@junghanacs/entwurf 0.14.1 → 0.15.0

package/docs/acp-backend-rail.md

@@ -70,7 +70,7 @@ none.** A turn ends only on a lifecycle event:
 |---|---|
 | the agent answers | mapped through the terminal set above |
 | the operator aborts | ACP `session/cancel` first — the agent closes its own turn (`cancelled → aborted`); process-group teardown only after a bounded grace, so an abort always returns |
-| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail, on both the new and the reuse path |
+| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail — or an honest bounded absence when transport EOF wins the race — on both the new and the reuse path |
 
 Elapsed time is not evidence of failure, and a silent turn is not a failed turn: tool
 use, reasoning, and provider queueing all legitimately outrun any number we could pick.
@@ -85,6 +85,102 @@ turned one long turn into four in 0.13.0. Gates: `check-acp-prompt-lifecycle` (b
 with pi's own classifier as the oracle), `check-probe-ordering` (no production prompt
 cutoff in source).
 
+## Support contract (#81)
+
+What "supported" means here, per declaration class. The classes are kept apart on purpose: one
+undifferentiated "supported" column is what let a Claude PASS read as if it also certified Cortex.
+
+| Surface | Declaration | Class | What a green actually says |
+|---|---|---|---|
+| Entwurf package | `0.14.1` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.84.3`, peer `>=0.84.3 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.3; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| ACP wire SDK | `@agentclientprotocol/sdk 1.3.0` | **exact** | the shared wire oracle both adapters speak |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.70.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude Agent SDK | `0.3.232` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
+| Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
+| Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
+| Cortex Code | operator-installed CLI | **on-demand**, external | NOT a pinned dependency. Each LIVE record must name the exact CLI version it measured |
+
+Current Cortex host reading: **`Cortex Code v1.1.52`, observed on the reference host `oracle`
+(2026-08-19)**. This is an OBSERVATION of what happens to be installed, not a pin, not a range, and
+not a direct LIVE certification — no Cortex evidence record is created by writing it down. It is
+recorded here only so the on-demand row names a concrete number instead of an abstraction.
+
+Reading rules that do not bend:
+
+- **Claude PASS never certifies Cortex, and a Cortex SKIP never becomes a PASS.** They are separate
+  evidence axes with separate records; Cortex stays outside the Claude release floor.
+- **Exact** means one measured build. **Range** means a closed accepted interval. **Floor** means a
+  minimum entwurf enforces itself. **On-demand** means the operator supplies the runtime and the
+  evidence names its version — presence of an adapter certifies no external release.
+- A declared pin is not evidence. Package/deterministic gates bind the declarations
+  (`check-dep-versions`, `check-acp-sdk-surface`, the pack/install consumer gates); LIVE gates carry
+  the runtime claim.
+
+### Minimum core value
+
+One provider identity, `entwurf`, with model-id routing to backend adapters. The host pi session is
+already the record-backed socket citizen; the ACP plugin mints no second citizen, socket, or peer
+layer. Backend differences stay behind `adapterSettings` and adapter methods, and the turn sequence
+stays backend-invariant.
+
+Supported: one real model turn; curated routing with authoritative model enforcement; a narrow
+callable tool surface; explicit MCP wiring including the entwurf bridge; session reuse with
+delta-only user history; operator cancellation with bounded cleanup; honest terminal/error mapping.
+
+Not supported, by design: workflow ownership, planner state, a memory DB, transcript hydration,
+credential proxying, or a second harness inside pi.
+
+### Capability posture
+
+`clientCapabilities: {}` is the support posture, not an oversight. Optional upstream features do not
+become reachable merely because an adapter ships them — but they stay out of reach for **two
+different reasons, and collapsing them would hide a real risk**:
+
+- **Capability-gated.** AIR typed session failures, the 0.69.0 AIR file-change report, terminal
+  output widgets and nested subagent transcripts each test a client capability entwurf does not
+  send, so the adapter itself keeps the legacy path.
+- **Advertised but never called.** Some surfaces carry no capability prerequisite at all — 0.70.0's
+  `providers/list` / `providers/set` / `providers/disable` are advertised unconditionally. They are
+  unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
+  enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+
+Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
+contract. An optional upstream feature is not a core-value gap.
+
+### Bump / defer rubric
+
+`claude-agent-acp latest` is not a work queue. Certify when at least one holds:
+
+- a turn/session/error path reachable under the default capability posture changes;
+- the Claude Agent SDK, ACP SDK, peer resolution, pi floor, or backend process contract moves;
+- a security, compatibility, or observed runtime defect requires the release;
+- accumulated inactive minors are best folded into the next meaningful certification.
+
+Otherwise record and defer. Every certification separates declared pins, deterministic/package
+evidence, Claude LIVE aggregate evidence, and Cortex direct on-demand evidence (with its CLI
+version). Per-bump measurements live in the ROADMAP **Dep bump(별도 트랙)** ledger.
+
+### Bridge reachability is part of the contract
+
+Explicit entwurf-bridge connectivity inside an ACP turn is core value, so it is measured rather than
+assumed. `command -v` succeeding is not evidence: a launcher can resolve and still fail to exec (a
+relocated package-manager shim deriving its target from `$0` exits 127), which leaves a turn with no
+`mcp__entwurf-bridge__*` tool at all while every ownership check reads green. Both doctors therefore boot the exact configured stdio invocation — `command`, `args`, and
+`env` — and require the full bridge verb set back over one shared leaf
+(`./run.sh probe-bridge-command <cmd>` runs a simple command standalone; the agy doctor passes
+its JSON invocation). The probe waits for a valid MCP `initialize` response before it sends
+`notifications/initialized` and `tools/list`; a tools response alone is not boot evidence.
+
+- **agy** probes every configured candidate invocation.
+- **pi** probes every effective stdio invocation, including a legacy managed path or unowned
+  override. Runtime truth says whether the command pi will launch works; ownership separately says
+  whether entwurf may repair or normalize it.
+
+entwurf never repairs a launcher it does not own — a foreign one is reported fail-loud with the
+operator's repair named.
+
 ## Shipped adapters
 
