@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/agy-bridge-config.py

@@ -98,13 +98,17 @@ PERMISSION_STATE_SCHEMA_VERSION = 2
 # EVERY call. The bridge was registered and two thirds of it was unusable — the same failure the
 # doctor already names for entwurf_v2, just never checked for the other two.
 #
-# The two tools deliberately NOT here, because a grant we do not need is a grant we should not take:
+# The four tools deliberately NOT here, because a grant we do not need is a grant we should not take:
 #   entwurf_inbox_read   — native-push has no inbox to drain. An agy citizen has no meta-mailbox
 #                          directory at all (measured), so granting it would pre-approve a rail this
 #                          backend does not have.
 #   entwurf_register_native — explicit/manual fallback, not the normal birth path (DELIVERY.md):
 #                          agy births automatically from PreInvocation. Auto-approving a registration
 #                          verb the normal path never calls is exactly the excess this list avoids.
+#   entwurf_fresh_call / entwurf_resume_call — both launch into the CALLER's own tmux session and
+#                          refuse without a pane anchor. An agy conversation is not a tmux client,
+#                          so these are not on its normal path either; the count moved from two to
+#                          four when 0.14 shipped the mux verbs, and the granted set did not.
 ALLOW_RULES = tuple(f"mcp({SERVER_KEY}/{tool})" for tool in ("entwurf_v2", "entwurf_peers", "entwurf_self"))
 # Rules that MATCH one of our tools: its exact grant, the server-wide rule, and the action wildcard.
 # Membership here is a statement about agy's matcher, not about which list the rule sits in — the

package/scripts/check-acp-backend-preflight.ts

@@ -6,7 +6,7 @@
 // exclude a built-in the Claude child still exposes (`read`); the turn must fail
 // fast into the returned stream as an `error` event — never reach a spawn, never
 // emit `done`. No live backend is launched (the preflight throws first), so this
-// stays deterministic and IN pnpm check.
+// stays deterministic and IN pnpm run check:full.
 //
 // backend.ts imports its siblings with `.js` suffixes (the root/jiti runtime
 // convention), which `node --experimental-strip-types` cannot resolve directly.

package/scripts/check-acp-carrier-augment.ts

@@ -15,7 +15,7 @@
 // Pure + temp-dir fs, no spawn/child — IN pnpm check.
 
 import { strict as assert } from "node:assert";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -38,6 +38,11 @@ const BRIDGE_MARK = "operating through entwurf";
 
