@junghanacs/entwurf 0.13.1 → 0.14.0

package/mcp/entwurf-bridge/dist/scripts/meta-facts.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * meta-facts — owner-normalized, read-only projection of the meta-record store (#65).
+ *
+ * The one join a consumer cannot make anywhere else — `(gardenId, nativeSessionId,
+ * transcriptPath)` — lives only in the meta-record store, and reading that store
+ * correctly means carrying the whole certification contract (strict v3 keyset,
+ * parse-before-uniqueness, no-winner duplicates, O_NOFOLLOW regular-file reads).
+ * External consumers that copied it decayed the day the contract moved. This surface
+ * makes THE owner emit the join: it is `listAllMetaIdentities` over the real store —
+ * the same listing `entwurf_peers` trusts — serialized verbatim. No parallel parser,
+ * no liveness, no socket paths, no transcript contents, no state, no watching.
+ *
+ * stdout (deterministic, 2-space indent, trailing newline):
+ *   {
+ *     "schemaVersion": 1,          // of THIS projection, not of the records
+ *     "storeDir": "/abs/path",
+ *     "citizens": [ <full verbatim strict 9-field v3 records, sorted by gardenId> ],
+ *     "defects":  [ { "filename", "message" }, … sorted by filename ]
+ *   }
+ *
+ * Defects ride IN-BAND: a readable store with uncertifiable entries is a fact to
+ * report, not a failure of this command — the healthy citizens are still true, and
+ * the defect list is exactly what `listAllMetaIdentities` refused and why (a rival
+ * pair is refused on BOTH sides; a schema-invalid record can never quarantine a
+ * healthy neighbour, because parse runs before uniqueness).
+ *
+ * EXIT CONTRACT — the verdict is the exit code (store-doctor precedent):
+ *   0 — store readable; the JSON above is on stdout (defects, if any, in-band).
+ *       A store that does not exist is a readable EMPTY store (ENOENT only).
+ *   2 — usage error (bad argv).
+ *   3 — the store could not be READ (EACCES/ENOTDIR/…). No JSON is emitted:
+ *       an unreadable host must never look like an empty one.
+ */
+import { defaultMetaSessionsDir, listAllMetaIdentitiesDir } from "../pi-extensions/lib/meta-session.js";
+const arg = process.argv[2];
+// A dash argv is a flag this command does not have, not a store directory — treating
+// it as a path would answer `--help` with "empty store, exit 0", a silent wrong fact.
+if (process.argv.length > 3 || (arg !== undefined && arg.startsWith("-"))) {
+    console.error("usage: entwurf meta-facts [meta-sessions-dir]");
+    process.exit(2);
+}
+let facts;
+try {
+    facts = listAllMetaIdentitiesDir(arg ?? defaultMetaSessionsDir());
+}
+catch (err) {
+    console.error(`FAIL: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one
+}
+process.stdout.write(`${JSON.stringify({ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors }, null, 2)}\n`);

package/mcp/entwurf-bridge/dist/scripts/new-session-id.js

@@ -1,11 +1,16 @@
 /**
  * new-session-id — print one fresh garden-native sessionId and exit.
  *
- * The garden launcher (operator alias / wrapper) calls this so every
- * `--entwurf-control` session is born a garden citizen:
+ * NOT a launcher contract. #50 C2 retired the injection form
+ * (`pi --session-id "$(./run.sh new-session-id)" --entwurf-control …`): pi mints its
+ * own session id (a `uuidv7` is normal), `session_start` attaches that session to its
+ * meta-record, and the RECORD mints the garden id and keys the control socket on it.
+ * Injecting a garden-shaped id gives a session two address-shaped strings of which only
+ * one is an address. Launch is plain `pi --entwurf-control` (README §Garden launcher).
  *
- *   pi --session-id "$(./run.sh new-session-id)" --entwurf-control \
- *      --emacs-agent-socket server …
+ * What survives is this: the operator-facing generator for the same id grammar the
+ * record layer itself uses — one fresh id on stdout, for a caller that needs to mint a
+ * token deliberately, never as a launch argument.
  *
  * The id is `generateSessionId()` from entwurf-core — the single SSOT for the
  * locked `YYYYMMDDTHHMMSS-[0-9a-f]{6}` grammar. Do NOT reimplement the format in

