@junghanacs/entwurf 0.12.9 → 0.12.10

package/scripts/mutants/acp-augment.json

@@ -0,0 +1,30 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-augment",
+	"mutants": [
+		{
+			"claim": "AUGMENT-BUDGET-FITS",
+			"title": "shrinking the augment cap re-opens the tail-cut that hid AGENTS rules + cwd from ACP siblings",
+			"subject": "pi-extensions/lib/acp/augment.ts",
+			"find": ["const MAX_AUGMENT_BYTES = 50 * 1024;"],
+			"replace": ["const MAX_AUGMENT_BYTES = 20 * 1024;"],
+			"gate": ["bash", "run.sh", "check-acp-carrier-augment"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:AUGMENT-BUDGET-FITS]",
+			"signatureSource": "scripts/check-acp-carrier-augment.ts"
+		},
+		{
+			"claim": "AUGMENT-TRUNC-MARKER",
+			"title": "silent truncation: dropping the honest marker leaves a cut augment with no trace",
+			"subject": "pi-extensions/lib/acp/augment.ts",
+			"find": [
+				"\tconst marker = `\\n\\n[entwurf: context augment truncated to ${MAX_AUGMENT_BYTES} bytes; read AGENTS.md files directly if more detail is needed.]`;"
+			],
+			"replace": ["\tconst marker = \"\";"],
+			"gate": ["bash", "run.sh", "check-acp-carrier-augment"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:AUGMENT-TRUNC-MARKER]",
+			"signatureSource": "scripts/check-acp-carrier-augment.ts"
+		}
+	]
+}