 // ===========================================================================
 // 1) loadEngraving is pure/deterministic + interpolates backend/mcp (sorted)
+//
+// This cell owns the BODY of the render. The carrier's leading boundary is cell
+// 11's axis, so the body assertions here match on the tail — a cell that pinned
+// the whole string would fire first on any boundary regression and steal the
+// attribution from the claim that actually owns it.
 // ===========================================================================
 {
 	const file = join(tmp, "engraving.md");
@@ -48,16 +53,15 @@ const BRIDGE_MARK = "operating through entwurf";
 		const a = loadEngraving({ backend: "claude", mcpServerNames: ["zebra", "alpha"] });
 		const b = loadEngraving({ backend: "claude", mcpServerNames: ["zebra", "alpha"] });
 		assert.equal(a, b, "loadEngraving is deterministic: same inputs → same output");
-		assert.equal(a, "backend=claude mcp=alpha, zebra", "interpolates {{backend}} and SORTED {{mcp_servers}}");
+		assert.ok(a?.endsWith("backend=claude mcp=alpha, zebra"), "interpolates {{backend}} and SORTED {{mcp_servers}}");
 		// Order of the input must not change the render (signature-stability guard).
 		assert.equal(
 			loadEngraving({ backend: "claude", mcpServerNames: ["alpha", "zebra"] }),
 			a,
 			"mcpServerNames order does not drift the rendered carrier (sorted)",
 		);
-		assert.equal(
-			loadEngraving({ backend: "claude", mcpServerNames: [] }),
-			"backend=claude mcp=(none registered)",
+		assert.ok(
+			loadEngraving({ backend: "claude", mcpServerNames: [] })?.endsWith("backend=claude mcp=(none registered)"),
 			"no mcp servers → (none registered)",
 		);
 	} finally {
@@ -86,7 +90,15 @@ const BRIDGE_MARK = "operating through entwurf";
 	const prev = process.env.ENTWURF_ACP_ENGRAVING_PATH;
 	process.env.ENTWURF_ACP_ENGRAVING_PATH = whitespace;
 	try {
-		assert.equal(loadEngraving({ backend: "claude", mcpServerNames: [] }), null, "whitespace-only template → null");
+		assert.equal(
+			loadEngraving({ backend: "claude", mcpServerNames: [] }),
+			null,
+			"[QK:CARRIER-OPT-OUT-SURVIVES-SEPARATOR] a whitespace-only override must still be the operator OPT-OUT (null), " +
+				"never a carrier made of nothing but the A-join boundary. Emptiness is decided on the TRIMMED BODY, before " +
+				"the leading separator is attached — attach it first and an emptied engraving file silently becomes a " +
+				'non-empty "\\n\\n" carrier: the opt-out disappears, the claude_code preset gets replaced by whitespace, and ' +
+				"bridgeConfigSignature folds a string the operator never wrote",
+		);
 	} finally {
 		if (prev === undefined) delete process.env.ENTWURF_ACP_ENGRAVING_PATH;
 		else process.env.ENTWURF_ACP_ENGRAVING_PATH = prev;
@@ -106,9 +118,9 @@ const BRIDGE_MARK = "operating through entwurf";
 	// `_meta.systemPrompt` → full preset replacement). That replacement is what
 	// strips the preset's auto-memory section so the model never learns it has a
 	// per-session memory store — the memory containment v1 shipped, restored here.
-	assert.equal(
-		loadEngraving({ backend: "claude", mcpServerNames: [] }),
-		"# Engraving Here",
+	// (`includes`, not `equal`: the leading A-join boundary is cell 11's axis.)
+	assert.ok(
+		loadEngraving({ backend: "claude", mcpServerNames: [] })?.includes("# Engraving Here"),
 		"shipped default engraving is the non-empty v1 lever → string carrier (preset replaced, auto-memory stripped)",
 	);
 
