@junghanacs/entwurf 0.14.2 → 0.15.1

package/AGENTS.md

@@ -28,9 +28,9 @@ For agents that own this repo: invariant principles and reproducible verificatio
 - **entwurf-core (v2)** owns garden-id addressing, peer facts, liveness interfaces, dispatch decisions, rail choice, and delivery evidence.
 - **Record authority** owns citizen identity. Every addressable citizen uses the same V3 `MetaIdentity` schema. `backend` selects capability/rail behavior; it does not create an identity hierarchy.
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
-- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code is mailbox/self-fetch; Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
+- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code and Copilot CLI are mailbox/self-fetch (a Claude hook arms the watch; a forked Copilot extension holds it); Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
-- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
+- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`, Copilot `--model <name>` beside `--interactive <prompt>` and the explicit `--yolo` policy — a GLG width decision, 2026-08-25, after a callback-only `--allow-tool` grant stopped the sibling at every task tool); the Copilot backend opens through entwurf's OWN managed invocation (`entwurf copilot`), never the bare vendor, and its four required capabilities — birth, MCP hand, receiver, visible footer — are decided by `copilot-fresh-preflight.ts` BEFORE the tmux mutation, so a missing unit is a named refusal instead of a dead window; it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
 - **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.
 
 ## Hard Rules
@@ -41,7 +41,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 4. **Dispatch is computed from live facts.** Never store liveness. Never infer send/resume from session type before resolving the target and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguous address, or indeterminate probe returns a reject and mutates nothing. No cosmetic success or silent fallback.
 6. **MCP is explicit.** Only explicit `mcpServers` wiring. No ambient `~/.mcp.json` scan or automatic retrieval.
-7. **Meta-record store contract is one contract.** Record body is authority; filename must agree with the body; every active entry is a regular non-symlink file readable by the live V3 schema; `nativeSessionId` ownership is unique. Identity writers and doctor certify the whole active store before writing. Address-bearing reads use `readAddressableMetaIdentity`; targeted relay reads keep the documented per-entry contract. `readStoreRecordFile`/`O_NOFOLLOW` and the lstat policy layer are both load-bearing—do not merge or bypass them. No legacy reader/migrator: quiesce and run `entwurf meta-bridge-fresh-cut` when the generation is unreadable. Source and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
+7. **Meta-record store contract is one contract.** Record body is authority; filename must agree with the body; every active entry is a regular non-symlink file readable by the live V3 schema; `nativeSessionId` ownership is unique. Identity writers and doctor certify the whole active store before writing. Address-bearing reads use `readAddressableMetaIdentity`; targeted relay reads keep the documented per-entry contract. `readStoreRecordFile`/`O_NOFOLLOW` and the lstat policy layer are both load-bearing—do not merge or bypass them. No legacy reader/migrator: quiesce and run `entwurf meta-bridge-fresh-cut` when the generation is unreadable. An unknown-backend defect is a stale deployed reader, not a rotten generation: redeploy the sibling unit; do not fresh-cut. `doctor-meta-bridge` already names that — run it after `META_BACKENDS` changes. Source and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims process resources, never memory/data.** Records and transcripts are preserved or archived; they are not casually deleted.
 9. **This is not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Each backend owns auth and transcript state.
 10. **Native-push is its own rail.** It is not a mailbox or pi socket in disguise. Antigravity replyability is record-backed plus probe-alive; no receiver marker, watch state, or resume authority is invented for it.
@@ -51,6 +51,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 14. **Native hook ownership is structural.** Claude hooks use the shipped exec-form launcher and provenance token; marker writers/readers share `isPlausibleOwnerPid`; no shell-form fallback, ancestry guess, or retired pid carrier. entwurf requires Claude Code `>=2.1.217` and enforces that floor itself because upstream gives no fail-loud — an older Claude validates the exec manifest, then drops `args` at runtime and reports success. The number is derived from `package.json` `entwurf.claudeCodeFloor`, never retyped as a second source. Currently certified axis is Linux desktop/workstation. Source/gates: `hook-launch.sh`, `meta-session.ts`, `check-hook-launch-topology`, `check-claude-floor-coherence`, `check-meta-doctor-oracle`.
 15. **Crash, don't warn.** Bad config/path/model/store state throws. Empty catches are only for bounded environment probing; operator diagnostics go to stderr.
 16. **mux is launch, never delivery.** A tmux window/pane handle is an ephemeral operator view, not an address: it mints no garden id, stores no record, and reports no liveness. Screen text and keystrokes are never an `entwurf_v2` receipt. Mux owns only placement and fixed-runtime launch; fresh identity correlation stays in callback envelopes, while same-id resume identity/liveness/locking stays on the v2 side of an injected launch seam.
+17. **Entwurf installs itself; setup composes what the operator already chose.** Package installation and source bootstrap supply Entwurf's own bytes, bins, dependencies and development fixtures only. They never install a harness binary, subscription, credential or login — `pi` has no privileged exception. `setup` detects already-present harnesses by capability and completes each detected integration; absence is an explicit zero-state SKIP, while a detected-but-incomplete integration is named non-green rather than cosmetic success. Source-only pinned Pi dev dependencies are build/test fixtures, not a product promise that neutral npm consumers receive Pi. Installation portability and rail/runtime support are separate evidence axes: Linux proof never certifies macOS or native Windows, and WSL counts as Linux rather than Windows.
 
