@junghanacs/entwurf 0.14.0 → 0.14.1

package/AGENTS.md

@@ -30,7 +30,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
 - **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code is mailbox/self-fetch; Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
-- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/cwd/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
+- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
 - **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.
 
 ## Hard Rules
@@ -101,6 +101,17 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 - Sender envelope: `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`.
 - Human-opened and spawned/resumed siblings use the same addressing and messaging semantics.
 
+## Issue queue — a manual sweeper, not a backlog
+
+- OPEN issues are live contracts only, capped at five. A sixth means something closes first; the cap does not bend.
+- A slot is earned by a current defect or executable contract, not by importance, age, or possible future value.
+- Direction, philosophy, frozen invariants and observations without a current action live in `ROADMAP.md`, durable docs, or closed history.
+- Nothing stays open "in case." If a closed problem recurs, it returns as a new issue carrying the new evidence.
+- Anything whose only value is knowing it gets moved to the document that owns it, then closed.
+- A new issue brings the best available observation plus an executable next measurement. Recovering a missing signature may be the first acceptance; an idea with neither evidence nor a next measurement is not an issue.
+- No collection points, umbrella trackers, or fallout buckets. Merge issues only when they share one cause and one acceptance.
+- Sweep manually after a release and before opening an issue. Solved work closes at its durable SHA; it does not wait for the next release.
+
 ## Verification
 
 Two axes are required: deterministic/package gates and opt-in LIVE evidence.

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.14.1 — 2026-08-13
+
+This patch fills the cross-repository creation gap in the visible mux lifecycle shipped in 0.14.0, so one operator tmux session can form siblings in multiple project roots without borrowing a dormant session as a cwd carrier.
+
+### Added
+
+- **`entwurf_fresh_call` accepts one optional literal absolute `cwd` for cross-repository siblings.** Omitting it (or passing `""`) keeps the caller's current directory; Pi and Claude Code receive the selected directory through their existing visible launch path, and the launch receipt reports the requested value without claiming runtime acceptance.
+
+### Changed
+
+- **The lifecycle selection matrix now separates address, continuity, and project root.** Use `entwurf_v2` for an existing live citizen, `entwurf_resume_call` only for continuity with a dormant Pi citizen under its recorded cwd and garden id, and `entwurf_fresh_call` for a new sibling — omitting `cwd` for the caller's project or passing an absolute `cwd` for another repository. Resume is not a substitute for cross-repository fresh creation.
+
+### Fixed
+
+- **The Claude meta-bridge installer relinquishes its retired ownership of `skipDangerousModePermissionPrompt`.** Proven prior install state is restored once when the value is still exactly entwurf's former managed value; operator-changed or unproven values remain untouched, malformed ownership evidence fails loud, and later uninstall cannot overwrite the returned choice.
+- **The cross-harness chain LIVE smoke no longer inherits the runner's `PI_SESSION_ID` / `PI_AGENT_ID`.** When release-gate (or any pi `--entwurf-control` parent) spawned hop A, the MCP bridge preferred those carriers over A's SessionStart meta-sender marker and stamped the runner's garden id on hop 1 — payload still traversed, identity assertion failed. Child env now strips the pi identity carriers so the Claude hop's own marker is authoritative.
+
+### Verification
+
+- Release-gate candidate: the in-gate `pnpm run check:full` exited 0 in 208s, and `./run.sh check-gate-qualification` killed **173/173** committed mutants.
+- `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.1.j2eAVu --cut` — **MUST PASS=20 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Full log: `/tmp/entwurf-release-gate-0.14.1.j2eAVu/release-gate.log` (SHA-256 `bdd4d0b332d08c24210e9f56382b5898c0544fb6dffbf70287dade2f00e67c36`).
+- Pre-tag installed-consumer diagnostics also passed: `./run.sh check-pack-install` installed the 0.14.1 tarball and proved the seven-tool boot plus physical delivery; `ENTWURF_REQUIRE_DOCKER=1 ./run.sh check-install-container` reached `container-consumer: PASS` in a checkout-invisible non-root Node 24 consumer (throwaway candidate SHA-256 `48778d33d1088af8078fe6b59ad932fb34ac8564e80bef84c34b25bab2bd5ef6`). These are diagnostic pack-once artifacts, not the preserved release candidate.
+- On the source-owned operator host, `./run.sh install-meta-bridge` completed the retired-warning relinquishment and `./run.sh doctor-meta-bridge` passed with live MCP owner join, physical delivery, and writer parity. Exact prepared-HEAD CI and acceptance of one preserved immutable candidate remain `make` responsibilities.
+
+### Notes
+
+- #76 (subscription-first refusal of `openrouter/*` sibling models), #60, #72, and #75 remain outside this patch.
+- The chain-smoke repair only scrubs ambient pi identity carriers from its children. The MCP bridge's existing pi-carrier precedence is unchanged; any general nested-runner product guard is a separate contract, not part of 0.14.1 or #76.
+
 ## 0.14.0 — 2026-08-08
 