@@ -320,10 +332,234 @@ function ctxWith(firstUser: string): Context {
 	);
 }
 
+// ===========================================================================
+// 10) CARRIER PROVENANCE — the augment states what it is, per rail.
+//
+// Measured 2026-07-30: asked where its instructions came from, the Claude ACP
+// model reported the bridge-identity and task-stance paragraphs as its SYSTEM
+// prompt. They are a first-user-message prepend. The model was not lying — on
+// the wire it cannot tell a long first user message from a system prompt, and
+// nothing in the block said which it was. The rails also differ for real
+// (backend-adapter.ts: claude's buildSessionMeta carries `_meta.systemPrompt`;
+// cortex's returns undefined so no `_meta` is sent), so ONE generic sentence
+// would be false on one of them.
+//
+// What this pins is a STATEABILITY claim, not an obedience claim: the boundary
+// must be present and rail-correct in the text the model reads. It cannot make
+// a model answer honestly — it removes the excuse that it had no way to know.
+// ===========================================================================
+{
+	const claudeAug = buildPiContextAugment({ backend: "claude", cwd: tmp, mcpServerNames: [], homeDir: tmp });
+	const cortexAug = buildPiContextAugment({ backend: "cortex", cwd: tmp, mcpServerNames: [], homeDir: tmp });
+
+	for (const [rail, aug] of [
+		["claude", claudeAug],
+		["cortex", cortexAug],
+	] as const) {
+		assert.ok(
+			aug.includes("prepended to the FIRST USER MESSAGE of this session. It is not your system prompt."),
+			`[QK:CARRIER-PROVENANCE-STATED] the ${rail} augment must say what it IS (first-user-message text) and what it ` +
+				"is NOT (the system prompt) — without that line a model reading it has no way to attribute it, and the " +
+				"measured failure was exactly that misattribution",
+		);
+		assert.ok(
+			aug.indexOf("# entwurf: where this text comes from") < aug.indexOf(BRIDGE_MARK),
+			`the ${rail} provenance frame precedes the bridge narrative it is about`,
+		);
+	}
+
+	// Rail-correct, not generic: claude names its carrier and scopes it to the
+	// engraving; cortex denies having one at all.
+	assert.ok(
+		claudeAug.includes("does have a system-prompt carrier (`_meta.systemPrompt`)") &&
+			claudeAug.includes("it carries the operator engraving only"),
+		"[QK:CARRIER-FRAME-NAMES-CLAUDE-CARRIER] the claude frame must name the real carrier AND scope it to the engraving — " +
+			`saying only "this is not your system prompt" leaves the model to guess what the system prompt then is. Got: ${JSON.stringify(claudeAug.slice(0, 500))}`,
+	);
+	assert.ok(
+		cortexAug.includes("carries no system-prompt carrier at all") &&
+			!cortexAug.includes("does have a system-prompt carrier"),
+		"[QK:CARRIER-FRAME-DENIES-CORTEX-CARRIER] the cortex frame must deny the carrier — cortex's buildSessionMeta returns " +
+			`undefined so no _meta is sent; claiming a tiny carrier there would be a lie. Got: ${JSON.stringify(cortexAug.slice(0, 500))}`,
+	);
+
+	// The rail difference is not a doc claim — it is in the adapter source.
+	const adapterSrc = readFileSync(join(REPO_DIR, "pi-extensions/lib/acp/backend-adapter.ts"), "utf8");
+	const cortexAt = adapterSrc.indexOf('backend: "cortex"');
+	assert.ok(cortexAt > 0, "backend-adapter.ts still declares the cortex adapter");
+	assert.match(
+		adapterSrc.slice(cortexAt),
+		/buildSessionMeta\(\)\s*\{\s*return undefined;/,
+		"[QK:CARRIER-RAIL-DIFF-IS-SOURCE-PINNED] cortex's buildSessionMeta must still return undefined — the source fact the " +
+			"cortex frame's 'no carrier at all' sentence rests on. If this ever grows a carrier, the frame becomes a lie.",
+	);
+
+	// DISJOINT SURFACES: the thing the model is told is its system prompt (the
+	// engraving) must not contain the narrative it is told is user text. If the
+	// two ever overlapped, the frame would be unfalsifiable prose.
+	const shippedCarrier = loadEngraving({ backend: "claude", mcpServerNames: [] });
+	assert.ok(shippedCarrier, "shipped carrier is present (fail-loud lever)");
+	assert.ok(
+		!(shippedCarrier as string).includes(BRIDGE_MARK) && !claudeAug.includes(shippedCarrier as string),
+		`the claude carrier and the augment must stay disjoint — the carrier carries the ` +
+			`engraving only and the augment carries the narrative, which is precisely what the provenance frame tells the ` +
