@junghanacs/entwurf 0.13.1 → 0.14.1

package/scripts/lib/mutation-qualify.ts

@@ -78,6 +78,70 @@ export function signatureOnFailureLine(output: string, token: string): boolean {
 	return output.split("\n").some((line) => line.includes(token) && !/^\s*ok\b/.test(line));
 }
 
+/** run_vitest prints this line when the runner asked it for a structured report.
+ * Its PRESENCE — not the report's readability — is what declares the lane structured. */
+export const VITEST_STRUCTURED_MARKER = "__ENTWURF_VITEST_JSON__";
+
+/**
+ * What a gate run said about WHICH tests failed.
+ *
+ * - `"legacy"`: no structured marker — a hand-built node:assert/shell gate whose
+ *   `ok`-line oracle is unchanged.
+ * - `"unreadable"`: the marker was printed but the report is missing or malformed.
+ *   This NEVER falls back to token scanning: a structured lane that lost its report
+ *   has no attribution at all, so the mutant is WRONG-REASON, not KILLED.
+ * - a title array: the exact `fullName` of every FAILED test.
+ */
+export type FailedTestTitles = "legacy" | "unreadable" | string[];
+
+/** Read the failed-test titles a vitest gate wrote, if it declared itself structured. */
+export function readVitestFailedTitles(output: string, reportPath: string | null): FailedTestTitles {
+	if (!output.split("\n").some((line) => line.trim() === VITEST_STRUCTURED_MARKER)) return "legacy";
+	if (!reportPath) return "unreadable";
+	let raw: string;
+	try {
+		raw = fs.readFileSync(reportPath, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	let report: {
+		testResults?: Array<{ assertionResults?: Array<{ status?: string; fullName?: string; title?: string }> }>;
+	};
+	try {
+		report = JSON.parse(raw);
+	} catch {
+		return "unreadable";
+	}
+	if (!Array.isArray(report.testResults)) return "unreadable";
+	const titles: string[] = [];
+	for (const suite of report.testResults) {
+		for (const assertion of suite.assertionResults ?? []) {
+			if (assertion.status !== "failed") continue;
+			titles.push(assertion.fullName ?? assertion.title ?? "");
+		}
+	}
+	return titles;
+}
+
+/**
+ * Attribute a kill to its claim. A Vitest failure's CODE FRAME quotes the source lines
+ * around the assertion — including an adjacent PASSING test's `it("[QK:…]" …)` title —
+ * so scanning output lines would certify a claim whose test never failed (measured:
+ * issue #62 review). Structured lanes therefore read only the failed-test title set.
+ */
+export function signatureAttributedToFailure(output: string, token: string, failed: FailedTestTitles): boolean {
+	if (failed === "legacy") return signatureOnFailureLine(output, token);
+	if (failed === "unreadable") return false;
+	return failed.some((title) => title.includes(token));
+}
+
+/** One legible word for the report line, so a WRONG-REASON says WHY it could not attribute. */
+export function describeAttribution(failed: FailedTestTitles): string {
+	if (failed === "legacy") return "failure-line";
+	if (failed === "unreadable") return "vitest-structured-but-unreadable";
+	return `vitest-failed-titles(${failed.length})`;
+}
+
 // ── manifest schema (fail-loud, exact keys) ─────────────────────────────────
 
 export interface MutantSpec {
@@ -430,6 +494,8 @@ export interface GateRunResult {
 	timedOut: boolean;
 	output: string;
 	seconds: number;
+	/** Structured failed-test attribution; `"legacy"` for every non-vitest gate. */
+	failedTitles: FailedTestTitles;
 }
 
 const OUTPUT_CAP = 4 * 1024 * 1024;
@@ -437,12 +503,23 @@ const OUTPUT_CAP = 4 * 1024 * 1024;
 /** Env prefixes the outer fence strips so a gate child starts from a neutral host. */
 const STRIP_ENV_PREFIXES = ["ENTWURF_", "AGY_", "PI_SESSION_ID", "PI_AGENT_ID"];
 
