@junghanacs/entwurf 0.14.2 → 0.15.0

package/scripts/mutants/mux-fresh-call.json

@@ -147,7 +147,7 @@
 			"title": "native pi drops the required model field from fresh-call while the composition still expects one",
 			"subject": "pi-extensions/entwurf-control.ts",
 			"find": [
-				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription: \"Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias.\",\n\t\t\t}),\n"
+				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t}),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -173,7 +173,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\"Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias.\"),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -224,6 +224,220 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:VITEST-FAILED-TITLE-ATTRIBUTION]",
 			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-MANAGED-RUNTIME",
+			"title": "fresh call opens the BARE vendor instead of entwurf's managed invocation — the window opens, the EXTENSIONS scan is skipped silently, and the sibling can never be delivered to",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tcopilot: \"entwurf\","],
+			"replace": ["\tcopilot: \"copilot\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-MANAGED-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-ARGV-INTERACTIVE",
+			"title": "the Copilot prompt rides -p instead of --interactive — the turn runs and the CLI EXITS, closing the window on a sibling that was supposed to stay open",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"-p\", prompt, \"--model\", model, \"--yolo\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-ARGV-INTERACTIVE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-MODEL-ARGV",
+			"title": "the Copilot argv drops the explicit model — the managed launcher then injects `--model auto` and the caller's model choice is silently discarded",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--yolo\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-MODEL-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-YOLO-POLICY",
+			"title": "the policy token narrows back to the callback-only --allow-tool grant — the exact regression GLG measured on 2026-08-25: no YOLO in the footer, a confirmation prompt at every task tool, an impractical sibling",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": [
+				"\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--allow-tool=entwurf-bridge(entwurf_v2)\"];"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-YOLO-POLICY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-CALLBACK-TOOL",
+			"title": "the Copilot callback names Claude Code's `mcp__server__tool` spelling — a dialect copied instead of measured, and the whole first turn is spent looking for a tool that is not there",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tcopilot: \"entwurf-bridge-entwurf_v2\","],
+			"replace": ["\tcopilot: \"mcp__entwurf-bridge__entwurf_v2\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-CALLBACK-TOOL]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-PREFLIGHT-PREMUTATION",
+			"title": "the capability preflight is removed — a host missing the birth, MCP, receiver or footer unit gets a real window and a launch receipt for a sibling that can never call home",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": [
+				"\tif (params.backend === \"copilot\") {\n\t\tconst missing = copilotFreshPreflight(env);\n\t\tif (missing) return { ok: false, reason: missing };\n\t}\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-PREFLIGHT-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-PREFLIGHT-AFTER-RUNTIME",
+			"title": "the preflight runs before the runtime is proven — an operator with no entwurf at all is told to install a Copilot unit, which is the wrong repair",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tlet runtimePath: string;"],
+			"replace": [
+				"\tif (params.backend === \"copilot\") {\n\t\tconst early = copilotFreshPreflight(env);\n\t\tif (early) return { ok: false, reason: early };\n\t}\n\tlet runtimePath: string;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-PREFLIGHT-AFTER-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
+			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\"])"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-VISIBLE-IDENTITY-EFFECTIVE",
+			"title": "the visible-identity axis gates on entwurf's ownership RECEIPT instead of the settings Copilot actually reads — a host with a correct, resolvable footer and no install-state is refused for a working identity surface (measured: that is the acceptance host)",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (state === null) return false; // absent state is not drift — see the doc comment above"],
+			"replace": ["\tif (state === null) return true;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-VISIBLE-IDENTITY-EFFECTIVE]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-VISIBLE-IDENTITY-REQUIRED",
+			"title": "the visible-identity axis is dropped entirely — a Copilot citizen is admitted whose garden id can only be found by scraping records, which step 4 refuses to call lifecycle parity",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-VISIBLE-IDENTITY-REQUIRED]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-MCP-CONFIG-DRIFT",
+			"title": "the MCP axis trusts the install-state alone — a config that lost the server key still reads as installed, and the first turn calls a tool that is not registered",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (!Object.hasOwn(servers as Record<string, unknown>, MCP_SERVER_KEY)) return \"copilot-mcp-hand-missing\";"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-MCP-CONFIG-DRIFT]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-BIRTH-AXIS",
+			"title": "the birth axis is satisfied by the directory alone — an assembly root with no hooks.json passes as a hook unit, so a host that cannot mint a record reads as ready",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (!isDir(birthUnit) || !existsSync(path.join(birthUnit, \"hooks\", \"hooks.json\"))) {"],
+			"replace": ["\tif (!isDir(birthUnit)) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-BIRTH-AXIS]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-RECEIVE-PATH-MISMATCH",
+			"title": "the receive axis ignores the launcher's DEST equality — a unit in a different extensions root than this env will scan still preflights green, then entwurf copilot refuses inside the new window",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tconst dest = receiveDest(env);\n\tif (dest === null || recvPath !== dest) return \"copilot-receive-unit-missing\";\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-RECEIVE-PATH-MISMATCH]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-RECEIVE-AXIS",
+			"title": "the receive axis is satisfied by the directory alone — a leftover folder with no extension.mjs passes as our unit, so a host that cannot arm still reads as ready",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (!isDir(recvPath) || !existsSync(path.join(recvPath, \"extension.mjs\"))) return \"copilot-receive-unit-missing\";"
+			],
+			"replace": ["\tif (!isDir(recvPath)) return \"copilot-receive-unit-missing\";"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-RECEIVE-AXIS]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-COMPLETE-HOST-PASSES",
+			"title": "a correctly wired host is still refused — the preflight becomes a permanent closed door wearing a check's clothes",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";\n\n\treturn null;"
+			],
+			"replace": [
+				"\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";\n\n\treturn \"copilot-birth-unit-missing\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-COMPLETE-HOST-PASSES]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-STATUSLINE-STATE-DRIFT",
+			"title": "an install-state that manages a different settings file is accepted — two files then disagree about who owns the footer and the preflight pretends they do not",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\treturn path.resolve(managed) !== path.resolve(settingsPath);"],
+			"replace": ["\treturn false;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-STATUSLINE-STATE-DRIFT]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-EXPLICIT-POLICY",
+			"title": "the composition stops stating its policy and silently leans on the launcher to inject --yolo — the effective profile survives but the fresh contract loses its explicit permission statement",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-EXPLICIT-POLICY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI",
+			"title": "a backend the composition can open is missing from the native pi surface enum — an in-process pi session cannot name a capability the module already opens",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\"], {"],
+			"replace": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\"], {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/pack-install.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "pack-install",
+	"mutants": [
+		{
+			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
+			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.84.30 reads as the pinned 0.84.3 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
+			"subject": "run.sh",
+			"find": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.84\\.3(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -v '@0\\.84\\.3' || true"],
+			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
+			"signatureSource": "run.sh"
+		}
+	]
+}

