@junghanacs/entwurf 0.14.1 → 0.15.0

package/scripts/smoke-copilot-mcp-state.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# smoke-copilot-mcp-state — hermetic install/doctor/inverse contract for
+# the Copilot MCP-config adapter. No Copilot process or model turn.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RUN="$REPO_DIR/run.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export COPILOT_MCP_CONFIG="$HOME/.copilot/mcp-config.json"
+export COPILOT_MCP_COMMAND="entwurf-bridge"
+STATE="$XDG_DATA_HOME/entwurf/copilot-mcp/install-state.json"
+mkdir -p "$(dirname "$COPILOT_MCP_CONFIG")" "$SB/bin"
+
+write_mcp_fake() {
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_dead_fake() {
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+echo "bash: /nonexistent/entwurf-bridge: No such file or directory" >&2
+exit 127
+FAKE
+  chmod +x "$1"
+}
+write_mcp_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+
+_clean_path=""
+while IFS= read -r dir; do
+  [ -n "$dir" ] || continue
+  [ -e "$dir/$COPILOT_MCP_COMMAND" ] || [ -L "$dir/$COPILOT_MCP_COMMAND" ] && continue
+  _clean_path="${_clean_path:+$_clean_path:}$dir"
+done < <(printf '%s\n' "$PATH" | tr ':' '\n')
+export PATH="$SB/bin:$_clean_path"
+
+write_config() {
+  printf '{\n  "mcpServers": {\n    "other": { "type": "local", "command": "keep-me" },\n    "entwurf-bridge": { "type": "local", "command": "manual-bridge", "args": [] }\n  }\n}\n' > "$COPILOT_MCP_CONFIG"
+}
+json() { python3 - "$COPILOT_MCP_CONFIG" "$@" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1]))
+mode = sys.argv[2]
+servers = data["mcpServers"]
+ours = {"type": "local", "command": "entwurf-bridge", "args": []}
+if mode == "installed":
+    assert servers["entwurf-bridge"] == ours
+    assert servers["other"] == {"type": "local", "command": "keep-me"}
+    assert set(data.keys()) == {"mcpServers"}
+elif mode == "manual":
+    assert servers["entwurf-bridge"] == {"type": "local", "command": "manual-bridge", "args": []}
+    assert servers["other"] == {"type": "local", "command": "keep-me"}
+elif mode == "created":
+    assert data == {"mcpServers": {"entwurf-bridge": ours}}
+else:
+    raise AssertionError(mode)
+PY
+}
+
+# Existing matching/manual config is adopted, not treated as a fresh file.
+write_config
+"$RUN" doctor-copilot-mcp >/dev/null
+want "unowned manual config doctor is an honest note" "[ $? -eq 0 ]"
+"$RUN" install-copilot-mcp >/dev/null
+json installed
+want "install adopts regular config and preserves unrelated servers" "[ $? -eq 0 ]"
+want "install writes state" "[ -f '$STATE' ]"
+"$RUN" doctor-copilot-mcp >/dev/null
+want "owned configured doctor is green" "[ $? -eq 0 ]"
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["preimage"] == {"type": "local", "command": "manual-bridge", "args": []}
+assert state["serverKey"] == "entwurf-bridge"
+PY
+ok "first install captures manual entwurf-bridge preimage"
+"$RUN" install-copilot-mcp >/dev/null
+"$RUN" uninstall-copilot-mcp >/dev/null
