@junghanacs/entwurf 0.14.0 → 0.14.2

package/run.sh

@@ -120,7 +120,7 @@ usage() {
   cat <<'EOF'
 Usage:
   ./run.sh setup [project-dir]        # ONE confident install: pnpm install + install + meta-bridge (if native harness) + v2 install smoke (LIVE substrate = release-gate)
-  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
+  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
@@ -156,8 +156,8 @@ Usage:
   ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
   ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
-  ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
-  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
+  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
@@ -197,6 +197,7 @@ Usage:
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
   ./run.sh install-agy-bridge         # 봉인 7: agy MCP install adapter — register ONE entwurf-bridge server in the agy mcp_config (adopt file / create / REFUSE symlink), stable bin command, install-state under $XDG_DATA_HOME/entwurf/agy-bridge/
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
+  ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
   ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
   ./run.sh install-agy-statusline     # own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings
   ./run.sh uninstall-agy-statusline   # honest inverse from statusline install-state
@@ -1356,7 +1357,7 @@ smoke_acp_cortex_live() {
   # (ACP rail Cortex verification boundary). Drives one real
   # cortex ACP turn through the entwurf provider path (outbound entwurf_v2 +
   # dual-HOME overlay facts + process-group reclaim — CP2).
-  # HONEST-SKIP (exit 0) when LIVE!=1 OR `cortex` is not on PATH OR no
+  # HONEST-SKIP (protocol exit 97, never 0) when LIVE!=1 OR `cortex` is not on PATH OR no
   # connection is pinned — the live turn needs `cortex` installed with the
   # operator's own web-login auth already present (there is no `cortex auth`
   # subcommand — CP0 D6), reached through the overlay's narrow credential
@@ -1389,7 +1390,7 @@ smoke_entwurf_v2_matrix_live() {
   # reject, no garbage). Model-in-loop is OUT (GPT Q2): "does the sender model call entwurf_v2"
   # is a separate behavior test — this is a transport/lock/enqueue gate. Negative/timeout/contention
   # stay deterministic. Honest skip when LIVE!=1 so the release-gate is runnable unattended.
-  # Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4).
+  # Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna).
   #   LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   entwurf_require_step_outcome
   if [ "${LIVE:-}" != "1" ]; then
@@ -1628,13 +1629,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.1 pin) whose
+// pi (past the declared ceiling — 0.85+ at the current 0.84.2 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.1` an existing 0.83.x host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.1 <0.85`).
+// install resolves: at `>=0.84.2` an existing 0.83.x host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.2 <0.85`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2741,6 +2742,9 @@ check_pack() {
     "mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js"
     "mcp/entwurf-bridge/dist/scripts/new-session-id.js"
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-prune.js"
+    # #81 — the boot probe doctor-pi-provider imports (and `entwurf probe-bridge-command` runs).
+    # Without the twin the installed doctor dies on the import before printing a verdict.
+    "mcp/entwurf-bridge/dist/scripts/probe-bridge-command.js"
     # The generation verb. The hosts that need it are installed hosts on a
     # previous-generation store; without this twin the prescription every
     # v3-only rejection names would be dead exactly where it matters.
@@ -2940,6 +2944,8 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js"
     "mcp/entwurf-bridge/dist/scripts/new-session-id.js"
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-prune.js"
+    # #81 — the boot probe the installed doctor imports (see check-pack).
+    "mcp/entwurf-bridge/dist/scripts/probe-bridge-command.js"
     # The generation verb (see check-pack). The installed-command regression below
     # opens a fresh generation on a 0-record sandbox through the real bin.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
@@ -3021,7 +3027,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.1`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.84.2`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3040,12 +3046,12 @@ _check_pack_install_impl() {
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.1" \
-    "@earendil-works/pi-coding-agent@0.84.1" \
-    "@earendil-works/pi-tui@0.84.1" \
-    "@earendil-works/pi-agent-core@0.84.1" \
-    "@earendil-works/pi-client@0.84.1" \
-    "@earendil-works/pi-protocol@0.84.1" \
+    "@earendil-works/pi-ai@0.84.2" \
+    "@earendil-works/pi-coding-agent@0.84.2" \
+    "@earendil-works/pi-tui@0.84.2" \
+    "@earendil-works/pi-agent-core@0.84.2" \
+    "@earendil-works/pi-client@0.84.2" \
+    "@earendil-works/pi-protocol@0.84.2" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3055,17 +3061,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.1. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.84.2. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.1". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.84.2". Fail loud instead of proving the wrong floor.
   local leaked_pi