package/scripts/raw-async-delivery/README.md

@@ -12,12 +12,26 @@ Codex is split by launch surface:
   auto-attached to a default-path app-server): raw `turn/start` over
   WebSocket-over-UDS wakes the live thread — **demonstrated, no managed
   standalone, no cloud**.
-- **Copilot CLI 1.0.80 TUI+server**: official SDK `1.0.11` can resolve the
-  foreground native session and enqueue into that exact idle TUI; D7 was
-  demonstrated once (L4 direct-native, one Linux workstation). The launch flag
-  `--ui-server` is hidden from CLI help and its loopback RPC authentication is
-  not established, so this remains a probe, not a managed lane. Undocumented
+
+Copilot is no longer blocked on transport, and the probe below is no longer the
+product — it is the receipt the product was built on:
+
+- **Copilot CLI 1.0.80 extension**: the CLI forks a first-party extension and
+  speaks JSON-RPC over that child's **stdio**, so `fs.watch` -> `session.send()`
+  wakes the idle TUI with **no network listener or token-authentication axis**. Idle wake
+  and exact-marker attribution were demonstrated; addressed isolation was observed but its
+  decisive control log was not preserved (2026-08-23, one Linux workstation). It needs the experimental
+  `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` flag at launch. The older
+  hidden `--ui-server` loopback probe is retired — it found the capability
+  through a door that could not pass admission. Undocumented
   `~/.copilot/run/ws.*` is still not a rail.
+- **The MANAGED receiver now lives at `pi/copilot-receive/entwurf-receive/`** and is
+  installed with `run.sh install-copilot-receive` (#82 RAIL 5). Read it before reusing
+  anything here, because it deliberately differs on three points: it binds to the V3
+  record instead of publishing its own `ready.json`; its receiver marker is owned by the
+  extension pid, so a crash retires it; and it **announces** the inbox rather than
+  sending the body, leaving the drain (and the read-receipt) to `entwurf_inbox_read`.
+  The files below stay as the measurement — do not develop the product in them.
 