+json manual
+want "reinstall keeps the first preimage for inverse" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# The live-host shape is already our command with no state: adopt that exact preimage too.
+write_config
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"local","command":"entwurf-bridge","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+"$RUN" install-copilot-mcp >/dev/null
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["preimage"] == {"type": "local", "command": "entwurf-bridge", "args": []}
+PY
+"$RUN" uninstall-copilot-mcp >/dev/null
+json installed
+want "matching manual Copilot MCP config is adopted and restored unchanged" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# State turns a later config drift into a red doctor rather than a silent pass.
+write_config
+"$RUN" install-copilot-mcp >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"stdio","command":"entwurf-bridge","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "type=stdio doctor should fail"; fi
+ok "state-present type=stdio entry is red"
+"$RUN" install-copilot-mcp >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"local","command":"other","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "command drift doctor should fail"; fi
+ok "state-present command drift is red"
+"$RUN" install-copilot-mcp >/dev/null
+
+# A stable-bin command that boots then dies is red without touching config.
+write_dead_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "dead command doctor should fail"; fi
+ok "state-present command that does not serve MCP is red"
+write_mcp_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+"$RUN" uninstall-copilot-mcp >/dev/null
+json manual
+want "inverse restores manual config after drift repairs" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# Created-new is removed only when it still contains only the adapter's key.
+rm -f "$COPILOT_MCP_CONFIG"
+"$RUN" install-copilot-mcp >/dev/null
+json created
+"$RUN" uninstall-copilot-mcp >/dev/null
+want "created-new empty mcp-config is removed by inverse" "[ ! -e '$COPILOT_MCP_CONFIG' ] && [ ! -f '$STATE' ]"
+
+# A foreign/corrupt config file is never adopted or given a state record.
+printf '{"mcpServers":{}}\n' > "$SB/foreign.json"
+ln -s "$SB/foreign.json" "$COPILOT_MCP_CONFIG"
+if "$RUN" install-copilot-mcp >/dev/null 2>&1; then die "symlink install should refuse"; fi
+ok "symlink config is refused"
+want "symlink refusal leaves foreign config and no state" "! grep -q entwurf-bridge '$SB/foreign.json' && [ ! -f '$STATE' ]"
+rm -f "$COPILOT_MCP_CONFIG"
+printf 'not-json{{' > "$COPILOT_MCP_CONFIG"
+if "$RUN" install-copilot-mcp >/dev/null 2>&1; then die "corrupt install should fail"; fi
+ok "corrupt config fails loud"
+want "corrupt refusal writes no state" "[ ! -f '$STATE' ]"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "smoke changed the checkout"
+printf '\nsmoke-copilot-mcp-state: %d checks passed\n' "$pass"