-  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.84\.1' || true)
+  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.84\.2' || true)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.2):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.1"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.2"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4463,6 +4469,23 @@ release_gate() {
   # is gated behind SMOKE_RGG_POSITIVE=1 in the BEHAVIOR lane below.
   run_step "smoke-resident-garden-guard (3c citizen: record birth / record-keyed socket / attach-on-reopen, 0-token)" gate env SMOKE_RGG_POSITIVE=0 bash "$self" smoke-resident-garden-guard
   run_step "check-bridge"                   gate bash "$self" check-bridge
+  # check-bridge booted the launcher THIS CHECKOUT ships; this boots the invocation the operator's
+  # pi provider actually EXECS. Two different strings, and only the second one reaches a live ACP
+  # session. 2026-08-19 measured the gap at full price: `~/.local/bin/entwurf-bridge` had been
+  # relocated onto a pnpm cmd-shim (basedir derived from $0, so not relocatable), it exited 127, the
+  # bundled bridge never booted, and the model had no `mcp__entwurf-bridge__*` tool — while
+  # `command -v` answered yes throughout. #81's probe already settles that in under a second and
+  # doctor-pi-provider consumes it; it was simply never a step, so the verdict first surfaced at
+  # smoke-acp-bundled-mcp-live, sixteen LIVE steps and ~20 minutes of real model spend later.
+  # `run_step`, not `run_live_step`: this doctor is not LIVE-gated and never emits 97, so it has no
+  # prerequisite to decline. It exits 1 for a configured invocation that will not boot and for
+  # state-owned drift; a host that never installed the circuit keeps its existing exit 0 note, and
+  # the bundled smokes below still fail loud there. So this tightens nothing — it only moves an
+  # existing red earlier. cwd is REPO_DIR regardless of `gate` (run_ts cds there), so the scope
+  # judged is this checkout's `.pi/settings.json` shadowing the operator's global: deterministic,
+  # but not in principle the smokes' global-only subject if the two ever diverge.
+  # Position and classifier arm are pinned by [QK:PI-DOCTOR-IS-RELEASE-MUST].
+  run_step "doctor-pi-provider (#81: the operator's CONFIGURED bridge invocation actually boots)" gate bash "$self" doctor-pi-provider
   # D4-c: the v2 dispatch substrate sentinel (5d-5). A SINGLE run (NOT backend-looped — it proves
   # production runEntwurfV2 deps + real pi control-socket RPC + real mailbox enqueue + v2 lock, not
   # per-backend model behavior). Placed right after check-bridge: the MCP/protocol substrate must be
@@ -5103,12 +5126,34 @@ case "$cmd" in
     # Fail-loud doctor for agy hooks.json imprint wiring.
     (cd "$REPO_DIR" && bash scripts/agy-hooks-bridge.sh doctor "$@")
     ;;
+  check-probe-bridge-command)
+    # #81: contract gate for the boot probe both doctors stake their verdict on — the reason
+    # taxonomy (each value = a different operator repair) plus the one side effect the probe owns,
+    # reaping the child it spawned. Hermetic stubs only; boots no bridge of ours.
+    run_ts scripts/check-probe-bridge-command.ts
+    ;;
+  probe-bridge-command)
+    # #81: does a configured bridge command actually BOOT and serve MCP? `command -v` answering
+    # yes is not that claim — a relocated launcher can resolve and still exit 127, which is how a
+    # host ran with NO bridge in its ACP turns while every doctor printed ok. It waits for the
+    # initialize RESPONSE before it sends notifications/initialized + `tools/list` (no tools/call),
+    # so it takes no lock, writes no record, and delivers nothing. Both doctors route their boot
+    # cell here so one leaf owns the verdict — agy for every configured {command,args,env}, pi for
+    # every effective stdio invocation.
+    shift || true
+    run_ts scripts/probe-bridge-command.ts "$@"
+    ;;
   doctor-pi-provider)
-    # #46 Task 2: read-only fail-loud doctor for the pi provider ownership (entwurfProvider.
-    # mcpServers.entwurf-bridge). Uses config.ts readProviderSettingsFile SSOT for the EFFECTIVE
-    # (project-shadows-user) command — never a re-implemented merge. Reports user/project/effective,
-    # gates on stable-bin resolvability, and distinguishes state-owned drift (FAIL) from an
-    # unowned user override (honest note). No agy/pi process needed — pure settings inspection.
+    # #46 Task 2 + #81: fail-loud doctor for the pi provider ownership (entwurfProvider.
+    # mcpServers.entwurf-bridge). Uses the config.ts SSOT for the EFFECTIVE (project-shadows-user)
+    # entry — per-name merge then ONE normalize, exactly as resolveProviderConfig does; never a
+    # re-implemented merge. Reports user/project/effective and distinguishes state-owned drift
+    # (FAIL) from an unowned user override (honest note).
+    # This doctor no longer merely reads files: it BOOTS every effective stdio invocation and
+    # requires the entwurf verb set back, because `command -v` succeeding was never evidence that
+    # pi gets a bridge. Runtime evidence and ownership are separate: an unowned override is not
+    # repaired, but a dead one is still red. It writes no operator state, but it does exec the
+    # configured command on this host. No agy/pi process is needed.
     run_ts scripts/doctor-pi-provider.ts "$@"
     ;;
   wire-agy-statusline)