+			`model. Carrier: ${JSON.stringify(shippedCarrier)}`,
+	);
+}
+
+// ===========================================================================
+// 11) A-JOIN — the carrier owns its own leading boundary.
+//
+// Measured LIVE 2026-07-31 (0.64.0 adapter, fresh Claude ACP): the system prompt
+// reached the model as
+//   `You are a Claude agent, built on Anthropic's Claude Agent SDK.# Engraving Here`
+// A string-form `_meta.systemPrompt` REPLACES the claude_code preset
+// (acp-agent.js), but the SDK still prefixes its own fixed identity sentence and
+// joins the two with NOTHING — the operator's heading was swallowed into the tail
+// of that sentence.
+//
+// The fix cannot live in engraving.md. The render is trimmed (cell 1's
+// determinism guard: operator file whitespace must not drift
+// bridgeConfigSignature), so a leading blank line in the markdown is eaten before
+// it ever reaches the wire. These cells pin the boundary where it can survive —
+// in the LOADER — and pin the two ways it can be lost again: an opt-out turned
+// into a whitespace carrier (cell 2), and a downstream normalize at the meta hop.
+// ===========================================================================
+{
+	// The exact sentence measured on the wire. Only its CONCATENATION is our
+	// contract — the SDK owns the wording and may change it; what may not change
+	// is that our carrier starts a block of its own after whatever precedes it.
+	const SDK_FIXED_SENTENCE = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+
+	const bare = join(tmp, "bare-engraving.md");
+	writeFileSync(bare, "# Operator Engraving");
+	const padded = join(tmp, "padded-engraving.md");
+	writeFileSync(padded, "\n\n\n# Operator Engraving\n\n");
+
+	const prev = process.env.ENTWURF_ACP_ENGRAVING_PATH;
+	let bareCarrier: string | null;
+	let paddedCarrier: string | null;
+	try {
+		process.env.ENTWURF_ACP_ENGRAVING_PATH = bare;
+		bareCarrier = loadEngraving({ backend: "claude", mcpServerNames: [] });
+		process.env.ENTWURF_ACP_ENGRAVING_PATH = padded;
+		paddedCarrier = loadEngraving({ backend: "claude", mcpServerNames: [] });
+	} finally {
+		if (prev === undefined) delete process.env.ENTWURF_ACP_ENGRAVING_PATH;
+		else process.env.ENTWURF_ACP_ENGRAVING_PATH = prev;
+	}
+
+	const shipped = loadEngraving({ backend: "claude", mcpServerNames: [] });
+	assert.ok(shipped, "shipped carrier is present (fail-loud lever)");
+	assert.equal(
+		loadEngraving({ backend: "claude", mcpServerNames: [] }),
+		shipped,
+		"the bounded shipped carrier is still a pure function of its inputs (no per-call drift → no per-turn rebuild)",
+	);
+
+	// Reproduce the SDK join with NO glue of our own — the exact concatenation
+	// acp-agent.js performs — and read the result the way the model does. The
+	// operator-override row is what proves the boundary is the LOADER's: that file
+	// carries no leading whitespace at all.
+	for (const [what, carrier] of [
+		["shipped default", shipped as string],
+		["operator override with no leading whitespace", bareCarrier as string],
+	] as const) {
+		const joined = `${SDK_FIXED_SENTENCE}${carrier}`;
+		const lines = joined.split("\n");
+		assert.ok(
+			lines[0] === SDK_FIXED_SENTENCE && lines[1] === "" && (lines[2]?.length ?? 0) > 0,
+			`[QK:CARRIER-LEADS-ITS-OWN-BLOCK] the ${what} must open its own block after the fixed SDK sentence. The SDK ` +
+				"concatenates that sentence with a string `_meta.systemPrompt` and puts NOTHING between them, and the render " +
+				"is trimmed, so the boundary has to come from the loader — measured 2026-07-31 as the swallowed heading " +
+				`\`…Claude Agent SDK.# Engraving Here\`, which is what taught the model its engraving was part of the SDK's ` +
+				`own sentence. Joined: ${JSON.stringify(joined.slice(0, 160))}`,
+		);
+	}
+
+	// …and the boundary is a loader CONSTANT: whatever the operator's file leads
+	// with, the carrier reads the same. Otherwise file whitespace would drift the
+	// carrier and, through appendSystemPrompt, the reuse signature.
+	assert.equal(
+		paddedCarrier,
+		bareCarrier,
+		"template leading/trailing whitespace never reaches the carrier — the boundary is ours, not the file's",
+	);
+	assert.equal(bareCarrier, "\n\n# Operator Engraving", "the boundary is exactly one blank line + the trimmed body");
+
+	// TINY is the billing axis, not a style rule (engraving.ts header): size, not