package/scripts/smoke-copilot-statusline-state.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# smoke-copilot-statusline-state — hermetic install/doctor/inverse contract for
+# the Copilot custom-footer settings adapter. No Copilot process or model turn.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RUN="$REPO_DIR/run.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export COPILOT_SETTINGS_CONFIG="$HOME/.copilot/settings.json"
+export COPILOT_STATUSLINE_COMMAND="entwurf-copilot-statusline"
+STATE="$XDG_DATA_HOME/entwurf/copilot-statusline/install-state.json"
+mkdir -p "$(dirname "$COPILOT_SETTINGS_CONFIG")" "$SB/bin"
+printf '#!/usr/bin/env bash\necho fake-copilot-statusline\n' > "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+chmod +x "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+
+_clean_path=""
+while IFS= read -r dir; do
+  [ -n "$dir" ] || continue
+  [ -e "$dir/$COPILOT_STATUSLINE_COMMAND" ] || [ -L "$dir/$COPILOT_STATUSLINE_COMMAND" ] && continue
+  _clean_path="${_clean_path:+$_clean_path:}$dir"
+done < <(printf '%s\n' "$PATH" | tr ':' '\n')
+export PATH="$SB/bin:$_clean_path"
+
+write_settings() {
+  printf '{\n  "enabledPlugins": { "other@marketplace": true },\n  "footer": { "showCustom": true, "showDirectory": true },\n  "statusLine": { "command": "manual-statusline" }\n}\n' > "$COPILOT_SETTINGS_CONFIG"
+}
+json() { python3 - "$COPILOT_SETTINGS_CONFIG" "$@" <<'PY'
+import json, sys
+settings = json.load(open(sys.argv[1]))
+mode = sys.argv[2]
+if mode == "installed":
+    assert settings["statusLine"] == {"command": "entwurf-copilot-statusline"}
+    assert settings["footer"] == {"showCustom": True, "showDirectory": True}
+    assert settings["enabledPlugins"] == {"other@marketplace": True}
+elif mode == "manual":
+    assert settings["statusLine"] == {"command": "manual-statusline"}
+    assert settings["footer"] == {"showCustom": True, "showDirectory": True}
+elif mode == "created":
+    assert settings == {"statusLine": {"command": "entwurf-copilot-statusline"}, "footer": {"showCustom": True}}
+else:
+    raise AssertionError(mode)
+PY
+}
+
+# Existing matching/manual settings are adopted, not treated as a fresh file.
+write_settings
+"$RUN" doctor-copilot-statusline >/dev/null
+want "unowned manual settings doctor is an honest note" "[ $? -eq 0 ]"
+"$RUN" install-copilot-statusline >/dev/null
+json installed
+want "install adopts regular settings and preserves unrelated keys" "[ $? -eq 0 ]"
+want "install writes state" "[ -f '$STATE' ]"
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["statusLinePreimage"] == {"command": "manual-statusline"}
+assert state["showCustomPreimage"] is True
+PY
+ok "first install captures manual statusLine preimage"
+"$RUN" install-copilot-statusline >/dev/null
+"$RUN" uninstall-copilot-statusline >/dev/null
+json manual
+want "reinstall keeps the first preimage for inverse" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# The live-host shape is already our command with no state: adopt that exact preimage too.
+write_settings
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["statusLine"]={"command":"entwurf-copilot-statusline"}; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+"$RUN" install-copilot-statusline >/dev/null
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["statusLinePreimage"] == {"command": "entwurf-copilot-statusline"}
+assert state["showCustomPreimage"] is True
+PY
+"$RUN" uninstall-copilot-statusline >/dev/null
+json installed
+want "matching manual Copilot config is adopted and restored unchanged" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# State turns a later setting drift into a red doctor rather than a silent pass.
+write_settings
+"$RUN" install-copilot-statusline >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["footer"]["showCustom"]=False; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "custom-disabled doctor should fail"; fi
+ok "state-present custom-disabled footer is red"
+"$RUN" install-copilot-statusline >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["statusLine"]={"command":"other"}; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "statusLine drift doctor should fail"; fi
+ok "state-present statusLine drift is red"
+"$RUN" install-copilot-statusline >/dev/null
+
+# A stable-bin command that stops resolving is red without touching settings.
+rm -f "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "dangling command doctor should fail"; fi
+ok "dangling bare command is red"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+chmod +x "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+"$RUN" uninstall-copilot-statusline >/dev/null
+json manual
+want "inverse restores manual settings after drift repairs" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# Created-new is removed only when it still contains only the adapter's keys.
+rm -f "$COPILOT_SETTINGS_CONFIG"
+"$RUN" install-copilot-statusline >/dev/null
+json created
+"$RUN" uninstall-copilot-statusline >/dev/null
+want "created-new empty settings file is removed by inverse" "[ ! -e '$COPILOT_SETTINGS_CONFIG' ] && [ ! -f '$STATE' ]"
+
+# A foreign/corrupt settings file is never adopted or given a state record.
+printf '{"footer":{}}\n' > "$SB/foreign.json"
+ln -s "$SB/foreign.json" "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" install-copilot-statusline >/dev/null 2>&1; then die "symlink install should refuse"; fi
+ok "symlink settings are refused"
+want "symlink refusal leaves foreign settings and no state" "! grep -q statusLine '$SB/foreign.json' && [ ! -f '$STATE' ]"
+rm -f "$COPILOT_SETTINGS_CONFIG"
+printf 'not-json{{' > "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" install-copilot-statusline >/dev/null 2>&1; then die "corrupt install should fail"; fi
+ok "corrupt settings fail loud"
+want "corrupt refusal writes no state" "[ ! -f '$STATE' ]"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "smoke changed the checkout"
+printf '\nsmoke-copilot-statusline-state: %d checks passed\n' "$pass"

