@junghanacs/entwurf 0.14.1 → 0.14.2

package/scripts/mutants/bridge-command-boot.json

@@ -0,0 +1,107 @@
+{
+	"schemaVersion": 1,
+	"lane": "bridge-command-boot",
+	"mutants": [
+		{
+			"claim": "PI-DOCTOR-BOOT-NEGATIVE",
+			"title": "the pi doctor goes back to blessing a command that merely RESOLVES — the exact #81 false success, where a host ran ACP turns with no mcp__entwurf-bridge__* tool while the doctor printed ok",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (probe.ok) {"],
+			"replace": ["\t\tif (probe.ok || true) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-BOOT-NEGATIVE",
+			"title": "the agy doctor stops asking whether the configured command boots and reports the old '(resolvable)' green — a registered bridge agy could never actually call",
+			"subject": "scripts/agy-bridge.sh",
+			"find": ["      if command_boots \"$invocation\"; then"],
+			"replace": ["      if true; then"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-PROBES-OVERRIDE",
+			"title": "the pi doctor skips runtime probing for a non-bare override, so a dead command that shadows the stable bridge returns green as an operator choice",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\tif (!resolvable(cmd)) {"],
+			"replace": [
+				"\tif (!isBare) {\n\t\tlog(`  note: skipped runtime for override '${cmd}'`);\n\t} else if (!resolvable(cmd)) {"
+			],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-PROBES-OVERRIDE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ARGS",
+			"title": "the agy invocation parser drops configured args, so the doctor boots command defaults while agy executes a failing argv",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    args = server.get(\"args\", [])"],
+			"replace": ["    args = []"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ARGS]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ENV",
+			"title": "the agy invocation parser drops configured environment, so the doctor boots command defaults while agy executes a failing environment",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    env = server.get(\"env\", {})"],
+			"replace": ["    env = {}"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ENV]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PROBE-REASON-MISSING-VERB",
+			"title": "bridge identity shrinks back to a single tool, so a build missing entwurf_self — the measured #81 session shape — reads as a healthy bridge again",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tconst missing = EXPECTED_TOOLS.filter((t) => !served.has(t));"],
+			"replace": ["\t\t\t\tconst missing = [\"entwurf_v2\"].filter((t) => !served.has(t));"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REASON-MISSING-VERB]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-REQUIRES-INITIALIZE",
+			"title": "the probe accepts tools/list before the MCP initialize handshake completes — a launcher the harness cannot initialize reads healthy",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tif (!initialized) {"],
+			"replace": ["\t\t\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REQUIRES-INITIALIZE]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-CLEANUP-ESCALATES",
+			"title": "the probe stops escalating past SIGTERM, so a launcher that traps TERM outlives the doctor that spawned it — the probe leaks the broken process it exists to detect",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\t\t\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-CLEANUP-ESCALATES]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-STDIN-EPIPE-GUARD",
+			"title": "the async EPIPE from a launcher that died on exec goes unlistened again, so the probe dies on an uncaught stream error and the doctor prints a Node stack trace where the LAUNCHER's own stderr belongs — the #81 diagnosis erased in the one cell that needs it",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\tchild.stdin.on(\"error\", () => {});"],
+			"replace": ["\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-STDIN-EPIPE-GUARD]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		}
+	]
+}

package/scripts/mutants/release-gate.json

@@ -135,6 +135,19 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:MUX-LIFECYCLE-IS-RELEASE-MUST]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "PI-DOCTOR-IS-RELEASE-MUST",
+			"title": "the pi-provider boot doctor is quietly dropped from the gate — the operator's CONFIGURED bridge invocation is never booted, so a 127 launcher (the #81 relocated cmd-shim class) stays invisible until smoke-acp-bundled-mcp-live sixteen LIVE steps and real model spend later",
+			"subject": "run.sh",
+			"find": [
+				"  run_step \"doctor-pi-provider (#81: the operator's CONFIGURED bridge invocation actually boots)\" gate bash \"$self\" doctor-pi-provider"
+			],
+			"replace": ["  : # pi doctor quietly dropped — the configured invocation is never booted"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:PI-DOCTOR-IS-RELEASE-MUST]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		}
 	]
 }

