@junghanacs/entwurf 0.14.2 → 0.15.0

package/scripts/copilot-statusline-config.py

@@ -0,0 +1,201 @@
+#!/usr/bin/env python3
+"""Stateful Copilot statusLine settings adapter; stdlib only.
+
+Owns the whole ``statusLine`` subtree and the one prerequisite leaf
+``footer.showCustom``.  It adopts regular settings.json files, refuses symlinks,
+and records first-install preimages for an honest inverse.
+"""
+
+import datetime
+import json
+import os
+import sys
+import tempfile
+
+STATE_SCHEMA_VERSION = 1
+STATUSLINE_KEY = "statusLine"
+FOOTER_KEY = "footer"
+SHOW_CUSTOM_KEY = "showCustom"
+
+
+def die(code: int, message: str) -> "None":
+    sys.stderr.write(message.rstrip("\n") + "\n")
+    raise SystemExit(code)
+
+
+def load_object(path: str, label: str) -> dict:
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            raw = handle.read()
+    except OSError as error:
+        die(4, f"copilot-statusline: cannot read {label} {path}: {error}")
+    if not raw.strip():
+        return {}
+    try:
+        value = json.loads(raw)
+    except json.JSONDecodeError as error:
+        die(4, f"copilot-statusline: {label} {path} is not valid JSON: {error}")
+    if not isinstance(value, dict):
+        die(4, f"copilot-statusline: {label} {path} top-level must be a JSON object")
+    return value
+
+
+def atomic_write(path: str, value: dict) -> None:
+    directory = os.path.dirname(os.path.abspath(path))
+    os.makedirs(directory, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(dir=directory, prefix=".copilot-statusline-", suffix=".json")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(value, handle, indent=2)
+            handle.write("\n")
+        os.replace(temporary, path)
+    except BaseException:
+        try:
+            os.unlink(temporary)
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def now() -> str:
+    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def checked_state(state_path: str) -> dict:
+    state = load_object(state_path, "install-state")
+    required = (
+        "managedSettingsPath",
+        "settingsExistedBefore",
+        "statusLineExisted",
+        "statusLinePreimage",
+        "footerExisted",
+        "showCustomExisted",
+        "showCustomPreimage",
+    )
+    if state.get("schemaVersion") != STATE_SCHEMA_VERSION or any(key not in state for key in required):
+        die(4, f"copilot-statusline: install-state {state_path} has an unsupported shape")
+    return state
+
+
+def prior_state(state_path: str, settings_path: str) -> dict | None:
+    if not os.path.exists(state_path):
+        return None
+    state = checked_state(state_path)
+    return state if state["managedSettingsPath"] == os.path.abspath(settings_path) else None
+
+
+def install(settings_path: str, command: str, state_path: str) -> None:
+    if os.path.islink(settings_path):
+        die(3, f"copilot-statusline: refusing to adopt {settings_path} — symlink to {os.readlink(settings_path)} (someone else's SSOT)")
+
+    existed = os.path.exists(settings_path)
+    settings = load_object(settings_path, "settings") if existed else {}
+    footer_existed = FOOTER_KEY in settings
+    footer = settings.get(FOOTER_KEY) if footer_existed else {}
+    if not isinstance(footer, dict):
+        die(4, f"copilot-statusline: {settings_path} footer must be a JSON object")
+
+    prior = prior_state(state_path, settings_path)
+    if prior is None:
+        state = {
+            "schemaVersion": STATE_SCHEMA_VERSION,
+            "managedSettingsPath": os.path.abspath(settings_path),
+            "command": command,
+            "detectMode": "adopt-regular-file" if existed else "created-new",
+            "settingsExistedBefore": existed,
+            "statusLineExisted": STATUSLINE_KEY in settings,