package/scripts/smoke-entwurf-chain-live.ts

@@ -63,7 +63,7 @@ const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 
-const GPT_TARGET = process.env.ENTWURF_CHAIN_GPT_TARGET?.trim() || "openai-codex/gpt-5.4";
+const GPT_TARGET = process.env.ENTWURF_CHAIN_GPT_TARGET?.trim() || "openai-codex/gpt-5.6-luna";
 const ACP_TARGET = process.env.ENTWURF_CHAIN_ACP_TARGET?.trim() || "entwurf/claude-sonnet-5";
 const BOOT_TIMEOUT_MS = 45_000;
 const CLAUDE_TURN_TIMEOUT_MS = Number(process.env.ENTWURF_CHAIN_CLAUDE_TIMEOUT_MS) || 240_000;

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -36,7 +36,7 @@
  *
  * LIVE-only (spawns a real pi, opens a real socket) — kept OUT of `pnpm check`; honest skip when
  * LIVE!=1 (a release-gate that hard-fails without auth/model is unrunnable unattended). Model:
- *   ENTWURF_LIVE_TARGET   = "<provider>/<model>"  (default "openai-codex/gpt-5.4")
+ *   ENTWURF_LIVE_TARGET   = "<provider>/<model>"  (default "openai-codex/gpt-5.6-luna")
  *   (or split: ENTWURF_LIVE_PROVIDER + ENTWURF_LIVE_MODEL)
  *   LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
  *
@@ -101,7 +101,7 @@ function resolveTarget(): { provider: string; model: string } {
 	}
 	return {
 		provider: process.env.ENTWURF_LIVE_PROVIDER?.trim() || "openai-codex",
-		model: process.env.ENTWURF_LIVE_MODEL?.trim() || "gpt-5.4",
+		model: process.env.ENTWURF_LIVE_MODEL?.trim() || "gpt-5.6-luna",
 	};
 }
 

package/scripts/smoke-mux-fresh-call-live.ts

@@ -43,7 +43,7 @@ import { skipLive } from "./lib/live-skip.ts";
 const LABEL = "smoke-mux-fresh-call-live";
 const CALLBACK_WAIT_MS = 180_000;
 const LIVE_MODEL = {
-	pi: "openai-codex/gpt-5.6-terra",
+	pi: "openai-codex/gpt-5.6-luna",
 	"claude-code": "claude-sonnet-5",
 } as const;
 
@@ -213,6 +213,8 @@ async function main(): Promise<void> {
 		// onboarding instead of exercising the configured runtime. Separate servers preserve
 		// those backend-native environments without adding an env carrier to the product.
 		const nonces = new Map<string, string>();
+		// Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
+		// and is not a release MUST — do not add `copilot` to this loop (VERIFY.md).
 		for (const backend of ["pi", "claude-code"] as const) {
 			const socket = path.join(root, `${backend}.sock`);
 			privateSockets.add(socket);

package/scripts/smoke-mux-lifecycle-live.ts

@@ -108,7 +108,7 @@ const BRIDGE_LAUNCHER = path.join(REPO, "mcp", "entwurf-bridge", "start.sh");
 
 /** The two pi shapes. They differ in exactly one thing that matters here — whether the record
  * carries `provider=entwurf`, which is what makes the resume argv re-inject the bridge (#29). */
-const PI_NATIVE_MODEL = "openai-codex/gpt-5.6-terra";
+const PI_NATIVE_MODEL = "openai-codex/gpt-5.6-luna";
 const PI_ACP_MODEL = "entwurf/claude-sonnet-5";
 const CLAUDE_MODEL = "claude-sonnet-5";
 
@@ -557,7 +557,9 @@ async function main(): Promise<void> {
 			return sender;
 		}
 