package/scripts/mutants/agy-permission.json

@@ -0,0 +1,144 @@
+{
+	"schemaVersion": 1,
+	"lane": "agy-permission",
+	"mutants": [
+		{
+			"claim": "AGY-EXACT-RULE-SET",
+			"title": "over-grant: adding entwurf_inbox_read to ALLOW_RULES must die at the independent literal oracle",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": [
+				"ALLOW_RULES = tuple(f\"mcp({SERVER_KEY}/{tool})\" for tool in (\"entwurf_v2\", \"entwurf_peers\", \"entwurf_self\"))"
+			],
+			"replace": [
+				"ALLOW_RULES = tuple(",
+				"    f\"mcp({SERVER_KEY}/{tool})\" for tool in (\"entwurf_v2\", \"entwurf_peers\", \"entwurf_self\", \"entwurf_inbox_read\")",
+				")"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:AGY-EXACT-RULE-SET]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-INSTALL-MALFORMED-PRIOR",
+			"title": "install reverts to a shallow prior-state check (empty provenance map passes all()) and re-captures",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": [
+				"        try:",
+				"            _prior_rules, prior_existed = _parse_permission_state(prior)",
+				"        except _PermissionStateError as exc:",
+				"            _die(4, f\"agy-bridge: prior permission install-state is unusable — {exc}. Refusing to \"",
+				"                    \"overwrite provenance this entwurf cannot read; inspect it by hand.\")",
+				"        for rule in ALLOW_RULES:",
+				"            if rule in prior_existed:",
+				"                rules_existed[rule] = prior_existed[rule]"
+			],
+			"replace": [
+				"        if prior.get(\"schemaVersion\") == 1:",
+				"            legacy_rule = prior.get(\"rule\")",
+				"            if isinstance(legacy_rule, str) and isinstance(prior.get(\"ruleExistedBefore\"), bool):",
+				"                if legacy_rule in ALLOW_RULES:",
+				"                    rules_existed[legacy_rule] = prior[\"ruleExistedBefore\"]",
+				"        else:",
+				"            prior_existed = prior.get(\"rulesExistedBefore\")",
+				"            if isinstance(prior_existed, dict) and all(isinstance(v, bool) for v in prior_existed.values()):",
+				"                for rule in ALLOW_RULES:",
+				"                    if rule in prior_existed:",
+				"                        rules_existed[rule] = prior_existed[rule]"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:AGY-INSTALL-MALFORMED-PRIOR]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-UNINSTALL-VALIDATE-FIRST",
+			"title": "uninstall validates the state only inside the settings-exists branch (refusal after mutation)",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": [
+				"    ours = _owned_rules(state)",
+				"",
+				"    if os.path.islink(settings_path):",
+				"        _die(3, f\"agy-bridge: refusing to uninstall — {settings_path} became a symlink since install \"",
+				"                f\"(someone else's SSOT now). Resolve by hand.\")",
+				"",
+				"    if os.path.exists(settings_path):",
+				"        data = _load_config(settings_path)"
+			],
+			"replace": [
+				"    if os.path.islink(settings_path):",
+				"        _die(3, f\"agy-bridge: refusing to uninstall — {settings_path} became a symlink since install \"",
+				"                f\"(someone else's SSOT now). Resolve by hand.\")",
+				"",
+				"    ours = []",
+				"    if os.path.exists(settings_path):",
+				"        data = _load_config(settings_path)",
+				"        ours = _owned_rules(state)"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:AGY-UNINSTALL-VALIDATE-FIRST]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-OWNERSHIP-AXIS",
+			"title": "the state-doctor rounds a path-correct but unreadable ownership record up to ok",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": [
+				"    try:",
+				"        rules, _existed = _parse_permission_state(state)",
+				"    except _PermissionStateError as exc:",
+				"        sys.stdout.write(f\"corrupt {exc}\\n\")",
+				"        return",
+				"    sys.stdout.write(f\"ok {len(rules)}\\n\")"
+			],
+			"replace": ["    sys.stdout.write(\"ok 0\\n\")"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:AGY-DOCTOR-OWNERSHIP-AXIS]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-CROSS-LIST-BROAD-FIRST",
+			"title": "broad-most-covering runs only within each list, so a deny-exact shadows an ask-broad host wrongly",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": [
+				"    for rule_set, scope in ((BROAD_RULES, \"broad\"), (ALLOW_RULES, \"exact\")):",
+				"        for list_name in SHADOWING_LISTS:",
+				"            rules = perms.get(list_name)",
+				"            if not isinstance(rules, list):",
+				"                continue",
+				"            for rule in rules:",
+				"                if rule in rule_set:",
+				"                    sys.stdout.write(f\"shadowed-by-{list_name} {scope} {rule}\\n\")",
+				"                    return"
+			],
+			"replace": [
+				"    for list_name in SHADOWING_LISTS:",
+				"        rules = perms.get(list_name)",
+				"        if not isinstance(rules, list):",
+				"            continue",
+				"        for rule_set, scope in ((BROAD_RULES, \"broad\"), (ALLOW_RULES, \"exact\")):",
+				"            for rule in rules:",
+				"                if rule in rule_set:",
+				"                    sys.stdout.write(f\"shadowed-by-{list_name} {scope} {rule}\\n\")",
+				"                    return"
+			],
+			"gate": ["bash", "run.sh", "check-agy-permission-matrix"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:AGY-CROSS-LIST-BROAD-FIRST]",
+			"signatureSource": "scripts/check-agy-permission-matrix.py"
+		},
+		{
+			"claim": "AGY-SCHEMA-VERSIONS-APART",
+			"title": "re-merging the two state schema constants stamps a lying version onto the MCP install-state",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["STATE_SCHEMA_VERSION = 1  # MCP install-state (server key + preimage); shape unchanged"],
+			"replace": ["STATE_SCHEMA_VERSION = 2  # re-merged with the permission version (the schema re-merge defect)"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:AGY-SCHEMA-VERSIONS-APART]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		}
+	]
+}

package/scripts/mutants/meta-identity.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "meta-identity",
+	"mutants": [
+		{
+			"claim": "META-FIFO-NONBLOCK",
+			"title": "removing O_NONBLOCK makes a fifo-shaped record block the open — the 7/26 mutation evidence, committed",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\tconst fd = fs.openSync(file, fs.constants.O_RDONLY | O_NOFOLLOW_FLAG | O_NONBLOCK_FLAG);"],
+			"replace": ["\tconst fd = fs.openSync(file, fs.constants.O_RDONLY | O_NOFOLLOW_FLAG);"],
+			"gate": ["bash", "run.sh", "check-meta-identity-consumers"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:META-FIFO-NONBLOCK]",
+			"signatureSource": "scripts/check-meta-identity-consumers.ts"
+		}
+	]
+}

