@junghanacs/entwurf 0.14.1 → 0.15.0

package/scripts/mutants/bridge-command-boot.json

@@ -0,0 +1,107 @@
+{
+	"schemaVersion": 1,
+	"lane": "bridge-command-boot",
+	"mutants": [
+		{
+			"claim": "PI-DOCTOR-BOOT-NEGATIVE",
+			"title": "the pi doctor goes back to blessing a command that merely RESOLVES — the exact #81 false success, where a host ran ACP turns with no mcp__entwurf-bridge__* tool while the doctor printed ok",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (probe.ok) {"],
+			"replace": ["\t\tif (probe.ok || true) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-BOOT-NEGATIVE",
+			"title": "the agy doctor stops asking whether the configured command boots and reports the old '(resolvable)' green — a registered bridge agy could never actually call",
+			"subject": "scripts/agy-bridge.sh",
+			"find": ["      if command_boots \"$invocation\"; then"],
+			"replace": ["      if true; then"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-PROBES-OVERRIDE",
+			"title": "the pi doctor skips runtime probing for a non-bare override, so a dead command that shadows the stable bridge returns green as an operator choice",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\tif (!resolvable(cmd)) {"],
+			"replace": [
+				"\tif (!isBare) {\n\t\tlog(`  note: skipped runtime for override '${cmd}'`);\n\t} else if (!resolvable(cmd)) {"
+			],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-PROBES-OVERRIDE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ARGS",
+			"title": "the agy invocation parser drops configured args, so the doctor boots command defaults while agy executes a failing argv",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    args = server.get(\"args\", [])"],
+			"replace": ["    args = []"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ARGS]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ENV",
+			"title": "the agy invocation parser drops configured environment, so the doctor boots command defaults while agy executes a failing environment",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    env = server.get(\"env\", {})"],
+			"replace": ["    env = {}"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ENV]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PROBE-REASON-MISSING-VERB",
+			"title": "bridge identity shrinks back to a single tool, so a build missing entwurf_self — the measured #81 session shape — reads as a healthy bridge again",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tconst missing = EXPECTED_TOOLS.filter((t) => !served.has(t));"],
+			"replace": ["\t\t\t\tconst missing = [\"entwurf_v2\"].filter((t) => !served.has(t));"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REASON-MISSING-VERB]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-REQUIRES-INITIALIZE",
+			"title": "the probe accepts tools/list before the MCP initialize handshake completes — a launcher the harness cannot initialize reads healthy",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tif (!initialized) {"],
+			"replace": ["\t\t\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REQUIRES-INITIALIZE]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-CLEANUP-ESCALATES",
+			"title": "the probe stops escalating past SIGTERM, so a launcher that traps TERM outlives the doctor that spawned it — the probe leaks the broken process it exists to detect",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\t\t\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-CLEANUP-ESCALATES]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-STDIN-EPIPE-GUARD",
+			"title": "the async EPIPE from a launcher that died on exec goes unlistened again, so the probe dies on an uncaught stream error and the doctor prints a Node stack trace where the LAUNCHER's own stderr belongs — the #81 diagnosis erased in the one cell that needs it",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\tchild.stdin.on(\"error\", () => {});"],
+			"replace": ["\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-STDIN-EPIPE-GUARD]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		}
+	]
+}

package/scripts/mutants/capability-cache.json

@@ -0,0 +1,64 @@
+{
+	"schemaVersion": 1,
+	"lane": "capability-cache",
+	"mutants": [
+		{
+			"claim": "CAPABILITY-REGISTRY-REREAD-SEES-REPLACEMENT",
+			"title": "memoizing the capability registry into a process-lifetime singleton makes every already-running dispatcher answer out of the registry it booted with — an install that moves a grade or wakeMode is invisible until the operator restarts, and nothing says so",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"export function loadMetaCapabilityRegistry(): MetaCapabilityRegistry {",
