@junghanacs/entwurf 0.12.8 → 0.12.10

package/scripts/smoke-agy-install-state.sh

@@ -452,32 +452,72 @@ rm -f "$LEGACY" "$DLINK" "$DSTATE"
 unset ENTWURF_DEV_BIN_DIR ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
 
 # ── K: permission grant — the OTHER half of a usable bridge ───────────────────
-# Registering the server only makes the tool REACHABLE. agy defaults every `mcp` action to Ask, so
-# without an allow rule every entwurf_v2 call stops for a y/n — a registered-but-ungranted bridge is
-# half-installed. We grant exactly ONE string in `permissions.allow`; the operator's own rules are
-# preserved, never managed (granting ourselves command(*) would be their trust decision, not ours).
+# Registering the server only makes the tools REACHABLE. agy defaults every `mcp` action to Ask, so
+# without an allow rule every call stops for a y/n — a registered-but-ungranted bridge is
+# half-installed. We grant ONE NARROW STRING PER NORMAL-PATH TOOL in `permissions.allow` (every
+# tool the server exposes is visible to the model; auto-granting is the smaller, deliberate set).
+# The operator's own rules are preserved, never managed (granting ourselves command(*) would be their
+# trust decision, not ours). The rule list comes from the config engine, never retyped here — a
+# second copy is how a newly shipped tool silently stops being granted.
 SETTINGS="$HOME/.gemini/antigravity-cli/settings.json"
 SLSTATE="$XDG_DATA_HOME/entwurf/agy-statusline/install-state.json"
 STATUSLINE="$REPO_DIR/scripts/agy-statusline-bridge.sh"
-RULE='mcp(entwurf-bridge/entwurf_v2)'
+RULES="$(python3 "$REPO_DIR/scripts/agy-bridge-config.py" permission-rules)"
+RULE="${RULES%% *}"   # first rule, for the single-string cases below
+
+# ── INDEPENDENT CONTRACT ─────────────────────────────────────────────────────
+# Everything below drives the SUT with $RULES, which the SUT itself printed. That is the right way
+# to keep operator messages and assertions from drifting — but as an ORACLE it is circular: adding
+# entwurf_inbox_read to ALLOW_RULES, or swapping entwurf_peers for something else, would sail
+# through every rule-set assertion because the expectation moved with the code. So the SET ITSELF is
+# pinned here, literally, once. Over-granting is the failure this catches: a permission we take and
+# do not need is not a smaller bug than one we forget.
+EXPECT_RULES='mcp(entwurf-bridge/entwurf_v2) mcp(entwurf-bridge/entwurf_peers) mcp(entwurf-bridge/entwurf_self)'
+want "contract: the auto-granted rule set is EXACTLY the three normal-path tools, in order [QK:AGY-EXACT-RULE-SET]" \
+  "[ \"$RULES\" = \"$EXPECT_RULES\" ]"
+# Named negatives, not just an equality: these two are the tools a future edit is most likely to add
+# by reflex ("grant everything the server exposes"), and each would be a grant we never justified —
+# inbox_read names a rail native-push does not have, register_native is a manual fallback the normal
+# birth path never calls.
+for forbidden in entwurf_inbox_read entwurf_register_native; do
+  want "contract: '$forbidden' is NOT auto-granted (we do not take permissions the normal path never uses)" \
+    "! printf '%s' \"$RULES\" | grep -qF 'mcp(entwurf-bridge/$forbidden)'"
+done
 has_rule() { python3 -c "
 import json,sys
 d=json.load(open('$1'))
-sys.exit(0 if '$RULE' in (d.get('permissions') or {}).get('allow', []) else 1)"; }
+allow=(d.get('permissions') or {}).get('allow', [])
+sys.exit(0 if all(r in allow for r in '''$RULES'''.split()) else 1)"; }
 
 rm -f "$SETTINGS" "$PSTATE" "$STATE" "$GLOBAL"
 bash "$BRIDGE" install >/dev/null 2>&1
-want "permission: install grants the rule into permissions.allow" "has_rule '$SETTINGS'"
+want "permission: install grants EVERY normal-path rule into permissions.allow" "has_rule '$SETTINGS'"
+
+# TWO state files, TWO schemas, versioned APART. The permission state moved to 2 when its shape
+# changed to a rule set; the MCP install-state's layout never moved and must stay 1. Sharing one
+# constant makes the version a lie in whichever file did not change — a later reader branching on it
+# would be branching on noise, and "the schema bumped" would stop meaning "the shape changed".
+want "state schemas are independent: MCP install-state stays at its own version (1) [QK:AGY-SCHEMA-VERSIONS-APART]" \
+  "[ \"\$(python3 -c \"import json;print(json.load(open('$STATE'))['schemaVersion'])\")\" = 1 ]"
+want "state schemas are independent: permission-state carries the rule-set version (2)" \
+  "[ \"\$(python3 -c \"import json;print(json.load(open('$PSTATE'))['schemaVersion'])\")\" = 2 ]"
+# The defect this pins (measured 2026-07-27 on a live agy citizen): install granted entwurf_v2 only,
+# so entwurf_peers and entwurf_self prompted for a y/n on every call while the doctor reported green.
+# A grant for the tool we happen to check first must never stand in for the whole surface.
+want "permission: a PARTIAL grant is not reported as configured (agy still prompts on the rest)" \
+  "printf '{\"permissions\":{\"allow\":[\"%s\"]}}\n' '$RULE' > '$SETTINGS'; \
+   [ \"\$(python3 '$REPO_DIR/scripts/agy-bridge-config.py' permission-doctor '$SETTINGS' | cut -d' ' -f1)\" = partially-configured ]"
+bash "$BRIDGE" install >/dev/null 2>&1
 
