@junghanacs/entwurf 0.14.2 → 0.15.1

package/scripts/smoke-copilot-mcp-state.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# smoke-copilot-mcp-state — hermetic install/doctor/inverse contract for
+# the Copilot MCP-config adapter. No Copilot process or model turn.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RUN="$REPO_DIR/run.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export COPILOT_MCP_CONFIG="$HOME/.copilot/mcp-config.json"
+export COPILOT_MCP_COMMAND="entwurf-bridge"
+STATE="$XDG_DATA_HOME/entwurf/copilot-mcp/install-state.json"
+mkdir -p "$(dirname "$COPILOT_MCP_CONFIG")" "$SB/bin"
+
+write_mcp_fake() {
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_dead_fake() {
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+echo "bash: /nonexistent/entwurf-bridge: No such file or directory" >&2
+exit 127
+FAKE
+  chmod +x "$1"
+}
+write_mcp_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+
+_clean_path=""
+while IFS= read -r dir; do
+  [ -n "$dir" ] || continue
+  [ -e "$dir/$COPILOT_MCP_COMMAND" ] || [ -L "$dir/$COPILOT_MCP_COMMAND" ] && continue
+  _clean_path="${_clean_path:+$_clean_path:}$dir"
+done < <(printf '%s\n' "$PATH" | tr ':' '\n')
+export PATH="$SB/bin:$_clean_path"
+
+write_config() {
+  printf '{\n  "mcpServers": {\n    "other": { "type": "local", "command": "keep-me" },\n    "entwurf-bridge": { "type": "local", "command": "manual-bridge", "args": [] }\n  }\n}\n' > "$COPILOT_MCP_CONFIG"
+}
+json() { python3 - "$COPILOT_MCP_CONFIG" "$@" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1]))
+mode = sys.argv[2]
+servers = data["mcpServers"]
+ours = {"type": "local", "command": "entwurf-bridge", "args": []}
+if mode == "installed":
+    assert servers["entwurf-bridge"] == ours
+    assert servers["other"] == {"type": "local", "command": "keep-me"}
+    assert set(data.keys()) == {"mcpServers"}
+elif mode == "manual":
+    assert servers["entwurf-bridge"] == {"type": "local", "command": "manual-bridge", "args": []}
+    assert servers["other"] == {"type": "local", "command": "keep-me"}
+elif mode == "created":
+    assert data == {"mcpServers": {"entwurf-bridge": ours}}
+else:
+    raise AssertionError(mode)
+PY
+}
+
+# Existing matching/manual config is adopted, not treated as a fresh file.
+write_config
+"$RUN" doctor-copilot-mcp >/dev/null
+want "unowned manual config doctor is an honest note" "[ $? -eq 0 ]"
+"$RUN" install-copilot-mcp >/dev/null
+json installed
+want "install adopts regular config and preserves unrelated servers" "[ $? -eq 0 ]"
+want "install writes state" "[ -f '$STATE' ]"
+"$RUN" doctor-copilot-mcp >/dev/null
+want "owned configured doctor is green" "[ $? -eq 0 ]"
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["preimage"] == {"type": "local", "command": "manual-bridge", "args": []}
+assert state["serverKey"] == "entwurf-bridge"
+PY
+ok "first install captures manual entwurf-bridge preimage"
+"$RUN" install-copilot-mcp >/dev/null
+"$RUN" uninstall-copilot-mcp >/dev/null
+json manual
+want "reinstall keeps the first preimage for inverse" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# The live-host shape is already our command with no state: adopt that exact preimage too.
+write_config
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"local","command":"entwurf-bridge","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+"$RUN" install-copilot-mcp >/dev/null
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["preimage"] == {"type": "local", "command": "entwurf-bridge", "args": []}
+PY
+"$RUN" uninstall-copilot-mcp >/dev/null
+json installed
+want "matching manual Copilot MCP config is adopted and restored unchanged" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# State turns a later config drift into a red doctor rather than a silent pass.