 Two arcs meet in this release. The product arc makes sibling sessions **visible**: opening and resuming a garden citizen is now an explicit, observable act, and the hidden alternatives were removed rather than kept as compatibility surface. The verification arc keeps the product from being swallowed by its own test cost: the everyday gate now runs in under a minute while the release floor stays strict. Claude Code native + pi + the meta-record store remain the main rail; the ACP backends (Claude ACP, Cortex) are optional service adapters on top of it.

package/README.md

@@ -114,6 +114,12 @@ npx entwurf install .
 npx entwurf check-bridge
 ```
 
+For an npm upgrade, rerun the install command in the same scope (use
+`@junghanacs/entwurf@latest` when you want the registry's stable line explicitly),
+then make the first check from that same scope: `entwurf check-bridge` for a global
+install or `npx entwurf check-bridge` for a project-local install. Native-harness
+installers and process restarts remain a separate post-upgrade step below.
+
 For manual MCP registration from a project-local install, point the host at:
 
 ```text
@@ -139,7 +145,11 @@ pnpm install
 
 A development clone runs the bridge source through Node's strip-types path;
 an npm-installed package runs the prebuilt JS under `mcp/entwurf-bridge/dist/`
-because Node refuses to strip `.ts` files under `node_modules`.
+because Node refuses to strip `.ts` files under `node_modules`. The dev launcher's
+source path means `./run.sh check-bridge` needs no build. After `git pull`, however,
+run `pnpm install` when the lockfile changed and run `pnpm run build-bridge` before
+artifact-consuming checks such as `./run.sh check-bridge-delivery`: `dist/` is
+gitignored and may be absent or stale immediately after a checkout or pull.
 
 ### Pi adapter / ACP plugin lane
 
@@ -218,9 +228,8 @@ host evidence boundaries are [VERIFY.md](./VERIFY.md) and [BASELINE.md](./BASELI
 
 The curated model registry exposes unprefixed Claude ids plus `cortex-` rows.
 Codex is not an ACP backend or a shipped managed citizen lane: it has verified
-native-delivery probe evidence only. Release 0.14.0 does not add Codex support;
-any future managed lane still owes lifecycle, identity, installation, and doctors
-before calling it supported.
+native-delivery probe evidence only. No managed Codex support is claimed; lifecycle,
+identity, installation, and doctors remain prerequisites for any such lane.
 