 | Seam | Claude | Cortex Code |
@@ -159,10 +255,13 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.66.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.70.0 nor the Cortex landing adds a client-side
 readiness fence, and `mcpServerStatus()` is not called by the common loop.
-(Re-measured at the 0.65.0 → 0.66.0 bump: the goal extension is not a fence,
-and `mcpServerStatus` appears nowhere in the 0.66.0 adapter source.)
+(Re-measured at the 0.68.0 → 0.70.0 bump: AIR typed failures and the 0.69.0 AIR
+file-change report are both capability-gated and unadvertised by entwurf; 0.70.0's
+`providers/set` / `providers/disable` are advertised unconditionally by the adapter but
+entwurf calls neither, so no session's provider state is transitioned; goal extension is
+still not a fence. This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
 

package/docs/external-mcp-host.md

@@ -7,17 +7,39 @@ the one-line registration; everything an operator needs to actually wire a host
 `entwurf-bridge` can also be registered in a separate MCP-aware harness (Claude Code, Codex CLI, Antigravity/`agy`, …). That host does **not** become a pi session and does **not** need to be ACP-backed. There are now two honest cases:
 
 - **plain external MCP host**: no garden meta-record / sender marker. It can call the read surfaces (`entwurf_peers`, `entwurf_inbox_read`), but `entwurf_v2` sends are **refused by default** (#50 C4: "if we don't know who sent it, we don't send it"). The operator may wire the explicit hatch below; the send then goes out external/non-replyable.
-- **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
+- **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy, `userPromptSubmitted`/`sessionStart` for GitHub Copilot CLI. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+  **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, or `entwurf` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+
+Observed: Claude Code, Codex CLI, Antigravity CLI and GitHub Copilot CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude and Copilot become symmetric/replyable through a mailbox-backed meta-session — Claude's watch armed by its own hook, Copilot's by the forked extension it installs; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
 Prerequisites on the host running the external MCP client:
 
 - A live pi session launched with `--entwurf-control` populates `~/.pi/entwurf-control/<gardenId>.sock` — the key is the **record's** garden id, never a transcript/session id (`PI_SESSION_ID` only carries the id record birth already established). Required for `entwurf_v2` control-socket dispatch and `entwurf_peers`.
 
-> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. No `entwurf_v2` rail launches a process, so this does not affect delivery — but `entwurf_fresh_call` and `entwurf_resume_call` do open a fixed runtime. If that runtime works in your terminal but an external-host call fails with `spawn pi ENOENT` or `spawn claude ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find the runtime. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
+> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. No `entwurf_v2` rail launches a process, so this does not affect delivery — but `entwurf_fresh_call` and `entwurf_resume_call` do open a fixed runtime. If that runtime works in your terminal but an external-host call fails with `spawn pi ENOENT`, `spawn claude ENOENT`, or `spawn entwurf ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find the runtime. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
+
+> **Identity-carrier boundary.** A complete `PI_SESSION_ID` + `PI_AGENT_ID` pair wins before a
+> native sender marker in the bridge's authoritative-self resolution. Those variables are correct
+> inside the pi process that planted them from record birth; they are foreign identity in another
+> native harness. Starting that harness from a pi citizen's bash can otherwise make the new host —
+> and any internal agents borrowing its MCP manager — speak under the parent pi garden id. Every
+> managed native launcher therefore removes both variables before exec and lets the launched
+> harness establish its own identity through its trusted birth marker. Clearing only one is not a
+> repair: an incomplete pair merely changes the failure wording, while retaining either carrier
+> invites future partial-reader drift. An unmanaged launch that inherits them is unsupported. A
+> native-harness admission made under this contract must add a doctor cell that names this
+> contamination rather than silently preferring the marker.
+>
+> **Certified so far: Copilot only** (#82 RAIL 9). `scripts/copilot-launch.sh` unsets both before
+> `exec`, `check-copilot-launch` asserts their absence from the vendor's OWN report of its
+> environment (and that clearing one alone does not pass), and `doctor-copilot-receive` reports any
+> live Copilot CLI still carrying either as RED on its own axis — a session can be perfectly armed
+> and still speak under the parent's garden id, so the flag verdict must not absorb it. The other
+> native launchers have NOT been certified against this failure mode; do not read Copilot's cells
+> as coverage for them.
 
 Example env file:
 

package/docs/setup-clean-host.md

@@ -11,7 +11,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm | bundled with Node | package installation |
 | entwurf | `@junghanacs/entwurf` | all lanes |
-| pi | optional, `@earendil-works/pi-coding-agent >=0.84.1 <0.85` | ACP provider, control sockets |
+| pi | optional, `@earendil-works/pi-coding-agent >=0.84.3 <0.85` | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
@@ -56,7 +56,7 @@ lists the seven garden tools; it does not prove a backend model turn or native h
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.1
+npm install -g @earendil-works/pi-coding-agent@0.84.3
 pi --version
 
 cd ~/entwurf-smoke
@@ -64,7 +64,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.1 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.84.3 <0.85`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -562,22 +562,24 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed " +
-    "backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Three fixed " +
+    "backends only: pi, claude-code, copilot. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
+    "or `auto` for copilot). A copilot launch goes through entwurf's own managed invocation and is refused " +
+    "BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
-        .enum(["pi", "claude-code"])
-        .describe("Which fixed runtime to open. Only these two; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot"])
+        .describe("Which fixed runtime to open. Only these three; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -591,7 +593,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias."),
+        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto)."),
     task: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -4,6 +4,7 @@
 		"claude-code": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"antigravity": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "conversationId" },
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
+		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/copilot-fresh-preflight.js