 ## TL;DR — three reception paths, ranked
 
@@ -88,7 +102,9 @@ do not ship that. Proven: deliver to A's sessionId → A wakes (FileChanged), B'
 - `raw-agy-send.sh <conv_id> …` — agy parity: PUSH into a live Antigravity session (LS gRPC)
 - `raw-codex-ws-turn-start.py <sock> <thread_id> …` — Codex parity (no managed standalone, no cloud): PUSH `turn/start` over WebSocket-over-UDS into a bare `app-server --listen` socket
 - `codex-local-appserver.sh [sock]` — start a bare local app-server so plain `codex` auto-attaches and becomes addressable
-- `copilot-ui-server-probe.mjs` — official-SDK D0 probe by default; `LIVE=1` performs one addressed idle enqueue and prints D0–D8
+- `copilot-enqueue-addressed.sh <session_id> …` — Copilot raw sender: write `.msg` + poke one session's signal; refuses a missing marker, but deliberately does not claim production stale-receiver safety
+- `copilot-extension-receive/extension.mjs` — Copilot reception unit: a first-party CLI extension that arms the per-session mailbox and calls `session.send()` (stdio JSON-RPC; no port, no token)
+- `copilot-ui-server-probe.mjs` — RETIRED rail, kept as history; the hidden `--ui-server` loopback path whose authentication could not be established
 
 ### Reproduction drivers
 - `repro-plugin-idle-wake.sh` — single-session smoke.
@@ -251,7 +267,7 @@ send-message-v2` spins a fresh thread, not the live one.
 4. **Unix-socket transport is WebSocket** (tokio-tungstenite), not newline JSON-RPC,
    and requires **no auth token** on the UDS. A plain WS client suffices.
 
-## Copilot CLI raw delivery status (1.0.80) — positive TUI+server probe, not a managed lane
+## Copilot CLI delivery status (1.0.80) — idle wake DEMONSTRATED on the extension rail
 
 Copilot is a GitHub **harness** (issues, PR, CI, model `auto`, mode `autopilot`,
 remote/delegate), not a second GPT provider next to pi. This makes a native lane
@@ -264,136 +280,156 @@ premium-interaction entitlement; model `auto` chooses a path within that budget.
 The reason to use it is GitHub specialization and auto routing, not an unlimited
 subscription claim. Model `auto` and mode `autopilot` are separate axes.
 
-### Positive transport
-
-The first-party `@github/copilot-sdk` exposes TUI+server coordination:
-`getForegroundSessionId()`, `getSessionMetadata()`, `resumeSession(id)`, and
-session-scoped `send({mode:"enqueue"|"immediate"})`. The native TUI launch mode is:
+### The rail: a first-party CLI extension, stdio only
 
-```bash
-copilot --ui-server --port 43817 --model auto
-```
+`copilot-extension-receive/extension.mjs` + `copilot-enqueue-addressed.sh`.
 