-		/** One private tmux server per CELL, plus the client env that anchors into it. */
+		/** One private tmux server per CELL, plus the client env that anchors into it.
+		 * Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
+		 * and is not a release MUST — do not widen this type (VERIFY.md). */
 		function startPrivateServer(
 			cell: string,
 			backend: "pi" | "claude-code",

package/scripts/smoke-pi-provider-state.sh

@@ -31,6 +31,14 @@ REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
 
 SB="$(mktemp -d)"
 trap 'rm -rf "$SB"' EXIT
+# This smoke drives register-pi-provider.py, which imports the sibling pi_settings_io module — and
+# CPython writes scripts/__pycache__/*.pyc for that import, INSIDE the checkout. The purity cell
+# below never caught it because those bytes are gitignored, so `git status --porcelain` stays clean
+# while the working tree is not. That difference is invisible here and load-bearing under gate
+# qualification, whose snapshot judges tree cleanliness rather than porcelain output. Write no
+# bytecode instead of cleaning it up afterwards: a smoke that leaves artifacts and then sweeps them
+# is one early `exit` away from leaving them for real.
+export PYTHONDONTWRITEBYTECODE=1
 export HOME="$SB/home"
 export XDG_DATA_HOME="$SB/xdg"
 GLOBAL="$SB/global.json"
@@ -46,8 +54,52 @@ LEGACY_CMD="$FAKE_REPO/mcp/entwurf-bridge/start.sh"
 # authoritative: drop EVERY original PATH dir that carries a real entwurf-bridge. A maintainer
 # can have both the managed dev link and the registry package shim; filtering only command -v's
 # first hit lets the second one mask the dangling-command cell.
-printf '#!/usr/bin/env bash\necho fake-bridge\n' > "$SB/bin/entwurf-bridge"
-chmod +x "$SB/bin/entwurf-bridge"
+#
+# #81: the doctor no longer stops at resolvability — it BOOTS the effective command and requires
+# the entwurf MCP tool surface back. So the healthy fake must actually speak MCP: answer the
+# `tools/list` frame (id 2) with a tools array carrying entwurf_v2. A fake that only echoed a word
+# would now (correctly) read as "resolves but does not serve MCP", which is the NEGATIVE cell
+# below — keeping the two fakes distinct is what makes this an A/B rather than a rename.
+write_mcp_fake() {   # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+# minimal MCP stdio server: enough frames for the boot probe, nothing else.
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+# A launcher that RESOLVES and dies on exec — the shape of a relocated package-manager shim whose
+# $0-derived target is gone (observed: exit 127 with a "No such file or directory" on stderr).
+write_dead_fake() {  # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+echo "bash: /nonexistent/../global/v11/deadbeef/node_modules/@junghanacs/entwurf/mcp/entwurf-bridge/start.sh: No such file or directory" >&2
+exit 127
+FAKE
+  chmod +x "$1"
+}
+# A launcher that boots and speaks MCP but is NOT this bridge: it serves entwurf_v2 while missing
+# entwurf_self. This is the shape of the observed #81 session (its schema had no entwurf_self) and
+# of a stale build or a foreign binary that happens to own the name — a probe keyed on one tool
+# would call it healthy, which is why identity is the exact verb SET.
+write_stale_fake() {  # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"stale-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_mcp_fake "$SB/bin/entwurf-bridge"
 _clean_path=""
 while IFS= read -r _dir; do
   [ -n "$_dir" ] || continue
@@ -136,14 +188,91 @@ printf '{}\n' > "$PROJECT"; rm -f "$STATE"
 OUT="$(doctor)"; RC=$?
 want "doctor(user-only bare): exits 0" "[ '$RC' -eq 0 ]"
 want "doctor(user-only bare): ok — bare bin resolves" "printf '%s' \"\$OUT\" | grep -q 'bare stable bin'"
+# The green must be about BOOTING, not about resolving — anchored on the verdict word so a doctor
+# that regressed to the resolvability-only ok cannot keep this cell green.
+want "doctor(user-only bare): green says the bin BOOTS (#81), not merely resolves" "printf '%s' \"\$OUT\" | grep -q 'and it BOOTS'"