+write_config
+"$RUN" install-copilot-mcp >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"stdio","command":"entwurf-bridge","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "type=stdio doctor should fail"; fi
+ok "state-present type=stdio entry is red"
+"$RUN" install-copilot-mcp >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["mcpServers"]["entwurf-bridge"]={"type":"local","command":"other","args":[]}; json.dump(d,open(p,"w"))' "$COPILOT_MCP_CONFIG"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "command drift doctor should fail"; fi
+ok "state-present command drift is red"
+"$RUN" install-copilot-mcp >/dev/null
+
+# A stable-bin command that boots then dies is red without touching config.
+write_dead_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+if "$RUN" doctor-copilot-mcp >/dev/null 2>&1; then die "dead command doctor should fail"; fi
+ok "state-present command that does not serve MCP is red"
+write_mcp_fake "$SB/bin/$COPILOT_MCP_COMMAND"
+"$RUN" uninstall-copilot-mcp >/dev/null
+json manual
+want "inverse restores manual config after drift repairs" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# Created-new is removed only when it still contains only the adapter's key.
+rm -f "$COPILOT_MCP_CONFIG"
+"$RUN" install-copilot-mcp >/dev/null
+json created
+"$RUN" uninstall-copilot-mcp >/dev/null
+want "created-new empty mcp-config is removed by inverse" "[ ! -e '$COPILOT_MCP_CONFIG' ] && [ ! -f '$STATE' ]"
+
+# A foreign/corrupt config file is never adopted or given a state record.
+printf '{"mcpServers":{}}\n' > "$SB/foreign.json"
+ln -s "$SB/foreign.json" "$COPILOT_MCP_CONFIG"
+if "$RUN" install-copilot-mcp >/dev/null 2>&1; then die "symlink install should refuse"; fi
+ok "symlink config is refused"
+want "symlink refusal leaves foreign config and no state" "! grep -q entwurf-bridge '$SB/foreign.json' && [ ! -f '$STATE' ]"
+rm -f "$COPILOT_MCP_CONFIG"
+printf 'not-json{{' > "$COPILOT_MCP_CONFIG"
+if "$RUN" install-copilot-mcp >/dev/null 2>&1; then die "corrupt install should fail"; fi
+ok "corrupt config fails loud"
+want "corrupt refusal writes no state" "[ ! -f '$STATE' ]"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "smoke changed the checkout"
+printf '\nsmoke-copilot-mcp-state: %d checks passed\n' "$pass"

package/scripts/smoke-copilot-statusline-state.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# smoke-copilot-statusline-state — hermetic install/doctor/inverse contract for
+# the Copilot custom-footer settings adapter. No Copilot process or model turn.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RUN="$REPO_DIR/run.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export COPILOT_SETTINGS_CONFIG="$HOME/.copilot/settings.json"
+export COPILOT_STATUSLINE_COMMAND="entwurf-copilot-statusline"
+STATE="$XDG_DATA_HOME/entwurf/copilot-statusline/install-state.json"
+mkdir -p "$(dirname "$COPILOT_SETTINGS_CONFIG")" "$SB/bin"
+printf '#!/usr/bin/env bash\necho fake-copilot-statusline\n' > "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+chmod +x "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+
+_clean_path=""
+while IFS= read -r dir; do
+  [ -n "$dir" ] || continue
+  [ -e "$dir/$COPILOT_STATUSLINE_COMMAND" ] || [ -L "$dir/$COPILOT_STATUSLINE_COMMAND" ] && continue
+  _clean_path="${_clean_path:+$_clean_path:}$dir"
+done < <(printf '%s\n' "$PATH" | tr ':' '\n')
+export PATH="$SB/bin:$_clean_path"
+
+write_settings() {
+  printf '{\n  "enabledPlugins": { "other@marketplace": true },\n  "footer": { "showCustom": true, "showDirectory": true },\n  "statusLine": { "command": "manual-statusline" }\n}\n' > "$COPILOT_SETTINGS_CONFIG"
+}
+json() { python3 - "$COPILOT_SETTINGS_CONFIG" "$@" <<'PY'
+import json, sys
+settings = json.load(open(sys.argv[1]))
+mode = sys.argv[2]
+if mode == "installed":
+    assert settings["statusLine"] == {"command": "entwurf-copilot-statusline"}
+    assert settings["footer"] == {"showCustom": True, "showDirectory": True}
+    assert settings["enabledPlugins"] == {"other@marketplace": True}
+elif mode == "manual":
+    assert settings["statusLine"] == {"command": "manual-statusline"}
+    assert settings["footer"] == {"showCustom": True, "showDirectory": True}
+elif mode == "created":
+    assert settings == {"statusLine": {"command": "entwurf-copilot-statusline"}, "footer": {"showCustom": True}}
+else:
+    raise AssertionError(mode)
+PY
+}
+
+# Existing matching/manual settings are adopted, not treated as a fresh file.