 # IDEMPOTENCY, and not only of the file: a re-install must not rewrite PROVENANCE either. Re-reading
 # the rule we ourselves wrote as "the operator already had it" would strand it forever (the inverse
 # would decline to remove it). Installers are re-run on every upgrade, so this path is the norm.
 bash "$BRIDGE" install >/dev/null 2>&1
 bash "$BRIDGE" install >/dev/null 2>&1
-want "permission: re-install is idempotent (rule appears exactly once)" \
-  "[ \"\$(python3 -c \"import json;print(json.load(open('$SETTINGS'))['permissions']['allow'].count('$RULE'))\")\" = 1 ]"
-want "permission: re-install does NOT re-attribute OUR rule to the operator (provenance is sticky)" \
-  "[ \"\$(python3 -c \"import json;print(json.load(open('$PSTATE'))['ruleExistedBefore'])\")\" = False ]"
+want "permission: re-install is idempotent (every rule appears exactly once)" \
+  "[ \"\$(python3 -c \"import json;a=json.load(open('$SETTINGS'))['permissions']['allow'];print(max(a.count(r) for r in '''$RULES'''.split()))\")\" = 1 ]"
+want "permission: re-install does NOT re-attribute OUR rules to the operator (provenance is sticky)" \
+  "[ \"\$(python3 -c \"import json;e=json.load(open('$PSTATE'))['rulesExistedBefore'];print(any(e.values()))\")\" = False ]"
 
 # Honest inverse after those re-installs: WE created the file and both containers, so nothing of
 # ours may survive. (Before the provenance fix, install×2 → uninstall left the rule behind.)
@@ -496,16 +536,145 @@ bash "$BRIDGE" uninstall >/dev/null 2>&1
 want "permission: uninstall takes back ONLY our rule, leaving the operator's structure intact" \
   "python3 -c \"import json,sys;p=json.load(open('$SETTINGS'))['permissions'];sys.exit(0 if p['allow']==['command(*)'] and p['deny']==['read_file(/etc)'] else 1)\""
 