package/scripts/probe-bridge-command.ts

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+// probe-bridge-command — does the EFFECTIVE bridge command actually BOOT and serve MCP?
+//
+// WHY THIS EXISTS (#81): every doctor that judged the bridge wiring asked only whether the
+// configured command RESOLVES — `command -v <bare name>` for pi (doctor-pi-provider) and agy
+// (agy-bridge.sh). Resolvability is not bootability, and the gap is not theoretical: on the
+// reference host `~/.local/bin/entwurf-bridge` was a symlink to the canonical pnpm shim, and
+// that shim derives its target from `$0`. Invoked through the relocated link the derived
+// `../global/...` path does not exist, so the launcher exits 127 and the MCP child never boots
+// — while `command -v` kept answering yes and both doctors kept printing ok. The model in a
+// Pi-hosted ACP turn then had no `mcp__entwurf-bridge__*` tool at all, which is a direct
+// violation of #81's minimum core value (explicit Entwurf bridge connectivity).
+//
+// So this leaf asks the only question that carries the claim: run the command, speak MCP to it,
+// and require the entwurf tool surface back. A green here is about the command the harness
+// actually execs — never a recomputed desired one (the same rule meta-bridge-doctor's delivery
+// self-diagnostic already states for the Claude lane).
+//
+// SIDE EFFECTS: none on operator state. Only `initialize` + `tools/list` are sent — never a
+// `tools/call` — so no lock is taken, no record is written, and no message is delivered. The
+// child is killed as soon as the frame arrives or the deadline passes. This is what makes the
+// probe affordable inside a doctor an operator runs repeatedly.
+//
+// USAGE
+//   library:  const r = await probeBridgeCommand({ command, args });   // doctor-pi-provider.ts
+//   CLI:      node probe-bridge-command.ts <command> [args...]
+//             node probe-bridge-command.ts --invocation-json '{"command":"…","args":[],"env":{}}'
+//             exit 0 = booted and served the entwurf tool surface; 1 = did not (reason on stdout).
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+
+/** Why a probe failed. Each value is a DISTINCT operator situation, never a generic "broken". */
+export type BridgeProbeReason =
+	| "ok"
+	| "spawn-failed" // the command could not be executed at all (ENOENT / EACCES)
+	| "exited-before-tools-list" // it ran and DIED — the relocated-shim 127 class lands here
+	| "initialize-failed" // it did not complete the MCP initialize handshake before tools/list
+	| "timeout" // it stayed up but never answered — a hung/wrong binary
+	| "no-tools-array" // it answered id:2 without result.tools — not an MCP server
+	| "tool-set-mismatch"; // an MCP server, but not THIS bridge (foreign binary, or a stale build)
+
+export interface BridgeProbeResult {
+	ok: boolean;
+	reason: BridgeProbeReason;
+	/** One line, safe to print in a doctor verdict. Carries rc/signal/stderr head when relevant. */
+	detail: string;
+}
+
+export interface BridgeProbeOptions {
+	command: string;
+	args?: string[];
+	env?: NodeJS.ProcessEnv;
+	timeoutMs?: number;
+}
+
+// The EXACT public verb set of the current bridge. Identity is the whole set, not one member:
+// the #81 symptom was a session whose schema lacked `entwurf_self` specifically, and a probe that
+// only looked for `entwurf_v2` would have called that host healthy. Exactness also catches the
+// other direction — a STALE build still serving a retired verb, or a foreign binary that happens
+// to expose an `entwurf_v2`. check-entwurf-bridge-boot binds this list to the real runtime
+// tools/list, so a verb added or retired without updating it turns that gate red.
+export const EXPECTED_TOOLS = [
+	"entwurf_v2",
+	"entwurf_self",
+	"entwurf_peers",
+	"entwurf_inbox_read",
+	"entwurf_register_native",
+	"entwurf_fresh_call",
+	"entwurf_resume_call",
+] as const;
+const DEFAULT_TIMEOUT_MS = 10_000;
+/** How long a probed child gets to die politely before it is killed outright. */
+const CLEANUP_GRACE_MS = 500;
+
+/** Collapse captured stderr into one printable line — a doctor verdict must stay one line. */
+function head(text: string, limit = 200): string {
+	const flat = text.replace(/\s+/g, " ").trim();
+	return flat.length > limit ? `${flat.slice(0, limit)}…` : flat;
+}
+
+export function probeBridgeCommand(opts: BridgeProbeOptions): Promise<BridgeProbeResult> {
+	const { command, args = [], env, timeoutMs = DEFAULT_TIMEOUT_MS } = opts;
+	return new Promise((resolve) => {
+		// No shell: a bare name goes through the normal PATH lookup the harness itself does,
+		// and an argument can never be reinterpreted as shell syntax.
+		const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], env });
+		// `write()` reports a synchronous closed pipe by throwing, but a launcher that dies on exec