+write_settings
+"$RUN" doctor-copilot-statusline >/dev/null
+want "unowned manual settings doctor is an honest note" "[ $? -eq 0 ]"
+"$RUN" install-copilot-statusline >/dev/null
+json installed
+want "install adopts regular settings and preserves unrelated keys" "[ $? -eq 0 ]"
+want "install writes state" "[ -f '$STATE' ]"
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["statusLinePreimage"] == {"command": "manual-statusline"}
+assert state["showCustomPreimage"] is True
+PY
+ok "first install captures manual statusLine preimage"
+"$RUN" install-copilot-statusline >/dev/null
+"$RUN" uninstall-copilot-statusline >/dev/null
+json manual
+want "reinstall keeps the first preimage for inverse" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# The live-host shape is already our command with no state: adopt that exact preimage too.
+write_settings
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["statusLine"]={"command":"entwurf-copilot-statusline"}; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+"$RUN" install-copilot-statusline >/dev/null
+python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+assert state["statusLinePreimage"] == {"command": "entwurf-copilot-statusline"}
+assert state["showCustomPreimage"] is True
+PY
+"$RUN" uninstall-copilot-statusline >/dev/null
+json installed
+want "matching manual Copilot config is adopted and restored unchanged" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# State turns a later setting drift into a red doctor rather than a silent pass.
+write_settings
+"$RUN" install-copilot-statusline >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["footer"]["showCustom"]=False; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "custom-disabled doctor should fail"; fi
+ok "state-present custom-disabled footer is red"
+"$RUN" install-copilot-statusline >/dev/null
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["statusLine"]={"command":"other"}; json.dump(d,open(p,"w"))' "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "statusLine drift doctor should fail"; fi
+ok "state-present statusLine drift is red"
+"$RUN" install-copilot-statusline >/dev/null
+
+# A stable-bin command that stops resolving is red without touching settings.
+rm -f "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+if "$RUN" doctor-copilot-statusline >/dev/null 2>&1; then die "dangling command doctor should fail"; fi
+ok "dangling bare command is red"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+chmod +x "$SB/bin/$COPILOT_STATUSLINE_COMMAND"
+"$RUN" uninstall-copilot-statusline >/dev/null
+json manual
+want "inverse restores manual settings after drift repairs" "[ $? -eq 0 ] && [ ! -f '$STATE' ]"
+
+# Created-new is removed only when it still contains only the adapter's keys.
+rm -f "$COPILOT_SETTINGS_CONFIG"
+"$RUN" install-copilot-statusline >/dev/null
+json created
+"$RUN" uninstall-copilot-statusline >/dev/null
+want "created-new empty settings file is removed by inverse" "[ ! -e '$COPILOT_SETTINGS_CONFIG' ] && [ ! -f '$STATE' ]"
+
+# A foreign/corrupt settings file is never adopted or given a state record.