+            "statusLinePreimage": settings.get(STATUSLINE_KEY),
+            "footerExisted": footer_existed,
+            "showCustomExisted": SHOW_CUSTOM_KEY in footer,
+            "showCustomPreimage": footer.get(SHOW_CUSTOM_KEY),
+            "installedAt": now(),
+        }
+    else:
+        state = prior
+
+    settings[STATUSLINE_KEY] = {"command": command}
+    footer[SHOW_CUSTOM_KEY] = True
+    settings[FOOTER_KEY] = footer
+    atomic_write(settings_path, settings)
+    atomic_write(state_path, state)
+    sys.stdout.write(f"{state['detectMode']} {os.path.abspath(settings_path)}\n")
+
+
+def uninstall(state_path: str) -> None:
+    if not os.path.exists(state_path):
+        die(2, f"copilot-statusline: no install-state at {state_path} — nothing to undo")
+    state = checked_state(state_path)
+    settings_path = state.get("managedSettingsPath")
+    if not isinstance(settings_path, str) or not os.path.isabs(settings_path):
+        die(4, f"copilot-statusline: install-state {state_path} has no absolute managedSettingsPath")
+    if os.path.islink(settings_path):
+        die(3, f"copilot-statusline: refusing to uninstall — {settings_path} became a symlink (someone else's SSOT)")
+
+    if os.path.exists(settings_path):
+        settings = load_object(settings_path, "settings")
+        if state.get("statusLineExisted"):
+            settings[STATUSLINE_KEY] = state.get("statusLinePreimage")
+        else:
+            settings.pop(STATUSLINE_KEY, None)
+
+        footer = settings.get(FOOTER_KEY)
+        if not isinstance(footer, dict):
+            die(4, f"copilot-statusline: {settings_path} footer changed to a non-object; refusing to guess")
+        if state.get("showCustomExisted"):
+            footer[SHOW_CUSTOM_KEY] = state.get("showCustomPreimage")
+        else:
+            footer.pop(SHOW_CUSTOM_KEY, None)
+        if footer or state.get("footerExisted"):
+            settings[FOOTER_KEY] = footer
+        else:
+            settings.pop(FOOTER_KEY, None)
+
+        created = state.get("detectMode") == "created-new" and state.get("settingsExistedBefore") is False
+        if created and not settings:
+            os.remove(settings_path)
+        else:
+            atomic_write(settings_path, settings)
+
+    os.remove(state_path)
+    sys.stdout.write(f"uninstalled {settings_path}\n")
+
+
+def doctor_static(settings_path: str, command: str) -> None:
+    if os.path.islink(settings_path):
+        sys.stdout.write("symlink\n")
+        return
+    if not os.path.exists(settings_path):
+        sys.stdout.write("file-absent\n")
+        return
+    try:
+        settings = load_object(settings_path, "settings")
+    except SystemExit:
+        sys.stdout.write("invalid-json\n")
+        return
+    status_line = settings.get(STATUSLINE_KEY)
+    if not isinstance(status_line, dict) or status_line.get("command") != command:
+        sys.stdout.write("not-ours\n")
+        return
+    footer = settings.get(FOOTER_KEY)
+    if not isinstance(footer, dict) or footer.get(SHOW_CUSTOM_KEY) is not True:
+        sys.stdout.write("custom-disabled\n")
+        return
+    sys.stdout.write(f"configured {command}\n")
+
+
+def main(argv: list[str]) -> None:
+    if len(argv) < 2:
+        die(5, "usage: copilot-statusline-config.py <install|uninstall|doctor-static> ...")
+    match argv[1]:
+        case "install" if len(argv) == 5:
+            install(argv[2], argv[3], argv[4])
+        case "uninstall" if len(argv) == 3:
+            uninstall(argv[2])
+        case "doctor-static" if len(argv) == 4:
+            doctor_static(argv[2], argv[3])
+        case _:
+            die(5, "usage: copilot-statusline-config.py <install settings command state|uninstall state|doctor-static settings command>")
+
+
+if __name__ == "__main__":
+    main(sys.argv)