+
+# ── H-merge: the doctor normalizes what PRODUCTION normalizes, not what each FILE holds ──
+# resolveProviderConfig merges the two mcpServers maps per-name and normalizes the RESULT once. A
+# doctor that normalized each file separately would validate entries production never sees: a
+# malformed global entry the project map shadows is gone before pi ever looks, yet the per-file
+# doctor throws and calls a healthy session red. Both directions are pinned here.
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":123}}}}, open(sys.argv[1],"w"))' "$GLOBAL"
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$PROJECT"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "doctor(invalid global SHADOWED by valid project): green — production never sees the bad entry" "[ '$RC' -eq 0 ]"
+want "doctor(invalid global shadowed): EFFECTIVE scope is project" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+# An unrelated malformed server in the global map is likewise production's problem only if it
+# survives the merge — here the project map does not shadow it, so it MUST stay red.
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"},"other":{"command":[]}}}}, open(sys.argv[1],"w"))' "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(unshadowed malformed sibling): should FAIL — the merged map is what production normalizes"; fi
+ok "doctor(unshadowed malformed sibling): FAILS — an invalid entry that SURVIVES the merge is red"
+# The effective entry itself malformed → red regardless of which scope wrote it.
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":123}}}}, open(sys.argv[1],"w"))' "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(effective malformed): should FAIL"; fi
+ok "doctor(effective malformed in project): FAILS — shadowing cannot rescue the EFFECTIVE entry"
+# restore the H-1 baseline for the cells below
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+
+# ── H-boot: #81 A/B — a bare bin that RESOLVES but does not serve MCP ─────────
+# This is the whole defect in one cell: before #81 the doctor printed ok here, and a host in this
+# exact state ran Pi ACP turns with NO mcp__entwurf-bridge__* tool at all. PATH/HOME/XDG are the
+# sandbox's, so the operator's real launcher is never touched by this A/B.
+write_dead_fake "$SB/bin/entwurf-bridge"
+# `set -e` is on: a doctor that (correctly) exits non-zero here would kill the smoke before it could
+# judge the failure. Fence just the drive, never the assertions — a silently swallowed rc is how a
+# negative cell turns into decoration.
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "[QK:PI-DOCTOR-BOOT-NEGATIVE] doctor(bare resolves, does not boot): FAILS instead of printing ok" "[ '$RC' -ne 0 ]"
+want "doctor(bare resolves, does not boot): names the boot failure reason" "printf '%s' \"\$OUT\" | grep -q 'does NOT serve MCP \[exited-before-tools-list\]'"
+want "doctor(bare resolves, does not boot): carries the launcher's own stderr" "printf '%s' \"\$OUT\" | grep -q 'No such file or directory'"
+# Remediation must NOT be a fix-all: entwurf may not clobber a launcher it does not own, so the
+# foreign case has to be named as the operator's repair.
+want "doctor(bare resolves, does not boot): refuses to clobber a foreign launcher" "printf '%s' \"\$OUT\" | grep -q 'will not overwrite'"
+want "doctor(bare resolves, does not boot): still distinguishes 'resolves' from 'boots'" "printf '%s' \"\$OUT\" | grep -q 'RESOLVES — probing'"
+# A bridge that BOOTS and speaks MCP but is not this one — the #81 symptom exactly.
+write_stale_fake "$SB/bin/entwurf-bridge"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "doctor(boots, wrong verb set): FAILS — booting an MCP server is not being THIS bridge" "[ '$RC' -ne 0 ]"
+want "doctor(boots, wrong verb set): names the missing verb (#81 symptom was entwurf_self)" "printf '%s' \"\$OUT\" | grep -q 'missing entwurf_self'"
+want "doctor(boots, wrong verb set): reason is the tool-set mismatch, not a boot failure" "printf '%s' \"\$OUT\" | grep -q 'tool-set-mismatch'"
 