-`--ui-server` is accepted by CLI 1.0.80 and named by the official SDK API docs,
-but hidden from `copilot --help`. Launch mode is therefore part of the capability,
-and this evidence does not apply to an already-running plain `copilot` TUI.
-
-Measured once on 2026-08-19 with SDK 1.0.11, **using the earlier chronological-slice
-probe** (it scored the events following the marker's position in the history). The probe
-in the tree today scores a named turn instead — see "Current probe contract" below — and
-that contract has NOT been run LIVE, so nothing in this list is retroactively evidence
-for it. Evidence level for the list: **L4 direct-native, ONE Linux workstation, one run**;
-the receipt is host-local probe stdout and was NOT archived as a durable artifact, so what
-follows is reproducible by instruction, not citable to a stored file:
-
-- protocol v3 ping succeeded;
-- foreground session id joined to metadata containing cwd/git root/branch;
-- `resumeSession(id)` + idle `enqueue` woke the visible TUI with zero typing;
-- the unique body appeared as `user.message` with `delivery:"idle"`;
-- model `auto` selected `gpt-5.6-luna` and returned the exact marker;
-- `assistant.message`, `assistant.turn_end`, and (in the one-session run)
-  ephemeral `session.idle` gave completion/reply evidence;
-- a two-session control then targeted A while B received no `user.message`, turn,
-  or assistant event, so D3 passed too.
-
-D0–D7 passed; D8 is unproven. One robustness defect surfaced in the two-session
-shape: the target visibly replied and persisted `assistant.message` + `turn_end`,
-but that joining SDK client did not receive ephemeral `session.idle`, so SDK
-`sendAndWait()` timed out after 60 seconds. The probe therefore uses `send()` plus
-bounded polling of the official session event-history API (`session.getEvents()` /
-`getMessages()`) and reports completion at `turn_end`. Name that surface at its real
-size: it is the SDK's own full event history — no narrower, no more privileged — and it
-is **not** TUI, file, or database transcript scraping; the probe never reads Copilot's
-storage. This is evidence, not a product retry/polling design.
-
-### Current probe contract — designed, not yet run LIVE
-
-Attribution is the load-bearing part, and it runs off the probe's own marker body:
+The CLI forks an extension as its own child and speaks JSON-RPC over that
+child's stdio. `joinSession()` attaches it to the foreground session; from
+there `session.send({mode:"enqueue"})` injects a user message. So the whole
+delivery path is:
 
-```text
-unique marker body  →  exactly one user.message
-                    →  its interactionId
-                    →  exactly one assistant.turn_start on that interaction
-                    →  that turn_start's required turnId
-                    →  only assistant.message / assistant.turn_end on that turnId
+```
+external file write  ->  fs.watch in the extension  ->  session.send()  ->  the idle session takes a turn
 ```
 
-Every link is required and unambiguous; absent or matched twice, the probe FAILS CLOSED.
-There is no positional fallback and no "the turn after ours" rule, because scoring "the
-newest assistant.message" in a session a human is also typing into is how a probe reports
-someone else's turn as its own delivery.
+`fs.watch` -> `session.send()` is not a mechanism found by inspection: the
+bundled SDK documents it (`copilot-sdk/docs/examples.md`, "Detecting when the
+plan file is created or edited"). The SDK also ships *inside* the CLI package
+(`<platform-pkg>/copilot-sdk/`) and is injected into extension children by
+`preloads/extension_bootstrap.mjs`, so nothing has to be installed and the SDK
+version cannot drift from the CLI.
 
-What is deliberately NOT the key: `session.send()` on the bundled CLI 1.0.80 resolves to a
-`Promise<string>` that is the SDK's own submission handle. The server-side `user.message`
-does not carry that string, and it is a different axis from that event's
-`id`/`interactionId` — a join on it cannot hold, so the probe logs it as a diagnostic and
-never matches on it.
+**This is why the rail clears the network-boundary bar the old one could not.**
+The `--ui-server` probe was refused because its loopback RPC authentication was
+not established. An extension has no port, token, or listener, so that network
+authentication axis does not exist. Product admission must instead certify the
+installed extension's provenance and the CLI-owned parent/child lifecycle; the
+fork is the transport boundary, not proof that every permission, liveness, and
+integrity obligation is already closed.
 
-The D3 control cell uses the same sentence it prints: across `onEvent` and `getEvents`, the
-non-target session received no `user.message` and no `assistant.*` event of any kind.
+### Launch contract
 
-Lifecycle, stated precisely rather than flatteringly: the probe never deletes target
-session A and issues no `A.disconnect()` of its own. `client.stop()` DOES tear down every
-tracked session — A included — as a wire `session.destroy`; because A's foreground
-ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
-session, so the net effect on A is detach-equivalent, not removal. The probe deletes only
-the control session it created itself, and reads `client.stop()`'s returned error list so a
-failed teardown cannot exit 0 behind a printed verdict. Reaching past the SDK for a raw
-detach wrapper is out of bounds — it would be a second lifecycle authority.
+Extensions sit behind an experimental feature flag. Without it the CLI never
+scans for extensions and the receiver is inert **with no error at all** —
+budget for that when a receiver appears not to arm:
 
-This contract has not been exercised by a LIVE turn. The next LIVE run is what would
-demonstrate it, and it also confirms the real event key names.
+```bash
+COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS copilot --model auto
+```
 
-### Reproduce with the pinned official SDK
+`--experimental` is NOT required (measured: a session launched with the env var
+alone armed its receiver). Discovery scopes are `user`
+(`~/.copilot/extensions/`), `plugin`, `session`, and — interactive mode only —
+`project` (`.github/extensions/`). Prompt mode (`-p`) drops `project` unless
+`GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true`. The `plugin` scope matters most
+here: the existing entwurf Copilot plugin is the candidate install scope for
+this receiver, so product design need not start from a per-repository
+`.github/extensions/` directory.
 
-The SDK is deliberately not an entwurf production dependency while this is only
-a raw probe. Install it in scratch and point the probe at its ESM entry:
+### Reproduce
 