package/mcp/entwurf-bridge/src/index.ts

@@ -11,7 +11,7 @@
  * Currently exposed tools (scope is deliberately narrow — anything that can live
  * as a local skill should live as a skill, not here):
  *   - entwurf_v2      — canonical delivery surface for existing garden citizens; the decider
- *                       chooses live control-socket send / dormant spawn-bg resume / meta-mailbox.
+ *                       chooses live control-socket send / meta-mailbox enqueue / native-push.
  *   - entwurf_peers   — entwurf fact surface: garden citizens (meta-records) with liveness +
  *                       diagnostics (#50 C4: record-less sockets surface THERE, never as identity).
  *                       Brain = pi-extensions/lib/entwurf-fact-provider (listEntwurfFacts) +
@@ -24,6 +24,18 @@
  *                       garden record may call this — so the surface is "drain the inbox you were
  *                       pointed at", not "drain your own". A rung doorbell is a wake attempt;
  *                       this read is the receipt.
+ *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
+ *                       conversation (antigravity) to a garden id. Never a spawn.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *                       returns a LAUNCH receipt only, and the new address arrives later as the
+ *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
+ *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
+ *                       apart.
+ *
+ * That list is the WHOLE public surface — seven verbs — and `check-entwurf-bridge-boot`
+ * (G1f) holds it as an exact set on the runtime tools/list, so a verb added or dropped
+ * here without a decision is red rather than merely undocumented.
  *
  * Removed from this v2-only surface: legacy MCP `entwurf`, `entwurf_resume`, and
  * `entwurf_send`. Use `entwurf_v2` for delivery to existing garden citizens.
@@ -59,6 +71,12 @@ import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-ren
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.ts";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.ts";
+import {
+	makeVisibleResumeDeps,
+	renderVisibleResume,
+	type VisibleResumeDeps,
+	visibleResume,
+} from "../../../pi-extensions/lib/entwurf-v2-visible-resume.ts";
 import {
 	probeNativeSenderAlive,
 	resolveTrustedMetaSenderIdentity,
@@ -71,6 +89,8 @@ import {
 	readMetaInbox,
 	readMetaReceiverMarker,
 } from "../../../pi-extensions/lib/meta-session.ts";
+import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.ts";
+import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.ts";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.ts";
 
 const HOME = os.homedir();
@@ -330,13 +350,12 @@ function abbreviateHomeMcp(cwd: string): string {
 