@@ -0,0 +1,253 @@
+/**
+ * copilot-fresh-preflight — the pre-mutation capability check a Copilot fresh call needs
+ * (#82 RAIL 9, `docs/adding-a-harness.md` step 9 clauses 3 and 4).
+ *
+ * ── Why this is a leaf and not a doctor ──
+ *
+ * A doctor answers "is this host correctly wired?" and is allowed to be slow, to spawn the
+ * vendor CLI, and to read live processes. This is not that. It answers ONE narrower question
+ * at ONE moment: *before* `mux-fresh-call` mutates the operator's tmux session, are the four
+ * things the fresh contract requires actually in place on this filesystem?
+ *
+ *   birth            — without the birth plugin the session mints no record, so the callback
+ *                      would carry no garden id and the sibling never becomes addressable.
+ *   MCP hand         — without the bridge server the callback tool does not exist in that
+ *                      session, and the first turn has nothing to call.
+ *   receive          — without the receiver unit the sibling can be launched and can call
+ *                      home, and then nothing can ever be delivered TO it.
+ *   visible identity — without the custom footer the citizen has a garden id nobody can see,
+ *                      which step 4 refuses to call lifecycle parity.
+ *
+ * ── Ordering is the whole point ──
+ *
+ * `scripts/copilot-launch.sh` already fails closed on the receiver, and that check is kept as
+ * it is: it guards every manual `entwurf copilot`, whose accepted contract stays receive-only.
+ * But a launcher runs INSIDE the window tmux just made, so its refusal leaves a dead window
+ * behind and the caller reads a launch receipt for a sibling that never was. `mux-fresh-call`'s
+ * rule is that nothing above the single mutation may leave a window behind, so the fresh lane
+ * decides the same facts one layer earlier. The overlap on the receiver axis is deliberate and
+ * each side names the other; the other three axes are the FRESH lane's requirement only.
+ *
+ * ── What this deliberately does NOT claim ──
+ *
+ * Ownership/configuration truth only: entwurf's units are installed and the settings the
+ * vendor will read say what they must say. It does NOT prove the Copilot CLI loaded the
+ * plugin, connected the MCP server, scanned the extension, or rendered a garden id in its
+ * footer — that is runtime truth, and it belongs to `doctor-copilot-*` (which may spawn the
+ * vendor) and to the step 9 clause 7 LIVE receipt. A green preflight is a statement about this
+ * filesystem, not a prediction about the next process.
+ *
+ * Every predicate below MIRRORS the shipped adapter that owns that file, deliberately
+ * including its environment seams — a preflight that resolved a path its own installer never
+ * writes would refuse a correctly installed host and send the operator hunting.
+ *
+ * No vendor spawn, no network, no await, no mutation.
+ */
+import { accessSync, constants, existsSync, lstatSync, readFileSync, statSync } from "node:fs";
+import * as path from "node:path";
+const BIRTH_PLUGIN = "entwurf-meta-receive-copilot";
+const RECEIVE_UNIT = "entwurf-receive";
+const MCP_SERVER_KEY = "entwurf-bridge";
+/** Same default and same env seam as `scripts/copilot-statusline-bridge.sh`. */
+const DEFAULT_STATUSLINE_COMMAND = "entwurf-copilot-statusline";
+function dataHome(env) {
+    const xdg = env.XDG_DATA_HOME;
+    if (typeof xdg === "string" && xdg.length > 0)
+        return xdg;
+    const home = env.HOME;
+    if (typeof home === "string" && home.length > 0)
+        return path.join(home, ".local", "share");
+    return null;
+}
+/** A JSON object or nothing. Failure to read, parse, or find an object is the SAME answer
+ * here — absent — because the caller's next move is identical in all of them: run the
+ * installer. Telling a corrupt state file apart from a missing one is the doctor's job. */
+function readJsonObject(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        // Bounded environment probing, Hard Rule 15's stated exception.
+        return null;
+    }
+}
+function isDir(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function isSymlink(p) {
+    try {
+        return lstatSync(p).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** Same DEST the managed launcher will arm from (`scripts/copilot-launch.sh`).
+ * `COPILOT_EXTENSIONS_DIR` wins; otherwise `$HOME/.copilot/extensions/<unit>`.
+ * String equality, not realpath: the launcher compares with `[ = ]`. */
+function receiveDest(env) {
+    const override = env.COPILOT_EXTENSIONS_DIR;
+    if (typeof override === "string" && override.length > 0) {
+        return path.join(override, RECEIVE_UNIT);
+    }
+    const home = env.HOME;
+    if (typeof home !== "string" || home.length === 0)
+        return null;