+		// closes stdin under us and the resulting EPIPE arrives ASYNCHRONOUSLY, as an 'error' event on
+		// the stream. Unlistened, Node turns that into an uncaught exception, so the probe dies
+		// printing its own stack trace INSTEAD of the launcher's stderr: precisely the diagnosis #81
+		// exists to surface, destroyed in the one cell that needs it. The window is real, not
+		// theoretical — under CPU contention the child can exec, write its stderr and exit between
+		// uv_spawn and our first write, which is how CI saw a doctor verdict with no launcher stderr
+		// in it. The `close` handler owns the verdict for that child (with captured stderr), so this
+		// listener is installed before anything can write and stays deliberately silent — one reason
+		// per failure, never an unhandled probe crash.
+		child.stdin.on("error", () => {});
+		let stdoutPending = "";
+		let stderr = "";
+		let settled = false;
+		let initialized = false;
+		let exited: { code: number | null; signal: NodeJS.Signals | null } | undefined;
+		let stderrEnded = false;
+
+		// This probe deliberately runs whatever command the operator configured — including a
+		// foreign or broken one — so it owns closing what it opened. Escalate SIGTERM → SIGKILL
+		// once, bounded: cleanup for THIS child, not a supervisor (no retries, no watching, no
+		// process-tree walking).
+		//
+		// The reap is AWAITED before the result resolves, and that ordering is load-bearing: the
+		// callers are doctors that print a verdict and `process.exit()` immediately, which tears
+		// down any still-pending timer. A fire-and-forget SIGTERM plus a deferred SIGKILL would
+		// therefore leave a TERM-ignoring launcher running after the doctor is gone — the probe
+		// would leak exactly the kind of broken process it exists to detect.
+		const reap = (): Promise<void> =>
+			new Promise((finished) => {
+				if (child.exitCode !== null || child.signalCode !== null) return finished();
+				let reaped = false;
+				let hard: ReturnType<typeof setTimeout> | undefined;
+				const finish = (): void => {
+					if (reaped) return;
+					reaped = true;
+					if (hard) clearTimeout(hard);
+					finished();
+				};
+				child.once("close", finish);
+				try {
+					child.kill("SIGTERM");
+				} catch {
+					return finish(); // already gone
+				}
+				hard = setTimeout(() => {
+					try {
+						child.kill("SIGKILL");
+					} catch {}
+					// SIGKILL cannot be trapped, so `close` follows. The outer bound exists only so a
+					// child already reaped by someone else can never hang this promise forever.
+					setTimeout(finish, CLEANUP_GRACE_MS);
+				}, CLEANUP_GRACE_MS);
+			});
+
+		const done = (reason: BridgeProbeReason, detail: string): void => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			void reap().then(() => resolve({ ok: reason === "ok", reason, detail }));
+		};
+
+		const timer = setTimeout(() => {
+			const waitingFor = initialized ? "tools/list" : "initialize";
+			done(
+				"timeout",
+				`'${command}' stayed up but never answered ${waitingFor} within ${timeoutMs}ms` +
+					(stderr.trim() ? ` — stderr: ${head(stderr)}` : ""),
+			);
+		}, timeoutMs);
+
+		child.on("error", (err) => {
+			done("spawn-failed", `'${command}' could not be executed: ${String(err)}`);
+		});
+
+		// `ChildProcess` close is normally after the stdio pipes close, but under nested shell
+		// capture that ordering has raced on this host. Do not mint a no-stderr diagnosis until the
+		// stderr reader ended: the launcher's own final diagnostic is part of the operator verdict.
+		const reportExited = (): void => {
+			if (!exited || !stderrEnded) return;
+			// Reaching here un-settled means the process died before answering id:2. This is the
+			// cell the relocated pnpm shim lands in (exit 127), and the stderr head is what tells
+			// the operator WHICH launcher hop broke.
+			done(
+				"exited-before-tools-list",
+				`'${command}' exited before answering tools/list (code=${exited.code} signal=${String(exited.signal)})` +
+					(stderr.trim() ? ` — stderr: ${head(stderr)}` : " — no stderr"),
+			);
+		};
+		child.on("close", (code, signal) => {
+			exited = { code, signal };
+			reportExited();
+		});
+
+		child.stderr.on("data", (d) => {
+			stderr += String(d);
+		});
+		child.stderr.on("end", () => {
+			stderrEnded = true;
+			reportExited();
+		});
+		child.stdout.on("data", (d) => {
+			const chunk = String(d);
+			stdoutPending += chunk;
+			if (settled) return;
+			// MCP frames are newline-delimited JSON-RPC. Consume each complete frame exactly once:
+			// replaying the accumulated id:1 response on a later data event would send a second
+			// tools/list before the first reply and stop being a sequential handshake.
+			const frames = stdoutPending.split("\n");
+			stdoutPending = frames.pop() ?? "";
+			for (const line of frames) {
