@junghanacs/entwurf 0.14.1 → 0.14.2

package/AGENTS.md

@@ -180,7 +180,7 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.1 <0.85` with devDep exact `0.84.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- pi runtime range is `>=0.84.2 <0.85` with devDep exact `0.84.2`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
 - ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style

package/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.14.2 — 2026-08-20
+
+This patch makes bridge availability a property of the exact invocation each harness will run, preserves child-exit facts across ACP transport closure, and records Copilot delivery as probe evidence without admitting a new citizen rail.
+
+### Changed
+
+- **ACTION REQUIRED — the certified runtime floor is now Pi `0.84.2`, with Claude ACP adapter `0.70.0`.** Pi's exact development pin and closed peer range move to `0.84.2` / `>=0.84.2 <0.85`; Claude ACP `0.70.0`, ACP SDK `1.3.0`, and Claude Code `>=2.1.217` are the measured support coordinates. Re-run setup after upgrading so the installed package and stable bridge launcher agree with this release. (#79)
+- **Every live-spend harness default is now `openai-codex/gpt-5.6-luna`.** The cross-harness chain, the v2 matrix, mux fresh/lifecycle, the resident garden guard, and the `entwurf-dev` skill's Pi default all name the cheaper model; the `ENTWURF_LIVE_TARGET` / `ENTWURF_CHAIN_GPT_TARGET` / `SMOKE_RGG_MODEL` overrides are unchanged. Fixture model strings are deliberately untouched — they assert exact argv or routing and spend nothing. This is a cost decision, not a gate change: no step moved tier and the LIVE gate was re-earned on the new default rather than inherited. Antigravity has no harness-side model at all (the operator opens that conversation), so its free-account fence — `gemini-3.6-flash`, never a Pro tier — is recorded in `VERIFY.md` and the `run.sh` help.
+- **Pi and Antigravity doctors boot the exact configured stdio invocation.** Runtime truth is separate from repair ownership: every effective Pi entry, including an unowned override, is probed without being overwritten; Antigravity preserves its configured `command`, `args`, and `env`. A valid MCP `initialize` response must arrive before `notifications/initialized` and `tools/list`, and the returned surface must equal the seven public Entwurf verbs. Closes #81.
+
+### Added
+
+- **A direct-native Copilot raw probe records one bounded Linux observation without claiming support.** The current probe binds a unique marker body to `user.message.interactionId`, then to one `assistant.turn_start.turnId`, and accepts only assistant events from that turn; missing or ambiguous identity fails closed, the control session rejects any `user.message` or `assistant.*` event, and cleanup is bounded. The earlier 2026-08-19 L4 observation used a chronological slice on one workstation and its stdout was not archived, so it is not evidence that the corrected named-turn contract has run LIVE. Copilot remains outside `MetaIdentity`, backend registries, `entwurf_v2`, native-push, fresh, and resume; admission work is tracked in #82.
+
+### Fixed
+
+- **ACP prompt failures no longer lose child exit facts when transport EOF arrives first.** A one-shot child-end latch gives an already-failed turn a bounded post-mortem settle before Entwurf teardown, preserving the original backend error plus lifecycle phase, exit code, signal, stderr tail, or an honest bounded absence. It adds no running-prompt timeout, replay, watcher, supervisor, or recovery API; #72 remains open for the natural retained-child death cause.