package/scripts/mutants/self-address.json

@@ -0,0 +1,59 @@
+{
+	"schemaVersion": 1,
+	"lane": "self-address",
+	"mutants": [
+		{
+			"claim": "SELFADDR-RAIL-RENDER",
+			"title": "entwurf_self reverts to an empty self-fetch guard + unconditional mailbox render (ordering-not-containment)",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\t\tif (rail === \"self-fetch\") {",
+				"\t\t\t\t\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+				"\t\t\t\t\textra.mailboxPath = mailboxPath;",
+				"\t\t\t\t\tlines.push(`mailboxPath: ${mailboxPath}`);",
+				"\t\t\t\t} else if (rail === \"native-push\") {"
+			],
+			"replace": [
+				"\t\t\t\tif (rail === \"self-fetch\") {",
+				"\t\t\t\t}",
+				"\t\t\t\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+				"\t\t\t\textra.mailboxPath = mailboxPath;",
+				"\t\t\t\tlines.push(`mailboxPath: ${mailboxPath}`);",
+				"\t\t\t\tif (rail === \"native-push\") {"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:SELFADDR-RAIL-RENDER]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		},
+		{
+			"claim": "SELFADDR-NO-HARDCODED-REPLYABLE",
+			"title": "buildStrictPiSenderEnvelope hardcodes replyable: true again (env presence read as reachability)",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\torigin: \"pi-session\",", "\t\treplyable: self.replyable,", "\t};", "}"],
+			"replace": ["\t\torigin: \"pi-session\",", "\t\treplyable: true,", "\t};", "}"],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:SELFADDR-NO-HARDCODED-REPLYABLE]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		},
+		{
+			"claim": "SELFADDR-RAIL-FACT-LEAK",
+			"title": "the native-push predicate lets a mailbox fact (watchArmed) buy replyability — behavioral, not text",
+			"subject": "pi-extensions/lib/entwurf-self-address.ts",
+			"find": [
+				"\t\t\t\t\tconst push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });"
+			],
+			"replace": [
+				"\t\t\t\t\tconst push = nativePushDeliverable({",
+				"\t\t\t\t\t\trecordBacked: facts.recordBacked,",
+				"\t\t\t\t\t\tprobeAlive: facts.probeAlive === true || facts.watchArmed === true,",
+				"\t\t\t\t\t});"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:SELFADDR-RAIL-FACT-LEAK]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -0,0 +1,87 @@
+{
+	"schemaVersion": 1,
+	"lane": "v2-surface",
+	"mutants": [
+		{
+			"claim": "V2SURF-MCP-LOCK-DOMAIN",
+			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY (do not \" +",
+				"\t\t\"over-generalize it): the per-target lock is taken for a control-socket-DOMAIN dispatch, which is \" +",
+				"\t\t\"both the live send AND the dormant cell's spawn-bg resume — spawn-bg is a separate relaunch \" +",
+				"\t\t\"transport yet it still runs under that domain's lock. The mailbox and native-push rails are \" +",
+				"\t\t\"lock-free: the mailbox is guarded instead by active-receiver deliverability, and native-push by \" +",
+				"\t\t\"its adapter probe. The decider — not the \" +"
+			],
+			"replace": [
+				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY: socket paths \" +",
+				"\t\t\"take a per-target lock; the mailbox path does not. The decider — not the \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-PI-MODE-SCOPE",
+			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push)",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": [
+				"\t\t\t\tdescription:",
+				"\t\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). \" +",
+				"\t\t\t\t\t\"The mailbox, native-push, and spawn-bg plans carry no mode, so it has no effect on those rails.\","
+			],
+			"replace": [
+				"\t\t\t\tdescription:",
+				"\t\t\t\t\t\"Delivery mode for a live send: steer (immediate, interrupt the current turn) or follow_up \" +",
+				"\t\t\t\t\t\"(queued after the current task finishes running to completion).\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-PI-MODE-SCOPE]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-INBOX-SCOPE-HONESTY",
+			"title": "entwurf_inbox_read reverts to the false \"drains your own inbox\" access claim (SCOPE paragraph gone)",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
+				"\t\t\"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against \" +",
+				"\t\t\"your own identity (a host with no garden record of its own can call this too). So passing \" +",
+				"\t\t\"another citizen's garden id drains THEIR mail and stamps THEIR receipt, and they will never \" +",
+				"\t\t\"see those messages. Pass only the id from your own doorbell notice or your own meta-record; \" +",
+				"\t\t\"use entwurf_self if you need to confirm which id that is. \" +"
+			],
+			"replace": [
+				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
+				"\t\t\"This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record. \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-INBOX-SCOPE-HONESTY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-MERGED-REJECT",
+			"title": "MCP long description merges the two owned rejects back under backend-liveness-unsupported",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
+				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend. Neither self-fetch nor \" +",
+				"\t\t\"native-push has resume authority, but they reject under DIFFERENT reasons — self-fetch as \" +",
+				"\t\t\"backend-liveness-unsupported, native-push as native-push-no-resume-authority. \" +"
+			],
+			"replace": [
+				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
+				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend, and on self-fetch and \" +",
+				"\t\t\"native-push alike it is rejected as backend-liveness-unsupported. \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-MERGED-REJECT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		}
+	]
+}