+    return path.join(home, ".copilot", "extensions", RECEIVE_UNIT);
+}
+function isExecutableFile(p) {
+    try {
+        // `X_OK` for THIS user, which is what `command -v` answers and what Copilot will need.
+        // A mode-bit test would call a root-owned 0700 binary executable for everyone.
+        accessSync(p, constants.X_OK);
+        return statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The statusline command as the shipped adapter resolves it: a value containing a separator is
+ * a path and must be executable; a bare name is looked up on PATH. This is a small local
+ * search rather than `mux-launch`'s resolver because the import fence keeps `mux-launch` to
+ * exactly two importers — a third would be a decision, and this leaf does not need one.
+ */
+function commandResolvable(command, env) {
+    if (command.includes("/"))
+        return isExecutableFile(command);
+    const raw = env.PATH;
+    if (typeof raw !== "string" || raw.length === 0)
+        return false;
+    for (const dir of raw.split(path.delimiter)) {
+        if (dir.length === 0)
+            continue;
+        if (isExecutableFile(path.join(dir, command)))
+            return true;
+    }
+    return false;
+}
+/**
+ * The visible-identity axis, step 9 clause 4. The subject is the EFFECTIVE settings the vendor
+ * will read, not entwurf's ownership record: a host can carry a correct footer configuration
+ * with no install-state (measured on the acceptance host, 2026-08-24 — `doctor-copilot-statusline`
+ * reported `settings: configured (resolvable)` / `state: absent` / rc=0), and refusing that host
+ * would be refusing a working visible identity because of a missing receipt.
+ *
+ * The install-state, when present, is checked for the ONE thing it can still contradict: that
+ * it manages the very file Copilot reads. A state pointing somewhere else means two settings
+ * files disagree about who owns the footer, and which one wins is not decidable from here.
+ */
+function visibleIdentityMissing(env, data) {
+    const command = env.COPILOT_STATUSLINE_COMMAND || DEFAULT_STATUSLINE_COMMAND;
+    const configured = env.COPILOT_SETTINGS_CONFIG;
+    let settingsPath;
+    if (typeof configured === "string" && configured.length > 0) {
+        settingsPath = configured;
+    }
+    else {
+        const home = env.HOME;
+        if (typeof home !== "string" || home.length === 0)
+            return true;
+        settingsPath = path.join(home, ".copilot", "settings.json");
+    }
+    // A symlinked settings file is somebody else's SSOT; the adapter refuses to touch it and
+    // this refuses to certify it.
+    if (isSymlink(settingsPath))
+        return true;
+    const settings = readJsonObject(settingsPath);
+    if (settings === null)
+        return true;
+    const statusLine = settings.statusLine;
+    if (typeof statusLine !== "object" || statusLine === null || Array.isArray(statusLine))
+        return true;
+    if (statusLine.command !== command)
+        return true;
+    const footer = settings.footer;
+    if (typeof footer !== "object" || footer === null || Array.isArray(footer))
+        return true;
+    // `showCustom` must be exactly true. A truthy string would render nothing.
+    if (footer.showCustom !== true)
+        return true;
+    if (!commandResolvable(command, env))
+        return true;
+    const state = readJsonObject(path.join(data, "entwurf", "copilot-statusline", "install-state.json"));
+    if (state === null)
+        return false; // absent state is not drift — see the doc comment above
+    const managed = state.managedSettingsPath;
+    if (typeof managed !== "string" || !path.isAbsolute(managed))
+        return true;
+    return path.resolve(managed) !== path.resolve(settingsPath);
+}
+/**
+ * Answer for ONE fresh Copilot launch. `null` means every required capability is in place on
+ * this filesystem; anything else is the first missing one, in the order the fresh contract
+ * consumes them: be born, hold the hand, be reachable, be visible.
+ */
+export function copilotFreshPreflight(env = process.env) {
+    const data = dataHome(env);
+    // With no HOME and no XDG_DATA_HOME there is no place any of these could be installed.
+    // Report the FIRST capability rather than inventing a fifth reason for "no home".
+    if (data === null)
+        return "copilot-birth-unit-missing";
+    // 1. Birth. The assembly is what the installer bakes and what the birth doctor certifies
+    // statically; `hooks.json` is what makes it a hook unit rather than a directory. There is
+    // no install-state for this unit — the artifact IS its ownership record.
+    const birthUnit = path.join(data, "entwurf", "meta-bridge-copilot", ".assembled", BIRTH_PLUGIN);
+    if (!isDir(birthUnit) || !existsSync(path.join(birthUnit, "hooks", "hooks.json"))) {