 **Snowflake Cortex Code is the second ACP backend** (contract and audit:
 [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)). Curated ids are
@@ -418,7 +427,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / Claude-Code-meta-mailbox / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi` or `claude-code`) as a visible window in the operator's own tmux session, requires an explicit model, passes that model on the runtime CLI, and hands it a first task; the sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model plus tmux coordinates and never claims that the runtime accepted the model or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / Claude-Code-meta-mailbox / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi` or `claude-code`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; the sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -437,7 +446,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi or Claude Code runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect, returns only a synchronous launch receipt, and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi or Claude Code runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/docs/external-mcp-host.md

@@ -9,7 +9,7 @@ the one-line registration; everything an operator needs to actually wire a host
 - **plain external MCP host**: no garden meta-record / sender marker. It can call the read surfaces (`entwurf_peers`, `entwurf_inbox_read`), but `entwurf_v2` sends are **refused by default** (#50 C4: "if we don't know who sent it, we don't send it"). The operator may wire the explicit hatch below; the send then goes out external/non-replyable.
 - **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
 Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -26,7 +26,8 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
+ *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
  *                       returns a LAUNCH receipt only, and the new address arrives later as the
  *                       sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
@@ -568,8 +569,10 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
-    "arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+    "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
+    "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+    "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
@@ -594,7 +597,11 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         .min(1)
         .max(16000)
         .describe("What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description)."),
-}, async ({ backend, model, task }) => {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
+}, async ({ backend, model, task, cwd }) => {
     let callerGardenId = null;
     try {
         const self = await buildAuthoritativeSelfEnvelope();
@@ -613,7 +620,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/classify-tmux-cwd.js