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.61.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.62.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-acp-v2-send-live.ts

@@ -32,26 +32,41 @@
 // The isolated world also keeps the operator's live store and mailbox clean: a
 // smoke that delivers into the real garden would page a human.
 //
-// KNOWN OPEN DEFECT this gate catches — bundled-MCP readiness (2026-07-24). Two
-// independent failures were first read as the model declining an explicit
-// instruction, and the transcripts said otherwise: in both, the entwurf tool was
-// ABSENT from the session's schema. The two models then behaved differently, which
-// is why the shared cause was easy to miss — in this gate's failure (a standalone
-// run) the model called anyway and the runtime answered `No such tool available:
-// mcp__entwurf-bridge__entwurf_v2`; in the sibling smoke-acp-bundled-mcp-live's
-// failure (a separate run, half an hour later, inside a release-gate aggregate) the
-// model read its schema first, reported that only Read/Bash/Edit/Write/Skill were
-// exposed, and refused to invent a result for a tool it did not have. Two
-// independent runs, different behaviour, one defect: the server was not there to be
-// called. The window is
-// structural: claude-agent-acp 0.61.0's createSession awaits only
+// KNOWN OPEN DEFECT this gate catches — bundled-MCP readiness (2026-07-24).
+// SSOT for the ledger and the claim tiers: ROADMAP 「번들 MCP readiness race」 +
+// docs/acp-backend-rail.md §11. Keep this comment at the strength those carry.
+//
+// OBSERVED (established): in three runs the entwurf tool was ABSENT from the
+// session's schema — the same SYMPTOM each time, reached by two different model
+// behaviours, which is why one shared symptom was easy to miss. In this gate's
+// failure (a standalone run) the model called anyway and the runtime answered
+// `No such tool available: mcp__entwurf-bridge__entwurf_v2`; in the sibling
+// smoke-acp-bundled-mcp-live's failure (a separate run, half an hour later,
+// inside a release-gate aggregate) the model read its schema first, reported that
+// only Read/Bash/Edit/Write/Skill were exposed, and refused to invent a result for
+// a tool it did not have.
+//
+// ESTABLISHED CONTRACT GAP (not the same as a cause): there is no client-side
+// readiness fence on this path. claude-agent-acp's createSession awaits only
 // `initializationResult()`, and this backend prompts right after
 // (acp/backend.ts:718-790) — nothing waits for the configured MCP servers to reach
-// `connected`, though claude-agent-sdk 0.3.217 exposes exactly that via
-// `mcpServerStatus()`. Both observed hits came under heavy concurrent load, which
-// is correlation, not established cause. So this gate stays MUST: its failures are
-// OURS. Until the readiness wait exists, a FAIL here is a real release blocker and
-// must not be re-read as model flakiness.
+// `connected`, though claude-agent-sdk exposes exactly that via
+// `mcpServerStatus()`.
+//
+// OPEN (do NOT write as settled): whether that missing fence is what produced the
+// three observations. No controlled repro exists yet, and the load association is
+// correlation only. Do not restate this as "one defect" or "the cause".
+//
+// Bump note: measured at claude-agent-acp 0.61.0 / claude-agent-sdk 0.3.217;
+// re-checked at the 2026-07-27 bump to 0.62.0 / 0.3.219 — the adapter's `dist/` is
+// byte-identical across 0.61.0→0.62.0 and adds no readiness fence. That is an
+// unchanged ABSENCE of any explicit wait, not an unchanged window: the transitive
+// SDK moved and MCP startup lives inside it, so effective timing may differ.
+//
+// So this gate stays MUST: it TELLS the model which tool to call, so a failure
+// here is OURS, not model preference. While the symptom and the contract gap
+// remain unresolved, a FAIL here is a real release blocker and must not be
+// re-read as model flakiness.
 //
 // LIVE-only — kept OUT of `pnpm check`; honest skip when LIVE!=1 (skip = CI safety,
 // NOT an acceptance PASS). Model override: ENTWURF_ACP_PROVIDER_MODEL (default sonnet).