+/** Where a vitest-backed gate writes its machine report for this one invocation. */
+function vitestReportPath(invocationDir: string): string {
+	return path.join(invocationDir, "vitest-report.json");
+}
+
 function fencedEnv(invocationDir: string): NodeJS.ProcessEnv {
 	const env: NodeJS.ProcessEnv = {};
 	for (const [k, v] of Object.entries(process.env)) {
 		if (STRIP_ENV_PREFIXES.some((p) => k === p || k.startsWith(p))) continue;
 		env[k] = v;
 	}
+	// A vitest-backed gate writes its machine report HERE, inside the per-invocation dir
+	// (outside the snapshot repo, so the work-surface purity hash never sees it). The
+	// report is a FILE and not stdout on purpose: `output` merges stdout+stderr, so one
+	// vite warning ahead of the JSON would break the parse and silently downgrade a real
+	// kill to WRONG-REASON. Legacy gates ignore the variable.
+	env.ENTWURF_MUTATION_VITEST_REPORT = vitestReportPath(invocationDir);
 	for (const d of ["home", "xdg-data", "xdg-config", "xdg-cache", "xdg-state"]) {
 		fs.mkdirSync(path.join(invocationDir, d), { recursive: true });
 	}
@@ -499,7 +576,9 @@ export function runGateBounded(opts: {
 		});
 		child.on("close", (code) => {
 			clearTimeout(timer);
-			resolve({ exitCode: code, timedOut, output, seconds: (Date.now() - started) / 1000 });
+			// Read the report BEFORE the caller removes the invocation dir.
+			const failedTitles = readVitestFailedTitles(output, vitestReportPath(opts.invocationDir));
+			resolve({ exitCode: code, timedOut, output, failedTitles, seconds: (Date.now() - started) / 1000 });
 		});
 	});
 }
@@ -548,6 +627,29 @@ function countOccurrences(haystack: string, needle: string): number {
 	return count;
 }
 
+/** Tail of a red control run's captured output that gets echoed into the log. */
+const CONTROL_TAIL_LINES = 40;
+
+/**
+ * Echo a RED control run's captured output. Without this the runner reports the
+ * verdict (`RED (exit=1 …)`) and DROPS the reason it already holds, which makes a
+ * CONTROL-RED that only reproduces on one host — a CI runner, say — undiagnosable
+ * from its log: the same single line no matter how often it is re-run. A bounded
+ * tail is enough, because a gate names its failure on the way out. Silence is a
+ * finding too, so an empty capture is reported as empty rather than skipped.
+ */
+function logControlOutput(output: string, log: (line: string) => void): void {
+	const body = output.replace(/\s+$/, "");
+	if (body === "") {
+		log("    │ (the control run produced no output — the failure is upstream of the gate's own reporting)");
+		return;
+	}
+	const lines = body.split("\n");
+	const dropped = Math.max(0, lines.length - CONTROL_TAIL_LINES);
+	if (dropped > 0) log(`    │ … ${dropped} earlier line(s) omitted`);
+	for (const line of lines.slice(-CONTROL_TAIL_LINES)) log(`    │ ${line}`);
+}
+
 /**
  * Run every mutant grouped by its gate command, with the control-mutant-restore-
  * control state machine. A red CONTROL-PRE aborts the whole group (every mutant
@@ -593,6 +695,7 @@ export async function qualifyMutants(
 			`  control-pre ${gate.join(" ")}: ${controlPreOk ? "green" : `RED (exit=${pre.exitCode} timedOut=${pre.timedOut})`} in ${pre.seconds.toFixed(1)}s`,
 		);
 		if (!controlPreOk) {
+			logControlOutput(pre.output, log);
 			group.control = "pre-red";
 			for (const m of groupMutants) {
 				group.mutants.push({
@@ -678,7 +781,7 @@ export async function qualifyMutants(
 				matchCount: 1,
 				timedOut: run.timedOut,
 				exitCode: run.exitCode,
-				signatureOnFailureLine: signatureOnFailureLine(run.output, m.signature),
+				signatureOnFailureLine: signatureAttributedToFailure(run.output, m.signature, run.failedTitles),
 				restoredOk,
 			});
 			if (!restoredOk) groupImpure = true;
@@ -687,7 +790,9 @@ export async function qualifyMutants(
 				verdict,
 				seconds: run.seconds,
 				subjectSha256: originalSha,
-				detail: `exit=${run.exitCode} timedOut=${run.timedOut} signature=${m.signature}`,
+				detail:
+					`exit=${run.exitCode} timedOut=${run.timedOut} signature=${m.signature}` +
+					` attribution=${describeAttribution(run.failedTitles)}`,
 			});
 			log(
 				`  claim ${m.claim}: ${verdict} in ${run.seconds.toFixed(1)}s (subject ${m.subject} sha256=${originalSha.slice(0, 12)}…)`,
@@ -705,6 +810,7 @@ export async function qualifyMutants(
 		log(
 			`  control-post ${gate.join(" ")}: ${controlPostOk ? "green" : `RED (exit=${post.exitCode} timedOut=${post.timedOut}) — restore contamination or gate state leak`} in ${post.seconds.toFixed(1)}s`,
 		);
+		if (!controlPostOk) logControlOutput(post.output, log);
 	}
 
