@junghanacs/entwurf 0.14.2 → 0.15.0

package/run.sh

@@ -130,6 +130,10 @@ Usage:
   ./run.sh check-meta-session          # deterministic gate (#30 step 2, V3-only): fs store — idempotent decideUpsert/upsertMetaSession + mailbox enqueue/read + receipt state, no API
   ./run.sh check-meta-v3-record        # deterministic gate: the ONE live record schema (v3) — canonical serialize/round-trip/mint, foreign-generation rejections name fresh-cut with the actual version value, strict keyset, no API
   ./run.sh check-mailbox-receipt-state # deterministic gate (0.11 Stage 0 step 3B): mailbox receipt state schema + store (stamp→persist→read-back) in a temp mailbox, strict keyset, no API
+  ./run.sh check-copilot-birth-hook   # #82 gate: drives the real Copilot assembler into a temp dir, fires the baked launcher with NO ARGV (the way Copilot's `exec`-string schema forces), and requires a backend:"copilot" v3 record + attach + peer row + a SENDER marker the resolver joins back to that record, and still zero mailbox/receiver marker (who-sent needs a shared parent; a receiver needs a doorbell this backend has not got). Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -185,6 +189,8 @@ Usage:
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-copilot-statusline-state # Copilot custom-footer install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
   ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
@@ -195,6 +201,18 @@ Usage:
   ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
+  ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
+  ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
+  ./run.sh doctor-copilot-bridge      # #82: fail-loud surface for that unit. Red = a hook that RAN and failed, or a broken/unbaked artifact. "Installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens (measured)
+  ./run.sh install-copilot-statusline # own Copilot statusLine + footer.showCustom with an install-state preimage
+  ./run.sh uninstall-copilot-statusline # honest inverse of install-copilot-statusline
+  ./run.sh doctor-copilot-statusline  # static ownership/config/bin doctor; never claims a render receipt
+  ./run.sh install-copilot-mcp        # #82 RAIL 5: register ONE entwurf-bridge server in ~/.copilot/mcp-config.json (adopt / create / REFUSE symlink), type:local, install-state under $XDG_DATA_HOME/entwurf/copilot-mcp/
+  ./run.sh uninstall-copilot-mcp      # honest inverse of install-copilot-mcp from install-state
+  ./run.sh doctor-copilot-mcp         # static ownership/config/boot doctor; RED only when install-state exists
+  ./run.sh install-copilot-receive    # #82 RAIL 5: install the RECEIVER extension (user scope ~/.copilot/extensions/entwurf-receive). Owns the artifact and CHECKS the launch flag; it never sets one (a launch does — see `./run.sh copilot`). Arms per session after birth
+  ./run.sh uninstall-copilot-receive  # honest inverse from install-state; never removes a unit it did not install
+  ./run.sh doctor-copilot-receive     # artifact + digest, COPILOT_CLI_ENABLED_FEATURE_FLAGS on the LIVE copilot processes (the silent failure), live receiver markers via the production reader, receiver log. RED only when install-state exists
   ./run.sh install-agy-bridge         # 봉인 7: agy MCP install adapter — register ONE entwurf-bridge server in the agy mcp_config (adopt file / create / REFUSE symlink), stable bin command, install-state under $XDG_DATA_HOME/entwurf/agy-bridge/
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
@@ -213,6 +231,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.30 must leak, @0.84.3 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -738,6 +757,41 @@ check_meta_receiver_marker() {
   run_ts scripts/check-meta-receiver-marker.ts
 }
 
+check_copilot_birth_hook() {
+  # #82 gate: the Copilot BIRTH path, proven without Copilot. Drives the REAL
+  # assembler (--assemble-only, into a temp dir), then fires the baked launcher the
+  # way Copilot fires it — NO ARGV, envelope on stdin — and requires a v3 record with
+  # backend "copilot", an attach on the second event of the same prompt, no
+  # mailbox/marker of any kind, and a peer row with liveness `unsupported`. Refusals
+  # (disagreeing ids, missing cwd, no id, malformed) must refuse rather than guess.