@@ -0,0 +1,47 @@
+/**
+ * classify-tmux-cwd — the ONE classification of a start directory that is about to be handed
+ * to tmux as a `-c` value. Shared leaf of the resume and fresh launch compositions; it owns
+ * the classification and NOTHING else — no hints (each consumer phrases its own: resume says
+ * "recorded cwd", fresh says "requested cwd"), no argv, no tmux, no fallback directory.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-08-06, private server), and each
+ * one is a way a launch would look successful while being wrong:
+ *
+ *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back
+ *      to `$HOME`. A launch whose directory has been deleted would therefore open a visible
+ *      window in the wrong project and look successful. Nothing downstream can catch that:
+ *      the launch receipt would be perfectly well-formed.
+ *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
+ *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its
+ *      command. A path is data; tmux reads it as a format. So `#` is refused outright.
+ *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
+ *      arrived intact. So there is no quoting grammar here, and none is owed.
+ *
+ * That is the entire defence: one existence check and one character. No escaping layer, no
+ * sanitiser, no trim, no realpath/symlink policy — a symlinked project dir is a normal thing
+ * to work in, and a value is classified exactly as given.
+ */
+import { statSync } from "node:fs";
+import path from "node:path";
+/**
+ * Classify a candidate start directory. Split into separate reasons rather than one because
+ * the operator's next move differs: an absolute-path bug is a caller defect, a missing
+ * directory is a moved/deleted project, and a `#` is a path tmux would rewrite under us.
+ */
+export function classifyTmuxCwd(cwd) {
+    if (!path.isAbsolute(cwd))
+        return "cwd-not-absolute";
+    // tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
+    // was observed executing; neither is something to escape our way out of.
+    if (cwd.includes("#"))
+        return "cwd-format-token";
+    let st;
+    try {
+        st = statSync(cwd);
+    }
+    catch {
+        // tmux would NOT report this — it opens the window and lands the child in $HOME.
+        return "cwd-missing";
+    }
+    return st.isDirectory() ? null : "cwd-not-directory";
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -25,8 +25,27 @@
  *      caller's own inbound surface. Merging them would claim knowledge this module cannot have.
  *   4. A launch with no callback is a REAL outcome, not an error to retry. No watcher, no poll,
  *      no timeout supervisor. The window is visible; the operator can look.
+ *
+ * ── The optional REQUESTED cwd (issue #73) ──
+ *
+ * A fresh sibling starts wherever the caller happens to be — unless the caller names ONE
+ * literal start directory. That input exists so a cross-repo fresh consultation never has to
+ * ride `entwurf_resume_call` for a dormant record's recorded cwd: resume stays a continuity
+ * verb, and placement pressure stays here. The rules are deliberately narrow:
+ *
+ *   - `undefined` and the exact empty string mean OMIT: no `-c` reaches tmux and the argv is
+ *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
+ *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
+ *     only cwd authority this module knows.
+ *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
+ *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
+ *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
+ *   - the receipt echoes what was REQUESTED, exactly as `runtimePath` does. It never reports
+ *     `pane_current_path`: proving where the pane actually landed belongs to acceptance, not
+ *     to the launch receipt.
  */
 import { randomBytes } from "node:crypto";
+import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 /** The two backends this rail can open. Fixed set, not a profile — a third one is a decision,
@@ -118,16 +137,24 @@ export function mintNonce(randomHex = defaultRandomHex) {
 function defaultRandomHex() {
     return randomBytes(12).toString("hex");
 }
-/** Launch argv: the leaf's detached-append shape, the runtime, then the backend's dialect. */
-export function buildFreshCallArgs(placement, runtimePath, backendArgs) {
+/** Launch argv: the leaf's detached-append shape, optionally `-c` at the resume-symmetric token
+ * position (after `-t`, before `-P -F`), the runtime, then the backend's dialect. An omitted cwd
+ * yields the exact pre-#73 argv — no carrier at all. */
+export function buildFreshCallArgs(placement, runtimePath, backendArgs, cwd) {
     assertSelector("session", placement.sessionId);
     assertLaunchTarget(runtimePath);
+    if (cwd !== undefined) {
+        const bad = classifyTmuxCwd(cwd);
+        if (bad)
+            throw new Error(`mux-fresh-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
+    }
     return [
         "new-window",
         "-d",
         "-a",
         "-t",
         `${placement.sessionId}:{end}`,
+        ...(cwd === undefined ? [] : ["-c", cwd]),
         "-P",
         "-F",
         APPEND_FORMAT,
@@ -159,6 +186,15 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         return { ok: false, reason: "task-empty" };
     if (task.length > TASK_MAX_CHARS)
         return { ok: false, reason: "task-too-long" };
+    // ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
+    // value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
+    // classification below instead of being silently repaired into a different directory.
+    const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    if (cwd !== undefined) {
+        const badCwd = classifyTmuxCwd(cwd);
+        if (badCwd)
+            return { ok: false, reason: badCwd };
+    }
     let runtimePath;
     try {
         runtimePath = resolveRuntimeOnPath(FRESH_CALL_RUNTIME[params.backend], env);
@@ -179,7 +215,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         callerGardenId: params.callerGardenId,
         nonce,
     });
-    const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model)), env);
+    const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model), cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -199,6 +235,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             ...fields,
             backend: params.backend,
             model,
+            ...(cwd === undefined ? {} : { cwd }),
             runtimePath,
             nonce,
         },
@@ -212,6 +249,10 @@ const REJECT_HINT = {
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
     "anchor-mismatch": "tmux answered about a different pane than the one asked about",
     "caller-identity-unavailable": "this surface has no record-backed garden id for the caller, so the sibling would have no address to call back to",
+    "cwd-not-absolute": "the requested cwd is not an absolute path (the value is taken literally — nothing trims or resolves it)",
+    "cwd-format-token": "the requested cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
+    "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
+    "cwd-not-directory": "the requested cwd exists but is not a directory",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -244,6 +285,7 @@ export function renderFreshCall(result) {
         text: `[entwurf fresh call →]\n` +
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
+            (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +
             `  nonce:    ${r.nonce}\n` +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-resume-call.js