 	const postTree = computeTreeManifest(snapshot.repoDir);

package/scripts/meta-bridge-doctor.sh

@@ -1207,14 +1207,12 @@ case "$REPO" in
     fi
     ;;
 esac
-# prefixRoots operator policy (5d-4b): the shared env SSOT both v2 surfaces read. Display
-# ONLY — the parser SSOT lives in entwurf-v2-surface.ts (proven by check-entwurf-v2-surface);
-# the doctor does NOT re-implement parsing. Unset ⇒ no prefix promotion (the safe default).
-if [ -z "${ENTWURF_PREFIX_ROOTS:-}" ]; then
-  ok "ENTWURF_PREFIX_ROOTS unset → no prefix auto-approve (preflight default trust)"
-else
-  ok "ENTWURF_PREFIX_ROOTS set → operator prefix-approve roots: $ENTWURF_PREFIX_ROOTS"
-fi
+# NOT REPORTED: ENTWURF_PREFIX_ROOTS. It was the operator-policy SSOT that both v2 surfaces
+# read to feed the dispatch-path trust preflight, and that preflight guarded the resume verdict
+# — so it left with `owned-outcome` in the visible-first cut. Nothing on the dispatch path reads
+# the variable now, and a doctor line saying "set → operator prefix-approve roots" would report a
+# knob that does nothing. Reporting an inert setting as live policy is the failure this doctor
+# exists to prevent, so the row is gone rather than softened.
 
 echo
 if [ "$fail" -eq 0 ]; then echo "meta-bridge doctor: PASS"; else echo "meta-bridge doctor: FAIL (see above)"; exit 1; fi

package/scripts/meta-bridge-state.py

@@ -74,7 +74,6 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
-    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
     ("verbose", ["verbose"], False),
     ("autoCompactEnabled", ["autoCompactEnabled"], False),
     ("showTurnDuration", ["showTurnDuration"], False),
@@ -84,6 +83,19 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("workflowKeywordTriggerEnabled", ["workflowKeywordTriggerEnabled"], False),
 ]
 
+# Keys entwurf used to own but now returns to the operator. An old install-state
+# entry is the only authority to undo our prior write; a bare matching value is
+# not provenance and is never changed. apply() consumes each proven old entry
+# exactly once, then uninstall can no longer restore over the operator's choice.
+RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
+    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
+]
+
+_managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}
+_retired_scalar_names = {name for name, _path, _last in RETIRED_SETTINGS_SCALARS}
+if overlap := _managed_scalar_names & _retired_scalar_names:
+    raise RuntimeError(f"settings scalar cannot be both managed and retired: {sorted(overlap)}")
+
 
 class StateError(RuntimeError):
     pass
@@ -391,6 +403,9 @@ def apply(repo: Path, asm: Path) -> None:
     if not isinstance(root, dict):
         die(f"{claude_root_config_path()} root must be a JSON object")
 
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        relinquish_retired_scalar(state, settings, name, path_, last_managed_value)
+
     set_nested(settings, ["enabledPlugins", PLUGIN_REF], True)
     set_nested(settings, ["extraKnownMarketplaces", MARKETPLACE], desired_marketplace(asm))
     for path_, desired in [(["permissions", "allow"], PERMISSION_ALLOW), (["permissions", "deny"], PERMISSION_DENY)]:
@@ -446,6 +461,53 @@ def restore_entry(obj: dict[str, Any], entry: dict[str, Any]) -> None:
     die(f"unknown state entry kind: {kind}")
 
 
+def settings_state_keys(state: dict[str, Any]) -> dict[str, Any]:
+    """The settings key ledger, or a loud failure.
+
+    `load_state` validates only the envelope (schemaVersion/owner), so a consumer
+    that indexes straight into files.settings.keys turns a corrupt state file into
+    a bare KeyError traceback instead of an operator diagnostic. Ownership
+    decisions read this ledger, so an unreadable one must stop before any write.
+    """
+    files = state.get("files")
+    entry = files.get("settings") if isinstance(files, dict) else None
+    keys = entry.get("keys") if isinstance(entry, dict) else None
+    if not isinstance(keys, dict):
+        die(f"install state {state_path()} has no files.settings.keys ledger; re-run install-meta-bridge")
+    return keys
+
+
+def relinquish_retired_scalar(
+    state: dict[str, Any], settings: dict[str, Any], name: str, path: list[str], last_managed_value: Any
+) -> None:
+    """Return one formerly managed scalar to operator ownership.
+
+    Only a preserved install-state entry proves entwurf wrote this path. If the
+    current value still has the exact JSON scalar type+value we last managed,
+    restore the snapshot. A changed or absent current value is already the
+    operator's and stays untouched. Malformed provenance fails before any file
+    write; silently discarding it would make a still-dangerous value look clean.
+    """
+    keys = settings_state_keys(state)
+    entry = keys.get(name)
+    if entry is None:
+        return
+    if not isinstance(entry, dict) or entry.get("kind") != "scalar" or entry.get("path") != path:
+        die(f"retired scalar state entry {name} is malformed; refusing to discard ownership evidence")
+    original = entry.get("original")
+    if (
+        not isinstance(original, dict)
+        or set(original) != {"existed", "value"}
+        or type(original.get("existed")) is not bool
+    ):
+        die(f"retired scalar state entry {name} has malformed original; refusing to guess")
+
+    existed, value = get_nested(settings, path)
+    if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+        restore_entry(settings, entry)
+    keys.pop(name)
+
+
 def preflight_uninstall() -> None:
     load_state(required=True)
     print(f"[meta-bridge-state] uninstall preflight ok ({state_path()})")
@@ -536,6 +598,18 @@ def check(repo: Path, asm: Path) -> None:
         if recorded_asm
         else desired_marketplace(asm)
     )
+    state_settings_keys = settings_state_keys(state)
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        if name in state_settings_keys:
+            failures.append(f"install-state still owns retired scalar {name}; re-run install-meta-bridge to relinquish it")
+            continue
+        existed, value = get_nested(settings, path_)
+        if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+            print(
+                f"NOTE: settings {name}={json.dumps(last_managed_value)} is operator-owned; "
+                f"entwurf no longer suppresses or restores this warning choice"
+            )
+
     checks = [
         (["enabledPlugins", PLUGIN_REF], True, "enabled plugin"),
         (["extraKnownMarketplaces", MARKETPLACE], marketplace_expected, "known marketplace"),

package/scripts/meta-facts.ts

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * meta-facts — owner-normalized, read-only projection of the meta-record store (#65).
+ *
+ * The one join a consumer cannot make anywhere else — `(gardenId, nativeSessionId,
+ * transcriptPath)` — lives only in the meta-record store, and reading that store
+ * correctly means carrying the whole certification contract (strict v3 keyset,
+ * parse-before-uniqueness, no-winner duplicates, O_NOFOLLOW regular-file reads).
+ * External consumers that copied it decayed the day the contract moved. This surface
+ * makes THE owner emit the join: it is `listAllMetaIdentities` over the real store —
+ * the same listing `entwurf_peers` trusts — serialized verbatim. No parallel parser,
+ * no liveness, no socket paths, no transcript contents, no state, no watching.
+ *
+ * stdout (deterministic, 2-space indent, trailing newline):
+ *   {
+ *     "schemaVersion": 1,          // of THIS projection, not of the records
+ *     "storeDir": "/abs/path",
+ *     "citizens": [ <full verbatim strict 9-field v3 records, sorted by gardenId> ],
+ *     "defects":  [ { "filename", "message" }, … sorted by filename ]
+ *   }
+ *
+ * Defects ride IN-BAND: a readable store with uncertifiable entries is a fact to
+ * report, not a failure of this command — the healthy citizens are still true, and
+ * the defect list is exactly what `listAllMetaIdentities` refused and why (a rival
+ * pair is refused on BOTH sides; a schema-invalid record can never quarantine a
+ * healthy neighbour, because parse runs before uniqueness).
+ *
+ * EXIT CONTRACT — the verdict is the exit code (store-doctor precedent):
+ *   0 — store readable; the JSON above is on stdout (defects, if any, in-band).
+ *       A store that does not exist is a readable EMPTY store (ENOENT only).
+ *   2 — usage error (bad argv).
+ *   3 — the store could not be READ (EACCES/ENOTDIR/…). No JSON is emitted:
+ *       an unreadable host must never look like an empty one.
+ */
+
+import { defaultMetaSessionsDir, listAllMetaIdentitiesDir } from "../pi-extensions/lib/meta-session.ts";
+
+const arg = process.argv[2];
+// A dash argv is a flag this command does not have, not a store directory — treating
+// it as a path would answer `--help` with "empty store, exit 0", a silent wrong fact.
+if (process.argv.length > 3 || (arg !== undefined && arg.startsWith("-"))) {
+	console.error("usage: entwurf meta-facts [meta-sessions-dir]");
+	process.exit(2);
+}
+
+let facts: ReturnType<typeof listAllMetaIdentitiesDir>;
+try {
+	facts = listAllMetaIdentitiesDir(arg ?? defaultMetaSessionsDir());
+} catch (err) {
+	console.error(`FAIL: ${err instanceof Error ? err.message : String(err)}`);
+	process.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one
+}
+
+process.stdout.write(
+	`${JSON.stringify(
+		{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors },
+		null,
+		2,
+	)}\n`,
+);