package/scripts/agy-bridge-config.py

@@ -28,8 +28,12 @@ Subcommands (argv[1]):
       This is NOT tracked for an honest inverse: the legacy entry was wrong and stays gone.
 
   doctor-static <config_path>
-      Print one line describing the candidate for the shell doctor: `absent` / `symlink ->
-      <target>` prefix / `invalid-json` / `not-configured` / `command <cmd>`. Never mutates.
+      Print one line describing the candidate for the shell doctor: `absent` / `invalid-json` /
+      `invalid-entry` / `not-configured` / `configured <cmd>`. Never mutates.
+
+  doctor-invocation <config_path>
+      Print the configured server's exact `{command,args,env}` as compact JSON for the boot probe.
+      Invalid or absent entries fail rather than silently dropping argv/environment.
 
   permission-install <settings_path> <state_path>
       The OTHER half of "agy can call our bridge": registering the server (above) makes the tools
@@ -349,25 +353,51 @@ def cmd_clean_legacy(config_path: str) -> None:
         sys.stdout.write(f"cleaned-kept {config_path}\n")
 
 
-def cmd_doctor_static(config_path: str) -> None:
-    # Report the RESOLVED path's config status in one shell-parseable token line. Symlink
-    # detection/reporting is the shell's job (realpath here just follows any link).
+def _doctor_invocation(config_path: str):
+    """Return the exact stdio invocation agy reads, or a status token.
+
+    Command-only inspection is a false-success surface: configured argv/env can make a launcher
+    fail even while the same command boots with defaults. Display and execution share this parser
+    so they cannot disagree about whether an entry is valid.
+    """
     real = os.path.realpath(config_path)
     if not os.path.exists(real):
-        sys.stdout.write("absent\n")
-        return
+        return "absent", None
     try:
         with open(real, "r", encoding="utf-8") as fh:
             data = json.loads(fh.read() or "{}")
     except (json.JSONDecodeError, OSError):
-        sys.stdout.write("invalid-json\n")
-        return
+        return "invalid-json", None
     server = (data.get("mcpServers") or {}).get(SERVER_KEY) if isinstance(data, dict) else None
-    if not isinstance(server, dict) or not server.get("command"):
-        sys.stdout.write("not-configured\n")
+    if server is None:
+        return "not-configured", None
+    if not isinstance(server, dict):
+        return "invalid-entry", None
+    command = server.get("command")
+    args = server.get("args", [])
+    env = server.get("env", {})
+    if not isinstance(command, str) or not command:
+        return "invalid-entry", None
+    if not isinstance(args, list) or not all(isinstance(arg, str) for arg in args):
+        return "invalid-entry", None
+    if not isinstance(env, dict) or not all(isinstance(k, str) and isinstance(v, str) for k, v in env.items()):
+        return "invalid-entry", None
+    return "configured", {"command": command, "args": args, "env": env}
+
+
+def cmd_doctor_static(config_path: str) -> None:
+    status, invocation = _doctor_invocation(config_path)
+    if status != "configured":
+        sys.stdout.write(f"{status}\n")
         return
-    # "configured <command>" — command is the trailing token(s); shell takes field 2..N.
-    sys.stdout.write(f"configured {server['command']}\n")
+    sys.stdout.write(f"configured {invocation['command']}\n")
+
+
+def cmd_doctor_invocation(config_path: str) -> None:
+    status, invocation = _doctor_invocation(config_path)
+    if status != "configured":
+        _die(4, f"agy-bridge: cannot read configured invocation from {config_path}: {status}")
+    sys.stdout.write(json.dumps(invocation, separators=(",", ":")) + "\n")
 
 
 def cmd_permission_install(settings_path: str, state_path: str) -> None:
@@ -619,6 +649,10 @@ def main(argv: list) -> None:
         if len(argv) != 3:
             _die(5, "usage: agy-bridge-config.py doctor-static <config_path>")
         cmd_doctor_static(argv[2])
+    elif sub == "doctor-invocation":
+        if len(argv) != 3:
+            _die(5, "usage: agy-bridge-config.py doctor-invocation <config_path>")
+        cmd_doctor_invocation(argv[2])
     elif sub == "permission-state-doctor":
         if len(argv) != 3:
             _die(5, "usage: agy-bridge-config.py permission-state-doctor <state_path>")

package/scripts/agy-bridge.sh

@@ -7,9 +7,11 @@
 #              install-state for an honest inverse. The command written is a STABLE bin
 #              (`entwurf-bridge`), NEVER a repo/git-hash path (the oracle dangling lesson).
 #   uninstall  honest inverse from the install-state (restore preimage / remove our key).
-#   doctor     2-tier: STATIC proves both candidate configs (documented + observed) resolve,
-#              parse, and carry a resolvable command; LIVE proves runtime-effectiveness only
-#              when an agy process exists, else an honest SKIP (never a PASS in disguise).
+#   doctor     2-tier: STATIC proves both candidate configs (documented + observed) resolve, parse,
+#              and carry a command that actually BOOTS the entwurf MCP surface (#81 — resolvable
+#              is necessary, not sufficient; it execs the configured command); LIVE proves
+#              runtime-effectiveness only when an agy process exists, else an honest SKIP (never a
+#              PASS in disguise).
 #
 # GLOBAL ROOT (the one file that matters): live agy reads its global MCP config from
 # ~/.gemini/config/mcp_config.json (agy's own builtin doc: mcp_servers.md — "Global Configuration:
@@ -25,6 +27,7 @@
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$HERE/.." && pwd)"
 CONFIG_PY="$HERE/agy-bridge-config.py"
 
 GLOBAL_CONFIG="${AGY_MCP_CONFIG:-$HOME/.gemini/config/mcp_config.json}"
@@ -62,6 +65,33 @@ command_resolvable() {
   esac
 }
 