@@ -4,12 +4,13 @@
  *
  * ── Why this is a module and not a parameter on fresh-call ──
  *
- * `mux-fresh-call` carries a TASK to a runtime it names; the sibling starts wherever the caller
- * happens to be. A resume carries neither: the argv comes from the record (`entwurf-v2-visible-
- * resume` builds it) and the cwd comes from the record too — it is the directory the citizen's
- * own transcript header remembers. Those are different inputs with a different risk, so they get
- * a different module rather than a fourth parameter on a composition whose contract is
- * "identity is an OUTPUT".
+ * `mux-fresh-call` carries a TASK to a runtime it names, and starts the sibling wherever the
+ * caller happens to be unless the caller REQUESTS one literal start directory (#73). A resume
+ * carries neither a task nor a caller choice: the argv comes from the record (`entwurf-v2-
+ * visible-resume` builds it) and the cwd comes from the record too — it is the directory the
+ * citizen's own transcript header remembers, never something the caller picks. Those are
+ * different inputs with a different risk, so they get a different module rather than a fourth
+ * parameter on a composition whose contract is "identity is an OUTPUT".
  *
  *   visible-resume composition → resume-call → placement leaf (unchanged, carrier-free)
  *   resume-call               -X-> garden identity, records, locks, delivery
@@ -20,22 +21,15 @@
  *
  * `mux-placement`'s `buildAppendArgs` deliberately emits no `-c` ("default shell only"), and it
  * stays that way — a resume must not widen the leaf's grammar for the three other callers. So
- * the `-c` shape lives here, with the three refusals MEASURED on tmux 3.6a (2026-08-06, private
- * server):
+ * the `-c` SHAPE lives here, while the classification of the value lives in the shared
+ * `classify-tmux-cwd.ts` leaf (fresh-call hands tmux the same flag, and a twin copy of the
+ * measured rules would rot apart on the next tmux hazard). The measured tmux 3.6a facts —
+ * a nonexistent `-c` silently lands the child in `$HOME`, `#` is format-expanded, whitespace
+ * is safe — are documented on that leaf. `|` is fine too: the cwd never enters the `-F` row
+ * (see `APPEND_FORMAT` below).
  *
- *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back to
- *      `$HOME`. A resume whose recorded cwd has been deleted would therefore open a visible
- *      window in the wrong project and look successful. Nothing downstream can catch that: the
- *      launch receipt would be perfectly well-formed.
- *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
- *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its command.
- *      A path is data; tmux reads it as a format. So `#` is refused outright.
- *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
- *      arrived intact. So there is no quoting grammar here, and none is owed. `|` is fine too:
- *      the cwd never enters the `-F` row (see `APPEND_FORMAT` below).
- *
- * That is the entire defence: one existence check and one character. No escaping layer, no
- * sanitiser, no symlink policy — a symlinked project dir is a normal thing to work in.
+ * What stays HERE is the phrasing: this module's hints say "recorded cwd", because a resume's
+ * directory comes from the record — fresh-call's say "requested cwd" for the same reasons.
  *
  * ── What the receipt does NOT say ──
  *
@@ -46,36 +40,13 @@
  * where the pane actually landed is a separate query against the stable pane id, and it belongs
  * to acceptance, not to the product's launch receipt.
  */
-import { statSync } from "node:fs";
-import path from "node:path";
+import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 /** The fixed runtime a resume reopens. Only pi stands a control socket up, so only pi has a
  * same-id resume at all — the backend boundary is enforced upstream by
  * `resolveResumeLaunchIdentity`, and this constant is the mux half of the same fact. */
 export const RESUME_CALL_RUNTIME = "pi";
-/**
- * Classify a candidate start directory. Split into three reasons rather than one because the
- * operator's next move differs: an absolute-path bug is a caller defect, a missing directory is
- * a moved/deleted project, and a `#` is a path tmux would rewrite under us.
- */
-export function classifyResumeCwd(cwd) {
-    if (!path.isAbsolute(cwd))
-        return "cwd-not-absolute";
-    // tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
-    // was observed executing; neither is something to escape our way out of.
-    if (cwd.includes("#"))
-        return "cwd-format-token";
-    let st;
-    try {
-        st = statSync(cwd);
-    }
-    catch {
-        // tmux would NOT report this — it opens the window and lands the child in $HOME.
-        return "cwd-missing";
-    }
-    return st.isDirectory() ? null : "cwd-not-directory";
-}
 /**
  * Launch argv: the leaf's detached-append shape plus `-c`, the runtime, then the caller's flags.
  * `--` is what keeps tmux from reading the runtime or its flags as tmux options.
@@ -83,7 +54,7 @@ export function classifyResumeCwd(cwd) {
 export function buildResumeCallArgs(placement, cwd, runtimePath, runtimeArgs) {
     assertSelector("session", placement.sessionId);
     assertLaunchTarget(runtimePath);
-    const bad = classifyResumeCwd(cwd);
+    const bad = classifyTmuxCwd(cwd);
     if (bad)
         throw new Error(`mux-resume-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
     return [
@@ -110,7 +81,7 @@ export function buildResumeCallArgs(placement, cwd, runtimePath, runtimeArgs) {
  * `runtimeArgs` is passed through untouched. This module does not know what `--session` means.
  */
 export function resumeCall(params, env = process.env) {
-    const badCwd = classifyResumeCwd(params.cwd);
+    const badCwd = classifyTmuxCwd(params.cwd);
     if (badCwd)
         return { ok: false, reason: badCwd };
     let runtimePath;