+- **A configured bridge cannot pass because its name resolves, its defaults boot, or it answers `tools/list` before initialization.** Pi and Antigravity reject dead overrides, argument/environment-specific failures, invalid invocation shapes, malformed initialize replies, missing/extra verbs, and foreign or relocated launchers while retaining the rule that Entwurf never clobbers a launcher it does not own.
+- **The release gate boots the operator's CONFIGURED Pi bridge invocation before it reaches the LIVE tier.** `check-bridge` only proves the launcher this checkout ships, so a relocated or shimmed `entwurf-bridge` that `command -v` resolves while `exec` returns 127 used to stay invisible until sixteen LIVE steps and real model spend later. `doctor-pi-provider` is now a release-gate MUST `run_step` — not LIVE-gated, with no skip arm — so that class fails in about a second instead of after a model turn. (#81 follow-up)
+- **The bridge probe preserves the launcher's own stderr across fast exit and asynchronous stdin `EPIPE`.** It installs the pipe error guard before the first write, consumes newline JSON-RPC frames once, and waits for process exit plus stderr end before issuing the exit verdict, so a Node stack trace cannot replace the diagnostic the operator needs.
+
+### Verification
+
+- **Landing SHA `d0fb8e6a37d401fc5ef660c90c1051db4b0811e8`** passed exact-SHA GitHub Actions run [32230953648](https://github.com/junghan0611/entwurf/actions/runs/32230953648): `check`, `install-surface`, and `artifact-consumer` all concluded success. At that SHA the combined landing candidate passed focused bridge 11/11, Pi provider 52/52, Antigravity 177/177, qualification **184/184 killed**, and `pnpm run check:full` in 315s before push. Those two numbers belong to `d0fb8e6` and are kept as its record — they are not this release's shipped figures.
+- **The accepted 0.14.2 candidate** passed qualification **185/185 killed** — the `release-gate` lane grew 11 → 12 with `PI-DOCTOR-IS-RELEASE-MUST`, added by `877b4da` — and `pnpm run check:full` in 207s standalone / 209s inside the gate (remeasured 2026-08-20; `run.sh` is a mutant subject, so the pre-edit 311s does not describe this tree). **185 is the shipped inventory.**
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.2.c5VqTP --cut` — MUST PASS=21 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** Log: `/tmp/entwurf-release-gate-0.14.2.c5VqTP/release-gate.log` (SHA-256 `27346d86be4a1a96a8ea8cab97687fcce807e4fa4bd6e3d179b91f85dbbcbe53`). Both model-in-loop lifecycle steps ran on the new default: `smoke-entwurf-chain-live` and `smoke-mux-lifecycle-live` passed with `openai-codex/gpt-5.6-luna`, so the cheaper default is proven LIVE rather than assumed. Cortex stayed the documented on-demand axis and is not part of this aggregate.
+- The new hermetic `check-probe-bridge-command` lane requires sequential initialization, exact tool equality, stderr preservation, bounded cleanup, and the stdin `EPIPE` guard; its `bridge-command-boot` qualification lane carries nine claims within the shipped 185-mutant inventory.
+
+### Notes
+
+- Snowflake Cortex has neither a subscription nor a free tier reachable from the source-owning host (measured 2026-08-20), so `smoke-acp-cortex-live` can only report protocol SKIP here. That is an absent axis, not a pass, and no other backend substitutes for it.
+- Copilot is probe-only in this release. #82 owns authentication, permission, liveness, stale/crash, operator-session cleanup, durable LIVE evidence, and the final admit/reject decision.
+- #76 (subscription-first refusal of `openrouter/*` sibling launches), #78 (macOS/native-Windows portability evidence), #80 (public vocabulary), and the remaining #72 field-cause investigation stay outside this patch.
+
 ## 0.14.1 — 2026-08-13
 