+  # It proves the MECHANISM, never the admission: §6 acceptance is a record minted by
+  # a real Copilot session, which costs a model turn.
+  run_ts scripts/check-copilot-birth-hook.ts
+}
+
+check_copilot_statusline() {
+  # #82 Copilot custom-footer renderer. Drives scripts/copilot-statusline.sh with
+  # session_id on stdin in an isolated store. ready / ? / exact gid; exit 0.
+  run_ts scripts/check-copilot-statusline.ts
+}
+
+check_copilot_launch() {
+  # #82 RAIL 7. The subject is a process REPLACEMENT, so the oracle is a fake vendor
+  # executable on a sandboxed PATH that reports the argv/env/pid/cwd it was handed —
+  # never a reading of the launcher's source. HOME/XDG/PATH are all redirected, so the
+  # install-state, the extensions root and the resolved binary are the fixture's.
+  run_ts scripts/check-copilot-launch.ts
+}
+
+check_copilot_receive_arm() {
+  # #82 RAIL 5 gate: drives the REAL receiver installer into a temp extensions dir, then
+  # forks the REAL extension.mjs with the SDK specifier resolved by a loader hook (the
+  # vendor's own mechanism). Binds arm-after-birth, watcher-owned marker, the self-fetch
+  # dispatch answer, a doorbell that carries the id and not the body, and every refusal.
+  # Needs the compiled bridge closure; hermetic otherwise (no Copilot, no model turn).
+  run_ts scripts/check-copilot-receive-arm.ts
+}
+
 check_hook_launch_topology() {
   # #51 gate 1, deliberately built only AFTER the B/B2 verdict. Binds the SHIPPED
   # hooks.json to real child topology: every leaf is exec form through the shipped
@@ -1099,7 +1153,10 @@ check_mux_fresh_call() {
   # could not see: real bridge boot → tools/list schema/description, Rust-regex-family pattern
   # validity on every emitted pattern (the #62 escape), and the schema riding the actual
   # anthropic-messages request body. No fake tmux: the real-window axis is smoke-mux-fresh-call-live.
-  run_vitest test/mux-fresh-call.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
+  # copilot-fresh-preflight rides here rather than in its own gate: it exists only as
+  # freshCall's pre-mutation branch (#82 RAIL 9), and splitting it would let the two halves
+  # of one refusal be certified in different runs.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1629,13 +1686,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.2 pin) whose
+// pi (past the declared ceiling — 0.85+ at the current 0.84.3 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.2` an existing 0.83.x host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.2 <0.85`).
+// install resolves: at `>=0.84.3` an existing 0.83.x host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.3 <0.85`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2757,6 +2814,9 @@ check_pack() {
     # strip-types under node_modules). meta-session.js is shared with the store-doctor
     # above; listed here too so the hook axis fails loud if the emit graph drops it.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    # #82 — the Copilot birth entry's compiled closure, for the same node_modules
+    # strip-types refusal that forces the Claude one.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -2769,6 +2829,23 @@ check_pack() {
     # It rides a per-FILE entry in the files array (not a whole directory), so one
     # deleted line drops it from the tarball while every other gate stays green.
     "pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh"
+    # #82 — the Copilot BIRTH unit. It is a SECOND marketplace root, not a second
+    # plugin inside the Claude one: the Claude installer assembles one root and copies
+    # one plugin out of it, so a shared marketplace.json would publish a `source` the
+    # assembly does not contain. Same per-FILE listing discipline as the Claude unit.
+    "pi/meta-bridge-copilot/.claude-plugin/marketplace.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
+    "pi-extensions/meta-bridge-hook-copilot.ts"
+    "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-doctor.sh"
+    # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
+    # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
+    # extensions dir. `extension.mjs` is the vendor's required entry NAME: a rename in
+    # the tarball is not a degraded path, it is a unit Copilot never discovers.