-# The rule was ALREADY the operator's before we ever installed → it was never ours to take away.
+# The rules were ALREADY the operator's before we ever installed → never ours to take away. Written
+# as the FULL set so that nothing here is ours: provenance is per rule, so a host where the operator
+# granted some and we added the rest is the MIXED case, pinned separately below.
+python3 -c "import json;json.dump({'permissions':{'allow':'''$RULES'''.split()}},open('$SETTINGS','w'))"
+bash "$BRIDGE" install >/dev/null 2>&1
+want "permission: an operator's pre-existing rules are recorded as theirs (rulesExistedBefore)" \
+  "[ \"\$(python3 -c \"import json;e=json.load(open('$PSTATE'))['rulesExistedBefore'];print(all(e.values()))\")\" = True ]"
+bash "$BRIDGE" uninstall >/dev/null 2>&1
+want "permission: uninstall does NOT revoke rules the operator already had" "has_rule '$SETTINGS'"
+
+# ── v1 → v2 permission-state migration, from a REAL v1 fixture ───────────────
+# A shipped host is mid-migration right now: its permission-state was written by an entwurf that
+# granted one rule and recorded `rule`/`ruleExistedBefore`. The release contract is that upgrading
+# carries that answer instead of re-capturing it — a re-capture would read the rule WE wrote as the
+# operator's and strand it, or read THEIRS as ours and delete it. Prose claimed this; now the gate
+# owns it, including a direct uninstall from an unmigrated v1 state.
+V1_RULE="$RULE"                      # what a v1 install granted
+V1_OTHER="${RULES#* }"; V1_OTHER="${V1_OTHER%% *}"   # second rule: operator-owned in this fixture
+V1_NEW="${RULES##* }"                # third rule: nobody has it yet → ours on migration
+rm -f "$STATE" "$PSTATE"
+python3 -c "import json;json.dump({'permissions':{'allow':['$V1_RULE','$V1_OTHER']}},open('$SETTINGS','w'))"
+python3 -c "
+import json,os
+json.dump({'schemaVersion':1,'managedSettingsPath':os.path.abspath('$SETTINGS'),
+           'rule':'$V1_RULE','detectMode':'adopt-regular-file','settingsExistedBefore':True,
+           'permissionsExistedBefore':True,'allowExistedBefore':True,'ruleExistedBefore':False,
+           'installedAt':'2026-07-26T00:00:18Z'}, open('$PSTATE','w'))"
+want "v1→v2: a v1 permission-state uninstalls on its own shape (removes ours, keeps theirs)" \
+  "bash '$BRIDGE' uninstall >/dev/null 2>&1 && python3 -c \"import json,sys;a=json.load(open('$SETTINGS'))['permissions']['allow'];sys.exit(0 if a==['$V1_OTHER'] else 1)\""
+
+# Now the migration proper: same v1 fixture, but install (upgrade) runs first.
+rm -f "$STATE" "$PSTATE"
+python3 -c "import json;json.dump({'permissions':{'allow':['$V1_RULE','$V1_OTHER']}},open('$SETTINGS','w'))"
+python3 -c "
+import json,os
+json.dump({'schemaVersion':1,'managedSettingsPath':os.path.abspath('$SETTINGS'),
+           'rule':'$V1_RULE','detectMode':'adopt-regular-file','settingsExistedBefore':True,
+           'permissionsExistedBefore':True,'allowExistedBefore':True,'ruleExistedBefore':False,
+           'installedAt':'2026-07-26T00:00:18Z'}, open('$PSTATE','w'))"
+bash "$BRIDGE" install >/dev/null 2>&1
+want "v1→v2: install migrates the state in place (schemaVersion 2, per-rule provenance)" \
+  "[ \"\$(python3 -c \"import json;s=json.load(open('$PSTATE'));print(s['schemaVersion']==2 and isinstance(s.get('rulesExistedBefore'),dict))\")\" = True ]"
+# The three-way answer, which is the whole point of per-rule provenance:
+#   the v1 rule stays OURS (carried, not re-read)  ·  the operator's rule stays THEIRS
+#   the newly granted tool becomes OURS
+want "v1→v2: provenance is carried per rule (v1 rule ours, operator's rule theirs, new rule ours)" \
+  "[ \"\$(python3 -c \"import json;e=json.load(open('$PSTATE'))['rulesExistedBefore'];print(e['$V1_RULE'] is False and e['$V1_OTHER'] is True and e['$V1_NEW'] is False)\")\" = True ]"
+bash "$BRIDGE" uninstall >/dev/null 2>&1
+want "v1→v2: the migrated inverse takes back only ours and leaves the operator's rule" \
+  "python3 -c \"import json,sys;a=json.load(open('$SETTINGS'))['permissions']['allow'];sys.exit(0 if a==['$V1_OTHER'] else 1)\""
+
+# A state shape we cannot read must REFUSE, never fall through to "nothing was theirs" and revoke.
+rm -f "$STATE" "$PSTATE"
+python3 -c "import json;json.dump({'permissions':{'allow':'''$RULES'''.split()}},open('$SETTINGS','w'))"
+python3 -c "
+import json,os
+json.dump({'schemaVersion':99,'managedSettingsPath':os.path.abspath('$SETTINGS')}, open('$PSTATE','w'))"
+want "malformed state: an unknown schemaVersion FAILS the uninstall instead of guessing" \
+  "! bash '$BRIDGE' uninstall >/dev/null 2>&1"
+want "malformed state: and the operator's rules are still there afterwards (no blind revoke)" \
+  "has_rule '$SETTINGS'"
+# The specific deletion hazard: a v2 state whose provenance map is EMPTY. Read permissively, every
+# rule reads as "not theirs" and the inverse revokes the operator's whole set.
+python3 -c "
+import json,os
+json.dump({'schemaVersion':2,'managedSettingsPath':os.path.abspath('$SETTINGS'),
+           'rules':'''$RULES'''.split(),'rulesExistedBefore':{}}, open('$PSTATE','w'))"
+want "malformed state: an INCOMPLETE provenance map fails loud (it must not promote their rules to ours)" \