+				"\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));",
+				"}"
+			],
+			"replace": [
+				"let cachedMetaCapabilities: MetaCapabilityRegistry | null = null;",
+				"export function loadMetaCapabilityRegistry(): MetaCapabilityRegistry {",
+				"\tif (cachedMetaCapabilities === null) {",
+				"\t\tcachedMetaCapabilities = parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));",
+				"\t}",
+				"\treturn cachedMetaCapabilities;",
+				"}"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-REREAD-SEES-REPLACEMENT]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		},
+		{
+			"claim": "CAPABILITY-REGISTRY-MISSING-STILL-THROWS",
+			"title": "answering a missing registry with a built-in default turns a broken install into a citizen that silently claims capabilities nobody shipped",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));"],
+			"replace": [
+				"\tconst registryPath = metaCapabilitiesFilePath();",
+				"\tif (!fs.existsSync(registryPath)) {",
+				"\t\treturn { schemaVersion: CAPABILITY_SCHEMA_VERSION, backends: {} } as unknown as MetaCapabilityRegistry;",
+				"\t}",
+				"\treturn parseMetaCapabilityRegistry(fs.readFileSync(registryPath, \"utf8\"));"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-MISSING-STILL-THROWS]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		},
+		{
+			"claim": "CAPABILITY-REGISTRY-CORRUPT-STILL-THROWS",
+			"title": "swallowing a parse failure and returning a fallback lets a half-written or hand-edited registry read as a valid one, so the strict parser stops being load-bearing",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));"],
+			"replace": [
+				"\tconst rawRegistry = fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\");",
+				"\ttry {",
+				"\t\treturn parseMetaCapabilityRegistry(rawRegistry);",
+				"\t} catch {",
+				"\t\treturn { schemaVersion: CAPABILITY_SCHEMA_VERSION, backends: {} } as unknown as MetaCapabilityRegistry;",
+				"\t}"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-CORRUPT-STILL-THROWS]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		}
+	]
+}

package/scripts/mutants/copilot-birth.json

@@ -0,0 +1,155 @@
+{
+	"schemaVersion": 1,
+	"lane": "copilot-birth",
+	"mutants": [
+		{
+			"claim": "COPILOT-BIRTH-NO-ARGV-LAUNCH",
+			"title": "reusing the Claude no-argv refusal in the Copilot launcher kills every Copilot birth (this is the exact defect that held copilot at 0 of 409 records)",
+			"subject": "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+			"find": ["exec \"$NODE_BIN\" \"$HOOK_ENTRY\""],
+			"replace": [
+				"if [ \"$#\" -eq 0 ]; then",
+				"\techo 'entwurf meta-bridge: this hook was launched with NO arguments.' >&2",
+				"\texit 1",
+				"fi",
+				"exec \"$NODE_BIN\" \"$HOOK_ENTRY\""
+			],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-NO-ARGV-LAUNCH]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-MINTS-COPILOT",
+			"title": "minting a Copilot session under the claude-code backend gives it a citizenship it cannot own and hides the Copilot lane's own count",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\t\tinput: { backend: \"copilot\", nativeSessionId: envelope.sessionId, cwd: envelope.cwd },"],
+			"replace": ["\t\t\tinput: { backend: \"claude-code\", nativeSessionId: envelope.sessionId, cwd: envelope.cwd },"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-MINTS-COPILOT]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-ID-DISAGREEMENT",
+			"title": "preferring one id when the two envelope keys disagree mints a citizen no live session can be joined back to",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": [
+				"\tif (native && compat && native !== compat) {",
+				"\t\treturn { refusal: `sessionId and session_id disagree (${native} vs ${compat})` };",
+				"\t}"
+			],
+			"replace": ["\t// disagreement tolerated: the native key simply wins"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-ID-DISAGREEMENT]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-EXEC-IS-STRING",
+			"title": "declaring the Copilot hook in Claude's array form is rejected at plugin load, before any prompt — the plugin never runs at all",
+			"subject": "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json",
+			"find": ["\t\t\"sessionStart\": [{ \"exec\": \"__COPILOT_LAUNCHER__\" }],"],
+			"replace": ["\t\t\"sessionStart\": [{ \"exec\": [\"__COPILOT_LAUNCHER__\"] }],"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-EXEC-IS-STRING]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "CAPABILITY-DRIFT-SCOPE-FROM-CONST",
+			"title": "a literal lane list in the capability drift guard lets any new backend's descriptor ship without ever being compared — the hole #82 found and closed",
+			"subject": "scripts/check-entwurf-capabilities.ts",
+			"find": ["const driftScope: readonly MetaBackend[] = META_BACKENDS;"],
+			"replace": ["const driftScope: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"codex\"];"],
+			"gate": ["bash", "run.sh", "check-entwurf-capabilities"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-DRIFT-SCOPE-FROM-CONST]",
+			"signatureSource": "scripts/check-entwurf-capabilities.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-QUALIFIED-STALE",
+			"title": "a BARE stale-unit name reaches a same-named plugin from somebody else's marketplace and uninstalls it",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": ["STALE_CLAUDE_UNIT=\"entwurf-meta-receive@meta-bridge-local\""],
+			"replace": ["STALE_CLAUDE_UNIT=\"entwurf-meta-receive\""],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-QUALIFIED-STALE]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-UNINSTALL-FAILURE-IS-FATAL",
+			"title": "swallowing a failed stale-unit uninstall installs on top of a unit that is still firing and reports success",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": [
+				"      copilot plugin uninstall \"$STALE_CLAUDE_UNIT\" >/dev/null \\",
+				"        || die \"the stale Claude unit '$STALE_CLAUDE_UNIT' is installed in Copilot but could not be removed. It fires on every prompt and exits 1 before node starts, so installing on top of it would leave that noise in place. Fix the Copilot CLI error above, or re-run with --keep-stale-claude-unit to proceed deliberately.\""
+			],
+			"replace": ["      copilot plugin uninstall \"$STALE_CLAUDE_UNIT\" >/dev/null 2>&1 || true"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-UNINSTALL-FAILURE-IS-FATAL]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "HOOK-LOG-RAIL-SCOPED",
+			"title": "an untagged ERROR grep lets a Copilot fail-closed refusal redden the CLAUDE doctor forever — copilot's recovery token cannot exist on that rail",
+			"subject": "scripts/meta-bridge-hook-log.sh",
+			"find": ["  own=\"$(grep -v ' \\[copilot\\] ' \"$log\" 2>/dev/null || true)\""],
+			"replace": ["  own=\"$(cat \"$log\" 2>/dev/null || true)\""],
+			"gate": ["bash", "run.sh", "check-meta-doctor-oracle"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:HOOK-LOG-RAIL-SCOPED]",
+			"signatureSource": "scripts/check-meta-doctor-oracle.sh"
+		},
+		{
+			"claim": "COPILOT-BIRTH-DOES-NOT-ARM-RECEIVER",
+			"title": "arming a mailbox from the BIRTH hook claims a watch this process does not hold. Copilot now has a doorbell (#82 RAIL 5), which is exactly why the writer matters: the extension owns the watch, so a marker minted here would name the host pid as a watcher and keep a wired-to-nothing citizen deliverable for as long as the TUI stayed open",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\tlogLine(\n\t\t\t\"INFO\","],
+			"replace": [
+				"\t\tfs.mkdirSync(path.join(path.dirname(defaultMetaSessionsDir()), \"meta-mailbox\", result.record.gardenId), { recursive: true });\n\t\tlogLine(\n\t\t\t\"INFO\","
+			],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-DOES-NOT-ARM-RECEIVER]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-WRITES-SENDER-MARKER",
+			"title": "dropping the sender-marker write leaves the reader open and the writer closed — the citizen calls entwurf_v2, the bridge holds its owner pid, finds no marker, and the send is refused as anonymous with nothing in any log naming the cause (the #46 defect, re-planted on the copilot rail)",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\twriteCopilotSenderMarker(result.record.gardenId, envelope);"],
+			"replace": ["\t\t// sender marker skipped"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-WRITES-SENDER-MARKER]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-SENDER-READER-OPEN",
+			"title": "closing the reader half leaves the writer talking to nobody — the hook writes a copilot marker, the bridge never looks in that directory, and the citizen's sends are refused as anonymous (the #46 shape, which is why writer and reader open in one change)",
+			"subject": "pi-extensions/lib/meta-sender-identity.ts",
+			"find": [
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\"];"
+			],
+			"replace": ["export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\"];"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-SENDER-READER-OPEN]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-LIST-FAILURE-IS-FATAL",
+			"title": "reading a failed `copilot plugin list` as an empty host installs on top of a stale unit that is still firing",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": ["  if ! INSTALLED_LIST=\"$(copilot plugin list 2>/dev/null)\"; then"],
+			"replace": ["  INSTALLED_LIST=\"$(copilot plugin list 2>/dev/null || true)\"", "  if false; then"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-LIST-FAILURE-IS-FATAL]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		}
+	]
+}

package/scripts/mutants/copilot-launch.json

@@ -0,0 +1,187 @@
+{
+	"schemaVersion": 1,
+	"lane": "copilot-launch",
+	"mutants": [
+		{
+			"claim": "COPILOT-LAUNCH-REQUIRES-RECEIVER",
+			"title": "launching with the scan flag while no receiver unit is installed promises a doorbell nothing can ring — the session looks managed and is permanently undeliverable, with no error anywhere",
+			"subject": "scripts/copilot-launch.sh",
+			"find": [
+				"[ -f \"$STATE_FILE\" ] \\",
+				"\t|| fail \"no receiver install-state at $STATE_FILE.",
+				"  '$VENDOR_CMD' launched with $FLAG_ENV=$FLAG_VALUE would scan for an extension that is",
+				"  not there, and the session would never become deliverable. Run: $REPAIR\""
+			],
+			"replace": [
+				"if [ ! -f \"$STATE_FILE\" ]; then",
+				"\tmkdir -p \"$STATE_DIR\"",
+				"\tprintf '{\"schemaVersion\":1,\"unit\":\"%s\",\"path\":\"%s\"}\\n' \"$UNIT\" \"$DEST\" > \"$STATE_FILE\"",
+				"fi"
+			],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-REQUIRES-RECEIVER]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-REFUSES-PATH-MISMATCH",
+			"title": "accepting an install-state that names a different extensions root lets the CLI scan a directory nobody installed into, while every artifact check stays green",
+			"subject": "scripts/copilot-launch.sh",
+			"find": [
+				"[ \"$claimed_path\" = \"$DEST\" ] \\",
+				"\t|| fail \"receiver install-state points at '$claimed_path' but this environment scans '$DEST'.",
+				"  The CLI would read a different extensions root than the one that was installed",
+				"  (COPILOT_EXTENSIONS_DIR / HOME differ from install time). Run: $REPAIR\""
+			],
+			"replace": ["# whichever root the state names is close enough"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-REFUSES-PATH-MISMATCH]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-SETS-EXTENSIONS-TOKEN",
+			"title": "not guaranteeing the EXTENSIONS token makes the managed launch identical to a plain one — Copilot skips the extension scan silently and the whole surface is decoration",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["[ \"$seen_extensions\" -eq 1 ] || flags_out=\"${flags_out:+$flags_out,}$FLAG_VALUE\""],
+			"replace": ["# assume the operator already set it"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-SETS-EXTENSIONS-TOKEN]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-PRESERVES-OPERATOR-TOKENS",
+			"title": "overwriting the feature-flag variable instead of extending it silently disables every other vendor feature flag the operator had enabled",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["export \"$FLAG_ENV=$flags_out\""],
+			"replace": ["export \"$FLAG_ENV=$FLAG_VALUE\""],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-PRESERVES-OPERATOR-TOKENS]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-DEFAULTS-BEFORE-TERMINATOR",
+			"title": "appending the injected defaults after the argv terminator turns them from options into positional data the vendor reads as prompt text, so the managed profile silently stops applying",
+			"subject": "scripts/copilot-launch.sh",
+			"find": [
+				"final_args=()",
+				"for (( i = 0; i < scan_end; i++ )); do final_args+=(\"${args[$i]}\"); done",
+				"if [ \"${#injected[@]}\" -gt 0 ]; then final_args+=(\"${injected[@]}\"); fi",
+				"for (( i = scan_end; i < ${#args[@]}; i++ )); do final_args+=(\"${args[$i]}\"); done"
+			],
+			"replace": [
+				"final_args=(\"${args[@]}\")",
+				"if [ \"${#injected[@]}\" -gt 0 ]; then final_args+=(\"${injected[@]}\"); fi"
+			],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-DEFAULTS-BEFORE-TERMINATOR]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-NO-DEFAULT-OVER-EXPLICIT-POLICY",
+			"title": "treating only the broadening flags as explicit policy means an operator who NARROWS permissions (--allow-url, --deny-tool, --excluded-tools) still gets --yolo appended — the managed default silently widens exactly what they were restricting",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["\t--allow-url", "\t--deny-url", "\t--available-tools", "\t--excluded-tools"],
+			"replace": ["\t# narrowing flags are not policy"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-NO-DEFAULT-OVER-EXPLICIT-POLICY]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-PREFIX-IS-NOT-POLICY",
+			"title": "matching policy flags by prefix instead of exactly makes --allow-all-mcp-server-instructions read as --allow-all, so a prompt-content flag suppresses the managed permission default",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["\t\tif [ \"$head\" = \"$ov\" ]; then"],
+			"replace": ["\t\tif case \"$head\" in \"$ov\"*) true ;; *) false ;; esac; then"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-PREFIX-IS-NOT-POLICY]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-KEEPS-OPERATOR-MODEL",
+			"title": "injecting the default model regardless of what the operator asked for silently overrides an explicit --model",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["\t\thas_model=1"],
+			"replace": ["\t\thas_model=0"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-KEEPS-OPERATOR-MODEL]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-EXECS-NOT-FORKS",
+			"title": "running the vendor as a child instead of exec'ing it leaves an entwurf shell sitting between the operator's terminal and the CLI, owning a pid and a signal path that belong to the vendor",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["exec \"$copilot_bin\" \"${final_args[@]}\""],
+			"replace": ["\"$copilot_bin\" \"${final_args[@]}\""],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-EXECS-NOT-FORKS]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-REFUSES-RECURSION",
+			"title": "dropping the sentinel lets a PATH entry that calls back into the managed launch spin forever; the operator sees a hung terminal, not an error",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["if [ -n \"${ENTWURF_COPILOT_LAUNCH_ACTIVE:-}\" ]; then"],
+			"replace": ["if false; then"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-REFUSES-RECURSION]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-REFUSES-ABSENT-VENDOR",
+			"title": "not checking that the vendor resolved turns a missing CLI into an opaque exec failure instead of the one sentence that says what is missing",
+			"subject": "scripts/copilot-launch.sh",
+			"find": [
+				"[ -n \"$copilot_bin\" ] \\",
+				"\t|| fail \"no '$VENDOR_CMD' executable found on PATH.",
+				"  The managed launch runs the GitHub Copilot CLI; install it, or put it on PATH.\""
+			],
+			"replace": ["# an empty resolution will surface itself at exec time"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-REFUSES-ABSENT-VENDOR]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-KEEPS-CALLER-CWD",
+			"title": "dispatching the managed launch through the repo-scoped subshell every neighbouring verb uses would start the vendor in the entwurf checkout instead of the operator's own directory",
+			"subject": "run.sh",
+			"find": ["    shift || true", "    exec bash \"$REPO_DIR/scripts/copilot-launch.sh\" \"$@\""],
+			"replace": ["    shift || true", "    (cd \"$REPO_DIR\" && bash scripts/copilot-launch.sh \"$@\")"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-KEEPS-CALLER-CWD]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-STRIPS-PI-IDENTITY",
+			"title": "the managed launch forwards inherited PI_SESSION_ID/PI_AGENT_ID — the Copilot session and every child it spawns then speak under the PARENT pi citizen's garden id, with a perfectly correct native marker sitting unused beside it",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["unset PI_SESSION_ID PI_AGENT_ID\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-STRIPS-PI-IDENTITY]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		},
+		{
+			"claim": "COPILOT-LAUNCH-STRIPS-BOTH-CARRIERS",
+			"title": "only one half of the identity pair is cleared — the failure merely changes wording while a carrier stays behind for the next partial reader to believe",
+			"subject": "scripts/copilot-launch.sh",
+			"find": ["unset PI_SESSION_ID PI_AGENT_ID"],
+			"replace": ["unset PI_SESSION_ID"],
+			"gate": ["bash", "run.sh", "check-copilot-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-LAUNCH-STRIPS-BOTH-CARRIERS]",
+			"signatureSource": "scripts/check-copilot-launch.ts"
+		}
+	]
+}