-# H-2: project STALE (user bare, project legacy) → effective=project=legacy note (green-runtime-red guard)
+write_mcp_fake "$SB/bin/entwurf-bridge"
+OUT="$(doctor)"; RC=$?
+want "doctor(after repair): the SAME unchanged doctor goes green once the launcher boots" "[ '$RC' -eq 0 ]"
+want "doctor(after repair): green names the exact verb set as the evidence" "printf '%s' \"\$OUT\" | grep -q 'exact entwurf verb set'"
+
+# The review A/B: an unowned/non-bare override shadows the healthy user bridge in production.
+# Ownership remains the operator's, but runtime truth cannot become a green note merely because
+# entwurf will not overwrite it. Keep this QK cell before the healthy legacy override: a mutant
+# that skips all non-bare runtime probes must be attributed to THIS failure, not the later positive.
+write_dead_fake "$SB/bin/dead-override"
 printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2],"args":[]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$SB/bin/dead-override"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "[QK:PI-DOCTOR-PROBES-OVERRIDE] doctor(dead unowned override): FAILS runtime independently of ownership" "[ '$RC' -ne 0 ]"
+want "doctor(dead unowned override): names the exact invocation failure" "printf '%s' \"\$OUT\" | grep -q 'effective invocation does NOT serve MCP'"
+
+# H-2: project legacy override still gets an independent runtime verdict before its ownership note.
+mkdir -p "$(dirname "$LEGACY_CMD")"
+write_mcp_fake "$LEGACY_CMD"
 python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
 OUT="$(doctor)"; RC=$?
-want "doctor(project-stale): exits 0 (honest note, not a crash)" "[ '$RC' -eq 0 ]"
-want "doctor(project-stale): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
-want "doctor(project-stale): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
+want "doctor(project-legacy): exits 0 when the exact override boots" "[ '$RC' -eq 0 ]"
+want "doctor(project-legacy): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+want "doctor(project-legacy): runtime BOOTS before the ownership note" "printf '%s' \"\$OUT\" | grep -q 'configured override BOOTS'"
+want "doctor(project-legacy): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
 
 # H-3: state-owned DRIFT → FAIL (state says managed but effective is foreign)
 printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/foreign/thing"}}}}\n' > "$GLOBAL"

package/scripts/smoke-resident-garden-guard.sh

@@ -70,7 +70,7 @@ fi
 SESSIONS_BASE="$RGG_AGENT_DIR/sessions"
 cleanup() { rm -rf "$RGG_AGENT_DIR"; }
 trap cleanup EXIT
-# Default target stays pi-native (openai-codex/gpt-5.4), but honor the SAME target
+# Default target stays pi-native (openai-codex/gpt-5.6-luna), but honor the SAME target
 # knob as the other live smokes: ENTWURF_LIVE_TARGET="<provider>/<model>". On
 # acp-on-v2 the ACP `entwurf` provider is back, and `./run.sh smoke-acp-rgg-live`
 # drives THIS runner against it (deterministic half) — the citizen logic (record +
@@ -83,7 +83,7 @@ if [ -n "${ENTWURF_LIVE_TARGET:-}" ]; then
 	esac
 else
 	_rgg_provider="${ENTWURF_LIVE_PROVIDER:-openai-codex}"
-	_rgg_model="${ENTWURF_LIVE_MODEL:-gpt-5.4}"
+	_rgg_model="${ENTWURF_LIVE_MODEL:-gpt-5.6-luna}"
 fi
 PROVIDER="${SMOKE_RGG_PROVIDER:-$_rgg_provider}"
 MODEL="${SMOKE_RGG_MODEL:-$_rgg_model}"

package/scripts/tsconfig.json

@@ -30,6 +30,7 @@
 		"../pi-extensions/lib/**/*.ts",
 		"../pi-extensions/model-lock.ts",
 		"../pi-extensions/meta-bridge-hook.ts",
+		"../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../mcp/entwurf-bridge/src/resume-mode.ts"
 	]
 }