 // entwurf_v2 — the unified v2 dispatch verb (0.11 step 5d-3b). It hands the
 // target + intent to the 5b decider, which chooses the transport (live
-// control-socket send / spawn-bg resume / meta-mailbox enqueue / native-push
-// direct injection) and reports one outcome. The per-target lock is NOT taken by
-// every rail: the decider locks only a control-socket-domain dispatch, which
-// covers the live send AND the dormant cell's spawn-bg resume; the mailbox and
-// native-push branches carry `lock: null` (entwurf-v2-decider.ts). It runs
+// control-socket send / meta-mailbox enqueue / native-push direct injection) and
+// reports one outcome. The per-target lock is NOT taken by every rail: the decider
+// locks only a control-socket-domain dispatch; the mailbox and native-push branches
+// carry `lock: null` (entwurf-v2-decider.ts). It runs
 // IN-PROCESS here (the same production runner pi-native uses) — NOT a delegating
-// RPC — so control, mailbox, native-push, AND spawn-bg all flow through
+// RPC — so control, mailbox and native-push all flow through
 // `runEntwurfV2`. The sender envelope is
 // `buildSendSenderEnvelope()` verbatim (origin/replyable as resolved) — v2 does
 // NOT gate on replyability (a `wants_reply` from an external/non-replyable caller
@@ -346,11 +365,10 @@ server.tool(
 	"entwurf_v2",
 	"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id " +
 		"alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
-		"from liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; " +
-		"deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection " +
-		"into its conversation) and reports ONE outcome (delivered / rejected / lock-retained / " +
-		"delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is " +
-		"rejected, never auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
+		"from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge " +
+		"mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE " +
+		"outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
+		"entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
 		"citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
 		'"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
 		"gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
@@ -358,26 +376,27 @@ server.tool(
 		"session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
 		"inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
 		"native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
-		"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → " +
-		"owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → " +
-		"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND " +
-		"the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The " +
+		"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
+		"— same receiver rule as the mailbox, no active drainer means no delivery. " +
+		"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
+		"and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. " +
+		"LOCK: taken for a control-socket-DOMAIN dispatch. The " +
 		"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode " +
 		"applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message " +
 		"caps at 16000 chars; send an artifact path + digest for more.",
 	{
 		target: z.string().min(1).describe("Target garden id (use entwurf_peers to discover)"),
 		intent: z
-			.enum(["fire-and-forget", "owned-outcome"])
+			.enum(["fire-and-forget"])
 			.describe(
 				"fire-and-forget = send/reply/hand-off to a LIVE socket target or to any citizen with no " +
 					"socket liveness — the decider picks its rail, and a rail can also REJECT (self-fetch → " +
 					"mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, " +
 					"dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate); set " +
-					"wants_reply for an answer. owned-outcome = " +
-					"wake a DORMANT socket-domain citizen via spawn-bg resume ONLY — on a live target rejected " +
-					"as owned-live-no-autosend, on self-fetch as backend-liveness-unsupported, on native-push as " +
-					"native-push-no-resume-authority, and never auto-converted",
+					"wants_reply for an answer. This is the ONLY intent: owned-outcome, which resumed a dormant " +
+					"citizen by launching a hidden background child, was withdrawn under the visible-first rule. " +
+					"It is not selectable, not deprecated-but-tolerated; a dormant citizen is currently " +
+					"unreachable by this verb and rejects as dormant-fire-forget-unsupported.",
 			),
 		message: z
 			.string()
@@ -391,8 +410,8 @@ server.tool(
 			.optional()
 			.describe(
 				"Injection style for a CONTROL-SOCKET send only: steer (interrupt the current turn) or " +
-					"follow_up (queue after it). The mailbox, native-push, and spawn-bg plans carry no mode, so it " +
-					"has no effect on those rails.",
+					"follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
+					"effect on those rails.",
 			),
 		wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 	},
@@ -403,8 +422,9 @@ server.tool(
 			const sender = await buildSendSenderEnvelope();
 			const rendered = await runAndRenderEntwurfV2FromSurface(
 				{ target, intent, message, mode, wants_reply },
-				// agentDir / prefixRoots intentionally omitted: runAndRenderEntwurfV2FromSurface falls
-				// back to the ENTWURF_PREFIX_ROOTS env SSOT for prefixRoots (5d-4); agentDir stays undefined.
+				// No trust-preflight inputs are passed, and none exist to pass: the preflight on this
+				// path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
+				// the whole options surface now (see the pi-native surface for the same note).
 				{ senderProvider: () => sender },
 			);
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
@@ -497,7 +517,9 @@ server.tool(
 		"`unsupported` for a backend with no control-socket probe such as claude-code); the dispatch " +
 		"decision (send vs resume) is computed LATER by the entwurf_v2 contract from that liveness, " +
 		"not here — this surface carries no per-row routing field, so do not read a transport off a " +
-		"row. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
+		"row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is " +
+		"currently unreachable by any verb, so listing it grants no action — appearing here is not " +
+		"an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
 		"control-socket probe. Which rail it answers on is a capability the decider resolves at dispatch " +
 		"time, and there are THREE possible answers, not two — a self-fetch mailbox (only while that " +
 		"mailbox is deliverable), native-push direct injection (only while its adapter probe is alive), " +
@@ -507,8 +529,8 @@ server.tool(
 		"is not a departed host. So " +
 		"`unsupported` does not promise reachability either: a record whose backend has no adapter on " +
 		"this lane resolves to that reject. " +
-		"Note: this is the *active* world. It is NOT a fresh-sibling creation surface; pass an " +
-		"existing garden id to entwurf_v2.",
+		"Note: this is the *active* world and it is facts-only — it creates nothing. Pass an " +
+		"existing garden id to entwurf_v2; to open a NEW sibling use entwurf_fresh_call.",
 	{},
 	async () => {
 		try {
@@ -621,6 +643,120 @@ server.tool(
 	},
 );
 