 This patch fills the cross-repository creation gap in the visible mux lifecycle shipped in 0.14.0, so one operator tmux session can form siblings in multiple project roots without borrowing a dormant session as a cwd carrier.

package/DELIVERY.md

@@ -81,6 +81,7 @@ D8 robustness: partial reason="..."
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. |
 | **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No managed citizen lane yet. |
 | **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
+| **Copilot CLI TUI+server** | verified probe | D7; D8 unproven | **Old chronological-slice run; the named-turn probe in the tree is unrun.** Official SDK over hidden `--ui-server`: foreground native id + metadata, two-session addressed idle enqueue, same-session auto-model reply, completion events read back through the official session event-history API. Loopback RPC authentication is not established; no managed citizen lane. Evidence is L4 direct-native on ONE Linux workstation, host-local stdout, not archived. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 
 “Verified probe” means the transport worked in a reproducible raw probe but entwurf
@@ -126,6 +127,62 @@ shipping commitment: GLG closed the managed native Codex lane on 2026-08-01 beca
 already supplies the official GPT provider path. Entwurf will not duplicate it as a
 native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wake.
 
+### Copilot CLI: TUI+server is the positive launch mode
+
+**Two things are recorded here and they are not the same thing: what was MEASURED on
+2026-08-19, and what the probe now CONTRACTS to measure.** The measurement below was
+taken with the earlier chronological-slice probe, which scored the events following the
+marker's position in the history. The current probe scores a named turn instead (next
+subsection). No result below has been re-taken under that contract, and none of it is
+retroactively a demonstration of it.
+
+**Measured 2026-08-19 (old chronological-slice probe).** A plain Copilot TUI and shell
+command hooks do not establish the measured route. CLI 1.0.80 launched with hidden
+`--ui-server --port <port>` and joined by first-party `@github/copilot-sdk` 1.0.11 did:
+protocol-v3 ping, foreground session id plus cwd/git metadata, exact session resume, idle
+`enqueue`, same-session model-`auto` reply, and `assistant.message`/`turn_end`/`session.idle`
+completion. A second run created a no-turn control session B, targeted A, and proved B
+received no user/turn/assistant event, closing D3 on one Linux workstation.
+
+The two-session shape also exposed a D8 gap: A visibly replied and persisted
+`assistant.message` + `turn_end`, but the joining SDK client did not receive ephemeral
+`session.idle`, so SDK `sendAndWait()` timed out. Bounded reads of the official session
+event-history API (`session.getEvents()` / `getMessages()`) then observed the completed
+target turn. Claim that at its real size: it is the SDK's own full event history, not a
+narrower or more privileged view, and equally not TUI, file, or database transcript
+scraping — the probe never reads Copilot's own storage. It is probe evidence, not a
+product polling/retry design.
+
+**Evidence level for everything above: L4 direct-native, ONE Linux workstation, one run.**
+The receipt is host-local probe stdout; it was not archived as a durable artifact, so this
+row is reproducible-by-instruction, not citable to a stored file.
+
+**Current probe contract (not yet run LIVE).** Attribution is now a named chain rather
+than a position in the history: the probe's unique marker body must match exactly one
+`user.message`; that event's `interactionId` must open exactly one `assistant.turn_start`;
+that turn_start must expose a `turnId`; and only `assistant.message` / `assistant.turn_end`
+carrying that `turnId` are scored. Every link is required, and absent-or-ambiguous fails
+the probe closed — there is no positional fallback and no "the turn after ours" rule.
+Note what is deliberately NOT the key: `session.send()` resolves to the SDK's own
+submission handle, a string that appears on no server event and is a different axis from
+`user.message.id`/`interactionId`, so joining on it cannot hold. It is logged as a
+diagnostic only. The next LIVE turn is what would demonstrate this contract; until then
+it is a design, not evidence.
+
+The probe also stays out of the operator's lifecycle, stated precisely: it never deletes
+target session A and issues no `A.disconnect()` of its own. `client.stop()` does tear down
+every tracked session — A included — as a wire `session.destroy`; because A's foreground
+ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
+session, so the net effect on A is detach-equivalent, not removal.
+
+This is not yet admissible as a native-push adapter. The flag is hidden from CLI help,
+and the loopback JSON-RPC server did not enforce the SDK connection token in the
+measured launch: an unauthenticated client connected, while a token-bearing client was
+rejected as `AUTHENTICATION_NOT_CONFIGURED`. The TCP port is only a runtime endpoint,
+never identity authority. Do not add a record backend or dispatch route until
+permission ownership, stale/crash handling, and a supported fail-closed local
+boundary are demonstrated.
+
 ## Recording a new claim
 
 For every matrix change, record:

package/README.md

@@ -154,7 +154,7 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.1 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.84.2 <0.85`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash

package/VERIFY.md

@@ -43,16 +43,16 @@ Verification here is not a benchmark. In production we exchange short turns and
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
 - **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
   - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
-> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass.
+> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass. **Operator-host limit (2026-08-20, measured):** the source-owning host has no Snowflake subscription, and Cortex Code offers no free tier that a live turn can reach — a direct attempt confirmed it. So on this host `smoke-acp-cortex-live` can only ever report protocol SKIP, and no LIVE Cortex evidence can be produced here until Snowflake supplies a free-usable route or the account is subscribed. Record that SKIP as an absent axis; never soften it into a pass, and never substitute a different backend as Cortex evidence.
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
 >
-> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-5.6-terra` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
+> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-5.6-luna` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
 >
 > One cell cannot be fully fenced, and that is recorded rather than glossed: the recorded-ACP pi cell runs under the operator's REAL home, because its provider spawns `claude` as a child that authenticates from there — measured, a fenced HOME kills that turn with `Authentication required` before the model is ever reached, and `CLAUDE_CONFIG_DIR` alone does not fix it. That is the same trade `smoke-acp-bundled-mcp-live` already makes. While that cell runs, its citizen's control socket and per-gid lock exist under the operator's own `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks`; its meta store stays fixture, so no garden record is minted outside the fixture, and the run ends by proving all six real roots hold the entry sets they started with, with no fixture garden id and no leftover lock.
 >
@@ -60,7 +60,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 >
 > **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut.
 >
-> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence.
+> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.

package/demo/README.md

@@ -2,6 +2,8 @@
 
 > **Archived pre-0.12 evidence.** These scripts still describe the retired v1 `entwurf` / `entwurf_resume` / `entwurf_send` demo flow. They are kept for historical comparison and will be replaced by a v2-native retake in a post-0.12 follow-up; do not treat them as the current 0.12 runnable recipe.
 
+> **Model ids here are archived, not recommended (2026-08-20).** The `entwurf/gpt-5.4` rows below record what these GIFs actually ran on. They are stale twice over: `entwurf/gpt-5.4` is no longer a curated `entwurf` ACP id at all — that provider serves only the `claude-*` and `cortex-*` rows in `pi-extensions/lib/acp/models.ts` — and the live-spend default has since moved to `openai-codex/gpt-5.6-luna` under a cheaper plan. Read them as a record of the recording, never as a default to copy; the current defaults live in `VERIFY.md` and `NEXT.md`.
+
 Two recorded GIF scripts live here. Both use `asciinema` for capture and
 `agg` for cast → GIF conversion. Both share the same gitignore policy
 (`*.cast` global, `demo/*.gif`, `demo/*.log` — only the `.sh` and this
@@ -137,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.1)
+- `pi` on PATH (current floor 0.84.2)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo-baseline.sh

@@ -7,6 +7,17 @@
 #   2. Entwurf surface — spawn a sibling via the entwurf tool and receive its
 #      reply in the same pane (cross-model, mode=sync).
 #
+# ARCHIVED pre-0.12 evidence — NOT a runnable recipe. Scene 2 drives the retired
+# v1 `entwurf` verb, which the 0.12 cutover removed. Kept for historical
+# comparison only. See demo/README.md.
+#
+# MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
+# recordings actually used — they are kept as the historical record, not as a
+# recommendation. Two things are stale about them: `entwurf/gpt-5.4` is no
+# longer a curated `entwurf` ACP id at all (that provider serves only the
+# claude-* and cortex-* rows in pi-extensions/lib/acp/models.ts), and GLG's
+# live-spend default moved to `openai-codex/gpt-5.6-luna` on a Plus plan. Do
+# NOT copy these ids into a live harness default — see VERIFY.md and NEXT.md.
 # Layout (tmux, 220x50):
 #   pane 0 (single) — driven pi (claude-sonnet-5) — receives both prompts.
 #
@@ -32,7 +43,7 @@ DRIVER_LOG="$OUTDIR/baseline-debug.log"
 # Driven pi runs the bridge surface and answers both prompts.
 DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-5}   # pias
 # Sibling spawned via entwurf in scene 2 — different backend for contrast.
-SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat
+SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat — ARCHIVED id, see MODEL NOTE above
 SIBLING_CWD=${SIBLING_CWD:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}
 