+# Does COMMAND actually BOOT and serve the entwurf MCP surface? (#81) Resolvability is necessary
+# and NOT sufficient: on the reference host the bare name resolved through a relocated pnpm shim
+# whose $0-derived target was gone, so it exited 127 and agy would have had no entwurf tool — while
+# this doctor printed "(resolvable)" and stayed green. The verdict leaf is shared with the pi
+# doctor via run.sh (the ONE strip-types fence crossing), so both lanes judge boot the same way.
+#
+# Cached per exact invocation: the probe spawns a real child, and the doctor asks about the same
+# configured {command,args,env} for two candidate configs plus the live tier. BOOT_DETAIL carries
+# the last probe's one-line verdict for the caller to print.
+BOOT_PROBED_INVOCATION=""
+BOOT_PROBED_RC=1
+BOOT_PROBED_OUT=""
+BOOT_DETAIL=""
+command_boots() {
+  local invocation="$1" out rc
+  if [ "$invocation" = "$BOOT_PROBED_INVOCATION" ]; then
+    BOOT_DETAIL="$BOOT_PROBED_OUT"
+    return "$BOOT_PROBED_RC"
+  fi
+  set +e
+  out="$("$REPO_DIR/run.sh" probe-bridge-command --invocation-json "$invocation" 2>&1)"
+  rc=$?
+  set -e
+  BOOT_PROBED_INVOCATION="$invocation"; BOOT_PROBED_RC="$rc"; BOOT_PROBED_OUT="$out"; BOOT_DETAIL="$out"
+  return "$rc"
+}
+
 # Prune the agy MCP tool-schema cache for the KNOWN-legacy server keys (LEGACY_CACHE_KEYS). Removes
 # ONLY the exact-named dirs — a symlink is left intact (not ours), and any OTHER server's cache is
 # never touched. Idempotent (absent = no-op). One-shot cutover hygiene, not honest-inverse tracked.
@@ -171,8 +201,8 @@ do_uninstall() {
 }
 
 # Static-check ONE candidate config. Prints a status line; returns 1 on a hard failure
-# (invalid JSON / configured-but-dangling command), 0 otherwise (absent / not-configured /
-# configured+resolvable are not doctor failures — a candidate may legitimately be unused).
+# (invalid JSON / configured invocation that cannot boot), 0 otherwise (absent / not-configured
+# are not doctor failures — a candidate may legitimately be unused).
 doctor_static_one() {
   local label="$1" candidate="$2"
   local link_note=""
@@ -185,13 +215,25 @@ doctor_static_one() {
     absent)         log "  $label: absent$link_note"; return 0 ;;
     not-configured) log "  $label: present but entwurf-bridge NOT configured$link_note"; return 0 ;;
     invalid-json)   log "  $label: INVALID JSON$link_note"; return 1 ;;
+    invalid-entry)  log "  $label: INVALID entwurf-bridge entry (command/args/env)$link_note"; return 1 ;;
     configured\ *)
-      local cmd="${status#configured }"
-      if command_resolvable "$cmd"; then
-        log "  $label: configured → '$cmd' (resolvable)$link_note"
+      local cmd="${status#configured }" invocation
+      if ! invocation="$(python3 "$CONFIG_PY" doctor-invocation "$candidate")"; then
+        log "  $label: configured → '$cmd' but its exact invocation is unreadable$link_note"
+        return 1
+      fi
+      if command_boots "$invocation"; then
+        log "  $label: configured → '$cmd' (the exact configured invocation boots the entwurf MCP surface)$link_note"
         return 0
       fi
-      log "  $label: configured → '$cmd' DANGLING (not on PATH / not executable)$link_note"
+      # A configured environment may itself carry PATH, so a shell-side `command -v` is not the
+      # runtime's subject. The shared probe executes the exact command + args + env instead.
+      # entwurf does NOT repair a failed launcher here: it may be owned by a foreign file.
+      log "  $label: configured → '$cmd' does NOT serve MCP with its configured args/env$link_note"
+      log "        $BOOT_DETAIL"
+      log "        Identify the launcher: command -v '$cmd'; readlink -f \"\$(command -v '$cmd')\""
+      log "        If it is entwurf's managed dev link, restore it with ./run.sh expose-dev-bin (it REFUSES a foreign link)."
+      log "        If a foreign launcher owns the name, repair/remove it yourself or put a working one earlier on PATH."
       return 1 ;;
     *) log "  $label: unexpected status '$status'$link_note"; return 1 ;;
   esac
@@ -283,23 +325,29 @@ sys.exit(0 if same and owned else 1)' "$PERMISSION_STATE_FILE" "$SETTINGS_FILE";
 
 do_doctor() {
   log "[agy-bridge doctor]"
-  local hard_fail=0 configured_any=0 resolvable_any=0
+  local hard_fail=0 configured_any=0 bootable_any=0
 