+    "pi/copilot-receive/entwurf-receive/extension.mjs"
+    "scripts/copilot-receive-bridge.sh"
     "pi-extensions/meta-bridge-hook.ts"
     "pi-extensions/lib/meta-session.ts"
     "pi-extensions/lib/session-id.js"
@@ -2836,7 +2913,41 @@ check_pack() {
   return 1
 }
 
+# The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
+# self-test below. The version BOUNDARY is load-bearing: a pnpm .pnpm entry is
+# `<name>@<version>` followed by either `_<peer-hash>` or end-of-name (measured pnpm 11.20.0
+# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.30`
+# while announcing the pinned floor — a false-green oracle (found by independent review,
+# 2026-08-25).
+pack_install_leaked_pi() {
+  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.3(_|$)' || true
+}
+
+# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise the
+# false-green shape (it contains no 0.84.30), so the oracle is proven against a fixture
+# listing. Expected: the two lookalikes leak, the pinned version passes bare and with a
+# peer-hash suffix. Exposed as its own snapshot-safe subcommand because the heavy
+# check-pack-install cannot run inside the qualification snapshot (no install environment),
+# and a kill-proof needs a control-green gate there; check-pack-install still runs this
+# first so the heavy gate cannot proceed on a broken oracle.
+check_pack_pin_matcher() {
+  local matcher_probe
+  matcher_probe=$(printf '%s\n' \
+    '@earendil-works+pi-ai@0.84.3' \
+    '@earendil-works+pi-ai@0.84.3_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.84.30' \
+    '@earendil-works+pi-agent-core@0.84.2' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.30
+@earendil-works+pi-agent-core@0.84.2' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.30/0.84.2 lookalikes and pass 0.84.3 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    return 1
+  fi
+  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with a peer-hash)"
+}
+
 _check_pack_install_impl() {
+  check_pack_pin_matcher || return 1
+
   # Heavy publish gate. Runs the remaining three checks in #13's
   # publish checklist that check_pack (dry-run only) does not cover:
   #
@@ -2954,6 +3065,9 @@ _check_pack_install_impl() {
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
     # hook regression below runs exactly this compiled JS from under node_modules.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    # #82 — the Copilot birth entry's compiled closure, for the same node_modules
+    # strip-types refusal that forces the Claude one.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -2965,6 +3079,23 @@ _check_pack_install_impl() {
     # both callers source. The install smoke below asserts the ASSEMBLED launcher is
     # executable; this asserts the artifact it is assembled FROM actually shipped.
     "pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh"
+    # #82 — the Copilot BIRTH unit. It is a SECOND marketplace root, not a second
+    # plugin inside the Claude one: the Claude installer assembles one root and copies
+    # one plugin out of it, so a shared marketplace.json would publish a `source` the
+    # assembly does not contain. Same per-FILE listing discipline as the Claude unit.
+    "pi/meta-bridge-copilot/.claude-plugin/marketplace.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
+    "pi-extensions/meta-bridge-hook-copilot.ts"
+    "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-doctor.sh"
+    # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
+    # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
+    # extensions dir. `extension.mjs` is the vendor's required entry NAME: a rename in
+    # the tarball is not a degraded path, it is a unit Copilot never discovers.
+    "pi/copilot-receive/entwurf-receive/extension.mjs"
+    "scripts/copilot-receive-bridge.sh"
     "pi-extensions/meta-bridge-hook.ts"
     "pi-extensions/lib/meta-session.ts"
     "pi-extensions/lib/session-id.js"
@@ -3027,7 +3158,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.2`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.84.3`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3046,12 +3177,12 @@ _check_pack_install_impl() {
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.2" \
-    "@earendil-works/pi-coding-agent@0.84.2" \
-    "@earendil-works/pi-tui@0.84.2" \
-    "@earendil-works/pi-agent-core@0.84.2" \
-    "@earendil-works/pi-client@0.84.2" \
-    "@earendil-works/pi-protocol@0.84.2" \
+    "@earendil-works/pi-ai@0.84.3" \
+    "@earendil-works/pi-coding-agent@0.84.3" \
+    "@earendil-works/pi-tui@0.84.3" \
+    "@earendil-works/pi-agent-core@0.84.3" \
+    "@earendil-works/pi-client@0.84.3" \
+    "@earendil-works/pi-protocol@0.84.3" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3061,17 +3192,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.2. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.84.3. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.2". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.84.3". Fail loud instead of proving the wrong floor.
   local leaked_pi
-  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.84\.2' || true)
+  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.2):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.3):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.2"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.3"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -3224,6 +3355,11 @@ _check_pack_install_impl() {
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf-copilot-statusline" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bin entwurf-copilot-statusline"
+    ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
+    return 1
+  fi
   wire_log=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
     fail "[check-pack-install] npm-managed run.sh install failed (preflight rejected hoisted deps?):"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
@@ -3394,6 +3530,48 @@ SH
   fi
   rm -rf "$nm_probe"
   echo "[check-pack-install] installed hook is node_modules-safe compiled JS (hooks.json points at .js; runs under node_modules with plain node; raw .ts refused there by the strip-types fence)"
+
+  # --- #82: the Copilot birth unit's INSTALLED-PACKAGE branch ------------------
+  # check-copilot-birth-hook drives the installer from a DEV CLONE, so it only ever
+  # exercises the `.ts` branch. The installed-package branch — compiled
+  # meta-bridge-hook-copilot.js, its rewritten `./lib/meta-session.js` import, the
+  # registry copied to the plugin root — was covered by pack LISTS and by nothing that
+  # RUNS it, which is the shape Hard Rule 11 exists to refuse (cross-review, terra +
+  # glm independently, 2026-08-21).
+  #
+  # `--assemble-only` stops before the Copilot CLI, so this needs no Copilot and no fake
+  # of one. A fake Copilot CLI would only prove our script calls our fake the way we
+  # wrote it — the vendor contract is unmeasured, and the first real execution is the
+  # §6 admission itself. This asserts the CITIZEN, not merely that a node process ran.
+  local cop_asm="$npm_tmp/copilot-asm" cop_store cop_log
+  cop_store="$(mktemp -d)"
+  if ! cop_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" ENTWURF_COPILOT_ASM="$cop_asm" PATH="$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-copilot-bridge --assemble-only 2>&1); then
+    fail "[check-pack-install] installed install-copilot-bridge --assemble-only failed:"
+    echo "$cop_log" | tail -20 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_unit="$cop_asm/entwurf-meta-receive-copilot"
+  # Branch SELECTION, pinned: an installed package must assemble the compiled entry and
+  # no raw .ts. Without this the fire below could pass on a layout that silently chose
+  # the dev-clone branch.
+  if [ ! -f "$cop_unit/meta-bridge-hook-copilot.js" ] || [ -f "$cop_unit/meta-bridge-hook-copilot.ts" ]; then
+    fail "[check-pack-install] installed install-copilot-bridge did not select the compiled branch (want meta-bridge-hook-copilot.js, no raw .ts) in $cop_unit"
+    return 1
+  fi
+  local cop_out
+  # Fired the way Copilot fires it: NO ARGV, envelope on stdin.
+  if ! cop_out="$(printf '%s' '{"sessionId":"pack-copilot-probe","cwd":"/tmp","source":"new"}' | env PI_CODING_AGENT_DIR="$cop_store" "$cop_unit/scripts/copilot-hook-launch.sh" 2>&1)"; then
+    fail "[check-pack-install] the installed Copilot launcher failed: $(printf '%s' "$cop_out" | tr '\n' ' ' | cut -c1-200)"
+    return 1
+  fi
+  local cop_records
+  cop_records="$(grep -l '"backend": "copilot"' "$cop_store"/meta-sessions/*.meta.json 2>/dev/null | wc -l | tr -d ' ')"
+  if [ "$cop_records" != "1" ]; then
+    fail "[check-pack-install] the installed Copilot unit did not mint exactly one copilot citizen (found ${cop_records:-0}); log: $(tail -1 "$cop_store/meta-bridge-hook.log" 2>/dev/null)"
+    return 1
+  fi
+  rm -rf "$cop_store"
+  echo "[check-pack-install] installed Copilot birth unit assembles its compiled branch and mints a citizen from a no-argv launch"
   python3 - "$mb_cfg/settings.json" "$mb_home/.claude.json" "$stable_asm" <<'PY'
 import json, sys
 settings = json.load(open(sys.argv[1]))
@@ -3596,6 +3774,60 @@ JS
     return 1
   fi
 
+  # #82 RAIL 7 — the managed launch, from the INSTALLED package. Hard Rule 11: a green
+  # clone is not a green tarball. `entwurf copilot` is a bash leaf, so its risk here is
+  # not the strip-types fence but PACKAGING — `scripts/copilot-launch.sh` has to be in
+  # the tarball and reachable from the installed `run.sh`, and a file-list assertion
+  # cannot tell a shipped script from a shipped script that resolves its siblings wrongly
+  # once it lives under node_modules. So the cell RUNS it, against a fake vendor on a
+  # sandbox PATH and a fake receiver install-state, and reads what the vendor was handed.
+  local cop_launch_home="$npm_tmp/cop-launch-home" cop_launch_xdg="$npm_tmp/cop-launch-xdg" cop_launch_bin="$npm_tmp/cop-launch-bin"
+  local cop_unit_dir="$cop_launch_home/.copilot/extensions/entwurf-receive"
+  local cop_state_dir="$cop_launch_xdg/entwurf/copilot-receive"
+  mkdir -p "$cop_unit_dir" "$cop_state_dir" "$cop_launch_bin"
+  printf '// fixture\n' > "$cop_unit_dir/extension.mjs"
+  printf '{"schemaVersion":1,"unit":"entwurf-receive","path":"%s"}\n' "$cop_unit_dir" > "$cop_state_dir/install-state.json"
+  # The stand-in is installed under the REAL name on a sandbox PATH: the launcher resolves
+  # `copilot` and nothing else, so there is no env switch here to prove the wrong contract with.
+  {
+    printf '#!/usr/bin/env bash\n'
+    printf 'echo "FLAG=[${COPILOT_CLI_ENABLED_FEATURE_FLAGS-<unset>}]"\n'
+    printf 'for a in "$@"; do printf "ARG<%%s>\\n" "$a"; done\n'
+  } > "$cop_launch_bin/copilot"
+  chmod +x "$cop_launch_bin/copilot"
+  # `env -u` for BOTH carriers, not just a reassignment: an operator running this gate with
+  # their own COPILOT_CLI_ENABLED_FEATURE_FLAGS exported would otherwise inherit those tokens
+  # into the oracle below and read a FALSE RED, and an inherited launch sentinel would trip
+  # the recursion fence before the vendor was ever reached. The cell must measure the
+  # installed launcher, not the shell that happened to start it.
+  if ! op_out=$(env -u COPILOT_CLI_ENABLED_FEATURE_FLAGS -u ENTWURF_COPILOT_LAUNCH_ACTIVE \
+      HOME="$cop_launch_home" XDG_DATA_HOME="$cop_launch_xdg" PATH="$cop_launch_bin:$PATH" \
+      "$installed_entwurf" copilot -p hi 2>&1); then
+    fail "[check-pack-install] installed 'entwurf copilot' FAILED to reach the vendor:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  # Assert MEANING: the scan flag this whole surface exists to set, the managed defaults,
+  # and the operator's own argument, all arriving at the vendor from the installed tree.
+  if ! printf '%s' "$op_out" | grep -q 'FLAG=\[EXTENSIONS\]'; then
+    fail "[check-pack-install] installed 'entwurf copilot' did not hand the vendor COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  for want in 'ARG<-p>' 'ARG<hi>' 'ARG<--model>' 'ARG<auto>' 'ARG<--yolo>'; do
+    if ! printf '%s' "$op_out" | grep -qF "$want"; then
+      fail "[check-pack-install] installed 'entwurf copilot' did not forward the managed argv (missing $want):"
+      echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if printf '%s' "$op_out" | grep -qF 'ARG<copilot>'; then
+    fail "[check-pack-install] installed 'entwurf copilot' leaked the dispatcher verb into the vendor's argv:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed 'entwurf copilot' reached the vendor with the scan flag and the managed argv"
+
   # The generation verb must reach its verdict from under node_modules. On the
   # sandbox 0-record agent dir it archives nothing and opens a fresh generation.
   # The exit code alone can't tell a verdict from a fence crash, so read the line.
@@ -4677,6 +4909,18 @@ case "$cmd" in
   check-hook-launch-topology)
     check_hook_launch_topology
     ;;
+  check-copilot-birth-hook)
+    check_copilot_birth_hook
+    ;;
+  check-copilot-statusline)
+    check_copilot_statusline
+    ;;
+  check-copilot-launch)
+    check_copilot_launch
+    ;;
+  check-copilot-receive-arm)
+    check_copilot_receive_arm
+    ;;
   check-meta-capability-source)
     check_meta_capability_source
     ;;
@@ -5061,6 +5305,77 @@ case "$cmd" in
     # zero claude-code meta-records is a SILENT MISS -> non-zero exit.
     (cd "$REPO_DIR" && bash scripts/meta-bridge-doctor.sh "$@")
     ;;
+  install-copilot-bridge)
+    # #82: the Copilot BIRTH install. Deliberately not a mode of install-meta-bridge —
+    # it assembles its OWN marketplace root (the Claude assembler copies one plugin out
+    # of one root, so a shared marketplace.json would publish a missing `source`), it
+    # bakes node+entry into the launcher rather than into the manifest (Copilot's exec
+    # form is a single string with no argv beside it), and it wires NO MCP: a drain tool
+    # for a mailbox nothing rings would advertise delivery this backend does not have.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh "$@")
+    ;;
+  doctor-copilot-bridge)
+    # #82: the fail-loud surface for the Copilot unit. Its red conditions differ from
+    # the Claude doctor's on purpose: a Copilot session mints on its FIRST PROMPT, not
+    # at session open, so "installed with zero records" is reported as NOT-YET rather
+    # than as a silent miss. Red is a hook that RAN and failed.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-doctor.sh "$@")
+    ;;
+  install-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh doctor "$@")
+    ;;
+  smoke-copilot-statusline-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-copilot-statusline-state.sh)
+    ;;
+  install-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh doctor "$@")
+    ;;
+  smoke-copilot-mcp-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-copilot-mcp-state.sh)
+    ;;
+  copilot)
+    # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
+    # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own
+    # exit status. The sibling install/doctor verbs wrap themselves in `(cd "$REPO_DIR" && …)`
+    # because they operate on the repo; this one operates on the operator's session, and a
+    # subshell would make run.sh a parent that outlives nothing and owns nothing.
+    #
+    # `shift` is load-bearing here, not cosmetic: this dispatcher keeps the verb in "$@"
+    # and each branch drops it for itself. The neighbouring install/doctor verbs get away
+    # without one because their bridge scripts take a leading subcommand and ignore the
+    # trailing noise; this branch forwards straight into the VENDOR's argv, where a stray
+    # "copilot" would arrive as a prompt argument.
+    shift || true
+    exec bash "$REPO_DIR/scripts/copilot-launch.sh" "$@"
+    ;;
+  install-copilot-receive)
+    # #82 RAIL 5: install the RECEIVER extension into the Copilot USER extensions dir.
+    # Artifact ownership only — it sets no launch flag (`run.sh copilot` owns one
+    # invocation's environment; this owns the unit on disk), and it arms
+    # nothing by itself: a session arms after birth, on a CLI launched with
+    # COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS.
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-receive)
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-receive)
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh doctor "$@")
+    ;;
   install-agy-bridge)
     # 봉인 7: the agy (Antigravity) MCP install ADAPTER (SEPARATE from the Claude
     # marketplace install — only runner/reporting is shared). Registers ONE entwurf-bridge
@@ -5316,6 +5631,9 @@ case "$cmd" in
   check-pack)
     check_pack
     ;;
+  check-pack-pin-matcher)
+    check_pack_pin_matcher
+    ;;
   check-pack-install)
     check_pack_install
     ;;