+				const trimmed = line.trim();
+				if (!trimmed) continue;
+				let msg: {
+					id?: unknown;
+					error?: unknown;
+					result?: { protocolVersion?: unknown; capabilities?: unknown; serverInfo?: unknown; tools?: unknown };
+				};
+				try {
+					msg = JSON.parse(trimmed);
+				} catch {
+					continue;
+				}
+				if (msg?.id === 1) {
+					const result = msg.result;
+					const valid =
+						msg.error === undefined &&
+						result?.protocolVersion === "2024-11-05" &&
+						typeof result.capabilities === "object" &&
+						result.capabilities !== null &&
+						typeof result.serverInfo === "object" &&
+						result.serverInfo !== null;
+					if (!valid) {
+						done("initialize-failed", `'${command}' returned an invalid MCP initialize response`);
+						return;
+					}
+					initialized = true;
+					sendReadyFrames();
+					continue;
+				}
+				if (msg?.id !== 2) continue;
+				if (!initialized) {
+					done("initialize-failed", `'${command}' answered tools/list before MCP initialize completed`);
+					return;
+				}
+				const tools = msg?.result?.tools;
+				if (!Array.isArray(tools)) {
+					done("no-tools-array", `'${command}' answered tools/list without result.tools — not an MCP server`);
+					return;
+				}
+				const names = tools
+					.map((t) => (t as { name?: unknown })?.name)
+					.filter((n): n is string => typeof n === "string");
+				const served = new Set(names);
+				const missing = EXPECTED_TOOLS.filter((t) => !served.has(t));
+				const unexpected = names.filter((n) => !(EXPECTED_TOOLS as readonly string[]).includes(n));
+				if (missing.length > 0 || unexpected.length > 0) {
+					// Name BOTH directions: a missing verb is the #81 symptom (the model had no
+					// entwurf_self), an unexpected one means this is not the bridge we ship.
+					const parts: string[] = [];
+					if (missing.length > 0) parts.push(`missing ${missing.join(", ")}`);
+					if (unexpected.length > 0) parts.push(`unexpected ${unexpected.join(", ")}`);
+					done(
+						"tool-set-mismatch",
+						`'${command}' is an MCP server but does not serve this bridge's verb set — ${parts.join("; ")} (served: ${names.join(", ") || "none"})`,
+					);
+					return;
+				}
+				done("ok", `'${command}' booted and served the exact entwurf verb set (${EXPECTED_TOOLS.length} tools)`);
+				return;
+			}
+		});
+
+		const send = (obj: unknown): void => {
+			try {
+				child.stdin.write(`${JSON.stringify(obj)}\n`);
+			} catch {
+				// Synchronous throws (a destroyed stream) land here; async EPIPE lands on the
+				// listener above. Both are the same verdict-free silence.
+			}
+		};
+		const sendReadyFrames = (): void => {
+			send({ jsonrpc: "2.0", method: "notifications/initialized" });
+			send({ jsonrpc: "2.0", id: 2, method: "tools/list" });
+		};
+		send({
+			jsonrpc: "2.0",
+			id: 1,
+			method: "initialize",
+			params: {
+				protocolVersion: "2024-11-05",
+				capabilities: {},
+				clientInfo: { name: "probe-bridge-command", version: "0" },
+			},
+		});
+	});
+}
+
+// CLI entrypoint. Kept argv-driven (no env carrier) so `./run.sh probe-bridge-command entwurf-bridge`
+// asks about exactly the name an operator typed, and a doctor can shell out to the same verdict.
+// Match the BASENAME exactly. A suffix test would also fire for `check-probe-bridge-command.ts`,
+// which imports this module — the CLI arm would then hijack that gate's argv and exit 2.
+if (process.argv[1] && /^probe-bridge-command\.(ts|js)$/.test(basename(process.argv[1]))) {
+	const argv = process.argv.slice(2);
+	let options: BridgeProbeOptions;
+	if (argv[0] === "--invocation-json") {
+		let raw: unknown;
+		try {
+			raw = JSON.parse(argv[1] ?? "");
+		} catch {
+			console.error("probe-bridge-command: --invocation-json must be valid JSON");
+			process.exit(2);
+		}
+		const obj = raw as { command?: unknown; args?: unknown; env?: unknown };
+		if (
+			typeof obj?.command !== "string" ||
+			!obj.command ||
+			!Array.isArray(obj.args) ||
+			!obj.args.every((arg) => typeof arg === "string") ||
+			typeof obj.env !== "object" ||
+			obj.env === null ||
+			Array.isArray(obj.env) ||
+			!Object.values(obj.env).every((value) => typeof value === "string")
+		) {
+			console.error("probe-bridge-command: invocation JSON requires string command, string[] args, string-map env");
+			process.exit(2);
+		}
+		options = {
+			command: obj.command,
+			args: obj.args as string[],
+			env: { ...process.env, ...(obj.env as Record<string, string>) },
+		};
+	} else {
+		const [command, ...args] = argv;
+		if (!command) {
+			console.error("usage: probe-bridge-command <command> [args...]");
+			process.exit(2);
+		}
+		options = { command, args };
+	}
+	const result = await probeBridgeCommand(options);
+	console.log(`[probe-bridge-command] ${result.reason}: ${result.detail}`);
+	process.exit(result.ok ? 0 : 1);
+}

package/scripts/raw-async-delivery/README.md

@@ -1,4 +1,4 @@
-# raw-async-delivery — RAW async message delivery into LIVE Claude Code / agy / Codex sessions
+# raw-async-delivery — RAW async message delivery into LIVE Claude Code / agy / Codex / Copilot sessions
 
 Goal: deliver an async message INTO an already-running **subscription** session,
 free, with no `claude -p` / backend CLI prompt spawn — and in particular wake an
@@ -12,6 +12,12 @@ Codex is split by launch surface:
   auto-attached to a default-path app-server): raw `turn/start` over
   WebSocket-over-UDS wakes the live thread — **demonstrated, no managed
   standalone, no cloud**.
+- **Copilot CLI 1.0.80 TUI+server**: official SDK `1.0.11` can resolve the
+  foreground native session and enqueue into that exact idle TUI; D7 was
+  demonstrated once (L4 direct-native, one Linux workstation). The launch flag
+  `--ui-server` is hidden from CLI help and its loopback RPC authentication is
+  not established, so this remains a probe, not a managed lane. Undocumented
+  `~/.copilot/run/ws.*` is still not a rail.
 
 ## TL;DR — three reception paths, ranked
 
@@ -82,6 +88,7 @@ do not ship that. Proven: deliver to A's sessionId → A wakes (FileChanged), B'
 - `raw-agy-send.sh <conv_id> …` — agy parity: PUSH into a live Antigravity session (LS gRPC)
 - `raw-codex-ws-turn-start.py <sock> <thread_id> …` — Codex parity (no managed standalone, no cloud): PUSH `turn/start` over WebSocket-over-UDS into a bare `app-server --listen` socket
 - `codex-local-appserver.sh [sock]` — start a bare local app-server so plain `codex` auto-attaches and becomes addressable
+- `copilot-ui-server-probe.mjs` — official-SDK D0 probe by default; `LIVE=1` performs one addressed idle enqueue and prints D0–D8
 
 ### Reproduction drivers
 - `repro-plugin-idle-wake.sh` — single-session smoke.
@@ -244,6 +251,150 @@ send-message-v2` spins a fresh thread, not the live one.
 4. **Unix-socket transport is WebSocket** (tokio-tungstenite), not newline JSON-RPC,
    and requires **no auth token** on the UDS. A plain WS client suffices.
 