+  "! bash '$BRIDGE' uninstall >/dev/null 2>&1"
+want "malformed state: the operator's rules survive the incomplete-provenance refusal" \
+  "has_rule '$SETTINGS'"
+
+# INSTALL must refuse the same unreadable prior, not silently re-capture over it. A shallow shape
+# check (dict? values bool?) passes an EMPTY map — all() of nothing is true — and the reinstall then
+# rewrote provenance from disk, which is exactly the re-capture this state file exists to prevent:
+# every rule would be recorded as the operator's and the inverse would decline to remove any of it.
+python3 -c "
+import json,os
+json.dump({'schemaVersion':2,'managedSettingsPath':os.path.abspath('$SETTINGS'),
+           'rules':'''$RULES'''.split(),'rulesExistedBefore':{}}, open('$PSTATE','w'))"
+PRE_S="$(python3 -c "import hashlib;print(hashlib.sha256(open('$SETTINGS','rb').read()).hexdigest())")"
+PRE_P="$(python3 -c "import hashlib;print(hashlib.sha256(open('$PSTATE','rb').read()).hexdigest())")"
+want "malformed state: INSTALL refuses an unreadable prior instead of re-capturing provenance [QK:AGY-INSTALL-MALFORMED-PRIOR]" \
+  "! bash '$BRIDGE' install >/dev/null 2>&1"
+want "malformed state: the refused install left settings AND state byte-identical" \
+  "[ \"\$(python3 -c \"import hashlib;print(hashlib.sha256(open('$SETTINGS','rb').read()).hexdigest())\")\" = '$PRE_S' ] && \
+   [ \"\$(python3 -c \"import hashlib;print(hashlib.sha256(open('$PSTATE','rb').read()).hexdigest())\")\" = '$PRE_P' ]"
+
+# A refusal must leave the world untouched even when the settings file is GONE. The validation used
+# to run inside the settings-exists branch, so on this host it was first reached in the closing
+# message — AFTER os.remove(state_path). The safety check destroyed the only record of what we owed.
+rm -f "$SETTINGS"
+want "malformed state: uninstall refuses when the settings file is absent (nothing to guess from) [QK:AGY-UNINSTALL-VALIDATE-FIRST]" \
+  "! bash '$BRIDGE' uninstall >/dev/null 2>&1"
+want "malformed state: the refused uninstall did NOT delete the permission-state" \
+  "[ -f '$PSTATE' ]"
+
+# DOCTOR must not round a corrupt ownership record up to green. Runtime here is perfect — all three
+# rules present, agy prompts on nothing — while the record that tells our grants from theirs is
+# unreadable. Hard rule 13: runtime truth and ownership truth are separate axes.
+python3 -c "import json;json.dump({'permissions':{'allow':'''$RULES'''.split()}},open('$SETTINGS','w'))"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then
+  die "corrupt-ownership: doctor must FAIL on an unreadable permission-state even when runtime is fine [QK:AGY-DOCTOR-OWNERSHIP-AXIS]"
+fi
+ok "permission: doctor FAILS on a path-correct but UNREADABLE permission-state (ownership axis)"
+DOC_OUT="$(bash "$BRIDGE" doctor 2>&1 || true)"
+want "permission: the corrupt-ownership report names the axis and does not blame runtime" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'CORRUPT (permission)'"
+rm -f "$STATE" "$PSTATE"
+
+# CROSS-LIST scope: broad-most-covering is a statement about the whole file, not about one list.
+# A deny of ONE exact tool next to an ask of the server-wide rule is a host where EVERYTHING is
+# shadowed; naming the exact hit because `deny` is scanned first would tell the operator their other
+# grants still work while agy prompts on all of them.
+python3 -c "
+import json
+json.dump({'permissions':{'allow':'''$RULES'''.split(),
+                          'deny':['${RULES##* }'],
+                          'ask':['mcp(entwurf-bridge)']}}, open('$SETTINGS','w'))"
+want "cross-list shadow: a broad rule in ANY list outranks an exact hit in a higher-precedence list" \
+  "[ \"\$(python3 '$REPO_DIR/scripts/agy-bridge-config.py' permission-doctor '$SETTINGS' | cut -d' ' -f2)\" = broad ]"
+DOC_OUT="$(bash "$BRIDGE" doctor 2>&1 || true)"
+want "cross-list shadow: the report says EVERY call is blocked, not 'other grants still work'" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'EVERY entwurf tool call'"
+rm -f "$STATE" "$PSTATE"
+
+# MIXED provenance — the shape agy's own "always allow" prompt creates, one rule at a time. The
+# operator owns one; we add the rest; the inverse must split them exactly, taking back only ours.
+rm -f "$STATE" "$PSTATE"
 printf '{"permissions":{"allow":["%s"]}}\n' "$RULE" > "$SETTINGS"
 bash "$BRIDGE" install >/dev/null 2>&1
-want "permission: an operator's pre-existing rule is recorded as theirs (ruleExistedBefore)" \
-  "[ \"\$(python3 -c \"import json;print(json.load(open('$PSTATE'))['ruleExistedBefore'])\")\" = True ]"
+want "permission: mixed provenance is recorded per rule (theirs stays theirs, ours stays ours)" \
+  "[ \"\$(python3 -c \"import json;e=json.load(open('$PSTATE'))['rulesExistedBefore'];print(e['$RULE'] is True and sum(1 for v in e.values() if v is False)==len(e)-1)\")\" = True ]"
 bash "$BRIDGE" uninstall >/dev/null 2>&1
-want "permission: uninstall does NOT revoke a rule the operator already had" "has_rule '$SETTINGS'"
+want "permission: uninstall keeps THEIR rule and removes only the ones WE added" \
+  "python3 -c \"import json,sys;a=json.load(open('$SETTINGS'))['permissions']['allow'];sys.exit(0 if a==['$RULE'] else 1)\""
 