 # Pacing in seconds.

package/demo/demo.sh

@@ -7,6 +7,14 @@
 # See demo/README.md. Scene 3's delivery proof was recovered as a deterministic gate
 # (scripts/check-bridge-delivery.ts); the v2-native retake is a post-0.12 follow-up.
 #
+#
+# MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
+# recordings actually used — they are kept as the historical record, not as a
+# recommendation. Two things are stale about them: `entwurf/gpt-5.4` is no
+# longer a curated `entwurf` ACP id at all (that provider serves only the
+# claude-* and cortex-* rows in pi-extensions/lib/acp/models.ts), and GLG's
+# live-spend default moved to `openai-codex/gpt-5.6-luna` on a Plus plan. Do
+# NOT copy these ids into a live harness default — see VERIFY.md and NEXT.md.
 # Layout (tmux, 220x50):
 #   pane 0 (top)    — peer pi (codex, gpt-5.4)       — idle, waits for greeting
 #   pane 1 (bottom) — sender pi (claude-sonnet-5)  — driven by send-keys
@@ -37,7 +45,7 @@ PEER_LOG="$OUTDIR/peer-debug.log"
 SENDER_LOG="$OUTDIR/sender-debug.log"
 
 # Models match the user's piat / pias aliases.
-PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat
+PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat — ARCHIVED id, see MODEL NOTE above
 SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-5}  # pias
 
 # Pacing in seconds. Tuned from real runs: each scene's actual agent work

package/docs/acp-backend-rail.md

@@ -70,7 +70,7 @@ none.** A turn ends only on a lifecycle event:
 |---|---|
 | the agent answers | mapped through the terminal set above |
 | the operator aborts | ACP `session/cancel` first — the agent closes its own turn (`cancelled → aborted`); process-group teardown only after a bounded grace, so an abort always returns |
-| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail, on both the new and the reuse path |
+| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail — or an honest bounded absence when transport EOF wins the race — on both the new and the reuse path |
 
 Elapsed time is not evidence of failure, and a silent turn is not a failed turn: tool
 use, reasoning, and provider queueing all legitimately outrun any number we could pick.
@@ -85,6 +85,102 @@ turned one long turn into four in 0.13.0. Gates: `check-acp-prompt-lifecycle` (b
 with pi's own classifier as the oracle), `check-probe-ordering` (no production prompt
 cutoff in source).
 