package/mcp/entwurf-bridge/src/index.ts

@@ -26,7 +26,8 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
+ *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
  *                       returns a LAUNCH receipt only, and the new address arrives later as the
  *                       sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
@@ -661,8 +662,10 @@ server.tool(
 		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
 		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
 		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
-		"arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
+		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
 		"same-user processes on this host. Requires that this agent itself runs " +
 		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
 	{
@@ -690,8 +693,14 @@ server.tool(
 			.describe(
 				"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
 			),
+		cwd: z
+			.string()
+			.optional()
+			.describe(
+				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+			),
 	},
-	async ({ backend, model, task }) => {
+	async ({ backend, model, task, cwd }) => {
 		let callerGardenId: string | null = null;
 		try {
 			const self = await buildAuthoritativeSelfEnvelope();
@@ -708,7 +717,7 @@ server.tool(
 			callerGardenId = null;
 		}
 		try {
-			const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+			const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {
 			return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.14.0",
+	"version": "0.14.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {

package/pi-extensions/entwurf-control.ts

@@ -1489,7 +1489,7 @@ const MUX_FRESH_CALL_MODULE = "./lib/mux-fresh-call.ts";
 
 interface MuxFreshCallModule {
 	freshCall(
-		params: { backend: "pi" | "claude-code"; model: string; task: string; callerGardenId: string | null },
+		params: { backend: "pi" | "claude-code"; model: string; task: string; cwd?: string; callerGardenId: string | null },
 		env?: NodeJS.ProcessEnv,
 	): { ok: boolean };
 	renderFreshCall(result: { ok: boolean }): { text: string; isError: boolean };
@@ -1520,8 +1520,10 @@ not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus tha
 it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls for the
 callback; if it never arrives the window is visible and can be read directly. For EXISTING citizens use
 entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the
-chosen runtime CLI (provider/model for pi; model id/alias for Claude Code); there are no arbitrary
-command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
+chosen runtime CLI (provider/model for pi; model id/alias for Claude Code). An optional cwd starts the
+sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume for a dormant
+record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. There are no
+arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
 processes on this host.`,
 		parameters: Type.Object({
 			backend: StringEnum(["pi", "claude-code"], {
@@ -1539,10 +1541,16 @@ processes on this host.`,
 				description:
 					"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
 			}),
+			cwd: Type.Optional(
+				Type.String({
+					description:
+						"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+				}),
+			),
 		}),
 		async execute(
 			_toolCallId: string,
-			params: { backend: "pi" | "claude-code"; model: string; task: string },
+			params: { backend: "pi" | "claude-code"; model: string; task: string; cwd?: string },
 			_signal: AbortSignal | undefined,
 			_onUpdate: unknown,
 			_ctx: ExtensionContext,
@@ -1553,6 +1561,7 @@ processes on this host.`,
 					backend: params.backend,
 					model: params.model,
 					task: params.task,
+					cwd: params.cwd,
 					callerGardenId: residentGardenId,
 				});
 				const rendered = mux.renderFreshCall(result);