 # ── K2: TWO adapters, ONE file — element ownership is what keeps them apart ────
-# The statusline adapter owns the `statusLine` subtree of this same settings.json; we own one string
+# The statusline adapter owns the `statusLine` subtree of this same settings.json; we own our rules
 # in `permissions.allow`. Neither may restore a whole-file preimage, or uninstalling one would
 # silently revert the other. Both orders, both inverses.
 rm -f "$SETTINGS" "$PSTATE" "$SLSTATE"
@@ -550,6 +719,22 @@ ok "permission: doctor FAILS when a higher-precedence ask/deny rule shadows our
 DOC_OUT="$(bash "$BRIDGE" doctor 2>&1 || true)"
 want "permission: the shadow report names the offending list and rule" \
   "printf '%s' \"\$DOC_OUT\" | grep -q 'SHADOWED'"
+want "permission: a BROAD shadow is described as covering EVERY entwurf tool call" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'EVERY entwurf tool call'"
+
+# SCOPE HONESTY: an EXACT shadow takes one tool, not the surface. Saying "every entwurf tool call is
+# blocked" when only entwurf_self is sends the operator hunting a wildcard that is not there. The
+# verdict stays red — a granted tool that agy still stops on is not green — but the diagnosis must
+# match what agy will actually do.
+EXACT_SHADOW="${RULES##* }"   # last rule in the set, shadowed alone
+python3 -c "
+import json
+json.dump({'permissions':{'allow':'''$RULES'''.split(),'ask':['$EXACT_SHADOW']}}, open('$SETTINGS','w'))"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "exact-shadow: doctor should FAIL when one of our tools is shadowed"; fi
+ok "permission: doctor FAILS when an EXACT rule shadows one granted tool (still not green)"
+DOC_OUT="$(bash "$BRIDGE" doctor 2>&1 || true)"
+want "permission: an EXACT shadow names that ONE tool and does NOT claim every call is blocked" \
+  "printf '%s' \"\$DOC_OUT\" | grep -qF '$EXACT_SHADOW' && printf '%s' \"\$DOC_OUT\" | grep -q 'that ONE tool' && ! printf '%s' \"\$DOC_OUT\" | grep -q 'EVERY entwurf tool call'"
 