package/scripts/copilot-statusline.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# copilot-statusline — Copilot custom footer: garden id only.
+#
+# Copilot already draws directory/branch/model/context/quota. This fills the
+# custom slot with the garden id. Vocabulary matches Claude and agy
+# (ready / ? / !); rail `cop`. Fail-quiet: nonzero blanks the slot (bundle Fxi).
+# Bare bin: entwurf-copilot-statusline. No cache, no git, no ANSI.
+# Reads session_id only — any other envelope key is Copilot's, not ours.
+set -euo pipefail
+
+# Copilot silently blanks a nonzero statusline, so a read failure degrades to ready.
+input=$(cat || true)
+if ! command -v python3 >/dev/null 2>&1; then
+  printf '🪛 ? cop'
+  exit 0
+fi
+output="$(STATUSLINE_INPUT="$input" python3 - <<'PY'
+import json, os, sys
+from pathlib import Path
+
+def load_input():
+    raw = os.environ.get("STATUSLINE_INPUT", "")
+    try:
+        data = json.loads(raw) if raw.strip() else {}
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+def meta_sessions_dir():
+    override = os.environ.get("ENTWURF_META_SESSIONS_DIR")
+    if override:
+        return Path(override).expanduser().resolve()
+    agent = os.environ.get("PI_CODING_AGENT_DIR")
+    if agent:
+        return Path(agent).expanduser().resolve() / "meta-sessions"
+    return Path.home() / ".pi" / "agent" / "meta-sessions"
+
+def garden_lookup(native_session_id):
+    if not native_session_id:
+        return "ready"
+    root = meta_sessions_dir()
+    if not root.exists():
+        return "?"
+    matches = []
+    try:
+        entries = sorted(root.glob("*.meta.json"))
+    except Exception:
+        return "?"
+    for file in entries:
+        try:
+            record = json.loads(file.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+        if isinstance(record, dict) and record.get("nativeSessionId") == native_session_id:
+            garden = record.get("gardenId")
+            matches.append(garden if isinstance(garden, str) and garden else "!")
+    if len(matches) == 1:
+        return matches[0]
+    if len(matches) > 1:
+        return "!"
+    return "?"
+
+data = load_input()
+sid = data.get("session_id")
+sys.stdout.write(f"🪛 {garden_lookup(sid if isinstance(sid, str) else '')} cop")
+PY
+)" || output='🪛 ? cop'
+printf '%s' "$output"