 Detailed incident histories belong in CHANGELOG/issues/BASELINE and source-adjacent comments, not in this prompt. When a concise rule and old archaeology disagree, verify source + gate and repair the stale prose.
 
@@ -89,7 +90,7 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 
 - **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and a dormant cell that rejects.
 - **No relaunch transport exists inside delivery.** `spawn-bg` — a detached, window-less resume child — was removed under the visible-first rule, not deprecated behind a reject, and `entwurf_v2` still starts no process: a dormant socket-domain citizen is refused as `dormant-fire-forget-unsupported`. Reopening one is the separate lifecycle verb `entwurf_resume_call`, which is pi-only (`target-not-pi` otherwise), returns a LAUNCH receipt and an OBSERVATION receipt that are never merged, releases its per-gid lock on every path, and on an unobserved socket leaves the visible window open rather than retrying. No watcher, no retry, no supervisor. Do not re-route it through `entwurf_v2` and do not describe a spawn domain that does not exist.
-- **self-fetch domain (currently Claude Code)**: active receiver + mailbox deliverability; no resume authority.
+- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs.
 - **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox and no resume authority.
 - `origin: "pi-session" | "meta-session" | "external-mcp"` records sender provenance. It is not the citizen identity schema and not a hierarchy.
 - `entwurf_peers` reports record citizens and liveness facts only. It never embeds routing verbs or socket addresses for peers.
@@ -111,6 +112,7 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 - A new issue brings the best available observation plus an executable next measurement. Recovering a missing signature may be the first acceptance; an idea with neither evidence nor a next measurement is not an issue.
 - No collection points, umbrella trackers, or fallout buckets. Merge issues only when they share one cause and one acceptance.
 - Sweep manually after a release and before opening an issue. Solved work closes at its durable SHA; it does not wait for the next release.
+- **An issue body is a snapshot; the thread is the live contract.** A body written before GLG stated what the work is *for* will disagree with the thread, and a reader who opens only the body inherits the stale half — including its fences, which is how a fence once forbade the very deliverable the lane existed to produce (#82, 2026-08-20). When they disagree the thread wins. Whoever notices owes the body an edit that strikes the withdrawn clause and says why it was there; deleting it silently makes the queue tidy and the lesson invisible.
 