package/scripts/mutants/acp-overlay.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-overlay",
+	"mutants": [
+		{
+			"claim": "ACP-OVERLAY-UNATTENDED-BYPASS",
+			"title": "the isolated Claude overlay goes back to authoring permissions.defaultMode \"default\" — the overlay is the only settings authority the ACP child reads, so an unattended entwurf turn suspends on an interactive permission prompt nobody is there to answer, and the session stalls rather than fails",
+			"subject": "pi-extensions/lib/acp/overlay.ts",
+			"find": ["\t\t\tpermissions: { defaultMode: \"bypassPermissions\" },"],
+			"replace": ["\t\t\tpermissions: { defaultMode: \"default\" },"],
+			"gate": ["bash", "run.sh", "check-acp-overlay"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:ACP-OVERLAY-UNATTENDED-BYPASS]",
+			"signatureSource": "scripts/check-acp-overlay.ts"
+		}
+	]
+}

package/scripts/mutants/acp-stream-hooks.json

@@ -0,0 +1,158 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-stream-hooks",
+	"mutants": [
+		{
+			"claim": "ACPHOOK-PAYLOAD-EXACT-WIRE",
+			"title": "the new-turn send site bypasses the payload hook entirely — the pi-vertex defect: extensions hooking before_provider_request silently observe nothing",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"replace": ["\t\t\tconst wireParams = { sessionId: acpSessionId, prompt };"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-PAYLOAD-EXACT-WIRE]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REPLACEMENT-ON-WIRE",
+			"title": "the helper validates the replacement and then discards it — the original params always cross the wire, so a payload-rewriting extension silently does nothing",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\treturn replacement as T;"],
+			"replace": ["\treturn params;"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REPLACEMENT-ON-WIRE]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REUSE-PARITY",
+			"title": "the reuse send site bypasses the hook, so resident-session requests become invisible to extensions while cold turns stay covered",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);"
+			],
+			"replace": ["\t\t\tconst wireParams = { sessionId: session.acpSessionId, prompt };"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REUSE-PARITY]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REJECTION-FAILS-LOUD",
+			"title": "the new-turn call site silently catches a hook rejection and falls back to the original params — a broken extension keeps 'working'",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model).catch(",
+				"\t\t\t\t() => ({ sessionId: acpSessionId, prompt }),",
+				"\t\t\t);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REJECTION-FAILS-LOUD]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-INVALID-REPLACEMENT-REFUSED",
+			"title": "the non-null/non-array object shape check is dropped, so a scalar replacement is refused for the wrong reason (or not at all) instead of by name",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tif (typeof replacement !== \"object\" || replacement === null || Array.isArray(replacement)) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request returned a non-object replacement — the ACP prompt payload must stay a non-null, non-array object\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// a JS extension can return anything; the sessionId check below is the real guard"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-INVALID-REPLACEMENT-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-EMPTY-PROMPT-REFUSED",
+			"title": "the non-empty prompt invariant is dropped from replacement validation, so an extension can rewrite the turn into an empty ACP send",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tconst replacementPrompt = (replacement as { prompt?: unknown }).prompt;",
+				"\tif (!Array.isArray(replacementPrompt) || replacementPrompt.length === 0) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request returned a replacement without a non-empty prompt array — an empty ACP prompt cannot be sent\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// the send sites already refuse an empty BUILT prompt; trust the replacement"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-EMPTY-PROMPT-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-SESSIONID-TAMPER-REFUSED",
+			"title": "the sessionId invariant is dropped under a literal reading of 'use any returned replacement payload' — the prompt is delivered to a session entwurf never bootstrapped",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tif ((replacement as { sessionId?: unknown }).sessionId !== params.sessionId) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request changed the ACP sessionId — entwurf cannot truthfully deliver to a session it did not bootstrap; prompt rewriting is allowed, session identity is not\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// upstream says use any returned replacement payload verbatim"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-SESSIONID-TAMPER-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-ABORT-DURING-HOOK-WINS",
+			"title": "the post-hook abort recheck is dropped, so an abort raised during a slow handler still sends the prompt to the wire",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);",
+				"\t\t\tif (signal?.aborted) throw new Error(\"aborted during payload hook\");"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-ABORT-DURING-HOOK-WINS]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REUSE-ABORT-WINS",
+			"title": "the REUSE call site's post-hook abort recheck is dropped, so an abort raised during a slow handler still sends a second prompt to the resident session",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);",
+				"\t\t\tif (signal?.aborted) throw new Error(\"aborted during payload hook\");"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REUSE-ABORT-WINS]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-ONRESPONSE-NEVER-CALLED",
+			"title": "someone 'completes' the hook contract by fabricating an HTTP 200 response on turn success — exactly the false evidence the exemption exists to forbid",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tfunction finishSuccess(promptResult: { stopReason?: string }): void {"],
+			"replace": [
+				"\tfunction finishSuccess(promptResult: { stopReason?: string }): void {",
+				"\t\tvoid options?.onResponse?.({ status: 200, headers: {} }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-ONRESPONSE-NEVER-CALLED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		}
+	]
+}