package/scripts/dev-bin.sh

@@ -12,6 +12,7 @@
 #   entwurf-bridge          -> mcp/entwurf-bridge/start.sh    (agy mcp_config command)
 #   entwurf-agy-statusline  -> scripts/agy-statusline.sh      (agy settings.statusLine command)
 #   entwurf-agy-imprint     -> scripts/agy-imprint.sh         (agy PreInvocation birth hook)
+#   entwurf-copilot-statusline -> scripts/copilot-statusline.sh (copilot settings.statusLine command)
 #
 # Ownership discipline (mirrors the agy adopt/refuse rule, 봉인 7), applied PER BIN:
 #   - create/refresh ONLY a link that is OURS — absent, or a symlink into our target, or the
@@ -35,6 +36,7 @@
 #   ENTWURF_BRIDGE_TARGET         entwurf-bridge target (default: $REPO/mcp/entwurf-bridge/start.sh)
 #   ENTWURF_AGY_STATUSLINE_TARGET entwurf-agy-statusline target (default: $REPO/scripts/agy-statusline.sh)
 #   ENTWURF_AGY_IMPRINT_TARGET    entwurf-agy-imprint target (default: $REPO/scripts/agy-imprint.sh)
+#   ENTWURF_COPILOT_STATUSLINE_TARGET entwurf-copilot-statusline target (default: $REPO/scripts/copilot-statusline.sh)
 #   XDG_DATA_HOME                 state root (states under $XDG_DATA_HOME/entwurf/dev-bin/)
 set -euo pipefail
 
@@ -45,7 +47,7 @@ BIN_DIR="${ENTWURF_DEV_BIN_DIR:-$HOME/.local/bin}"
 STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/dev-bin"
 LEGACY_STATE="$STATE_DIR/install-state.json"   # pre-multi-bin single state == entwurf-bridge
 
-MANAGED_BINS="entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint"
+MANAGED_BINS="entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
 
 log()  { printf '%s\n' "$*"; }
 warn() { printf '%s\n' "$*" >&2; }
@@ -56,6 +58,7 @@ bin_target() {  # $1 = name → prints target path (env-overridable for smoke)
     entwurf-bridge)         echo "${ENTWURF_BRIDGE_TARGET:-$REPO_DIR/mcp/entwurf-bridge/start.sh}" ;;
     entwurf-agy-statusline) echo "${ENTWURF_AGY_STATUSLINE_TARGET:-$REPO_DIR/scripts/agy-statusline.sh}" ;;
     entwurf-agy-imprint)    echo "${ENTWURF_AGY_IMPRINT_TARGET:-$REPO_DIR/scripts/agy-imprint.sh}" ;;
+    entwurf-copilot-statusline) echo "${ENTWURF_COPILOT_STATUSLINE_TARGET:-$REPO_DIR/scripts/copilot-statusline.sh}" ;;
     *) return 1 ;;
   esac
 }