+// The caller identity for THIS surface comes from the same authoritative resolution
+// `entwurf_self` uses — BOTH of its certified paths: the pi carrier this child inherited
+// (PI_SESSION_ID + PI_AGENT_ID, which a record minted at birth), or a trusted meta-sender marker
+// the native host's own hook wrote. Neither is a guess and neither is deprecated here.
+//
+// What is refused is a caller-supplied id. The measured failure mode is exactly that: asked for
+// its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
+// environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
+// against that answer would call home to a garden id nobody holds.
+server.tool(
+	"entwurf_fresh_call",
+	"Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed " +
+		"backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+		"sender envelope of that callback is its garden id — that is how you learn the address of something that " +
+		"did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
+		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
+		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
+		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
+		"arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+		"same-user processes on this host. Requires that this agent itself runs " +
+		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
+	{
+		backend: z
+			.enum(["pi", "claude-code"])
+			.describe("Which fixed runtime to open. Only these two; there is no arbitrary command."),
+		model: z
+			.string()
+			.min(1)
+			.max(200)
+			// The `\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source
+			// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a
+			// Rust regex engine that rejects an unescaped `[` inside a character class as "unclosed
+			// character class" — a 400 on tools/list that stops EVERY Claude session from opening
+			// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must
+			// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads
+			// as an unused suppression while the escape goes back to being fixable.
+			// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
+			.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
+			.describe("Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias."),
+		task: z
+			.string()
+			.min(1)
+			.max(16000)
+			.describe(
+				"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
+			),
+	},
+	async ({ backend, model, task }) => {
+		let callerGardenId: string | null = null;
+		try {
+			const self = await buildAuthoritativeSelfEnvelope();
+			callerGardenId = self.envelope.sessionId;
+		} catch (err) {
+			// ONE error is a legitimate answer here: this host has no authoritative identity at all
+			// (no pi carrier inherited, no trusted marker written), so the sibling would have nowhere
+			// to call home. That normalises to the named refusal.
+			//
+			// Everything else — a corrupt record, an unreadable store, a broken marker — keeps its
+			// own diagnosis and fails loud. Folding those into "you are anonymous" would relabel a
+			// store defect as a wiring choice, and the operator would go looking in the wrong place.
+			if (!(err instanceof EntwurfEnvelopeWiringError)) throw err;
+			callerGardenId = null;
+		}
+		try {
+			const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+		} catch (err) {
+			return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	},
+);
+
+// The composition root for a visible resume: this surface is the only layer that may know BOTH
+// halves, so it is where the mux launcher is handed to the v2 composition. `entwurf-v2-visible-
+// resume` cannot open a window on its own and `mux-resume-call` cannot read a record — that is
+// the import fence in docs/mux-launch-rail.md §11, expressed as a function argument.
+const visibleResumeLaunch: VisibleResumeDeps["launch"] = (input) => {
+	const launched = resumeCall({ cwd: input.cwd, runtimeArgs: input.runtimeArgs });
+	return launched.ok
+		? { ok: true, handle: launched.receipt }
+		: { ok: false, reason: launched.reason, hint: RESUME_CALL_REJECT_HINT[launched.reason] };
+};
+
+server.tool(
+	"entwurf_resume_call",
+	"Reopen ONE DORMANT pi citizen under its OWN garden id, in a visible window in the operator's own tmux " +
+		"session. The record supplies everything — which transcript, which model, which provider, which cwd — so " +
+		"the only input is the target id: there is no model override, no task, and no prompt. This runs NO turn: " +
+		"the window comes back with the conversation and waits, and talking to it is still entwurf_v2 " +
+		"fire-and-forget on the socket this call stands up. You get TWO receipts and they mean different things: a " +
+		"LAUNCH receipt (tmux made a window and was asked to start pi) and an OBSERVATION receipt (the control " +
+		"socket answered under the same id, or resume-unobserved). Unobserved is a real outcome, not an error to " +
+		"retry — the window is visible, so read it. A citizen that is already LIVE is refused: address it with " +
+		"entwurf_v2 instead. Only pi citizens have a same-id resume, because only they stand a control socket up. " +
+		"Requires that this agent itself runs inside tmux.",
+	{
+		target: z
+			.string()
+			.min(1)
+			.regex(/^\d{8}T\d{6}-[0-9a-f]{6}$/)
+			.describe("Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers)."),
+	},
+	async ({ target }) => {
+		try {
+			const result = await visibleResume(target, makeVisibleResumeDeps(visibleResumeLaunch));
+			const rendered = renderVisibleResume(result);
+			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+		} catch (err) {
+			return textErr(`entwurf_resume_call error: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	},
+);
+
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/start.sh