package/scripts/mutants/bridge-boot-resume.json

@@ -0,0 +1,45 @@
+{
+	"schemaVersion": 1,
+	"lane": "bridge-boot-resume",
+	"mutants": [
+		{
+			"claim": "BRIDGEBOOT-RESUME-CALL-REGISTERED",
+			"title": "the resume verb is imported but never registered — invisible to every host, while every import-level assertion stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_resume_call\","],
+			"replace": [
+				"const _unregisteredResumeTool = (...a: unknown[]) => void a;\n_unregisteredResumeTool(\n\t\"entwurf_resume_call\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-RESUME-CALL-REGISTERED]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-RESUME-CALL-TARGET-ONLY",
+			"title": "a model knob is added to the resume schema, giving the caller a second way to decide what a resumed citizen is after the record already decided",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t.describe(\"Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers).\"),"],
+			"replace": [
+				"\t\t\t.describe(\"Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers).\"),\n\t\tmodel: z.string().optional().describe(\"Override the recorded model.\"),"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-RESUME-CALL-TARGET-ONLY]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET",
+			"title": "a verb no assertion happens to name (entwurf_fresh_call) is imported but never registered — the public surface silently shrinks while every named check stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_fresh_call\","],
+			"replace": [
+				"const _unregisteredFreshCallTool = (...a: unknown[]) => void a;\n_unregisteredFreshCallTool(\n\t\"entwurf_fresh_call\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		}
+	]
+}

package/scripts/mutants/meta-facts.json

@@ -0,0 +1,50 @@
+{
+	"schemaVersion": 1,
+	"lane": "meta-facts",
+	"mutants": [
+		{
+			"claim": "MF-EXIT-UNREADABLE",
+			"title": "answering an unreadable store with exit 0 makes an unreadable host look like an empty one — the false-success class the exit contract exists to refuse (#65)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\tprocess.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"replace": ["\tprocess.exit(0); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-EXIT-UNREADABLE]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-FULL-V3-JOIN",
+			"title": "dropping the kept identities from the projection empties the join while still reporting a certified-looking store (#65 wrong fact)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors },"],
+			"replace": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: [], defects: facts.errors },"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-FULL-V3-JOIN]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-DEFECTS-IN-BAND",
+			"title": "dropping the defect list shows a store the certification refuses as clean — the decayed-copy failure mode this surface exists to end (#65 wrong fact)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors },"],
+			"replace": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: [] },"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-DEFECTS-IN-BAND]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-USAGE",
+			"title": "disabling the argv guard makes extra positional args silently read the first as a store dir instead of refusing usage (#65)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["if (process.argv.length > 3 || (arg !== undefined && arg.startsWith(\"-\"))) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-USAGE]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		}
+	]
+}