   log "── static (configured candidates)"
   doctor_static_one "global ($GLOBAL_CONFIG)" "$GLOBAL_CONFIG" || hard_fail=1
   doctor_static_one "legacy ($LEGACY_CONFIG)" "$LEGACY_CONFIG" || hard_fail=1
   doctor_permission || hard_fail=1
-  # Did EITHER candidate carry a configured + resolvable entwurf-bridge? Keep this runtime fact
-  # separate from ownership-state failures below: a FOREIGN TARGET makes the doctor red, but it
-  # does not make a visibly configured command disappear.
-  local c candidate_status candidate_cmd
+  # Did EITHER candidate carry a configured entwurf-bridge that actually BOOTS? Keep this runtime
+  # fact separate from ownership-state failures below: a FOREIGN TARGET makes the doctor red, but it
+  # does not make a visibly configured command disappear. Boot (not mere resolvability) is the fact
+  # the live tier reports on — the probe is cached, so this loop re-costs nothing.
+  local c candidate_status candidate_cmd candidate_invocation
   for c in "$GLOBAL_CONFIG" "$LEGACY_CONFIG"; do
     candidate_status="$(python3 "$CONFIG_PY" doctor-static "$c")"
     case "$candidate_status" in
       configured\ *)
         configured_any=1
         candidate_cmd="${candidate_status#configured }"
-        command_resolvable "$candidate_cmd" && resolvable_any=1
+        if candidate_invocation="$(python3 "$CONFIG_PY" doctor-invocation "$c")"; then
+          command_boots "$candidate_invocation" && bootable_any=1
+        else
+          log "  runtime: configured '$candidate_cmd' has an unreadable exact invocation."
+          hard_fail=1
+        fi
         ;;
     esac
   done
@@ -373,17 +421,19 @@ do_doctor() {
 
   log "── live (runtime wiring)"
   if command -v pgrep >/dev/null 2>&1 && pgrep -x agy >/dev/null 2>&1; then
-    if [ "$resolvable_any" -eq 1 ]; then
-      # HONEST label (N2): a running agy + a resolvable configured candidate is CONSISTENT with
-      # runtime wiring, but it does NOT prove agy actually read that config — that needs MCP
-      # tool-listing-grade evidence (deferred). Ownership/state failures remain red independently.
+    if [ "$bootable_any" -eq 1 ]; then
+      # HONEST label (N2): a running agy + a configured candidate whose command BOOTS and serves the
+      # entwurf MCP surface is CONSISTENT with runtime wiring. It still does NOT prove agy actually
+      # READ that config — that remains the deferred half. What is no longer deferred (#81) is the
+      # tool-listing evidence itself: the static tier above got it from the command, not from the
+      # mere fact that a name resolved. Ownership/state failures remain red independently.
       if [ "$hard_fail" -eq 0 ]; then
-        log "  live: agy is running AND a configured candidate has a resolvable command — consistent with runtime wiring (config-read NOT proven; MCP-tool-listing evidence deferred)."
+        log "  live: agy is running AND a configured candidate's command boots the entwurf MCP surface — consistent with runtime wiring (agy's own config-read NOT proven)."
       else
-        log "  live: agy is running and a configured candidate resolves, but ownership/state errors above keep this doctor red (config-read NOT proven)."
+        log "  live: agy is running and a configured candidate boots, but ownership/state errors above keep this doctor red (agy's own config-read NOT proven)."
       fi
     else
-      log "  live: agy is running but no resolvable configured candidate — runtime wiring is broken."
+      log "  live: agy is running but no configured candidate whose command boots the entwurf MCP surface — runtime wiring is broken."
       hard_fail=1
     fi
   else
@@ -391,7 +441,7 @@ do_doctor() {
   fi
 
   if [ "$hard_fail" -ne 0 ]; then
-    fail "doctor found a broken candidate (invalid JSON / dangling command / broken live wiring)."
+    fail "doctor found a broken candidate (invalid JSON / dangling command / command that does not serve MCP / broken live wiring)."
   fi
   log "doctor: ok (static candidates clean)."
 }