+	// shape, is what reclassifies a Claude OAuth subscription call as metered
+	// "extra usage". The boundary costs 2 bytes; the shipped carrier stays a
+	// placeholder and rich context keeps riding the first-user augment.
+	const CARRIER_BUDGET_BYTES = 512;
+	const shippedBytes = Buffer.byteLength(shipped as string, "utf8");
+	assert.ok(
+		shippedBytes <= CARRIER_BUDGET_BYTES,
+		`[QK:CARRIER-STAYS-TINY] the SHIPPED carrier must stay under ${CARRIER_BUDGET_BYTES} bytes — a carrier that grows ` +
+			"materially past the SDK-default size routes subscription (OAuth) calls to metered extra usage, which is an " +
+			"HTTP 400 for an operator with no metered balance. AGENTS.md, the bridge narrative and tool catalogs ride the " +
+			`first-user-message augment, never this carrier. Got ${shippedBytes} bytes: ` +
+			`${JSON.stringify((shipped as string).slice(0, 200))}`,
+	);
+
+	// The LAST hop. backend.ts folds the loadCarrier result into
+	// bridgeConfigSignature (`appendSystemPrompt`) and hands the SAME string to
+	// buildSessionMeta. A normalize here would strip the boundary back off on the
+	// wire while the signature still folded the bounded value: the A-join returns
+	// invisibly AND reuse keys on a string that was never sent.
+	const metaFromShipped = buildClaudeSessionMeta(
+		{
+			modelId: "claude-x",
+			tools: ["Read"],
+			permissionAllow: ["Read(*)"],
+			disallowedTools: [],
+			settingSources: [],
+			strictMcpConfig: false,
+			skillPlugins: [],
+		},
+		shipped as string,
+	);
+	assert.equal(
+		metaFromShipped.systemPrompt,
+		shipped,
+		"[QK:CARRIER-META-SENDS-CARRIER-VERBATIM] `_meta.systemPrompt` must be the loader's string BYTE-FOR-BYTE. " +
+			"backend.ts folds that same string into bridgeConfigSignature's appendSystemPrompt slot, so any normalize at " +
+			"this hop desynchronizes the wire from the signature — reuse would key on a carrier the backend never received, " +
+			`and a trim in particular re-opens the A-join with every gate above still green. Got ${JSON.stringify(metaFromShipped.systemPrompt)}`,
+	);
+
+	// The boundary is signature-relevant, which is what makes the desync above
+	// detectable at all: a build that silently dropped it is judged INCOMPATIBLE
+	// (fresh ACP session with the corrected carrier), never quietly reused.
+	const sigBase = {
+		backend: "claude" as const,
+		modelId: "claude-x",
+		nativeModelId: "claude-x",
+		mcpServersHash: "deadbeef",
+		settingSources: [],
+		strictMcpConfig: true,
+		tools: ["Read", "Bash", "Edit", "Write"],
+		skillPlugins: [],
+		permissionAllow: ["Read(*)"],
+		disallowedTools: [],
+	};
+	assert.notEqual(
+		bridgeConfigSignature({ ...sigBase, appendSystemPrompt: shipped as string }),
+		bridgeConfigSignature({ ...sigBase, appendSystemPrompt: (shipped as string).trim() }),
+		"the boundary is part of the reuse signature — dropping it invalidates a live session instead of passing unnoticed",
+	);
+}
+
 console.log(
 	"[check-acp-carrier-augment] ok — engraving carrier: pure/deterministic, sorted mcp interpolation, " +
 		"empty/whitespace/missing → null, shipped-default → non-empty v1 lever (preset replaced), carrier absent → no _meta.systemPrompt key, carrier change → " +
 		"signature change (stable carrier → stable signature); augment: prepended on `new` only (reuse delta has none), " +
 		"wire-only so it never enters contextMessageSignatures, entwurf cwd/AGENTS.md de-dup (present → drop only that " +
-		"section, home kept; absent → kept), day-granularity date, 50KB truncation marker, shipped AGENTS budget",
+		"section, home kept; absent → kept), day-granularity date, 50KB truncation marker, shipped AGENTS budget; " +
+		"provenance: both rails state the augment is first-user-message text and not the system prompt, claude names its " +
+		"tiny engraving-only carrier while cortex denies having one (pinned against cortexAdapter.buildSessionMeta → " +
+		"undefined), and carrier/augment stay disjoint; A-join: the carrier opens its own block after the SDK's fixed " +
+		"sentence, the boundary is a loader constant (not the template's whitespace, which trim eats) and does not " +
+		"resurrect an opted-out carrier, the shipped carrier stays under the tiny budget, and the meta hop sends the " +
+		"loader string byte-for-byte so the wire and the reuse signature cannot desynchronize",
 );