+## Copilot CLI raw delivery status (1.0.80) — positive TUI+server probe, not a managed lane
+
+Copilot is a GitHub **harness** (issues, PR, CI, model `auto`, mode `autopilot`,
+remote/delegate), not a second GPT provider next to pi. This makes a native lane
+product-distinct from the declined Codex lane: Copilot can own GitHub work while
+implementation checkpoints arrive from another garden id. That split is operator
+etiquette plus dispatch, not a substrate role system.
+
+The cost premise must stay honest. Copilot reports AI Credits and a monthly
+premium-interaction entitlement; model `auto` chooses a path within that budget.
+The reason to use it is GitHub specialization and auto routing, not an unlimited
+subscription claim. Model `auto` and mode `autopilot` are separate axes.
+
+### Positive transport
+
+The first-party `@github/copilot-sdk` exposes TUI+server coordination:
+`getForegroundSessionId()`, `getSessionMetadata()`, `resumeSession(id)`, and
+session-scoped `send({mode:"enqueue"|"immediate"})`. The native TUI launch mode is:
+
+```bash
+copilot --ui-server --port 43817 --model auto
+```
+
+`--ui-server` is accepted by CLI 1.0.80 and named by the official SDK API docs,
+but hidden from `copilot --help`. Launch mode is therefore part of the capability,
+and this evidence does not apply to an already-running plain `copilot` TUI.
+
+Measured once on 2026-08-19 with SDK 1.0.11, **using the earlier chronological-slice
+probe** (it scored the events following the marker's position in the history). The probe
+in the tree today scores a named turn instead — see "Current probe contract" below — and
+that contract has NOT been run LIVE, so nothing in this list is retroactively evidence
+for it. Evidence level for the list: **L4 direct-native, ONE Linux workstation, one run**;
+the receipt is host-local probe stdout and was NOT archived as a durable artifact, so what
+follows is reproducible by instruction, not citable to a stored file:
+
+- protocol v3 ping succeeded;
+- foreground session id joined to metadata containing cwd/git root/branch;
+- `resumeSession(id)` + idle `enqueue` woke the visible TUI with zero typing;
+- the unique body appeared as `user.message` with `delivery:"idle"`;
+- model `auto` selected `gpt-5.6-luna` and returned the exact marker;
+- `assistant.message`, `assistant.turn_end`, and (in the one-session run)
+  ephemeral `session.idle` gave completion/reply evidence;
+- a two-session control then targeted A while B received no `user.message`, turn,
+  or assistant event, so D3 passed too.
+
+D0–D7 passed; D8 is unproven. One robustness defect surfaced in the two-session
+shape: the target visibly replied and persisted `assistant.message` + `turn_end`,
+but that joining SDK client did not receive ephemeral `session.idle`, so SDK
+`sendAndWait()` timed out after 60 seconds. The probe therefore uses `send()` plus
+bounded polling of the official session event-history API (`session.getEvents()` /
+`getMessages()`) and reports completion at `turn_end`. Name that surface at its real
+size: it is the SDK's own full event history — no narrower, no more privileged — and it
+is **not** TUI, file, or database transcript scraping; the probe never reads Copilot's
+storage. This is evidence, not a product retry/polling design.
+
+### Current probe contract — designed, not yet run LIVE
+
+Attribution is the load-bearing part, and it runs off the probe's own marker body:
+
+```text
+unique marker body  →  exactly one user.message
+                    →  its interactionId
+                    →  exactly one assistant.turn_start on that interaction
+                    →  that turn_start's required turnId
+                    →  only assistant.message / assistant.turn_end on that turnId
+```
+
+Every link is required and unambiguous; absent or matched twice, the probe FAILS CLOSED.
+There is no positional fallback and no "the turn after ours" rule, because scoring "the
+newest assistant.message" in a session a human is also typing into is how a probe reports
+someone else's turn as its own delivery.
+
+What is deliberately NOT the key: `session.send()` on the bundled CLI 1.0.80 resolves to a
+`Promise<string>` that is the SDK's own submission handle. The server-side `user.message`
+does not carry that string, and it is a different axis from that event's
+`id`/`interactionId` — a join on it cannot hold, so the probe logs it as a diagnostic and