+printf '{"footer":{}}\n' > "$SB/foreign.json"
+ln -s "$SB/foreign.json" "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" install-copilot-statusline >/dev/null 2>&1; then die "symlink install should refuse"; fi
+ok "symlink settings are refused"
+want "symlink refusal leaves foreign settings and no state" "! grep -q statusLine '$SB/foreign.json' && [ ! -f '$STATE' ]"
+rm -f "$COPILOT_SETTINGS_CONFIG"
+printf 'not-json{{' > "$COPILOT_SETTINGS_CONFIG"
+if "$RUN" install-copilot-statusline >/dev/null 2>&1; then die "corrupt install should fail"; fi
+ok "corrupt settings fail loud"
+want "corrupt refusal writes no state" "[ ! -f '$STATE' ]"
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "smoke changed the checkout"
+printf '\nsmoke-copilot-statusline-state: %d checks passed\n' "$pass"

package/scripts/smoke-mux-fresh-call-live.ts

@@ -213,6 +213,8 @@ async function main(): Promise<void> {
 		// onboarding instead of exercising the configured runtime. Separate servers preserve
 		// those backend-native environments without adding an env carrier to the product.
 		const nonces = new Map<string, string>();
+		// Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
+		// and is not a release MUST — do not add `copilot` to this loop (VERIFY.md).
 		for (const backend of ["pi", "claude-code"] as const) {
 			const socket = path.join(root, `${backend}.sock`);
 			privateSockets.add(socket);

package/scripts/smoke-mux-lifecycle-live.ts

@@ -557,7 +557,9 @@ async function main(): Promise<void> {
 			return sender;
 		}
 
-		/** One private tmux server per CELL, plus the client env that anchors into it. */
+		/** One private tmux server per CELL, plus the client env that anchors into it.
+		 * Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
+		 * and is not a release MUST — do not widen this type (VERIFY.md). */
 		function startPrivateServer(
 			cell: string,
 			backend: "pi" | "claude-code",

package/scripts/smoke-setup-verdict.sh

@@ -0,0 +1,291 @@
+#!/usr/bin/env bash
+# smoke-setup-verdict.sh — the smallest aggregate `setup` verdict fixture (#86 C1).
+#
+# The aggregate composition had ZERO automated consumers before this file: no
+# living layer executed `entwurf setup` at all, so the false-green shape (WARN
+# swallowing + unconditional "DONE ... green") had only a human operator as its
+# gate. This fixture drives the REAL `run.sh setup` end to end in a sandbox and
+# pins exactly the #86 C1 acceptance cells:
+#
+#   S-1 all-harness-absent  → core PASS, pi/claude/agy SKIP, computed green,
+#                             zero harness writes, credential store untouched
+#   S-2 pi below floor      → detected FAIL (never SKIP), nonzero, no Pi wiring
+#   S-3 pi at floor         → presence completes project+user wiring, green,
+#                             credential store still byte-identical
+#   S-4 agy detected+corrupt→ named component FAIL + NON-GREEN + nonzero exit,
+#                             core and later components still attempted
+#   S-5 installed mode      → the installed-vs-source branch is a NAMED verdict
+#                             printed before anything else, and never reaches
+#                             the source pnpm bootstrap
+#
+# Mutation attribution does NOT live here (round 3): the setup-verdict lane's
+# QK signatures and kill cells moved to the snapshot-safe oracle
+# scripts/check-setup-qualification.sh, so this file carries no [QK] tokens.
+# This fixture is the BEHAVIOR authority only — S-2/S-4 still exercise the same
+# below-floor and false-green shapes as living end-to-end evidence.
+#
+# Deterministic: no model, no network, no cost. Presence probes are pinned via
+# PI_BIN / CLAUDE_BIN / AGY_BIN (the same hermetic seam smoke-agy-install-state
+# uses), and every write root is sandboxed: HOME, XDG roots, the pi agent dir,
+# and the dev-bin dir. The source bootstrap (`pnpm install --frozen-lockfile`)
+# runs against the ALREADY-INSTALLED checkout, which is a verified no-op under a
+# sandbox HOME (measured 2026-08-26).
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$HERE/.." && pwd)"
+
+case "$REPO_DIR" in
+  */node_modules/*)
+    echo "entwurf: 'smoke-setup-verdict' is a dev-clone-only surface — run it from a checkout." >&2
+    exit 1
+    ;;
+esac
+
+# Same snapshot-purity rule as the sibling install smokes: run.sh paths import
+# scripts/*.py and CPython would mint scripts/__pycache__/*.pyc inside the
+# gate-qualification snapshot, ending the run IMPURE.