 ## Verification
 
@@ -180,7 +182,7 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.2 <0.85` with devDep exact `0.84.2`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- pi runtime range is `>=0.84.3 <0.85` with devDep exact `0.84.3`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
 - ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style
@@ -206,12 +208,14 @@ An overgrowth is built from locally correct steps; what fails is the absence of
 - **Unrelated meta-infra never rides a capability lane.** The source-adjacent gate/mutant that proves a capability's contract belongs in the same change as that capability — the removal/repair rule above is untouched. What stays out of a feature commit candidate is unrelated verification machinery: scheduling rework, selectors, caches, receipts, floor restructuring. That pain is recorded and handled in its own subtraction lane later.
 - **Stop signal — evidence outgrowing the product.** When verification/meta-tool changes grow larger than the capability change they serve, stop and report to GLG. This is an operator-judgment trigger, deliberately not a mechanized ratio gate.
 - **Claim only what the evidence carries.** "The full floor was green once on the declared candidate" is strong enough; a stronger sentence mints proof obligations, and those obligations mint subsystems.
+- **A claim that crosses sessions carries its evidence state.** Measured here (name the receipt), read at `file:line`, read from an external artifact (name the path), inherited and unchecked (name the source) — and design proposals in a box of their own, since a proposal is adopted or decided differently, never measured. This repo is where siblings from many models each get a few turns, so a bare sentence costs the next one its turn re-deriving the ground, and leaves it only "believe or refute" when the honest move is "that carries no receipt, so I measured it." Retire claims, not people. Receipts in host-local paths do not travel: paste the decisive lines into the artifact that crosses.
 - **Risk classes are not equal.** Data loss, identity authority, false delivery success, install destruction, and secrets get fail-closed strength. Doc tense, future possibility, and total environment-byte binding get repaired when seen — they do not justify new gate machinery.
 
 ## Next and References
 
 - [NEXT.md](./NEXT.md) — current priority and exact next move; branch work uses disposable `NEXT--<branch>.md`.
 - [ROADMAP.md](./ROADMAP.md) — forward direction and deferred lanes.
+- [docs/adding-a-harness.md](./docs/adding-a-harness.md) — **first entry point for putting a NEW harness in the garden.** The order the eight steps are actually walked in (lane choice, vendor measurement, backend registration, birth, statusline, MCP hand, sender identity, receive, grade), what each owes before the next may start, and which of the other docs owns each slice. It routes; it grants nothing — Hard Rule 7 remains the authority on the meta-record store contract its registration step touches, and the gates and doctors it names remain the truth.
 - [docs/acp-backend-rail.md](./docs/acp-backend-rail.md) — ACP adapter contract and current entry conditions.
 - [DELIVERY.md](./DELIVERY.md) — delivery capability/evidence coordinates.
 - [VERIFY.md](./VERIFY.md) / [BASELINE.md](./BASELINE.md) — verification protocol and recorded evidence.

package/CHANGELOG.md

@@ -4,6 +4,155 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.15.1 — 2026-08-27
+
+This patch is the Linux install-honesty floor for #86: Entwurf installs itself only,
+`setup` composes harnesses the operator already chose, and a detected integration that
+cannot be completed makes the command non-green. It is not a new garden capability.
+macOS and native-Windows implementation move to #78; this cut makes no cross-platform
+support claim.
+
+### Changed
+
+- **`setup` is presence-driven composition, not recruitment.** Mode is a named
+  source-versus-installed branch before any prerequisite check or write. Each detected
+  harness (pi, Claude Code, Copilot, agy) is completed independently; absence is
+  zero-state SKIP; below-floor or incomplete is named FAIL and a nonzero exit. The old
+  unconditional `DONE ... green` is gone — the summary is computed from component
+  outcomes. Pi is optional-by-presence with the package-derived floor `>=0.84.3 <0.85`.
+  A detected Copilot composes all four native units (birth → MCP → receiver → visible
+  footer). Installed-package setup never runs npm/pnpm inside `node_modules`. (#86)
+- **The shared Pi user-scope registration has a recorded owner.** Silent
+  last-writer-wins normalization is retired. A second root's install/setup/remove refuses
+  with zero settings writes and names `takeover-user-scope`; only that explicit operator
+  verb moves the entry (old→new reported). The inverse removes only the recorded owner's
+  exact entry. (#86 C2)
+- **Setup no longer mutates credential stores.** The unconditional `sync_auth` path that
+  copied the Anthropic OAuth object to an `entwurf` alias is removed. Hosts that already
+  ran the legacy path keep the alias and `auth.json.bak` as a documented manual cleanup,
+  not an automated one. (#86 A5)
+
+### Added
+
+- **Copilot birth has a package-owned inverse.** `uninstall-copilot-bridge` uses the
+  qualified `plugin@marketplace` identity, runs a read-only ownership/safety preflight
+  before any vendor write, and refuses to remove an unproven foreign unit. Installer,
+  inverse, and doctor share one structural oracle. (#86 C3a)
+- **Packed-consumer and all-absent setup rows are first-class fixtures.**
+  `smoke-setup-verdict` and the installed `entwurf setup` path inside `check-pack-install`
+  prove absence, independence, false-success refusal, and the named installed-versus-source
+  branch without a model turn. That npm-consumer harness is the Linux install evidence
+  #78 waits on. (#86)
+
+### Fixed
+
+- **Source setup now exposes the `entwurf` operator command Copilot fresh requires.**
+  `./run.sh setup` manages `~/.local/bin/entwurf` as an ownership-checked symlink to the
+  current checkout's `run.sh`, with per-bin state and an honest inverse. npm consumers
+  already received this command through package bin linking; the missing source half caused
+  `entwurf_fresh_call {backend:"copilot"}` to reject `runtime-unresolved` unless an unrelated
+  global package happened to mask the defect. Source setup now fails loud when that
+  operator path is foreign, outside PATH, or shadowed; helper units are attempted
+  independently and a foreign helper is a named FAIL, never a warning followed by cosmetic
+  success. The managed `entwurf copilot` boundary and every fresh/preflight/delivery
+  contract are unchanged. Discovered while rechecking #82. (#86)
+
+### Verification
+
+- **`pnpm run check:full`** — PASS, exit 0, 252s standalone / 247s inside the gate
+  on the 0.15.1 versioned tree (HEAD `4a23af1` + uncommitted changelog/version).
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.15.1.hAAn7U --cut`** —
+  **MUST PASS=21 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.**
+  `check-gate-qualification` inside the gate killed **277/277** mutants across 33
+  lanes. Log: `/tmp/entwurf-release-gate-0.15.1.hAAn7U/release-gate.log`
+  (SHA-256 `aa1364922301e685c650670dd6556a3c27feacdf1481d850d8e2ef56ef5cb23e`).
+
+### Notes
+
+- #78 owns macOS and native-Windows implementation. WSL remains Linux evidence.
+- Native-harness doctors stay the per-leaf live-certification surface. Setup writes
+  artifacts; a new session is still required before `doctor-meta-bridge` / Copilot receive
+  can go green on a host that already had processes open.
+
+## 0.15.0 — 2026-08-25
+
+This release admits Copilot CLI as a full self-fetch garden citizen — birth, an owned
+MCP hand, record-backed sender identity, an installed first-party receive extension, and
+a visible-fresh launch path — closing #82, and fixes the fresh-launch YOLO regression the
+admission work exposed.
+
+### Added
+
+- **Copilot CLI is a self-fetch garden citizen.** `birthCopilotCitizen` upserts
+  `(backend:"copilot", nativeSessionId)` into the shared V3 record store, gives the
+  session a garden id, an owned `entwurf` MCP hand, a footer statusline slot showing that
+  id, and record-backed sender identity on every dispatched message. The receive rail is
+  an installed first-party extension (`run.sh install-copilot-receive`) that binds to the
+  V3 record, arms a watcher, and rings a doorbell the model drains with
+  `entwurf_inbox_read`; `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail —
+  armed sessions get `delivered`, unarmed or stale sessions get the honest
+  `mailbox-undeliverable` refusal. Launch is exclusively through the owned invocation
+  `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one
+  process; a session started any other way is silently inert by design, and
+  `doctor-copilot-receive` reads the live CLI environment to catch that class. (#82)
+- **Fresh Copilot siblings are admitted through the same preflight contract as birth.**
+  `copilot-fresh-preflight.ts` decides birth, MCP hand, receiver, and visible footer
+  BEFORE the tmux mutation, so a missing capability is a named refusal instead of a dead
+  window. `entwurf_fresh_call` takes one explicit model in Copilot's measured CLI dialect
+  (`--model <name>` beside `--interactive <prompt>`) and opens through `entwurf`'s own
+  managed invocation, never the bare vendor binary. (#82)
+- **Visible-fresh and D6 receive are LIVE-accepted on one host.** 2026-08-23 D6 receive
+  acceptance (garden `20260823T181316-d9f6ba`, CLI 1.0.80): `joined → armed → doorbell →
+  rang`, mailbox enqueue/read timestamps, and a model reply on the same
+  record/native/garden-id chain. 2026-08-25 visible-fresh acceptance: launch window `@89`,
+  nonce `mux-fresh-call-690529ae99f99faa2252aefb`, exact-callback garden
+  `20260825T085721-f68be0`, one `entwurf_v2` mailbox enqueue plus a same-garden reply, and
+  an operator-observed footer garden id on a healthy multi-turn window. Both rows are
+  evidence level L4 (one host) and stay unmerged; visible fresh is operator-metered and is
+  not a release-gate MUST.
+
+### Fixed
+
+- **Fresh Copilot siblings now default to `--yolo`, matching the profile a human gets
+  from `entwurf copilot`.** `mux-fresh-call.ts` previously passed a callback-only
+  `--allow-tool=entwurf-bridge(entwurf_v2)` grant, which caused `copilot-launch.sh`'s
+  explicit-policy scan to suppress its own `--yolo` injection — every task-tool call then
+  stopped on a confirmation prompt the new sibling could not answer, making it practically
+  unusable. GLG operator LIVE on 2026-08-25 confirmed the missing `YOLO` footer and the
+  per-task-tool stalls; the fix restores the default without adding a permission
+  parameter to the fresh-call API or changing the manual `entwurf copilot` override
+  behavior. (#82 follow-up)
+- **Pi runtime pin moves to `0.84.3`.** Certified development pin and closed peer range
+  are now `0.84.3` / `>=0.84.3 <0.85`. `compat.ts` stayed byte-identical at the previous
+  bump but `loader.ts` did not, so the diff was read and judged reachable before moving
+  the ceiling; the argument is not reused across bumps and each future ceiling move is
+  judged on its own diff.
+
+### Verification
+
+- **`pnpm run check:full`** — PASS, exit 0, 406s standalone on the prepared HEAD.
+- **`LIVE=1 ./run.sh release-gate <scratch> --cut`** — **MUST PASS=21 FAIL=0 SKIP=0,
+  BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** `check-gate-qualification` inside the gate
+  killed **252/252** mutants across 30 lanes. Log:
+  `/tmp/entwurf-release-gate-0.15.0.run2.fB2LLP/release-gate.log` (SHA-256
+  `9a00a22e8b4ca715ad0b955b51c99a2bacc385bf0c225180026948a4618e5ff6`).
+- A first attempt on the same prepared HEAD (scratch `.../entwurf-release-gate-0.15.0.7yUIFH`)
+  hit one MUST FAIL in `smoke-mux-lifecycle-live`'s cleanup launcher-integrity self-fence:
+  all 78 lifecycle assertions passed, but the Claude Code launcher symlink changed target
+  and content mid-run (`2.1.243`→`2.1.245`) because auto-update was still on the default
+  channel. GLG pinned `autoUpdatesChannel: stable` before the rerun above; this was an
+  environment race during the LIVE run, not a defect in the 0.15.0 candidate.
+
+### Notes
+
+- Copilot's D7 grade is PARTIAL: reply and read receipts are observed; completion
+  taxonomy and long-haul operation are not. D3 (second-session isolation of an owned
+  invocation) is PENDING — observed once, but the decisive log was lost to scratch
+  cleanup before it could be preserved; re-measurement is tracked outside this release.
+- #76 (subscription-first refusal of `openrouter/*` sibling launches), #78
+  (macOS/native-Windows portability evidence), #80 (public vocabulary), #83, #84, #85, and
+  the remaining #72 field-cause investigation stay outside this release.
+
 ## 0.14.2 — 2026-08-20
 
 This patch makes bridge availability a property of the exact invocation each harness will run, preserves child-exit facts across ACP transport closure, and records Copilot delivery as probe evidence without admitting a new citizen rail.

package/DELIVERY.md

@@ -74,14 +74,22 @@ D8 robustness: partial reason="..."
 
 ## Current matrix
 
+**Vocabulary.** *Owned* in this file names entwurf ownership of a concrete invocation,
+installer, or config writer. Historical receipts may say *managed* for that same ownership
+axis; neither word is an admission grade or a synonym of *supported*. A pre-contract probe
+can be owned without being supported; a supported harness still has to walk
+[`docs/adding-a-harness.md`](./docs/adding-a-harness.md) step 9.
+
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. |
-| **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No managed citizen lane yet. |
+| **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No owned native-citizen install/invocation lane. |
 | **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
-| **Copilot CLI TUI+server** | verified probe | D7; D8 unproven | **Old chronological-slice run; the named-turn probe in the tree is unrun.** Official SDK over hidden `--ui-server`: foreground native id + metadata, two-session addressed idle enqueue, same-session auto-model reply, completion events read back through the official session event-history API. Loopback RPC authentication is not established; no managed citizen lane. Evidence is L4 direct-native on ONE Linux workstation, host-local stdout, not archived. |
+| **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
+| **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
+| **Copilot CLI TUI+server** — *withdrawn lane, kept as evidence* | rejected | D7; D8 unproven | Older official-SDK probe over hidden `--ui-server`; idle enqueue worked, but loopback RPC authentication was not established. The bundled extension supersedes this candidate without reviving it. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 
 “Verified probe” means the transport worked in a reproducible raw probe but entwurf
@@ -112,7 +120,7 @@ directly through the native adapter, with one bounded re-probe retry. Replyabili
 `record-backed identity ∧ probe-alive`; mailbox state does not exist on this rail, and no
 rail has resume authority since the visible-first cut.
 
-The managed bridge, statusline, and hook installers own separate configuration atoms.
+The owned bridge, statusline, and hook installers own separate configuration atoms.
 Same-pid concurrent model invocation by multiple conversations is not claimed because
 the pid/start-key sender marker would be last-writer-wins. Current operator checks are
 in [BASELINE.md](./BASELINE.md); deterministic ownership and sender gates run in
@@ -123,65 +131,70 @@ in [BASELINE.md](./BASELINE.md); deterministic ownership and sender gates run in
 Do not describe “Codex” as one delivery shape. The measured app-server-backed TUI can
 accept `turn/start` for a live thread and report completion; the standalone embedded
 TUI exposed no equivalent receive route. This remains archived method evidence, not a
-shipping commitment: GLG closed the managed native Codex lane on 2026-08-01 because pi
+shipping commitment: GLG declined to own a native Codex invocation/install lane on 2026-08-01 because pi
 already supplies the official GPT provider path. Entwurf will not duplicate it as a
 native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wake.
 
-### Copilot CLI: TUI+server is the positive launch mode
-
-**Two things are recorded here and they are not the same thing: what was MEASURED on
-2026-08-19, and what the probe now CONTRACTS to measure.** The measurement below was
-taken with the earlier chronological-slice probe, which scored the events following the
-marker's position in the history. The current probe scores a named turn instead (next
-subsection). No result below has been re-taken under that contract, and none of it is
-retroactively a demonstration of it.
-
-**Measured 2026-08-19 (old chronological-slice probe).** A plain Copilot TUI and shell
-command hooks do not establish the measured route. CLI 1.0.80 launched with hidden
-`--ui-server --port <port>` and joined by first-party `@github/copilot-sdk` 1.0.11 did:
-protocol-v3 ping, foreground session id plus cwd/git metadata, exact session resume, idle
-`enqueue`, same-session model-`auto` reply, and `assistant.message`/`turn_end`/`session.idle`
-completion. A second run created a no-turn control session B, targeted A, and proved B
-received no user/turn/assistant event, closing D3 on one Linux workstation.
-
-The two-session shape also exposed a D8 gap: A visibly replied and persisted
-`assistant.message` + `turn_end`, but the joining SDK client did not receive ephemeral
-`session.idle`, so SDK `sendAndWait()` timed out. Bounded reads of the official session
-event-history API (`session.getEvents()` / `getMessages()`) then observed the completed
-target turn. Claim that at its real size: it is the SDK's own full event history, not a
-narrower or more privileged view, and equally not TUI, file, or database transcript
-scraping — the probe never reads Copilot's own storage. It is probe evidence, not a
-product polling/retry design.
-
-**Evidence level for everything above: L4 direct-native, ONE Linux workstation, one run.**
-The receipt is host-local probe stdout; it was not archived as a durable artifact, so this
-row is reproducible-by-instruction, not citable to a stored file.
-
-**Current probe contract (not yet run LIVE).** Attribution is now a named chain rather
-than a position in the history: the probe's unique marker body must match exactly one
-`user.message`; that event's `interactionId` must open exactly one `assistant.turn_start`;
-that turn_start must expose a `turnId`; and only `assistant.message` / `assistant.turn_end`
-carrying that `turnId` are scored. Every link is required, and absent-or-ambiguous fails
-the probe closed — there is no positional fallback and no "the turn after ours" rule.
-Note what is deliberately NOT the key: `session.send()` resolves to the SDK's own
-submission handle, a string that appears on no server event and is a different axis from
-`user.message.id`/`interactionId`, so joining on it cannot hold. It is logged as a
-diagnostic only. The next LIVE turn is what would demonstrate this contract; until then
-it is a design, not evidence.
-
-The probe also stays out of the operator's lifecycle, stated precisely: it never deletes
-target session A and issues no `A.disconnect()` of its own. `client.stop()` does tear down
-every tracked session — A included — as a wire `session.destroy`; because A's foreground
-ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
-session, so the net effect on A is detach-equivalent, not removal.
-
-This is not yet admissible as a native-push adapter. The flag is hidden from CLI help,
-and the loopback JSON-RPC server did not enforce the SDK connection token in the
-measured launch: an unauthenticated client connected, while a token-bearing client was
-rejected as `AUTHENTICATION_NOT_CONFIGURED`. The TCP port is only a runtime endpoint,
-never identity authority. Do not add a record backend or dispatch route until
-permission ownership, stale/crash handling, and a supported fail-closed local
-boundary are demonstrated.
+### Copilot CLI: one citizen, two rails, one pending receipt
+
+The branch product owns the native citizen's birth, garden id, statusline, MCP hand,
+outbound sender identity — and, since RAIL 5, the receiver. A real Copilot CLI 1.0.80
+session minted a V3 record and sent under that record-backed garden id on 2026-08-21.
+That proved who SENDS. Whether a reply LANDS is a different fact on a different process,
+and the paragraphs below are the two halves of it: where the transport came from, and
+what the owned product unit had to add before it could be dispatched to.
+
+The missing receive transport was found and measured on 2026-08-23. Copilot's platform
+package bundles its first-party extension SDK and bootstrap. With
+`COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS`, the CLI forks an installed extension and
+speaks JSON-RPC over the child's stdio; `joinSession()` binds the foreground session, and
+the vendor-documented `fs.watch` → `session.send({mode:"enqueue"})` pattern wakes it.
+An idle, never-typed-into session received a unique marker and returned it, then emitted
+`session.idle`. A second armed process was observed to remain untouched, but its decisive
+B log was not preserved before scratch cleanup, so D3 isolation remains an admission
+rerun rather than a durable acceptance. This is L4 direct-native evidence on one Linux
+workstation. The travelling receipt and reproduction are in
+[`scripts/raw-async-delivery/README.md`](./scripts/raw-async-delivery/README.md).
+
+This extension rail has no network listener, so the rejected `--ui-server` loopback
+transport's authentication blocker does not apply. The owned product unit then took that
+transport and gave it the obligations a product owes (#82 RAIL 5):
+
+- **Artifact.** `run.sh install-copilot-receive` installs the receiver into the user
+  extensions directory from an install-state file it owns, refuses a unit it did not
+  put there, and removes only what that state names.
+- **Identity.** The extension arms only when the CLI pid's sender marker, the V3 record
+  and the SDK's `session.sessionId` all agree; a drifted id or a parent-pid carrier that
+  disagrees with the real parent is a refusal, logged, never a best guess.
+- **Liveness.** The marker's owner is the EXTENSION child — the process that actually
+  holds the watch — so a crashed receiver stops being deliverable at the next start-key
+  read, and the vendor's bootstrap already exits that child when the CLI goes.
+- **Dispatch.** `wakeMode: self-fetch` puts Copilot on the existing mailbox rail. Armed
+  and matching → enqueue + doorbell; anything else → `mailbox-undeliverable`.
+- **The flag.** entwurf still does not own the operator's shell and writes nothing to it,
+  but it owns ONE invocation: `entwurf copilot` execs the vendor CLI in the caller's own
+  terminal with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` set for that process only,
+  and refuses to launch at all unless the receiver unit it is promising is really
+  installed. `doctor-copilot-receive` still reads the live CLI environments, because a
+  session started any other way without the flag is silently inert. Plain `copilot` is
+  untouched; running the owned invocation IS the consent to its profile (EXTENSIONS,
+  `--model auto` when no model was given, `--yolo` when no explicit permission or surface
+  policy flag was given).
+
+The owned receive invocation has now been accepted LIVE (2026-08-23, receipts in the matrix row
+above), which is what moved receive from D0 to D6. Visible fresh is a later, separate LIVE
+(2026-08-25, same row) and does not reopen D3 or D8. What remains owed is still EVIDENCE,
+not code: D3 isolation lost its decisive log to a scratch cleanup and is pending, and the
+active-turn case, `/clear` re-arm and flag durability across vendor releases are
+unmeasured. The hermetic gate drives the real installer and the real extension against a
+stubbed SDK — it proves everything on entwurf's side of the fork and nothing about the
+vendor turn on the other side of it, so a green gate is still not a wake.
+
+The hidden `--ui-server` probe remains retired evidence, not a fallback. It found a real
+idle-enqueue capability through an unauthenticated loopback door; the extension finds the
+same class of capability through the CLI-owned stdio lifecycle. Absence of Claude's
+`FileChanged` / `asyncRewake` / `watchPaths` therefore means only that Claude's hook
+mechanism cannot be copied — it never proved Copilot had no vendor wake surface.
 
 ## Recording a new claim