@@ -12,7 +12,7 @@
 # DEV CLONE (path is NOT under node_modules): runs src/index.ts via
 # --experimental-strip-types. The clone lives outside node_modules so strip-types
 # is allowed, edits are picked up with no build step, and a leftover dist/ (e.g.
-# emitted by `prepack` during a `pnpm check` pack gate) can never silently shadow
+# emitted by `prepack` during a `pnpm run check:full` pack gate) can never silently shadow
 # the source. Node >= 24 (engines.node in ../../package.json is the SSOT;
 # check-node-floor-coherence binds this comment to it).
 #
@@ -48,7 +48,7 @@ SRC_ENTRY="$HERE/src/index.ts"
 # Mode is decided by LOCATION, not by "does dist happen to exist". A dev clone
 # lives outside node_modules and ALWAYS runs the TS source via strip-types, so an
 # edit is picked up immediately and a stale dist (e.g. left behind by a prior
-# `npm pack`/`prepack` during `pnpm check`) can never silently shadow the source.
+# `npm pack`/`prepack` during `pnpm run check:full`) can never silently shadow the source.
 # An installed package lives under node_modules, where Node refuses strip-types,
 # so it MUST run the prebuilt dist. All chatter goes to stderr so it never
 # confuses an MCP client reading JSON-RPC frames from stdout.

package/mcp/entwurf-bridge/test.sh

@@ -40,19 +40,33 @@ OUT="$(jsonrpc)"
 TOOLS_JSON="$(printf '%s\n' "$OUT" | grep '"id":2' | tail -1)"
 [[ -n "$TOOLS_JSON" ]] || fail "missing tools/list response: $OUT"
 
-python3 - <<'PY' <<<"$TOOLS_JSON"
-import json, sys
-obj=json.load(sys.stdin)
-names={t['name'] for t in obj['result']['tools']}
-expected={'entwurf_v2','entwurf_self','entwurf_peers','entwurf_inbox_read','entwurf_register_native'}
-missing=expected-names
+# The payload rides an ENV VAR, not stdin. It used to be `python3 - <<'PY' <<<"$TOOLS_JSON"`,
+# which is TWO redirections onto fd 0: the here-string wins, so python read the tools/list JSON
+# as its PROGRAM (a bare dict literal — valid Python that does nothing) and the here-doc below
+# never ran at all. Every assertion in this block was dead from the day it was written, and the
+# `ok:` line beneath printed unconditionally. Keep exactly one stdin here.
+TOOLS_JSON="$TOOLS_JSON" python3 - <<'PY'
+import json, os
+obj=json.loads(os.environ["TOOLS_JSON"])
+raw=[t['name'] for t in obj['result']['tools']]
+names=set(raw)
+# EXACT set, not a floor. This suite ships inside the tarball and is what an installed
+# `entwurf check-bridge` runs against the dist branch of start.sh, so a subset check here
+# was an artifact-surface hole: a bundle missing entwurf_fresh_call / entwurf_resume_call
+# answered tools/list and passed. Equality also refuses an undecided extra verb; the
+# duplicate arm catches a name registered twice, which set membership cannot see.
+expected={'entwurf_v2','entwurf_self','entwurf_peers','entwurf_inbox_read','entwurf_register_native','entwurf_fresh_call','entwurf_resume_call'}
 legacy={'entwurf','entwurf_resume','entwurf_send'} & names
-if missing:
-    raise SystemExit(f"missing tools: {sorted(missing)}")
+if len(raw)!=len(names):
+    raise SystemExit(f"duplicate tool registrations: {sorted(raw)}")
+# Named negative first, so a resurrected v1 verb keeps its own diagnosis instead of
+# arriving as a nameless "unexpected" entry in the equality message below.
 if legacy:
     raise SystemExit(f"legacy v1 tools still registered: {sorted(legacy)}")
+if names!=expected:
+    raise SystemExit(f"tool set MISMATCH — missing {sorted(expected-names)}, unexpected {sorted(names-expected)}")
 PY
-ok "v2-only tool surface registered"
+ok "public tool surface is EXACTLY the seven garden verbs (no v1 verb, no undecided extra, no duplicate)"
 
 SELF_JSON="$(printf '%s\n' "$OUT" | grep '"id":3' | tail -1)"
 [[ "$SELF_JSON" == *"isError"* ]] || fail "entwurf_self without identity should be an error: $SELF_JSON"