+export PYTHONDONTWRITEBYTECODE=1
+
+SB="$(mktemp -d -t entwurf-setup-verdict.XXXXXX)"
+cleanup() { rm -rf "$SB"; }
+trap cleanup EXIT
+
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/home/.local/share"
+export XDG_STATE_HOME="$SB/home/.local/state"
+export XDG_CACHE_HOME="$SB/home/.cache"
+export XDG_CONFIG_HOME="$SB/home/.config"
+export PI_CODING_AGENT_DIR="$SB/home/.pi/agent"
+export ENTWURF_DEV_BIN_DIR="$SB/bin"
+export PATH="$SB/bin:$PATH"
+mkdir -p "$HOME" "$PI_CODING_AGENT_DIR" "$SB/bin" "$SB/harness"
+
+# Presence pins: default every harness to a definitely-absent path; each cell
+# re-pins what it needs. Production leaves these unset.
+ABSENT="$SB/harness/definitely-absent"
+export PI_BIN="$ABSENT" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="$ABSENT"
+
+PASS=0
+ok()   { PASS=$((PASS + 1)); printf '  ok    %s\n' "$*"; }
+die()  { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
+want() { # $1 = label, $2 = shell condition
+  if eval "$2"; then ok "$1"; else die "$1"; fi
+}
+
+AUTH="$PI_CODING_AGENT_DIR/auth.json"
+seed_auth() {
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "sandbox-oauth-token"\n  }\n}\n' > "$AUTH"
+  AUTH_BEFORE="$(sha256sum "$AUTH" | cut -d' ' -f1)"
+}
+want_auth_untouched() { # $1 = cell label prefix
+  want "$1: credential store is byte-identical (no read-modify-write)" \
+    "[ \"\$(sha256sum '$AUTH' | cut -d' ' -f1)\" = '$AUTH_BEFORE' ]"
+  want "$1: no auth.json.bak was written" "[ ! -e '$AUTH.bak' ]"
+  want "$1: no 'entwurf' credential alias appeared" \
+    "! grep -q '\"entwurf\"' '$AUTH'"
+}
+
+# ── S-1: all harnesses absent → core PASS, three SKIPs, computed green, zero writes ──
+echo "[smoke-setup-verdict] S-1 all-harness-absent setup"
+PROJ1="$SB/proj1"; mkdir -p "$PROJ1"
+seed_auth
+set +e; OUT="$(bash "$REPO_DIR/run.sh" setup "$PROJ1" 2>&1)"; RC=$?; set -e
+want "S-1: all-absent setup exits 0 (core green is still green)" "[ '$RC' -eq 0 ]"
+want "S-1: mode is a named source-checkout branch, printed first" \
+  "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: source checkout'"
+want "S-1: pi absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP'"
+want "S-1: claude absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'claude: SKIP'"
+want "S-1: agy absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'agy: SKIP'"
+want "S-1: copilot absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP'"
+want "S-1: core bridge boundary validated (PASS)" "printf '%s' \"\$OUT\" | grep -q 'core: PASS'"
+want "S-1: final verdict is computed, not unconditional" \
+  "printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
+want "S-1: the retired unconditional green line is gone" \
+  "! printf '%s' \"\$OUT\" | grep -q 'pi adapter + detected native bridges + v2 install smoke) green'"
+want "S-1: zero Pi wiring written for an absent pi" "[ ! -e '$PROJ1/.pi' ]"
+want "S-1: no user-scope pi settings were created" "[ ! -e '$PI_CODING_AGENT_DIR/settings.json' ]"
+want "S-1: no agy config was created" "[ ! -e '$HOME/.gemini' ]"
+want "S-1: no Copilot config/units were created" "[ ! -e '$HOME/.copilot' ]"
+want_auth_untouched "S-1"
+
+# ── S-2: pi resolvable but BELOW floor → detected FAIL, never SKIP, no writes ──
+echo "[smoke-setup-verdict] S-2 pi below floor"
+PROJ2="$SB/proj2"; mkdir -p "$PROJ2"
+printf '#!/usr/bin/env bash\necho 0.1.0\n' > "$SB/harness/pi-stale"; chmod +x "$SB/harness/pi-stale"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-stale" bash "$REPO_DIR/run.sh" setup "$PROJ2" 2>&1)"; RC=$?; set -e
+# Assertion ORDER is part of the kill contract: the verdict-label check runs
+# FIRST so the PI-FLOOR-SKIP mutant dies on its own token, and the exit-code
+# check runs SECOND so the FALSE-GREEN mutant (labels intact, exit flipped)
+# dies on its token instead of a mislabeled line.