+## Support contract (#81)
+
+What "supported" means here, per declaration class. The classes are kept apart on purpose: one
+undifferentiated "supported" column is what let a Claude PASS read as if it also certified Cortex.
+
+| Surface | Declaration | Class | What a green actually says |
+|---|---|---|---|
+| Entwurf package | `0.14.1` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.84.2`, peer `>=0.84.2 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.2; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| ACP wire SDK | `@agentclientprotocol/sdk 1.3.0` | **exact** | the shared wire oracle both adapters speak |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.70.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude Agent SDK | `0.3.232` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
+| Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
+| Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
+| Cortex Code | operator-installed CLI | **on-demand**, external | NOT a pinned dependency. Each LIVE record must name the exact CLI version it measured |
+
+Current Cortex host reading: **`Cortex Code v1.1.52`, observed on the reference host `oracle`
+(2026-08-19)**. This is an OBSERVATION of what happens to be installed, not a pin, not a range, and
+not a direct LIVE certification — no Cortex evidence record is created by writing it down. It is
+recorded here only so the on-demand row names a concrete number instead of an abstraction.
+
+Reading rules that do not bend:
+
+- **Claude PASS never certifies Cortex, and a Cortex SKIP never becomes a PASS.** They are separate
+  evidence axes with separate records; Cortex stays outside the Claude release floor.
+- **Exact** means one measured build. **Range** means a closed accepted interval. **Floor** means a
+  minimum entwurf enforces itself. **On-demand** means the operator supplies the runtime and the
+  evidence names its version — presence of an adapter certifies no external release.
+- A declared pin is not evidence. Package/deterministic gates bind the declarations
+  (`check-dep-versions`, `check-acp-sdk-surface`, the pack/install consumer gates); LIVE gates carry
+  the runtime claim.
+
+### Minimum core value
+
+One provider identity, `entwurf`, with model-id routing to backend adapters. The host pi session is
+already the record-backed socket citizen; the ACP plugin mints no second citizen, socket, or peer
+layer. Backend differences stay behind `adapterSettings` and adapter methods, and the turn sequence
+stays backend-invariant.
+
+Supported: one real model turn; curated routing with authoritative model enforcement; a narrow
+callable tool surface; explicit MCP wiring including the entwurf bridge; session reuse with
+delta-only user history; operator cancellation with bounded cleanup; honest terminal/error mapping.
+
+Not supported, by design: workflow ownership, planner state, a memory DB, transcript hydration,
+credential proxying, or a second harness inside pi.
+
+### Capability posture
+
+`clientCapabilities: {}` is the support posture, not an oversight. Optional upstream features do not
+become reachable merely because an adapter ships them — but they stay out of reach for **two
+different reasons, and collapsing them would hide a real risk**:
+
+- **Capability-gated.** AIR typed session failures, the 0.69.0 AIR file-change report, terminal
+  output widgets and nested subagent transcripts each test a client capability entwurf does not
+  send, so the adapter itself keeps the legacy path.
+- **Advertised but never called.** Some surfaces carry no capability prerequisite at all — 0.70.0's
+  `providers/list` / `providers/set` / `providers/disable` are advertised unconditionally. They are
+  unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
+  enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+
+Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
+contract. An optional upstream feature is not a core-value gap.
+
+### Bump / defer rubric
+
+`claude-agent-acp latest` is not a work queue. Certify when at least one holds:
+
+- a turn/session/error path reachable under the default capability posture changes;
+- the Claude Agent SDK, ACP SDK, peer resolution, pi floor, or backend process contract moves;
+- a security, compatibility, or observed runtime defect requires the release;
+- accumulated inactive minors are best folded into the next meaningful certification.
+
+Otherwise record and defer. Every certification separates declared pins, deterministic/package
+evidence, Claude LIVE aggregate evidence, and Cortex direct on-demand evidence (with its CLI
+version). Per-bump measurements live in the ROADMAP **Dep bump(별도 트랙)** ledger.
+
+### Bridge reachability is part of the contract
+
+Explicit entwurf-bridge connectivity inside an ACP turn is core value, so it is measured rather than
+assumed. `command -v` succeeding is not evidence: a launcher can resolve and still fail to exec (a
+relocated package-manager shim deriving its target from `$0` exits 127), which leaves a turn with no
+`mcp__entwurf-bridge__*` tool at all while every ownership check reads green. Both doctors therefore boot the exact configured stdio invocation — `command`, `args`, and
+`env` — and require the full bridge verb set back over one shared leaf
+(`./run.sh probe-bridge-command <cmd>` runs a simple command standalone; the agy doctor passes
+its JSON invocation). The probe waits for a valid MCP `initialize` response before it sends
+`notifications/initialized` and `tools/list`; a tools response alone is not boot evidence.
+
+- **agy** probes every configured candidate invocation.
+- **pi** probes every effective stdio invocation, including a legacy managed path or unowned
+  override. Runtime truth says whether the command pi will launch works; ownership separately says
+  whether entwurf may repair or normalize it.
+
+entwurf never repairs a launcher it does not own — a foreign one is reported fail-loud with the
+operator's repair named.
+
 ## Shipped adapters
 
 | Seam | Claude | Cortex Code |
@@ -159,10 +255,13 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.66.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.70.0 nor the Cortex landing adds a client-side
 readiness fence, and `mcpServerStatus()` is not called by the common loop.
-(Re-measured at the 0.65.0 → 0.66.0 bump: the goal extension is not a fence,
-and `mcpServerStatus` appears nowhere in the 0.66.0 adapter source.)
+(Re-measured at the 0.68.0 → 0.70.0 bump: AIR typed failures and the 0.69.0 AIR
+file-change report are both capability-gated and unadvertised by entwurf; 0.70.0's
+`providers/set` / `providers/disable` are advertised unconditionally by the adapter but
+entwurf calls neither, so no session's provider state is transitioned; goal extension is
+still not a fence. This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
 

package/docs/setup-clean-host.md

@@ -11,7 +11,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm | bundled with Node | package installation |
 | entwurf | `@junghanacs/entwurf` | all lanes |
-| pi | optional, `@earendil-works/pi-coding-agent >=0.84.1 <0.85` | ACP provider, control sockets |
+| pi | optional, `@earendil-works/pi-coding-agent >=0.84.2 <0.85` | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
@@ -56,7 +56,7 @@ lists the seven garden tools; it does not prove a backend model turn or native h
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.1
+npm install -g @earendil-works/pi-coding-agent@0.84.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -64,7 +64,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.1 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.84.2 <0.85`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.