+        return "copilot-birth-unit-missing";
+    }
+    // 2. MCP hand. The install-state names the config it owns, so the config path is READ from
+    // ownership truth rather than re-derived — a preflight that guessed would refuse a
+    // correctly installed host whose config lives somewhere else.
+    const mcpState = readJsonObject(path.join(data, "entwurf", "copilot-mcp", "install-state.json"));
+    if (mcpState === null || mcpState.serverKey !== MCP_SERVER_KEY)
+        return "copilot-mcp-hand-missing";
+    const managedConfigPath = mcpState.managedConfigPath;
+    if (typeof managedConfigPath !== "string" || !path.isAbsolute(managedConfigPath))
+        return "copilot-mcp-hand-missing";
+    const servers = readJsonObject(managedConfigPath)?.mcpServers;
+    if (typeof servers !== "object" || servers === null || Array.isArray(servers))
+        return "copilot-mcp-hand-missing";
+    // The state can be current while the config drifted (hand-edited, restored from a backup,
+    // replaced by another tool). The server key present in the file the CLI actually reads is
+    // the fact the first turn depends on.
+    if (!Object.hasOwn(servers, MCP_SERVER_KEY))
+        return "copilot-mcp-hand-missing";
+    // 3. Receive. The same facts `scripts/copilot-launch.sh` checks — unit name, recorded
+    // path, DEST equality against this env's extensions root, then the entry file.
+    const recvState = readJsonObject(path.join(data, "entwurf", "copilot-receive", "install-state.json"));
+    if (recvState === null || recvState.unit !== RECEIVE_UNIT)
+        return "copilot-receive-unit-missing";
+    const recvPath = recvState.path;
+    if (typeof recvPath !== "string" || !path.isAbsolute(recvPath))
+        return "copilot-receive-unit-missing";
+    // Mirror the launcher's path-mismatch predicate PRE-MUTATION. A state that names a
+    // real unit in a different extensions root than this env will scan still opens a
+    // window today if we only check that the files exist — then `entwurf copilot`
+    // refuses inside it and the caller holds a launch receipt for a dead sibling.
+    const dest = receiveDest(env);
+    if (dest === null || recvPath !== dest)
+        return "copilot-receive-unit-missing";
+    if (!isDir(recvPath) || !existsSync(path.join(recvPath, "extension.mjs")))
+        return "copilot-receive-unit-missing";
+    // 4. Visible identity.
+    if (visibleIdentityMissing(env, data))
+        return "copilot-visible-identity-missing";
+    return null;
+}
+/** Repair text, one line per reason. A reason a caller cannot act on is a reason they will
+ * guess about — each names the exact command that installs the missing capability. */
+export const COPILOT_PREFLIGHT_HINT = {
+    "copilot-birth-unit-missing": "the Copilot BIRTH plugin is not installed here, so the sibling would mint no record and its callback would carry no garden id — run: entwurf install-copilot-bridge",
+    "copilot-mcp-hand-missing": "the entwurf-bridge MCP server is not registered in the Copilot config this host owns, so the callback tool would not exist in that session — run: entwurf install-copilot-mcp",
+    "copilot-receive-unit-missing": "the Copilot RECEIVER extension is not installed here, so the sibling could call home but nothing could ever be delivered to it — run: entwurf install-copilot-receive",
+    "copilot-visible-identity-missing": "Copilot's custom footer is not configured to entwurf's resolvable statusline command (or an install-state manages a different settings file), so the sibling's garden id would be visible nowhere — run: entwurf doctor-copilot-statusline, then entwurf install-copilot-statusline",
+};

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -37,8 +37,16 @@
  */
 import { isPlausibleOwnerPid, metaRecordExistsByGardenId, parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
-/** Every native backend that mints a garden-id from its own hook and writes a sender marker. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity"];
+/** Every native backend that mints a garden-id from its own hook and writes a sender marker.
+ *
+ * WRITER AND READER OPEN TOGETHER OR NOT AT ALL. A backend listed here whose hook writes no
+ * marker costs one wasted directory read; a backend whose hook writes a marker but is absent
+ * here is INVISIBLE — the bridge holds the owner pid, never looks in that directory, and the
+ * citizen's sends are refused as anonymous for a reason nothing in the log names. That was
+ * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
+ * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
+ * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
+export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot"];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend