+	// WHY the three OPERATOR commands ride this build (0.12.7): `entwurf` dispatches
+	// them through run.sh, whose REPO_DIR is under node_modules once installed — so
+	// they hit the same fence the imprint hook did, and shipped dead. They are not
+	// dev gates: doctor-pi-provider is the pi-ownership verdict, new-session-id is
+	// the operator alias that mints a garden citizen (docs/setup-clean-host.md tells
+	// operators to run it from the installed bin), and meta-bridge-prune is the store
+	// maintenance verb. check-*/smoke-* stay OUT on purpose — they are dev-clone-only
+	// and run_ts refuses them under an installed package rather than emitting 70+
+	// gate leaves into the tarball.
 	"include": [
 		"./src/index.ts",
 		"../../protocol.js",
 		"../../scripts/meta-bridge-store-doctor.ts",
+		"../../scripts/agy-imprint.ts",
+		"../../scripts/doctor-pi-provider.ts",
+		"../../scripts/new-session-id.ts",
+		"../../scripts/meta-bridge-prune.ts",
 		"../../pi-extensions/meta-bridge-hook.ts"
 	]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.6",
+	"version": "0.12.7",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -60,7 +60,9 @@
 		"VERIFY.md",
 		"DELIVERY.md",
 		"CONTRIBUTING.md",
-		"CHANGELOG.md"
+		"CHANGELOG.md",
+		"!**/__pycache__",
+		"!**/*.pyc"
 	],
 	"engines": {
 		"node": ">=22.6.0"
@@ -90,11 +92,12 @@
 	"scripts": {
 		"prepare": "husky 2>/dev/null || true; npm run --silent build-bridge",
 		"postinstall": "node scripts/postinstall-chmod.cjs",
-		"build-bridge": "rm -rf mcp/entwurf-bridge/dist && tsc -p mcp/entwurf-bridge/tsconfig.build.json",
+		"build-bridge": "bash scripts/with-dist-lock.sh bash scripts/build-bridge.sh",
 		"prepack": "pnpm --silent run build-bridge",
 		"prepublishOnly": "pnpm run check && pnpm run check-pack-install",
 		"setup": "./run.sh setup",
 		"check-shell-quote": "./run.sh check-shell-quote",
+		"check-install-surface": "./run.sh check-install-surface",
 		"check-entwurf-session-identity": "./run.sh check-entwurf-session-identity",
 		"check-meta-session": "./run.sh check-meta-session",
 		"check-meta-record-v2": "./run.sh check-meta-record-v2",
@@ -119,7 +122,7 @@
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",
 		"check-package-source-routing": "./run.sh check-package-source-routing",
-		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-record-v2 && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-meta-dual-read && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-migration && ./run.sh check-meta-dual-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-entwurf-mailbox-guard && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-pack"
+		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-install-surface && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-record-v2 && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-meta-dual-read && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-migration && ./run.sh check-meta-dual-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-entwurf-mailbox-guard && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-agy-sender-identity && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [
@@ -132,7 +135,9 @@
 	"bin": {
 		"entwurf": "./run.sh",
 		"entwurf-bridge": "./mcp/entwurf-bridge/start.sh",
-		"entwurf-statusline": "./scripts/meta-bridge-statusline.sh"
+		"entwurf-statusline": "./scripts/meta-bridge-statusline.sh",
+		"entwurf-agy-statusline": "./scripts/agy-statusline.sh",
+		"entwurf-agy-imprint": "./scripts/agy-imprint.sh"
 	},
 	"peerDependenciesMeta": {
 		"@earendil-works/pi-ai": {

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -3,20 +3,34 @@
  * (SE-1/SE-2 slice 2c). "If I enqueue a conversational reply to this target's mailbox
  * right now, will a model actually see it — or will it rot as garbage?"
  *
- * Two layers, both pure (facts injected, no IO):
+ * Three predicates, all pure (facts injected, no IO) — but on TWO different delivery
+ * axes that must never be collapsed into one (보정①):
  *
  *  - computeMetaReceiverActive(facts): the shared "is this receiver active?" atom —
  *    recordBacked AND ownerAlive AND watchArmed. This is the SAME conjunction the
  *    self-addressability predicate uses for its meta branch; both import it so the
  *    "active receiver" definition has ONE source of truth (concept shared, API split).
+ *    `watchArmed` is the MAILBOX-ONLY "idle-wake watch armed" signal (meta-session
+ *    receiver marker) — it belongs to the mailbox axis and nothing else.
  *
  *  - mailboxConversationalDeliverable(facts): the enqueue gate. A mailbox enqueue +
- *    doorbell only delivers for a SELF-FETCH backend (Claude Code / Codex / agy): the
- *    receiver drains its own inbox on wake. A DIRECT-INJECT backend (pi) has no
- *    mailbox drain at all — enqueuing for it is the SE-1 false success ("✓ delivered"
- *    into a void). So deliverable = wakeMode === "self-fetch" AND the receiver is
- *    active. This is the guard that the v1 fallback, MCP v1, pi-native v1, and the v2
- *    decider/send-fallback enqueue sites must all pass before writing a .msg (slice 2d).
+ *    doorbell only delivers for a SELF-FETCH backend (Claude Code): the receiver
+ *    drains its own inbox on wake. A DIRECT-INJECT backend (pi / codex / antigravity)
+ *    has no mailbox drain at all — enqueuing for it is the SE-1 false success
+ *    ("✓ delivered" into a void). So deliverable = wakeMode === "self-fetch" AND the
+ *    receiver is active. This is the guard that the v1 fallback, MCP v1, pi-native v1,
+ *    and the v2 decider/send-fallback enqueue sites must all pass before writing a
+ *    .msg (slice 2d).
+ *
+ *  - nativePushDeliverable(facts): the SEPARATE deliverability predicate for a
+ *    NATIVE-PUSH backend (antigravity). A native-push citizen has no mailbox and no
+ *    idle-wake watch — delivery is a direct injection into a LIVE app-server
+ *    conversation the adapter probe located. So deliverable = recordBacked AND
+ *    probeAlive. It MUST NOT reuse computeMetaReceiverActive: that atom folds in
+ *    `watchArmed`, so composing it here would smuggle a mailbox liveness fact into a
+ *    domain that has no mailbox (보정① — native-push replyable ≠ mailbox receiver).
+ *    The two axes are pinned apart in code so a future replyable-sender path cannot
+ *    quietly collapse them.
  *
  * The contract is "mailboxConversationalDeliverable", NOT a broad "deliverable": it is
  * specifically about a conversational reply that needs a live doorbell wake, NOT about
@@ -103,8 +117,10 @@ export interface MailboxDeliverabilityResult {
 
 /**
  * The conversational-mailbox enqueue gate. False (no enqueue) unless the backend is
- * self-fetch AND the receiver is active. A direct-inject backend (pi) is refused
- * outright — it has no mailbox drain, so an enqueue would be a silent false success.
+ * self-fetch AND the receiver is active. A direct-inject backend (pi / codex /
+ * antigravity) is refused outright — it has no mailbox drain, so an enqueue would be a
+ * silent false success. A native-push backend's live delivery goes through
+ * nativePushDeliverable, not this gate.
  */
 export function mailboxConversationalDeliverable(facts: MailboxDeliverabilityFacts): MailboxDeliverabilityResult {
 	if (facts.wakeMode !== "self-fetch") {
@@ -121,3 +137,40 @@ export function mailboxConversationalDeliverable(facts: MailboxDeliverabilityFac
 			: `self-fetch receiver inactive — ${recv.reason}`,
 	};
 }
+
+// ── native-push deliverability (봉인 6) ──────────────────────────────────────
+// A DISTINCT axis from the mailbox one above. Native-push (antigravity) has no
+// mailbox and no idle-wake watch: delivery is a direct injection into a live
+// app-server conversation the adapter probe found. Kept in this file so the two
+// deliverability predicates sit side by side and their axis separation is visible,
+// but sharing NOTHING with computeMetaReceiverActive (which requires watchArmed).
+
+export interface NativePushDeliverabilityFacts {
+	/** The target garden id is backed by a live meta-record (identity exists). */
+	recordBacked?: boolean;
+	/** An adapter probe found the target's live native conversation (route resolved). */
+	probeAlive?: boolean;
+}
+
+export interface NativePushDeliverabilityResult {
+	deliverable: boolean;
+	reason: string;
+}
+
+/**
+ * The native-push deliverability predicate (봉인 6). deliverable ⟺ recordBacked ∧
+ * probeAlive. This DELIBERATELY does NOT reuse computeMetaReceiverActive — that atom
+ * requires `watchArmed`, the mailbox-only "idle-wake watch armed" signal, which is
+ * meaningless for a backend with no mailbox (보정①). Fail-closed: an undefined fact
+ * is treated as false, never optimistic; each failure names its own cause so a
+ * record-less target is never conflated with a probe that found no live conversation.
+ */
+export function nativePushDeliverable(facts: NativePushDeliverabilityFacts): NativePushDeliverabilityResult {
+	if (facts.recordBacked !== true) {
+		return { deliverable: false, reason: "no backing meta-record" };
+	}
+	if (facts.probeAlive !== true) {
+		return { deliverable: false, reason: "adapter probe found no live native conversation" };
+	}
+	return { deliverable: true, reason: "record backed, native conversation probed alive" };
+}