+want "S-2: below-floor pi is a detected FAIL naming the supported range" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: FAIL' && printf '%s' \"\$OUT\" | grep -q 'outside the supported range'"
+want "S-2: a detected component FAIL owns a nonzero setup exit" "[ '$RC' -ne 0 ]"
+want "S-2: a stale pi is never relabeled SKIP" "! printf '%s' \"\$OUT\" | grep -q 'pi: SKIP'"
+want "S-2: summary is NON-GREEN and names the failed component" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: pi)'"
+want "S-2: no Pi wiring was written for the refused pi" "[ ! -e '$PROJ2/.pi' ]"
+want_auth_untouched "S-2"
+
+# ── S-2b: pi resolvable but --version CRASHES → computed FAIL, never a set -e abort ──
+# Review defect (2026-08-26): an unreadable detected pi must reach the verdict
+# engine and the summary, not kill setup before them.
+echo "[smoke-setup-verdict] S-2b pi present but version unreadable"
+PROJ2B="$SB/proj2b"; mkdir -p "$PROJ2B"
+printf '#!/usr/bin/env bash\necho "pi exploded" >&2\nexit 1\n' > "$SB/harness/pi-broken"; chmod +x "$SB/harness/pi-broken"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-broken" bash "$REPO_DIR/run.sh" setup "$PROJ2B" 2>&1)"; RC=$?; set -e
+want "S-2b: unreadable pi version makes setup exit nonzero via the computed verdict" "[ '$RC' -ne 0 ]"
+want "S-2b: unreadable pi is a detected FAIL naming the unreadable version" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: FAIL' && printf '%s' \"\$OUT\" | grep -q 'unreadable version'"
+want "S-2b: later components were still attempted (core bridge smoke ran)" \
+  "printf '%s' \"\$OUT\" | grep -q 'core: PASS'"
+want "S-2b: summary is NON-GREEN (no set -e abort before the summary)" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: pi)'"
+want "S-2b: no Pi wiring was written for the unreadable pi" "[ ! -e '$PROJ2B/.pi' ]"
+want_auth_untouched "S-2b"
+
+# ── S-3: pi at the pinned floor → presence completes project + user wiring ──
+echo "[smoke-setup-verdict] S-3 pi present at floor"
+PROJ3="$SB/proj3"; mkdir -p "$PROJ3"
+PI_PIN="$(node -e 'console.log(require(process.argv[1]).devDependencies["@earendil-works/pi-coding-agent"])' "$REPO_DIR/package.json")"
+printf '#!/usr/bin/env bash\necho %s\n' "$PI_PIN" > "$SB/harness/pi-ok"; chmod +x "$SB/harness/pi-ok"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" bash "$REPO_DIR/run.sh" setup "$PROJ3" 2>&1)"; RC=$?; set -e
+want "S-3: pi-present setup exits 0" "[ '$RC' -eq 0 ]"
+want "S-3: pi wiring completed as PASS at pin $PI_PIN" "printf '%s' \"\$OUT\" | grep -q 'pi: PASS'"
+want "S-3: project .pi/settings.json written (Pi-owned wiring gated on presence)" \
+  "[ -f '$PROJ3/.pi/settings.json' ] && grep -q 'entwurf' '$PROJ3/.pi/settings.json'"
+want "S-3: user-scope citizen registered" \
+  "[ -f '$PI_CODING_AGENT_DIR/settings.json' ] && grep -q 'entwurf' '$PI_CODING_AGENT_DIR/settings.json'"
+want_auth_untouched "S-3"
+
+# ── S-4: agy detected + corrupt config → named component FAIL, NON-GREEN, later components attempted ──
+echo "[smoke-setup-verdict] S-4 agy detected but corrupt"
+PROJ4="$SB/proj4"; mkdir -p "$PROJ4"