 ```bash
-mkdir -p /tmp/copilot-sdk-probe
-printf '{"private":true,"type":"module"}\n' >/tmp/copilot-sdk-probe/package.json
-pnpm --dir /tmp/copilot-sdk-probe add --ignore-scripts @github/copilot-sdk@1.0.11
-
-# terminal A: visible native session (accept folder trust)
-copilot --ui-server --port 43817 --model auto
+mkdir -p /tmp/cop-lab/.github/extensions/entwurf-mailbox
+cp copilot-extension-receive/extension.mjs /tmp/cop-lab/.github/extensions/entwurf-mailbox/
+
+# terminal A: a visible session that arms its own receiver
+cd /tmp/cop-lab
+export COPILOT_MAILBOX_ROOT=/tmp/cop-lab/mbx COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS
+copilot --model auto --allow-all-tools     # accept folder trust
+
+# terminal B: find the armed receiver, then wake it with zero typing
+ls /tmp/cop-lab/mbx/*/ready.json
+COPILOT_MAILBOX_ROOT=/tmp/cop-lab/mbx \
+  ./copilot-enqueue-addressed.sh <session_id> "Reply with exactly PING and nothing else."
+```
 
-# terminal B: D0 only, no model call
-COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+### Measured — 2026-08-23, CLI 1.0.80, model `auto`, one Linux workstation (oracle, arm64)
 
-# one paid/subscription turn: addressed idle enqueue through the official SDK
-LIVE=1 COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+Evidence level **L4 direct-native, one host**. The receiver log lines that still
+travel are pasted here. Scratch was cleaned before the second-session control and
+second-turn lines were copied, so those two observations are explicitly downgraded
+below rather than being laundered into durable receipts:
 
-# creates a second no-turn control session and proves only the target receives the marker
-LIVE=1 COPILOT_D3_CONTROL=1 \
-  COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+```text
+02:19:33.996 ARMED sessionId=4fc16d8d-473d-4258-a1fd-f99d3cb375e9
+02:20:03.388 DELIVER (signal) 1787451603.msg bytes=96
+02:20:03.422 SENT 1787451603.msg
+02:20:06.141 EVENT user.message  {"content":"...Reply with exactly ENTWURF-WAKE-1787451603..."}
+02:20:06.492 EVENT assistant.turn_start {"turnId":"0"}
+02:20:09.935 EVENT assistant.message {"turnId":"0","content":"ENTWURF-WAKE-1787451603"}
+02:20:10.024 EVENT session.idle {}
 ```
 
-### Admission blockers and negative evidence
-
-- **Transport authentication is not established.** The TUI server bound loopback,
-  but an SDK client without a token connected. Setting `COPILOT_CONNECTION_TOKEN`
-  on the UI server did not enable auth: the unauthenticated client still connected,
-  while a token-bearing client received `AUTHENTICATION_NOT_CONFIGURED`. Do not
-  ship this as a rail until the supported same-user/fail-closed boundary is proved.
-- Shell command-hook `sessionStart` input is `{timestamp,cwd,source,initialPrompt?}`;
-  it does **not** carry `sessionId`. SDK callbacks receive `sessionId` separately in
-  their invocation object. The discarded command-hook probe therefore could not
-  establish D0, and UUID-only process-log scraping did not satisfy D0's cwd/liveness
-  join. Do not revive that path.
-- Hooks have no `FileChanged` / `watchPaths` / `asyncRewake`; the Claude mailbox
-  mechanism cannot be copied.
-- `--acp` is a pi-host child path, not this native TUI citizen path. `--remote` is
-  GitHub web/mobile steering, not a local `entwurf_v2` API. Undocumented
-  `~/.copilot/run/ws.*` remains out of bounds.
-
-Do not add `backend:"copilot"`, `FRESH_CALL_BACKENDS`, a schema change, or an OPEN
-issue from these positive probes. Next evidence is active-turn enqueue/immediate
-behavior, TUI-vs-SDK permission ownership, the missing multi-session `session.idle`,
-endpoint staleness/crash behavior, and a supported authenticated or equivalent local
-boundary.
+- **Idle wake: PASS.** The session had never been typed into — an empty timeline,
+  already past any turn boundary. An external file write started a turn. ~2.7 s
+  poke -> `user.message`, ~6.5 s poke -> reply. The visible TUI showed the prompt
+  and the answer.
+- **Attribution: PASS.** A unique per-run marker went in and came back exactly,
+  on one `assistant.turn_start`/`assistant.message` pair.
+- **Addressed routing: reported, receipt not preserved.** The measuring Opus
+  reported that a second armed process B stayed at one `ARMED` line across two
+  deliveries to A, with no `user.message` or `assistant.*` event. The decisive B
+  line and A's second delivery were not copied before scratch cleanup, so this is
+  a lead for the admission rerun, not durable D3 acceptance.
+- **Continuity: one turn demonstrated.** The pasted chain shows one joined
+  session taking the marker turn and replying; no `-p` process was spawned. A
+  second same-session turn was reported but its lines were not preserved, so no
+  stronger repeatability claim crosses from this checkpoint.
+
+### Not proven — do not describe these as working
+
+- **Active-turn delivery.** Every measured send landed on an idle session.
+  `mode:"enqueue"` vs `"immediate"` against a busy turn is untested.
+- **Multi-session inside ONE CLI process.** A and B were separate `copilot`
+  processes. Whether a *background* session inside one process (sidebar tabs)
+  can be woken while another holds the foreground is untested, and
+  `joinSession()` attaching to "the foreground session" is the reason to doubt it.
+- **`/clear` and foreground replacement.** The docs say extensions reload there;
+  re-arming was not measured. `[문서]`, not `[측정]`.
+- **Flag durability.** `EXTENSIONS` is an experimental flag with
+  `experimental`/`staff-or-experimental` availability. It can move or be
+  withdrawn between CLI releases; re-verify on upgrade. A flagged surface is an
+  admission question for a managed lane even when the transport is sound.
+- **Permission ownership, crash and ordering behavior, delivery under load.**
+
+That fence has since been walked, not deleted: `backend:"copilot"` receive capability
+IS now real (`wakeMode: self-fetch` plus a record-bound receiver marker, #82 RAIL 5),
+and it arrived through the managed unit with its own installer, doctor, gate and
+mutants — not by widening anything in this directory. `FRESH_CALL_BACKENDS` now
+includes `copilot` (#82 RAIL 9); that launch path lives in `mux-fresh-call`, not here.
+This probe still does not open a sibling. Waking an already-running Copilot and
+opening a new one remain different capabilities.
+The registry's receive grade moved off D0 later, and NOT because of this probe: a managed
+LIVE wake was observed on 2026-08-23 (garden `20260823T181316-d9f6ba`, CLI 1.0.80,
+doorbell→`lastReadAt` 09:23:41.235Z→09:23:56.480Z) and that is what makes the shipped lane
+D6, with D7 partial and D3 pending. This probe's receipt remains what it always was —
+evidence about the MECHANISM, not about the shipped lane. Keep the two apart when citing
+either.
+
+### Retired: the hidden `--ui-server` probe (kept for the lesson)
+
+The 2026-08-19 probe reached the TUI through `copilot --ui-server --port 43817`
+and the separately-installed SDK, and it did demonstrate an idle enqueue. It was
+refused admission because the launch flag is hidden from `copilot --help` and its
+loopback RPC authentication could not be established: an unauthenticated client
+connected, while setting `COPILOT_CONNECTION_TOKEN` on the server made a
+token-bearing client fail with `AUTHENTICATION_NOT_CONFIGURED`.
+
+The lesson is not "that probe was wrong". It found a real capability through the
+wrong door, and then the door — not the capability — was what failed admission.
+The bundled extension door was in the same package the whole time: the SDK that
+this probe installed from npm also ships inside the CLI, with an `extension.mjs` contract and
+docs beside it. `copilot-ui-server-probe.mjs` remains in this tree as that history.
+Do not revive `--ui-server` as a rail; use the extension.
+
+Also still true, and still out of bounds: hooks have no `FileChanged` /
+`watchPaths` / `asyncRewake`, so the Claude mailbox hook mechanism cannot be
+copied; the shell command-hook `sessionStart` input carries no `sessionId`
+(the receiver publishes its own `ready.json` instead of scraping for one);
+`--acp` is a pi-host child path and `--remote` is GitHub web/mobile steering,
+neither of which is a local `entwurf_v2` API; and undocumented
+`~/.copilot/run/ws.*` is not a rail.
 
 ## Live SSOT for "is the target session alive?"
 
@@ -407,9 +443,18 @@ boundary.
   `$HOME/.codex/app-server-control/app-server-control.sock` (or any owned 0700
   socket via `codex app-server --listen unix://PATH`) is the delivery surface.
   threadId comes from the newest rollout's `session_meta.id`.
-- Copilot TUI+server probe: SDK `ping` + `getForegroundSessionId()` +
-  `getSessionMetadata()` identify the currently displayed native session, and
-  the official session event-history API (`getEvents()` / `getMessages()`) reads
-  a turn back — no transcript file or database is touched. The TCP port is a
-  runtime endpoint, never an identity axis; no managed liveness join exists
-  until its authentication and stale-endpoint behavior are proved.
+- Copilot raw probe: `<COPILOT_MAILBOX_ROOT>/<session_id>/ready.json`, written by
+  the receiver extension about itself (sessionId, pid, cwd, armedAt). `[번들]`
+  `preloads/extension_bootstrap.mjs` monitors the CLI parent, but this is a
+  discovery marker for the experiment, **not a production liveness SSOT**: the
+  probe sender checks only that the file exists, so a crashed extension can
+  leave stale state and produce a false enqueue receipt.
+- Copilot PRODUCT: `<pi-agent-dir>/meta-receivers/<gardenId>.json`, written by the
+  managed extension and keyed by the garden id a sender actually targets. Liveness is
+  pid + start-key on the EXTENSION child, so a crashed receiver reads as inactive at the
+  next read — that is what `ready.json` could not do. Parent monitoring never cleaned the
+  probe's marker by itself; the product does not depend on cleanup at all. Nothing
+  scrapes `~/.copilot/session-store.db` or the session-state dirs, and the shell
+  command-hook `sessionStart` input is NOT
+  a source — it carries no `sessionId`. The retired `--ui-server` TCP port was
+  never an identity axis.