 # THE MIRROR OF IT: the same rules that shadow our allow from ask/deny COVER it from allow. An
 # operator who granted a broad mcp(*) has already made entwurf_v2 callable — reporting that host as
@@ -588,11 +773,11 @@ want "permission: an operator wildcard does NOT mask drift of the rule WE instal
 want "permission: the owned-drift report names both axes (our grant gone, their rule covering)" \
   "printf '%s' \"\$DOC_OUT\" | grep -q 'DRIFT' && printf '%s' \"\$DOC_OUT\" | grep -qF 'mcp(*)'"
 
-# …but an operator's OWN pre-existing rule vanishing is not our drift: ruleExistedBefore=true means
-# the rule was never ours to lose. Their file, their edit; the wildcard covering it stays a NOTE.
+# …but an operator's OWN pre-existing rules vanishing is not our drift: rulesExistedBefore all true
+# means nothing here was ours to lose. Their file, their edit; the wildcard covering it stays a NOTE.
 rm -f "$STATE" "$PSTATE"
-printf '{"permissions":{"allow":["%s"]}}\n' "$RULE" > "$SETTINGS"
-bash "$BRIDGE" install >/dev/null 2>&1   # rule pre-existed → recorded as theirs
+python3 -c "import json;json.dump({'permissions':{'allow':'''$RULES'''.split()}},open('$SETTINGS','w'))"
+bash "$BRIDGE" install >/dev/null 2>&1   # rules pre-existed → recorded as theirs
 python3 -c "import json;d=json.load(open('$SETTINGS'));d['permissions']['allow']=['mcp(*)'];json.dump(d,open('$SETTINGS','w'))"
 if ! bash "$BRIDGE" doctor >/dev/null 2>&1; then
   die "covered: losing the OPERATOR's own pre-existing rule must not be reported as OUR drift"

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -66,8 +66,9 @@ import {
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
-// pi's control socket lives at the canonical dir keyed by session id — pi owns this path, so
-// C1 must point the decider's controlSocketDir at the REAL dir (a fresh gid avoids collision).
+// pi's control socket lives at the canonical dir keyed by the RECORD's garden id (#50 C4: the
+// record is the sole address authority — never a transcript/session id; :196 below proves it),
+// so C1 must point the decider's controlSocketDir at the REAL dir (a fresh gid avoids collision).
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 // Release-gate topology: repo-under-test, not deployment smoke. Load only this

package/scripts/smoke-meta-install-state.sh

@@ -534,7 +534,7 @@ valid_record "20260606T000000-aaaaaa" "native-a" > "$STORE/20260606T000000-aaaaa
 valid_record "20260606T000001-bbbbbb" "native-b" > "$STORE/20260606T000001-bbbbbb.meta.json"
 
 STATUS_INPUT_MATCH='{"session_id":"native-a","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":2,"current_usage":{"input_tokens":10}}}'
-STATUS_INPUT_MISS='{"session_id":"native-missing","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-opus-4-8"}}'
+STATUS_INPUT_MISS='{"session_id":"native-missing","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-opus-5"}}'
 STATUS_INPUT_READY='{"workspace":{"current_dir":"/tmp"},"model":{"id":"claude-haiku-4-5"}}'
 STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
 if [ "$(printf '%s\n' "$STATUS_OUT_MATCH" | wc -l | tr -d ' ')" = "2" ]; then ok "statusline renders exactly two rows"; else bad "statusline should render two rows: $STATUS_OUT_MATCH"; fi

package/scripts/smoke-pi-attach.ts

@@ -52,12 +52,17 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { type AcpKeyValue, type AcpMcpServer, enrichMcpServersWithEnvelope } from "../pi-extensions/lib/acp/config.ts";
-import { listAllMetaIdentities, parseMetaRecordV3 } from "../pi-extensions/lib/meta-session.ts";
+import {
+	listAllMetaIdentities,
+	makeStoreRecordReader,
+	parseMetaRecordV3,
+	readActiveStoreEntries,
+} from "../pi-extensions/lib/meta-session.ts";
 import { birthPiCitizen } from "../pi-extensions/lib/pi-citizen-birth.ts";
 
 /** Record count in the isolated store, read the same way production reads it. */
 function citizenCount(dir: string): number {
-	return listAllMetaIdentities(fs.readdirSync(dir), (f) => fs.readFileSync(path.join(dir, f), "utf8"), {
+	return listAllMetaIdentities(readActiveStoreEntries(dir), makeStoreRecordReader(dir), {
 		mode: "strict",
 	}).identities.length;
 }

package/scripts/smoke-user-scope-citizen.sh

@@ -9,6 +9,11 @@
 # statusline `?` had a tripwire; THIS omission had none and hid until GLG hit it
 # in another repo. This gate is that missing tripwire: if the registration ever
 # regresses, `pnpm check` goes red.
+#
+# Cells 11–13 close the second omission (#53 B): every case here drove a fake
+# settings file with ABSOLUTE entries, so the portable, settings-relative form this
+# repo actually commits was never registered against — and `setup` duplicated and
+# restyled the tracked file for four cuts without a single gate seeing it.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -187,5 +192,177 @@ assert d['defaultProvider']=='openai-codex', 'run.sh remove-user-scope dropped a
 # idempotent: a second remove-user-scope is a clean no-op (no crash on absent entry)
 if XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1; then ok "run.sh remove-user-scope is idempotent (no-op second run)"; else bad "run.sh remove-user-scope second run crashed"; fi
 