package/scripts/check-acp-cortex.ts

@@ -1,12 +1,12 @@
 // Deterministic gate for the Cortex (Snowflake Cortex Code) ACP backend — the
-// first non-claude adapter on the rail (docs/acp-backend-rail.md §4/§6/§11-8).
+// first non-claude adapter on the rail (docs/acp-backend-rail.md, Cortex audit D1–D10).
 // The cortex source lives in one `cortexAdapter` object (backend-adapter.ts) +
 // its curated surface (models.ts) + the dual-HOME overlay (overlay.ts); the
-// 결합 규칙 requires the gate to land WITH it, and §6 said EXTEND the
+// 결합 규칙 requires the gate to land WITH it, and the rail's “Shipped adapters” said EXTEND the
 // `check-acp-*` family, so cortex's whole deterministic axis lives here.
 //
 // The contract under test is the CP0-measured one (v1.1.52, 2026-07-29), not
-// PR #40's v1.1.8-era shape — the D-numbers refer to §11-8:
+// PR #40's v1.1.8-era shape — the D-numbers refer to the current Cortex audit:
 //   1. curated surface is the GLG-decided 4-row set, riding real registry bases;
 //   2. `cortex-` prefix routes to cortexAdapter; prefix-strip recovers the
 //      native id; the unprefixed claude ids are never claimed;
@@ -22,7 +22,7 @@
 //      session-scoped dirs with exact rewrite + dead-pid sweep;
 //   6. CORTEX_HOME ambient presence (empty string INCLUDED) refuses the spawn
 //      (D3 — upstream consumers disagree about empty);
-//   7. system-prompt-carrier-less augment (§9-4/§11-8) — the operator engraving OVERRIDE rides the
+//   7. system-prompt-carrier-less augment — the operator engraving OVERRIDE rides the
 //      first-user augment; a carrier backend (claude) never folds it in.
 //
 // [QK:*] labels mark the claims kill-qualified by scripts/mutants/acp-cortex.json
@@ -329,7 +329,7 @@ const enrichedServers: AcpMcpServer[] = [
 }
 
 // ---------------------------------------------------------------------------
-// Layer A.3 — system-prompt-carrier-less augment (§9-4/§11-8): the operator engraving override
+// Layer A.3 — system-prompt-carrier-less augment: the operator engraving override
 // rides the FIRST-USER AUGMENT for cortex; claude (a carrier backend) never
 // folds it in; no override → no engraving injected.
 // ---------------------------------------------------------------------------

package/scripts/check-acp-overlay.ts

@@ -3,8 +3,9 @@
 // Drives ensureClaudeConfigOverlay against INJECTED temp realDir/overlayDir
 // (no operator ~/.claude touched), then asserts the overlay shape the ACP
 // child must see:
-//   - settings.json: permissions.defaultMode "default", autoMemoryEnabled
-//     false, hooks === {} (configured-but-empty → mailbox absence by design);
+//   - settings.json: permissions.defaultMode "bypassPermissions" (unattended
+//     ACP turns never pause on a prompt), autoMemoryEnabled false, hooks === {}
+//     (configured-but-empty → mailbox absence by design);
 //   - whitelisted operator entries symlinked to their real path;
 //   - projects/sessions are overlay-PRIVATE real dirs, NOT symlinks;
 //   - non-whitelist operator entries (CLAUDE.md, settings.local.json, plugins,
@@ -73,7 +74,16 @@ try {
 
 	// settings.json
 	const settings = JSON.parse(readFileSync(join(overlayDir, "settings.json"), "utf8"));
-	assert.equal(settings.permissions?.defaultMode, "default", "settings.permissions.defaultMode must be 'default'");
+	assert.equal(
+		settings.permissions?.defaultMode,
+		"bypassPermissions",
+		"[QK:ACP-OVERLAY-UNATTENDED-BYPASS] the overlay we author must pin permissions.defaultMode to " +
+			"'bypassPermissions'. The isolated overlay is the ONLY authority here — CLAUDE_CONFIG_DIR redirects the " +
+			"SDK away from the operator's native settings, so an unattended entwurf ACP turn inherits nothing and a " +
+			"regression to 'default' suspends that turn on an interactive permission prompt with no operator at the " +
+			"keyboard. The callable surface stays bounded by explicit tools/disallowedTools and backend auth, not by " +
+			"this mode.",
+	);
 	assert.equal(settings.autoMemoryEnabled, false, "settings.autoMemoryEnabled must be false");
 	assert.ok(
 		settings.hooks && typeof settings.hooks === "object" && Object.keys(settings.hooks).length === 0,