package/scripts/meta-bridge-hook-log.sh

@@ -4,20 +4,32 @@
 # proves the Claude SessionStart/CwdChanged hook re-armed the mailbox watch. A
 # later `INFO attach record (event=UserPromptSubmit, ...)` is merely degraded
 # backfill and must NOT clear an arm/upsert failure.
-
+#
+# THIS JUDGEMENT IS CLAUDE'S ONLY, and since #82 it has to say so. The Copilot birth
+# unit appends to the SAME log file (one grep for the operator), tagging its lines
+# `LEVEL [copilot]`. Those lines must be invisible here, for a reason stronger than
+# tidiness: a copilot ERROR is often a CORRECT fail-closed refusal (a degraded envelope
+# the unit refused to mint from), and its recovery token can never appear — `armed
+# watch` is the Claude hook rail's token. Copilot's measured extension transport has a
+# different, not-yet-admitted lifecycle and writes no token this doctor owns. Counting them
+# would make the CLAUDE doctor permanently red for a refusal on a different rail, with
+# a prescription pointing at a Claude wake failure that never happened (cross-review,
+# glm, 2026-08-21). Copilot's own recovery rule lives in copilot-bridge-doctor.sh.
 meta_bridge_hook_log_status() {
   local log="$1"
-  if ! grep -q ' ERROR ' "$log" 2>/dev/null; then
+  local own
+  own="$(grep -v ' \[copilot\] ' "$log" 2>/dev/null || true)"
+  if ! printf '%s\n' "$own" | grep -q ' ERROR '; then
     echo "no-error"
     return 0
   fi
 
   local last_err last_recovery
-  last_err="$(grep -n ' ERROR ' "$log" | tail -1 | cut -d: -f1)"
-  last_recovery="$(grep -n ' INFO armed watch ' "$log" | tail -1 | cut -d: -f1)"
+  last_err="$(printf '%s\n' "$own" | grep -n ' ERROR ' | tail -1 | cut -d: -f1)"
+  last_recovery="$(printf '%s\n' "$own" | grep -n ' INFO armed watch ' | tail -1 | cut -d: -f1)"
 
   if [ -z "$last_recovery" ] || [ "$last_err" -gt "$last_recovery" ]; then
-    grep ' ERROR ' "$log" | tail -1
+    printf '%s\n' "$own" | grep ' ERROR ' | tail -1
     return 1
   fi
 

package/scripts/mutants/capability-cache.json

@@ -0,0 +1,64 @@
+{
+	"schemaVersion": 1,
+	"lane": "capability-cache",
+	"mutants": [
+		{
+			"claim": "CAPABILITY-REGISTRY-REREAD-SEES-REPLACEMENT",
+			"title": "memoizing the capability registry into a process-lifetime singleton makes every already-running dispatcher answer out of the registry it booted with — an install that moves a grade or wakeMode is invisible until the operator restarts, and nothing says so",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"export function loadMetaCapabilityRegistry(): MetaCapabilityRegistry {",
+				"\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));",
+				"}"
+			],
+			"replace": [
+				"let cachedMetaCapabilities: MetaCapabilityRegistry | null = null;",
+				"export function loadMetaCapabilityRegistry(): MetaCapabilityRegistry {",
+				"\tif (cachedMetaCapabilities === null) {",
+				"\t\tcachedMetaCapabilities = parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));",
+				"\t}",
+				"\treturn cachedMetaCapabilities;",
+				"}"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-REREAD-SEES-REPLACEMENT]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		},
+		{
+			"claim": "CAPABILITY-REGISTRY-MISSING-STILL-THROWS",
+			"title": "answering a missing registry with a built-in default turns a broken install into a citizen that silently claims capabilities nobody shipped",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));"],
+			"replace": [
+				"\tconst registryPath = metaCapabilitiesFilePath();",
+				"\tif (!fs.existsSync(registryPath)) {",
+				"\t\treturn { schemaVersion: CAPABILITY_SCHEMA_VERSION, backends: {} } as unknown as MetaCapabilityRegistry;",
+				"\t}",
+				"\treturn parseMetaCapabilityRegistry(fs.readFileSync(registryPath, \"utf8\"));"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-MISSING-STILL-THROWS]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		},
+		{
+			"claim": "CAPABILITY-REGISTRY-CORRUPT-STILL-THROWS",
+			"title": "swallowing a parse failure and returning a fallback lets a half-written or hand-edited registry read as a valid one, so the strict parser stops being load-bearing",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\treturn parseMetaCapabilityRegistry(fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\"));"],
+			"replace": [
+				"\tconst rawRegistry = fs.readFileSync(metaCapabilitiesFilePath(), \"utf8\");",
+				"\ttry {",
+				"\t\treturn parseMetaCapabilityRegistry(rawRegistry);",
+				"\t} catch {",
+				"\t\treturn { schemaVersion: CAPABILITY_SCHEMA_VERSION, backends: {} } as unknown as MetaCapabilityRegistry;",
+				"\t}"
+			],
+			"gate": ["bash", "run.sh", "check-meta-capability-source"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-REGISTRY-CORRUPT-STILL-THROWS]",
+			"signatureSource": "scripts/check-meta-capability-source.ts"
+		}
+	]
+}