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -16,8 +16,10 @@
 	// (TS 5.7+) instead of `noEmit`, so emitted JS references `.js` paths, including
 	// the lazy `await import("./entwurf-preflight.ts")` → `./entwurf-preflight.js`.
 	// That dynamic import stays dynamic in the output, so the eager boot closure
-	// remains pi-free (check-entwurf-bridge-pi-free) while the owned-outcome resume
-	// branch still lazy-loads the pi-backed preflight. This is an EMIT pass, not a
+	// remains pi-free (check-entwurf-bridge-pi-free). The branch that used to reach
+	// that lazy edge — the owned-outcome resume verdict — was withdrawn, so nothing
+	// on the dispatch path loads the pi-backed preflight today; the dynamic form is
+	// kept because the eager-closure guarantee must not depend on that. This is an EMIT pass, not a
 	// typecheck pass — the noEmit typecheck fence (scripts/tsconfig.json) is
 	// untouched, so every `.ts` is still typechecked by exactly one `tsc --noEmit`.
 	"extends": "../../tsconfig.json",
@@ -84,6 +86,12 @@
 	// and run_ts refuses them under an installed package rather than emitting 70+
 	// gate leaves into the tarball.
 	//
+	// WHY meta-facts rides this build (#65): it is the operator projection external
+	// consumers call INSTEAD of parsing the store, and those consumers live on
+	// INSTALLED hosts — under node_modules, where run_ts needs a compiled twin.
+	// Its only repo import is meta-session.ts, already emitted for the
+	// store-doctor, so it adds ONE leaf JS and ZERO new deps.
+	//
 	// WHY meta-bridge-fresh-cut rides this build: it is the ONE operator command
 	// every v3-only rejection surface names, and the hosts that need it most are
 	// INSTALLED hosts sitting on a previous-generation store — exactly where
@@ -102,6 +110,7 @@
 		"../../scripts/new-session-id.ts",
 		"../../scripts/meta-bridge-prune.ts",
 		"../../scripts/meta-bridge-fresh-cut.ts",
+		"../../scripts/meta-facts.ts",
 		"../../pi-extensions/meta-bridge-hook.ts"
 	]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.13.1",
+	"version": "0.14.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -74,33 +74,35 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.64.0",
+		"@agentclientprotocol/claude-agent-acp": "0.66.0",
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.83.0 <0.84",
-		"@earendil-works/pi-coding-agent": ">=0.83.0 <0.84",
-		"@earendil-works/pi-tui": ">=0.83.0 <0.84",
+		"@earendil-works/pi-ai": ">=0.84.1 <0.85",
+		"@earendil-works/pi-coding-agent": ">=0.84.1 <0.85",
+		"@earendil-works/pi-tui": ">=0.84.1 <0.85",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.83.0",
-		"@earendil-works/pi-coding-agent": "0.83.0",
-		"@earendil-works/pi-tui": "0.83.0",
+		"@earendil-works/pi-ai": "0.84.1",
+		"@earendil-works/pi-coding-agent": "0.84.1",
+		"@earendil-works/pi-tui": "0.84.1",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
-		"typescript": "^6.0.2"
+		"rregex": "1.13.1",
+		"typescript": "^6.0.2",
+		"vitest": "4.1.9"
 	},
 	"scripts": {
 		"prepare": "husky 2>/dev/null || true; npm run --silent build-bridge",
 		"postinstall": "node scripts/postinstall-chmod.cjs",
 		"build-bridge": "bash scripts/with-dist-lock.sh bash scripts/build-bridge.sh",
 		"prepack": "pnpm --silent run build-bridge",
-		"prepublishOnly": "pnpm run check && pnpm run check-pack-install",
+		"prepublishOnly": "pnpm run check:full && pnpm run check-pack-install",
 		"setup": "./run.sh setup",
 		"check-shell-quote": "./run.sh check-shell-quote",
 		"check-install-surface": "./run.sh check-install-surface",
@@ -129,13 +131,22 @@
 		"check-pack": "./run.sh check-pack",
 		"check-pack-install": "./run.sh check-pack-install",
 		"check-install-container": "./run.sh check-install-container",
+		"test": "vitest run",
+		"test:watch": "vitest",
 		"test:pack": "pnpm run check-pack && pnpm run check-pack-install",
 		"typecheck": "tsc --noEmit && tsc -p mcp/tsconfig.json && tsc -p scripts/tsconfig.json",
 		"lint": "biome check .",
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",
 		"check-package-source-routing": "./run.sh check-package-source-routing",
-		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-install-surface && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh check-meta-doctor-oracle && ./run.sh smoke-agy-install-state && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-agy-sender-identity && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-gate-qualification && ./run.sh check-pack"
+		"check": "bash scripts/check-elapsed.sh check check:core",
+		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
+		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
+		"check:toolchain": "pnpm lint && pnpm typecheck",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
+		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [