@junghanacs/entwurf 0.14.2 → 0.15.1

package/scripts/mutants/copilot-receive.json

@@ -0,0 +1,263 @@
+{
+	"schemaVersion": 1,
+	"lane": "copilot-receive",
+	"mutants": [
+		{
+			"claim": "COPILOT-RECEIVE-VENDOR-ENTRY-NAME",
+			"title": "installing the receiver under any other file name produces a unit Copilot never discovers — the vendor scans subdirectories for `extension.mjs` and says nothing when it finds none",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": ["\tcp \"$SRC/extension.mjs\" \"$stage/extension.mjs\""],
+			"replace": ["\tcp \"$SRC/extension.mjs\" \"$stage/index.mjs\""],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-VENDOR-ENTRY-NAME]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-INSTALL-REFUSES-FOREIGN",
+			"title": "overwriting an unclaimed unit of the same name deletes somebody else's extension and installs ours in its place",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\tif [ -e \"$DEST\" ] && [ ! -f \"$STATE_FILE\" ]; then",
+				"\t\tfail \"$DEST already exists and no entwurf install-state claims it. Refusing to overwrite an extension this installer did not put there.\"",
+				"\tfi"
+			],
+			"replace": ["\t# an unclaimed unit is assumed to be ours"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-INSTALL-REFUSES-FOREIGN]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-ARMS-AFTER-BIRTH",
+			"title": "arming only at join leaves every ordinary session unarmed forever: a Copilot citizen is born on its FIRST PROMPT, which is always after the extension has already joined",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": [
+				"for (const type of [\"user.message\", \"assistant.turn_start\", \"assistant.message\", \"session.idle\"]) {",
+				"\tsession.on(type, () => armOnce(type));",
+				"}"
+			],
+			"replace": ["// one shot at join, no retry"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-ARMS-AFTER-BIRTH]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-OWNER-IS-WATCHER",
+			"title": "naming the CLI as the marker's owner keeps a crashed extension 'armed' for as long as the TUI stays open — the citizen reads deliverable while nothing is watching its mailbox",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": ["\t\t\townerPid: process.pid,"],
+			"replace": ["\t\t\townerPid: hostPid,"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-OWNER-IS-WATCHER]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-WAKE-MODE-SELF-FETCH",
+			"title": "a copilot row that still says direct-inject routes every dispatch into the fail-closed refusal — the armed receiver exists and no reply can ever reach it",
+			"subject": "pi/entwurf-capabilities.json",
+			"find": [
+				"\t\t\"copilot\": { \"wakeMode\": \"self-fetch\", \"deliveryLevel\": \"D6\", \"nativeIdLabel\": \"sessionId\" },"
+			],
+			"replace": [
+				"\t\t\"copilot\": { \"wakeMode\": \"direct-inject\", \"deliveryLevel\": \"D6\", \"nativeIdLabel\": \"sessionId\" },"
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-WAKE-MODE-SELF-FETCH]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOORBELL-NOT-BODY",
+			"title": "putting the message body in the doorbell turns a self-fetch announcement into an injection: untrusted content lands in the model's context with no read receipt, and `wakeMode: self-fetch` becomes a false label",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": [
+				"\t\t\t\t\t`[entwurf inbox] ${unread} unread mailbox ${plural} available for garden ${armed.gardenId}. ` +"
+			],
+			"replace": [
+				"\t\t\t\t\t(await import(\"node:fs\")).readFileSync(path.join(armed.mailbox, `${fresh[0]}.delivered`), \"utf8\") +",
+				"\t\t\t\t\t`[entwurf inbox] ${unread} unread mailbox ${plural} available for garden ${armed.gardenId}. ` +"
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOORBELL-NOT-BODY]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-NO-STALE-RERING",
+			"title": "ringing on any signal change re-announces a backlog the model already declined to read — every unrelated poke wakes an idle session for nothing",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": ["\t\t\tif (fresh.length === 0) return;"],
+			"replace": ["\t\t\t// ring on every poke, fresh body or not"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-NO-STALE-RERING]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-REFUSES-ID-DRIFT",
+			"title": "arming when the SDK session id disagrees with the marker's native id tells a sender that a reply lands in a session that will never see it",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": [
+				"\tif (marker.nativeSessionId !== sessionId) {",
+				"\t\treturn {",
+				"\t\t\tidentity: null,",
+				"\t\t\treason: `id-drift marker=${marker.nativeSessionId} sdk=${sessionId}`,",
+				"\t\t};",
+				"\t}"
+			],
+			"replace": ["\t// a drifted id is tolerated: the marker wins"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-REFUSES-ID-DRIFT]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-REFUSES-FOREIGN-PARENT",
+			"title": "trusting a parent-pid carrier that disagrees with the real parent lets a reparented or hand-run extension arm under somebody else's citizen",
+			"subject": "pi/copilot-receive/entwurf-receive/extension.mjs",
+			"find": [
+				"\tif (Number.isSafeInteger(declared) && declared > 0 && declared !== actual) {",
+				"\t\tlogLine(\"WARN\", `arm-refused: COPILOT_EXTENSION_PARENT_PID=${declared} disagrees with ppid ${actual}`);",
+				"\t\treturn null;",
+				"\t}"
+			],
+			"replace": ["\t// a disagreeing carrier is tolerated"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-REFUSES-FOREIGN-PARENT]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DEAD-EXTENSION-REFUSED",
+			"title": "dropping the receiver marker's liveness guard makes a dead watcher's marker read as an ACTIVE receiver — replies to a closed Copilot session are enqueued into a void and reported as delivered",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"\t\t// as an ACTIVE RECEIVER and pull the mailbox rail into delivering to a void.",
+				"\t\tif (!isPlausibleOwnerPid(marker.ownerPid)) return null;",
+				"\t\tif (opts.verifyOwner !== false) {",
+				"\t\t\tconst liveKey = processStartKey(marker.ownerPid);",
+				"\t\t\tif (!liveKey || liveKey !== marker.ownerStartKey) return null;",
+				"\t\t}"
+			],
+			"replace": [
+				"\t\t// as an ACTIVE RECEIVER and pull the mailbox rail into delivering to a void.",
+				"\t\tif (!isPlausibleOwnerPid(marker.ownerPid)) return null;"
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DEAD-EXTENSION-REFUSED]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-CATCHES-STALE-WRITER",
+			"title": "reporting a stale deployed writer as ordinary state hides the one failure that has no other symptom: the arm throws inside the extension and the citizen simply never becomes deliverable",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\t\t\t\tbad \"the deployed writer is STALE: unit has ${dep:0:12}, this checkout builds ${cur:0:12}. An arm can fail on a contract the deployed copy does not know, and the only symptom is a session that never becomes deliverable. Re-run ./run.sh install-copilot-receive\""
+			],
+			"replace": ["\t\t\t\tnote \"the deployed writer differs from this checkout's (${dep:0:12} vs ${cur:0:12})\""],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-CATCHES-STALE-WRITER]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-SEES-MISSING-FLAG",
+			"title": "downgrading a CLI launched without the scan flag to a note leaves the vendor's own silence unchallenged — the receiver is installed, nothing arms, and no surface anywhere says why",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\t\t\t\tbad \"$armed_missing live Copilot CLI process(es) lack $FLAG_ENV=$FLAG_VALUE while the receiver is installed (pids: $missing_pids) — relaunch them with 'entwurf copilot', or uninstall the receiver so nothing promises a doorbell\""
+			],
+			"replace": ["\t\t\t\tnote \"$armed_missing live Copilot CLI process(es) lack $FLAG_ENV=$FLAG_VALUE\""],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-SEES-MISSING-FLAG]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-PASSES-CLEAN-LOG",
+			"title": "a doctor that dies mid-script on a healthy host prints no verdict at all — under `set -euo pipefail` an unguarded no-match grep (exit 1) ends the run before the PASS line, so the operator cannot tell 'fine' from 'crashed' and the silent death returns with the first zero-count log",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\t\ttotal_err=\"$({ grep -c ' ERROR \\[copilot-receive\\] ' \"$RECEIVE_LOG\" 2>/dev/null || [ \"$?\" -eq 1 ]; } | head -1)\""
+			],
+			"replace": [
+				"\t\ttotal_err=\"$(grep -c ' ERROR \\[copilot-receive\\] ' \"$RECEIVE_LOG\" 2>/dev/null | head -1)\""
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-PASSES-CLEAN-LOG]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-FINDS-EXECED-NATIVE",
+			"title": "identifying the CLI by command name finds nothing at all — the vendor shim execs node, so the surviving process never carries the name `copilot`, and the detector built to break a vendor silence reports the benign 'no live copilot' note forever",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\tis_native = any(\"/@github/copilot/\" in a and a.endswith(\".js\") for a in argv)",
+				"\tif not is_native and os.path.basename(argv[0]) == \"copilot\":",
+				"\t\tis_native = True"
+			],
+			"replace": ["\tis_native = os.path.basename(argv[0]) == \"copilot\""],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-FINDS-EXECED-NATIVE]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-EXCLUDES-EXTENSION-CHILD",
+			"title": "counting our own extension children as Copilot sessions makes the doctor blame the operator for sessions that do not exist — every armed receiver would report itself as a CLI launched without the scan flag",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": ["\tif any(a.endswith(\"extension.mjs\") for a in argv):", "\t\tcontinue"],
+			"replace": ["\t# an extension child is close enough to a session"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-EXCLUDES-EXTENSION-CHILD]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-UNREADABLE-ENVIRON-IS-RED",
+			"title": "downgrading an identified CLI whose environment cannot be read to a note lets the doctor end in PASS while a session that can never arm is running — identity already succeeded, so 'unknown' here is the exact question the section exists to answer",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\t\t\t\tbad \"$unreadable live Copilot CLI process(es) have an unreadable environment (pids: $unreadable_pids) — their $FLAG_ENV state is UNKNOWN and is NOT assumed armed. Re-run this doctor as the user that owns those sessions.\""
+			],
+			"replace": [
+				"\t\t\t\tnote \"$unreadable live Copilot CLI process(es) have an unreadable environment (pids: $unreadable_pids) — their $FLAG_ENV state is UNKNOWN and is NOT assumed armed. Re-run this doctor as the user that owns those sessions.\""
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ENVIRON-IS-RED]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-OWNS-SCANNER-FAILURE",
+			"title": "letting the scanner's exit status reach the assignment under `set -e` kills the doctor mid-section: no verdict line is printed at all, so the operator cannot tell a healthy host from a broken doctor — the same silent-death shape this lane already fixed once in the log grep",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": ["PY\n)\" || scan_rc=$?"],
+			"replace": ["PY\n)\""],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-OWNS-SCANNER-FAILURE]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-PI-CARRIER-IS-RED",
+			"title": "downgrading inherited PI_SESSION_ID/PI_AGENT_ID to a note lets an armed Copilot speak under the parent pi garden id while the doctor still ends PASS — the flag axis cannot absorb this",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": [
+				"\t\t\t\tbad \"$contaminated live Copilot CLI process(es) inherited PI_SESSION_ID/PI_AGENT_ID (pids: $contaminated_pids) — they can speak under the PARENT pi citizen's garden id even with a correct native marker. Relaunch them with 'entwurf copilot', which unsets both before exec; a raw 'copilot' started from a pi citizen's shell is unsupported.\""
+			],
+			"replace": [
+				"\t\t\t\tnote \"$contaminated live Copilot CLI process(es) inherited PI_SESSION_ID/PI_AGENT_ID (pids: $contaminated_pids)\""
+			],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-PI-CARRIER-IS-RED]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		}
+	]
+}

package/scripts/mutants/fresh-cut.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "fresh-cut",
+	"mutants": [
+		{
+			"claim": "FRESH-CUT-COLLISION-NO-MOVE",
+			"title": "preflighting only the FIRST planned destination lets an occupied second destination through: the cut renames over it and reports a clean generation",
+			"subject": "scripts/meta-bridge-fresh-cut.ts",
+			"find": ["\tconst collisions = plan.filter(({ dest }) => archiveDestOccupied(dest));"],
+			"replace": ["\tconst collisions = plan.slice(0, 1).filter(({ dest }) => archiveDestOccupied(dest));"],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESH-CUT-COLLISION-NO-MOVE]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		}
+	]
+}

package/scripts/mutants/mux-fresh-call.json

@@ -147,7 +147,7 @@
 			"title": "native pi drops the required model field from fresh-call while the composition still expects one",
 			"subject": "pi-extensions/entwurf-control.ts",
 			"find": [
-				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription: \"Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias.\",\n\t\t\t}),\n"
+				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t}),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -173,7 +173,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\"Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias.\"),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -224,6 +224,220 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:VITEST-FAILED-TITLE-ATTRIBUTION]",
 			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-MANAGED-RUNTIME",
+			"title": "fresh call opens the BARE vendor instead of entwurf's managed invocation — the window opens, the EXTENSIONS scan is skipped silently, and the sibling can never be delivered to",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tcopilot: \"entwurf\","],
+			"replace": ["\tcopilot: \"copilot\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-MANAGED-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-ARGV-INTERACTIVE",
+			"title": "the Copilot prompt rides -p instead of --interactive — the turn runs and the CLI EXITS, closing the window on a sibling that was supposed to stay open",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"-p\", prompt, \"--model\", model, \"--yolo\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-ARGV-INTERACTIVE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-MODEL-ARGV",
+			"title": "the Copilot argv drops the explicit model — the managed launcher then injects `--model auto` and the caller's model choice is silently discarded",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--yolo\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-MODEL-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-YOLO-POLICY",
+			"title": "the policy token narrows back to the callback-only --allow-tool grant — the exact regression GLG measured on 2026-08-25: no YOLO in the footer, a confirmation prompt at every task tool, an impractical sibling",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": [
+				"\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--allow-tool=entwurf-bridge(entwurf_v2)\"];"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-YOLO-POLICY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-CALLBACK-TOOL",
+			"title": "the Copilot callback names Claude Code's `mcp__server__tool` spelling — a dialect copied instead of measured, and the whole first turn is spent looking for a tool that is not there",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tcopilot: \"entwurf-bridge-entwurf_v2\","],
+			"replace": ["\tcopilot: \"mcp__entwurf-bridge__entwurf_v2\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-CALLBACK-TOOL]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-PREFLIGHT-PREMUTATION",
+			"title": "the capability preflight is removed — a host missing the birth, MCP, receiver or footer unit gets a real window and a launch receipt for a sibling that can never call home",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": [
+				"\tif (params.backend === \"copilot\") {\n\t\tconst missing = copilotFreshPreflight(env);\n\t\tif (missing) return { ok: false, reason: missing };\n\t}\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-PREFLIGHT-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-PREFLIGHT-AFTER-RUNTIME",
+			"title": "the preflight runs before the runtime is proven — an operator with no entwurf at all is told to install a Copilot unit, which is the wrong repair",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tlet runtimePath: string;"],
+			"replace": [
+				"\tif (params.backend === \"copilot\") {\n\t\tconst early = copilotFreshPreflight(env);\n\t\tif (early) return { ok: false, reason: early };\n\t}\n\tlet runtimePath: string;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-PREFLIGHT-AFTER-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
+			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\"])"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-VISIBLE-IDENTITY-EFFECTIVE",
+			"title": "the visible-identity axis gates on entwurf's ownership RECEIPT instead of the settings Copilot actually reads — a host with a correct, resolvable footer and no install-state is refused for a working identity surface (measured: that is the acceptance host)",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (state === null) return false; // absent state is not drift — see the doc comment above"],
+			"replace": ["\tif (state === null) return true;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-VISIBLE-IDENTITY-EFFECTIVE]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-VISIBLE-IDENTITY-REQUIRED",
+			"title": "the visible-identity axis is dropped entirely — a Copilot citizen is admitted whose garden id can only be found by scraping records, which step 4 refuses to call lifecycle parity",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-VISIBLE-IDENTITY-REQUIRED]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-MCP-CONFIG-DRIFT",
+			"title": "the MCP axis trusts the install-state alone — a config that lost the server key still reads as installed, and the first turn calls a tool that is not registered",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (!Object.hasOwn(servers as Record<string, unknown>, MCP_SERVER_KEY)) return \"copilot-mcp-hand-missing\";"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-MCP-CONFIG-DRIFT]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-BIRTH-AXIS",
+			"title": "the birth axis is satisfied by the directory alone — an assembly root with no hooks.json passes as a hook unit, so a host that cannot mint a record reads as ready",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\tif (!isDir(birthUnit) || !existsSync(path.join(birthUnit, \"hooks\", \"hooks.json\"))) {"],
+			"replace": ["\tif (!isDir(birthUnit)) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-BIRTH-AXIS]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-RECEIVE-PATH-MISMATCH",
+			"title": "the receive axis ignores the launcher's DEST equality — a unit in a different extensions root than this env will scan still preflights green, then entwurf copilot refuses inside the new window",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tconst dest = receiveDest(env);\n\tif (dest === null || recvPath !== dest) return \"copilot-receive-unit-missing\";\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-RECEIVE-PATH-MISMATCH]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-RECEIVE-AXIS",
+			"title": "the receive axis is satisfied by the directory alone — a leftover folder with no extension.mjs passes as our unit, so a host that cannot arm still reads as ready",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (!isDir(recvPath) || !existsSync(path.join(recvPath, \"extension.mjs\"))) return \"copilot-receive-unit-missing\";"
+			],
+			"replace": ["\tif (!isDir(recvPath)) return \"copilot-receive-unit-missing\";"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-RECEIVE-AXIS]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-COMPLETE-HOST-PASSES",
+			"title": "a correctly wired host is still refused — the preflight becomes a permanent closed door wearing a check's clothes",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": [
+				"\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";\n\n\treturn null;"
+			],
+			"replace": [
+				"\tif (visibleIdentityMissing(env, data)) return \"copilot-visible-identity-missing\";\n\n\treturn \"copilot-birth-unit-missing\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-COMPLETE-HOST-PASSES]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "COPILOT-PREFLIGHT-STATUSLINE-STATE-DRIFT",
+			"title": "an install-state that manages a different settings file is accepted — two files then disagree about who owns the footer and the preflight pretends they do not",
+			"subject": "pi-extensions/lib/copilot-fresh-preflight.ts",
+			"find": ["\treturn path.resolve(managed) !== path.resolve(settingsPath);"],
+			"replace": ["\treturn false;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:COPILOT-PREFLIGHT-STATUSLINE-STATE-DRIFT]",
+			"signatureSource": "test/copilot-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-COPILOT-EXPLICIT-POLICY",
+			"title": "the composition stops stating its policy and silently leans on the launcher to inject --yolo — the effective profile survives but the fresh contract loses its explicit permission statement",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model, \"--yolo\"];"],
+			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", prompt, \"--model\", model];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-COPILOT-EXPLICIT-POLICY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI",
+			"title": "a backend the composition can open is missing from the native pi surface enum — an in-process pi session cannot name a capability the module already opens",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\"], {"],
+			"replace": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\"], {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/pack-install.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "pack-install",
+	"mutants": [
+		{
+			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
+			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.84.30 reads as the pinned 0.84.3 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
+			"subject": "run.sh",
+			"find": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.84\\.3(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -v '@0\\.84\\.3' || true"],
+			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
+			"signatureSource": "run.sh"
+		}
+	]
+}

package/scripts/mutants/pi-package-ownership.json

@@ -0,0 +1,92 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-package-ownership",
+	"mutants": [
+		{
+			"claim": "SILENT-TAKEOVER",
+			"title": "a normal user-scope install silently replaces another LIVE root's registration, resurrecting the last-writer-wins takeover the #86 C2 ownership contract retires (only the operator-explicit takeover-user-scope may move the shared entry)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        if os.path.isdir(owner):\n            _refuse(6, \"register-pi-package: the user-scope entwurf registration is owned by another LIVE root: \"\n                       f\"{owner}. Normal install/setup never replaces another owner — zero settings bytes written. \"\n                       f\"Run './run.sh takeover-user-scope' from {repo_dir} to explicitly move the shared entry.\")"
+			],
+			"replace": [
+				"        if os.path.isdir(owner):\n            return register_user(settings_path, repo_dir_arg, state_path, True)"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SILENT-TAKEOVER]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "FOREIGN-INVERSE-REMOVE",
+			"title": "an old root's inverse removes the CURRENT live owner's user-scope registration, so one stale checkout's remove-user-scope deletes the shared entry every other project depends on",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        if os.path.isdir(owner):\n            _refuse(6, \"register-pi-package: the user-scope registration is owned by another LIVE root: \"\n                       f\"{owner}. This root's inverse must not remove someone else's registration — zero settings \"\n                       \"bytes written. Run remove from that root, or take the entry over first.\")"
+			],
+			"replace": [
+				"        if os.path.isdir(owner):\n            n, kept = remove(settings_path, owner)\n            state_path.unlink()\n            print(f\"remove: removed {n} entries (foreign owner ignored)\")\n            return 0"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:FOREIGN-INVERSE-REMOVE]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "BROAD-INSTALL-COLLAPSE",
+			"title": "a same-owner user-scope install routes through the broad project-scope register() collapse, so a second entwurf-shaped root in the GLOBAL packages[] is silently deleted as collateral of an ordinary install — the exact transition B reproduced against 096a5cd (#86 C2 corrective amendment, blocker 1)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"            _require_user_owner_entry(settings_path, owner)\n            if preflight:\n                print(\"preflight: install ok (this root owns one unambiguous registration)\")\n                return 0\n            print(f\"install: entwurf package already registered (no-op) -> {repo_dir}\")\n            return 0"
+			],
+			"replace": [
+				"            if preflight:\n                print(\"preflight: install ok (this root owns one unambiguous registration)\")\n                return 0\n            register(settings_path, repo_dir_arg)\n            print(f\"install: entwurf package already registered (no-op) -> {repo_dir}\")\n            return 0"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:BROAD-INSTALL-COLLAPSE]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "BROAD-DOCTOR-GREEN",
+			"title": "doctor-pi-package judges the recorded owner through the broad entwurf-shape matcher, so a store whose exact owner entry is GONE but which still holds some other entwurf-shaped root reads owned/exit-0 while the inverse refuses the very same state — contradictory verdicts on one store (#86 C2 corrective amendment, blocker 2)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"    owner_exact, owner_extra = _classify_user_owner_entries(settings_path, owner)\n    if len(owner_exact) != 1 or owner_extra:\n        print(f\"doctor-pi-package: mismatch — owner state records {owner} but the settings hold \"\n              f\"{len(owner_exact)} exact entr{'y' if len(owner_exact) == 1 else 'ies'} and \"\n              f\"{len(owner_extra)} additional entwurf-shaped entr{'y' if len(owner_extra) == 1 else 'ies'} \"\n              \"(expected exactly one exact entry and no other entwurf-shaped root)\")\n        return 1"
+			],
+			"replace": [
+				"    owner_matches = _entwurf_matches(packages, owner, settings_dir)\n    if not owner_matches:\n        print(f\"doctor-pi-package: mismatch — owner state records {owner} but no packages[] entry names it\")\n        return 1"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:BROAD-DOCTOR-GREEN]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "PROVIDER-ROOT-TYPE-FAIL-OPEN",
+			"title": "the typed installerRoot classifier reports a wrong-TYPE value (number, empty string, bool, object, array) as LEGACY instead of CORRUPT, so provider install adopts and rebinds an unattributed state, remove proceeds on it, and the doctor coupling stays silent — the fall-through B reproduced against 096a5cd (#86 C2 corrective amendment, blocker 3)",
+			"subject": "scripts/pi_settings_io.py",
+			"find": ["    if isinstance(root, str) and root:\n        return \"owner\", root\n    return \"corrupt\", None"],
+			"replace": [
+				"    if isinstance(root, str) and root:\n        return \"owner\", root\n    return \"legacy\", None"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PROVIDER-ROOT-TYPE-FAIL-OPEN]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "MISSING-OWNER-AUTO-TAKEOVER",
+			"title": "a normal install auto-claims a MISSING owner's registration, turning every moved or deleted checkout into a silent ownership transfer instead of the named missing-owner verdict plus explicit takeover/orphan path",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        _refuse(6, \"register-pi-package: the user-scope entwurf registration is owned by a MISSING root: \"\n                   f\"{owner} (doctor verdict: missing-owner). Normal install/setup still refuses — zero settings \"\n                   \"bytes written. Use './run.sh takeover-user-scope' to claim it explicitly, or \"\n                   \"'./run.sh remove-user-scope' for the aligned orphan cleanup.\")"
+			],
+			"replace": ["        return register_user(settings_path, repo_dir_arg, state_path, True)"],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MISSING-OWNER-AUTO-TAKEOVER]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		}
+	]
+}