package/scripts/mutants/copilot-birth.json

@@ -0,0 +1,155 @@
+{
+	"schemaVersion": 1,
+	"lane": "copilot-birth",
+	"mutants": [
+		{
+			"claim": "COPILOT-BIRTH-NO-ARGV-LAUNCH",
+			"title": "reusing the Claude no-argv refusal in the Copilot launcher kills every Copilot birth (this is the exact defect that held copilot at 0 of 409 records)",
+			"subject": "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+			"find": ["exec \"$NODE_BIN\" \"$HOOK_ENTRY\""],
+			"replace": [
+				"if [ \"$#\" -eq 0 ]; then",
+				"\techo 'entwurf meta-bridge: this hook was launched with NO arguments.' >&2",
+				"\texit 1",
+				"fi",
+				"exec \"$NODE_BIN\" \"$HOOK_ENTRY\""
+			],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-NO-ARGV-LAUNCH]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-MINTS-COPILOT",
+			"title": "minting a Copilot session under the claude-code backend gives it a citizenship it cannot own and hides the Copilot lane's own count",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\t\tinput: { backend: \"copilot\", nativeSessionId: envelope.sessionId, cwd: envelope.cwd },"],
+			"replace": ["\t\t\tinput: { backend: \"claude-code\", nativeSessionId: envelope.sessionId, cwd: envelope.cwd },"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-MINTS-COPILOT]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-ID-DISAGREEMENT",
+			"title": "preferring one id when the two envelope keys disagree mints a citizen no live session can be joined back to",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": [
+				"\tif (native && compat && native !== compat) {",
+				"\t\treturn { refusal: `sessionId and session_id disagree (${native} vs ${compat})` };",
+				"\t}"
+			],
+			"replace": ["\t// disagreement tolerated: the native key simply wins"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-ID-DISAGREEMENT]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-EXEC-IS-STRING",
+			"title": "declaring the Copilot hook in Claude's array form is rejected at plugin load, before any prompt — the plugin never runs at all",
+			"subject": "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json",
+			"find": ["\t\t\"sessionStart\": [{ \"exec\": \"__COPILOT_LAUNCHER__\" }],"],
+			"replace": ["\t\t\"sessionStart\": [{ \"exec\": [\"__COPILOT_LAUNCHER__\"] }],"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-EXEC-IS-STRING]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "CAPABILITY-DRIFT-SCOPE-FROM-CONST",
+			"title": "a literal lane list in the capability drift guard lets any new backend's descriptor ship without ever being compared — the hole #82 found and closed",
+			"subject": "scripts/check-entwurf-capabilities.ts",
+			"find": ["const driftScope: readonly MetaBackend[] = META_BACKENDS;"],
+			"replace": ["const driftScope: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"codex\"];"],
+			"gate": ["bash", "run.sh", "check-entwurf-capabilities"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CAPABILITY-DRIFT-SCOPE-FROM-CONST]",
+			"signatureSource": "scripts/check-entwurf-capabilities.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-QUALIFIED-STALE",
+			"title": "a BARE stale-unit name reaches a same-named plugin from somebody else's marketplace and uninstalls it",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": ["STALE_CLAUDE_UNIT=\"entwurf-meta-receive@meta-bridge-local\""],
+			"replace": ["STALE_CLAUDE_UNIT=\"entwurf-meta-receive\""],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-QUALIFIED-STALE]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-UNINSTALL-FAILURE-IS-FATAL",
+			"title": "swallowing a failed stale-unit uninstall installs on top of a unit that is still firing and reports success",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": [
+				"      copilot plugin uninstall \"$STALE_CLAUDE_UNIT\" >/dev/null \\",
+				"        || die \"the stale Claude unit '$STALE_CLAUDE_UNIT' is installed in Copilot but could not be removed. It fires on every prompt and exits 1 before node starts, so installing on top of it would leave that noise in place. Fix the Copilot CLI error above, or re-run with --keep-stale-claude-unit to proceed deliberately.\""
+			],
+			"replace": ["      copilot plugin uninstall \"$STALE_CLAUDE_UNIT\" >/dev/null 2>&1 || true"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-UNINSTALL-FAILURE-IS-FATAL]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "HOOK-LOG-RAIL-SCOPED",
+			"title": "an untagged ERROR grep lets a Copilot fail-closed refusal redden the CLAUDE doctor forever — copilot's recovery token cannot exist on that rail",
+			"subject": "scripts/meta-bridge-hook-log.sh",
+			"find": ["  own=\"$(grep -v ' \\[copilot\\] ' \"$log\" 2>/dev/null || true)\""],
+			"replace": ["  own=\"$(cat \"$log\" 2>/dev/null || true)\""],
+			"gate": ["bash", "run.sh", "check-meta-doctor-oracle"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:HOOK-LOG-RAIL-SCOPED]",
+			"signatureSource": "scripts/check-meta-doctor-oracle.sh"
+		},
+		{
+			"claim": "COPILOT-BIRTH-DOES-NOT-ARM-RECEIVER",
+			"title": "arming a mailbox from the BIRTH hook claims a watch this process does not hold. Copilot now has a doorbell (#82 RAIL 5), which is exactly why the writer matters: the extension owns the watch, so a marker minted here would name the host pid as a watcher and keep a wired-to-nothing citizen deliverable for as long as the TUI stayed open",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\tlogLine(\n\t\t\t\"INFO\","],
+			"replace": [
+				"\t\tfs.mkdirSync(path.join(path.dirname(defaultMetaSessionsDir()), \"meta-mailbox\", result.record.gardenId), { recursive: true });\n\t\tlogLine(\n\t\t\t\"INFO\","
+			],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-DOES-NOT-ARM-RECEIVER]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-BIRTH-WRITES-SENDER-MARKER",
+			"title": "dropping the sender-marker write leaves the reader open and the writer closed — the citizen calls entwurf_v2, the bridge holds its owner pid, finds no marker, and the send is refused as anonymous with nothing in any log naming the cause (the #46 defect, re-planted on the copilot rail)",
+			"subject": "pi-extensions/meta-bridge-hook-copilot.ts",
+			"find": ["\t\twriteCopilotSenderMarker(result.record.gardenId, envelope);"],
+			"replace": ["\t\t// sender marker skipped"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-BIRTH-WRITES-SENDER-MARKER]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-SENDER-READER-OPEN",
+			"title": "closing the reader half leaves the writer talking to nobody — the hook writes a copilot marker, the bridge never looks in that directory, and the citizen's sends are refused as anonymous (the #46 shape, which is why writer and reader open in one change)",
+			"subject": "pi-extensions/lib/meta-sender-identity.ts",
+			"find": [
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\"];"
+			],
+			"replace": ["export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\"];"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-SENDER-READER-OPEN]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		},
+		{
+			"claim": "COPILOT-INSTALL-LIST-FAILURE-IS-FATAL",
+			"title": "reading a failed `copilot plugin list` as an empty host installs on top of a stale unit that is still firing",
+			"subject": "scripts/copilot-bridge-install.sh",
+			"find": ["  if ! INSTALLED_LIST=\"$(copilot plugin list 2>/dev/null)\"; then"],
+			"replace": ["  INSTALLED_LIST=\"$(copilot plugin list 2>/dev/null || true)\"", "  if false; then"],
+			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-INSTALL-LIST-FAILURE-IS-FATAL]",
+			"signatureSource": "scripts/check-copilot-birth-hook.ts"
+		}
+	]
+}