+# ── 11–13. #53 B: install must not dirty a tracked, formatter-governed settings file
+# The cell whose ABSENCE let this ship. Every case above drove a fake settings file
+# with absolute entries, so the one shape this repo actually commits — the portable,
+# settings-relative `".."` that check-install-surface S7c pins — was never registered
+# against. `setup` therefore appended the absolute path BESIDE it and rewrote the
+# tracked, biome-owned bytes at indent=2, and `pnpm check` died at step 1 reading
+# "format error" instead of "install wrote this".
+#
+# The seed is the repo's OWN committed settings, copied into a stand-in checkout so
+# `".."` resolves to that clone rather than to the real repo (nothing here touches
+# $REPO). Setup landing is PROVEN before any product verdict: if the seed is not the
+# portable form, this says SETUP MISS in its own name instead of blaming the code.
+CLONE="$TMP/selfclone"; mkdir -p "$CLONE/.pi"
+CS="$CLONE/.pi/settings.json"
+seed_src=""
+if (cd "$REPO" && git show :.pi/settings.json) > "$CS" 2>/dev/null && [ -s "$CS" ]; then
+  seed_src="candidate index"
+elif cp "$REPO/.pi/settings.json" "$CS" 2>/dev/null; then
+  seed_src="worktree"
+fi
+if [ ! -s "$CS" ]; then
+  bad "11 SETUP MISS: could not seed this repo's own .pi/settings.json (no git object, no worktree file)"
+elif ! python3 -c "
+import json,sys
+p=json.load(open(sys.argv[1])).get('packages')
+sys.exit(0 if p==['..'] else 1)" "$CS"; then
+  bad "11 SETUP MISS: the seed ($seed_src) is not the committed portable form (packages != ['..']) — product verdict withheld"
+else
+  BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
+  OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
+  AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
+  if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
+    ok "11 register against this repo's OWN committed settings is a no-op (seed: $seed_src)"
+  else
+    bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
+  fi
+  if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
+    ok "11b the tracked, formatter-governed bytes are UNCHANGED (sha256 + mtime)"
+  else
+    bad "11b install rewrote the tracked settings file (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
+  fi
+  # The inverse direction of the same asymmetry: the shared matcher now RECOGNIZES
+  # `".."`, so an uninstall that deleted it would edit committed source — the same
+  # defect pointed the other way. remove leaves it and says so; dry-run agrees,
+  # because both ask one predicate.
+  BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
+  OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
+  OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
+  if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
+    ok "11c --remove does NOT delete the committed portable entry (bytes unchanged)"
+  else
+    bad "11c --remove edited the repo's committed settings source" "$OUT_RM"
+  fi
+  if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
+    ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
+  else
+    bad "11d --remove left the entry without saying so" "$OUT_RM"
+  fi
+  if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
+    ok "11e --dry-run agrees with remove (one predicate, no over-report)"
+  else
+    bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
+  fi
+fi
+
+# 12. the state a pre-fix `setup` already left on real hosts: the portable entry AND
+#     the absolute one. The repair must collapse onto the PORTABLE form — absolutizing
+#     it would fix the duplicate and dirty the tracked bytes in the same breath.
+DUP="$TMP/dupclone"; mkdir -p "$DUP/.pi"
+DS="$DUP/.pi/settings.json"
+cat > "$DS" <<JSON
+{"packages": ["..", "$DUP", "../../repos/gh/andenken"]}
+JSON
+python3 "$REG" "$DS" "$DUP" >/dev/null
+if python3 -c "
+import json
+p=json.load(open('$DS'))['packages']
+assert p.count('..')==1, f'the portable entry did not survive as the sole self-reference: {p}'
+assert '$DUP' not in p, f'the absolute path was written beside/instead of the portable one: {p}'
+assert '../../repos/gh/andenken' in p, 'unrelated relative package dropped'
+" 2>/dev/null; then ok "12 a duplicated ('..' + absolute) settings file repairs onto the PORTABLE entry"; else bad "12 the duplicate repair absolutized or dropped the portable entry: $(cat "$DS")"; fi
+
+# 13. a genuine rewrite keeps the file's own indent unit. Narrow by design: it does
+#     NOT make the output formatter-clean (biome also decides where short arrays
+#     collapse), which is why byte-identity for this repo's own file rests on the
+#     no-op above, not on the writer's style.
+printf '{\n\t"packages": [\n\t\t"/old/moved/entwurf"\n\t]\n}\n' > "$S"
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null
+if grep -q $'^\t"packages"' "$S"; then ok "13 a rewrite preserves the file's tab indentation (never forces 2 spaces)"; else bad "13 the rewrite restyled a file it does not own: $(cat -A "$S" | head -3)"; fi
+
+# ── 14. THE cell #53 B needed: the whole `run.sh install` drive, end to end ──
+# Cells 11–13 call ONE python writer. That is what let the second round ship: the same
+# settings file has TWO writers (register-pi-package for packages[], register-pi-provider
+# for entwurfProvider.mcpServers) plus a user-scope side effect, and closing only the
+# first left `install` still re-serializing this repo's tracked, biome-governed bytes at
+# indent=2 — semantically a no-op, byte-wise a RED `pnpm check` diagnosed as "formatting".
+# A per-writer cell can never see that; only the real drive can. So this one runs
+# `run.sh install <checkout>` for real and demands sha256 + mtime invariance.
+#
+# The checkout is a stand-in: run.sh resolves its OWN symlinks to find REPO_DIR, so
+# run.sh is COPIED (a link would point the drive back at the operator's real repo) while
+# the trees it only reads are linked. That makes REPO_DIR == the stand-in, which is the
+# shape that matters — `".."` in <checkout>/.pi/settings.json resolves to the very repo
+# being registered, exactly as it does in a dev clone.
+CK="$TMP/checkout"
+mkdir -p "$CK/.pi"
+cp "$REPO/run.sh" "$CK/run.sh"
+for entry in scripts node_modules package.json mcp pi-extensions pi protocol.js; do
+  [ -e "$REPO/$entry" ] && ln -s "$REPO/$entry" "$CK/$entry"
+done
+CKS="$CK/.pi/settings.json"
+ck_seed=""
+if (cd "$REPO" && git show :.pi/settings.json) > "$CKS" 2>/dev/null && [ -s "$CKS" ]; then
+  ck_seed="candidate index"
+elif cp "$REPO/.pi/settings.json" "$CKS" 2>/dev/null; then
+  ck_seed="worktree"
+fi
+# Landing is PROVEN before any product verdict — a bad seed or a drive that died for its
+# own reasons is SETUP MISS, never "install dirtied the file".
+if [ ! -s "$CKS" ]; then
+  bad "14 SETUP MISS: could not seed the stand-in checkout's .pi/settings.json"
+elif ! python3 -c "
+import json,sys
+d=json.load(open(sys.argv[1]))
+sys.exit(0 if d.get('packages')==['..'] and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
+  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed portable form (packages ['..'] + entwurfProvider)"
+else
+  CK_BEFORE="$(sha256sum "$CKS" | cut -d' ' -f1)"; CK_MT="$(stat -c %Y "$CKS")"
+  sleep 1
+  set +e
+  # Isolated on the same line as the drive, not only by the exports above: this is a
+  # MUTATING run.sh command and it writes through three roots (agent dir, XDG state,
+  # $HOME for the user-scope registration). check-install-surface S5c matches the drive
+  # and then demands exactly these — which is why the path is unquoted here, so the
+  # tripwire can SEE the drive it is meant to police.
+  ck_out="$(HOME="$TMP/home" XDG_DATA_HOME="$TMP/xdg" XDG_STATE_HOME="$TMP/state" XDG_CACHE_HOME="$TMP/cache" PI_CODING_AGENT_DIR="$TMP/agent14" bash $CK/run.sh install "$CK" 2>&1)"
+  ck_rc=$?
+  set -e
+  if [ "$ck_rc" != 0 ]; then
+    bad "14 SETUP MISS: the stand-in \`run.sh install\` drive did not complete (exit $ck_rc) — no byte verdict from a drive that failed for its own reasons" "$ck_out"
+  else
+    ok "14 the stand-in \`run.sh install\` drive completed (seed: $ck_seed)"
+    if [ "$CK_BEFORE" = "$(sha256sum "$CKS" | cut -d' ' -f1)" ] && [ "$CK_MT" = "$(stat -c %Y "$CKS")" ]; then
+      ok "14b end-to-end: install left the tracked .pi/settings.json byte-identical (sha256 + mtime)"
+    else
+      bad "14b \`run.sh install\` rewrote the tracked settings file — one of its writers does not know the contract" "$(diff <(printf '%s' "$CK_BEFORE") <(sha256sum "$CKS" | cut -d' ' -f1); cat -A "$CKS" | head -6)"
+    fi
+    # The drive really did reach the writers (a no-op that never ran proves nothing), and
+    # the user-scope side effect landed in the sandbox rather than the operator's home.
+    case "$ck_out" in
+      *"entwurf-bridge"*) ok "14c the provider writer really ran (it reported its classification)" ;;
+      *) bad "14c the drive never reached the provider writer — 14b would be vacuous" "$ck_out" ;;
+    esac
+    if [ -f "$TMP/agent14/settings.json" ]; then
+      ok "14d the user-scope registration landed in the SANDBOX agent dir (isolation held)"
+    else
+      bad "14d the user-scope citizen was not written under the sandboxed PI_CODING_AGENT_DIR" "$ck_out"
+    fi
+  fi
+fi
+
+# 15. WIRING: both writers of this one file must share the serializer, not copy it.
+#     A duplicated indent-detector is how the provider writer stayed open after the
+#     package writer was closed; a parity check is cheaper than a third round.
+for w in register-pi-package.py register-pi-provider.py; do
+  if grep -q "from pi_settings_io import" "$REPO/scripts/$w"; then
+    ok "15 $w routes through the shared pi_settings_io serializer"
+  else
+    bad "15 $w serializes settings on its own again (copied rule = the #53 B shape)"
+  fi
+done
+
 echo
 if [ "$fail" -eq 0 ]; then echo "smoke-user-scope-citizen: PASS"; else echo "smoke-user-scope-citizen: FAIL (see above)"; exit 1; fi