+never matches on it.
+
+The D3 control cell uses the same sentence it prints: across `onEvent` and `getEvents`, the
+non-target session received no `user.message` and no `assistant.*` event of any kind.
+
+Lifecycle, stated precisely rather than flatteringly: the probe never deletes target
+session A and issues no `A.disconnect()` of its own. `client.stop()` DOES tear down every
+tracked session — A included — as a wire `session.destroy`; because A's foreground
+ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
+session, so the net effect on A is detach-equivalent, not removal. The probe deletes only
+the control session it created itself, and reads `client.stop()`'s returned error list so a
+failed teardown cannot exit 0 behind a printed verdict. Reaching past the SDK for a raw
+detach wrapper is out of bounds — it would be a second lifecycle authority.
+
+This contract has not been exercised by a LIVE turn. The next LIVE run is what would
+demonstrate it, and it also confirms the real event key names.
+
+### Reproduce with the pinned official SDK
+
+The SDK is deliberately not an entwurf production dependency while this is only
+a raw probe. Install it in scratch and point the probe at its ESM entry:
+
+```bash
+mkdir -p /tmp/copilot-sdk-probe
+printf '{"private":true,"type":"module"}\n' >/tmp/copilot-sdk-probe/package.json
+pnpm --dir /tmp/copilot-sdk-probe add --ignore-scripts @github/copilot-sdk@1.0.11
+
+# terminal A: visible native session (accept folder trust)
+copilot --ui-server --port 43817 --model auto
+
+# terminal B: D0 only, no model call
+COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+
+# one paid/subscription turn: addressed idle enqueue through the official SDK
+LIVE=1 COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+
+# creates a second no-turn control session and proves only the target receives the marker
+LIVE=1 COPILOT_D3_CONTROL=1 \
+  COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+```
+
+### Admission blockers and negative evidence
+
+- **Transport authentication is not established.** The TUI server bound loopback,
+  but an SDK client without a token connected. Setting `COPILOT_CONNECTION_TOKEN`
+  on the UI server did not enable auth: the unauthenticated client still connected,
+  while a token-bearing client received `AUTHENTICATION_NOT_CONFIGURED`. Do not
+  ship this as a rail until the supported same-user/fail-closed boundary is proved.
+- Shell command-hook `sessionStart` input is `{timestamp,cwd,source,initialPrompt?}`;
+  it does **not** carry `sessionId`. SDK callbacks receive `sessionId` separately in
+  their invocation object. The discarded command-hook probe therefore could not
+  establish D0, and UUID-only process-log scraping did not satisfy D0's cwd/liveness
+  join. Do not revive that path.
+- Hooks have no `FileChanged` / `watchPaths` / `asyncRewake`; the Claude mailbox
+  mechanism cannot be copied.
+- `--acp` is a pi-host child path, not this native TUI citizen path. `--remote` is
+  GitHub web/mobile steering, not a local `entwurf_v2` API. Undocumented
+  `~/.copilot/run/ws.*` remains out of bounds.
+
+Do not add `backend:"copilot"`, `FRESH_CALL_BACKENDS`, a schema change, or an OPEN
+issue from these positive probes. Next evidence is active-turn enqueue/immediate
+behavior, TUI-vs-SDK permission ownership, the missing multi-session `session.idle`,
+endpoint staleness/crash behavior, and a supported authenticated or equivalent local
+boundary.
+
 ## Live SSOT for "is the target session alive?"
 
 - Claude Code: `~/.claude/sessions/<pid>.json` (pid, sessionId, cwd, status). NOT
@@ -256,3 +407,9 @@ send-message-v2` spins a fresh thread, not the live one.
   `$HOME/.codex/app-server-control/app-server-control.sock` (or any owned 0700
   socket via `codex app-server --listen unix://PATH`) is the delivery surface.
   threadId comes from the newest rollout's `session_meta.id`.
+- Copilot TUI+server probe: SDK `ping` + `getForegroundSessionId()` +
+  `getSessionMetadata()` identify the currently displayed native session, and
+  the official session event-history API (`getEvents()` / `getMessages()`) reads
+  a turn back — no transcript file or database is touched. The TCP port is a
+  runtime endpoint, never an identity axis; no managed liveness join exists
+  until its authentication and stale-endpoint behavior are proved.