package/pi-extensions/lib/entwurf-mailbox-guard.ts

@@ -1,100 +0,0 @@
-/**
- * entwurf-mailbox-guard — the IO orchestration that gates a conversational mailbox
- * enqueue on the (pure) deliverability predicate (SE-1/SE-2 slice 2d). Kept SEPARATE
- * from entwurf-deliverability.ts so the predicate stays pure (gate-pinnable) and only
- * this thin wrapper touches the record store / capability registry / presence marker.
- *
- * The contract every conversational-reply enqueue site (MCP entwurf_v2 fallback,
- * pi-native entwurf_v2 fallback) must use INSTEAD of calling enqueueMetaMessage
- * directly:
- *   1. gather facts for the target garden id (record? wakeMode? receiver active?),
- *   2. ask mailboxConversationalDeliverable,
- *   3. enqueue ONLY when deliverable; otherwise return a typed non-delivery with a
- *      reason — no .msg written, no doorbell poked.
- *
- * This is the SE-2 "no garbage in a dead/absent receiver's mailbox" guard and the
- * SE-1 "never enqueue for a backend with no mailbox drain (pi)" guard, in one place.
- * The low-level enqueueMetaMessage stays a raw primitive — it has no in-band reject;
- * the refusal happens HERE, before transport, not inside it.
- */
-
-import {
-	type MailboxDeliverabilityFacts,
-	mailboxConversationalDeliverable,
-	receiverMarkerMatchesIdentity,
-} from "./entwurf-deliverability.ts";
-import {
-	type MetaCapability,
-	type MetaCitizenBackend,
-	type MetaIdentity,
-	type MetaReceiverMarker,
-	metaCapabilityFor,
-	readMetaIdentityByGardenId,
-	readMetaReceiverMarker,
-} from "./meta-session.ts";
-
-export interface MailboxGuardDeps {
-	/** Read the target's identity (throws when there is no backing record). */
-	readIdentity?: (gardenId: string) => MetaIdentity;
-	/** Read the target's receiver presence marker (null = no live, armed receiver). */
-	readReceiverMarker?: (gardenId: string) => MetaReceiverMarker | null;
-	/** Resolve a backend's capability (wake mode). */
-	capabilityFor?: (backend: MetaCitizenBackend) => MetaCapability;
-}
-
-/**
- * Gather the deliverability facts for a target garden id, all via injected (or
- * production-default) readers. recordBacked/wakeMode come from the record + capability
- * registry; ownerAlive and watchArmed both derive from the receiver presence marker —
- * at runtime they move together (a verified marker means a live owner that reached the
- * watch-arm path; its absence/dead-owner means neither), but the pure predicate keeps
- * the axes separate so each cause stays nameable. A present marker only counts when it
- * actually belongs to THIS identity (garden/backend/native id match via the shared
- * receiverMarkerMatchesIdentity helper) — a drifted/foreign marker is fail-closed to
- * inactive, the same SSOT the v2 production mailboxDeliverabilityFor seam uses.
- */
-export function gatherMailboxDeliverabilityFacts(
-	gardenId: string,
-	deps: MailboxGuardDeps = {},
-): MailboxDeliverabilityFacts {
-	const readIdentity = deps.readIdentity ?? ((g: string) => readMetaIdentityByGardenId(g));
-	const readReceiverMarker = deps.readReceiverMarker ?? ((g: string) => readMetaReceiverMarker({ gardenId: g }));
-	const capabilityFor = deps.capabilityFor ?? metaCapabilityFor;
-
-	let recordBacked = false;
-	let wakeMode: string | undefined;
-	let identity: MetaIdentity | null = null;
-	try {
-		identity = readIdentity(gardenId);
-		recordBacked = true;
-		wakeMode = capabilityFor(identity.backend).wakeMode;
-	} catch {
-		recordBacked = false;
-		identity = null;
-	}
-
-	// No record → no identity → never matched (a marker without a record cannot be
-	// verified against one). With a record, the marker must agree on garden/backend/
-	// native id; otherwise it is a stale or foreign marker and the receiver is inactive.
-	const marker = readReceiverMarker(gardenId);
-	const matched = identity !== null && receiverMarkerMatchesIdentity(marker, identity);
-	return { wakeMode, recordBacked, ownerAlive: matched, watchArmed: matched };
-}
-
-export type GuardedMailboxOutcome<T> = { delivered: true; result: T } | { delivered: false; reason: string };
-
-/**
- * Enqueue a conversational reply to the target's mailbox ONLY when it is deliverable.
- * When not, returns `{ delivered: false, reason }` and the injected `enqueue` is never
- * called — the SE-2 guarantee that a refused send mutates nothing.
- */
-export function guardedMailboxEnqueue<T>(
-	gardenId: string,
-	deps: MailboxGuardDeps,
-	enqueue: () => T,
-): GuardedMailboxOutcome<T> {
-	const facts = gatherMailboxDeliverabilityFacts(gardenId, deps);
-	const verdict = mailboxConversationalDeliverable(facts);
-	if (!verdict.deliverable) return { delivered: false, reason: verdict.reason };
-	return { delivered: true, result: enqueue() };
-}