+printf '#!/usr/bin/env bash\necho fake-agy\n' > "$SB/harness/agy"; chmod +x "$SB/harness/agy"
+mkdir -p "$HOME/.gemini/config"
+printf 'this is not json{{{' > "$HOME/.gemini/config/mcp_config.json"
+seed_auth
+set +e; OUT="$(AGY_BIN="$SB/harness/agy" bash "$REPO_DIR/run.sh" setup "$PROJ4" 2>&1)"; RC=$?; set -e
+want "S-4: detected agy failure owns a nonzero setup exit" "[ '$RC' -ne 0 ]"
+want "S-4: the corrupt agy bridge is a NAMED component FAIL" \
+  "printf '%s' \"\$OUT\" | grep -q 'agy-bridge: FAIL'"
+want "S-4: the reason is corrupt-specific (invalid JSON), not a silent skip" \
+  "printf '%s' \"\$OUT\" | grep -qi 'invalid JSON'"
+want "S-4: later components were still attempted (core bridge smoke ran)" \
+  "printf '%s' \"\$OUT\" | grep -q 'core: PASS'"
+want "S-4: summary is NON-GREEN and computed from the outcomes" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN' && ! printf '%s' \"\$OUT\" | grep -q 'result: green'"
+want "S-4: the corrupt config was preserved, not clobbered" \
+  "[ \"\$(cat '$HOME/.gemini/config/mcp_config.json')\" = 'this is not json{{{' ]"
+want_auth_untouched "S-4"
+rm -rf "$HOME/.gemini" "$SB/harness/agy"
+
+# ── S-6: copilot PRESENT → all FOUR units compose independently as PASS (#86 C3b) ──
+# The fake vendor is the shared factory (scripts/fake-copilot-vendor.sh, the
+# same measured answer shapes check-copilot-birth-hook.ts bakes), so the birth
+# installer's real preflight/list/add/install sequence runs end to end against
+# it. The three writer units (MCP/receiver/footer) never touch the vendor; they
+# land in the sandbox HOME/XDG.
+echo "[smoke-setup-verdict] S-6 copilot present — four-unit composition"
+PROJ6="$SB/proj6"; mkdir -p "$PROJ6"
+FAKE_COP="$SB/harness/copilot-fake"
+bash "$REPO_DIR/scripts/fake-copilot-vendor.sh" "$FAKE_COP" "$REPO_DIR/pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json"
+seed_auth
+set +e; OUT="$(COPILOT_BIN="$FAKE_COP/copilot" PATH="$FAKE_COP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ6" 2>&1)"; RC=$?; set -e
+want "S-6: copilot-present setup exits 0 (four units + core all green)" "[ '$RC' -eq 0 ]"
+want "S-6: birth unit composed as PASS" "printf '%s' \"\$OUT\" | grep -q 'copilot-birth: PASS'"
+want "S-6: MCP unit composed as PASS" "printf '%s' \"\$OUT\" | grep -q 'copilot-mcp: PASS'"
+want "S-6: receiver unit composed as PASS" "printf '%s' \"\$OUT\" | grep -q 'copilot-receive: PASS'"
+want "S-6: visible-footer unit composed as PASS" "printf '%s' \"\$OUT\" | grep -q 'copilot-statusline: PASS'"
+want "S-6: computed summary is green" \
+  "printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
+want "S-6: the birth install drove the real vendor sequence (marketplace add before plugin install)" \
+  "grep -q '^plugin marketplace add ' '$FAKE_COP/calls.log' && grep -q '^plugin install entwurf-meta-receive-copilot@meta-bridge-copilot-local$' '$FAKE_COP/calls.log'"
+want "S-6: all four package-owned install-states exist (each unit keeps its inverse authority)" \
+  "[ -f '$XDG_DATA_HOME/entwurf/copilot-bridge/install-state.json' ] && [ -f '$XDG_DATA_HOME/entwurf/copilot-mcp/install-state.json' ] && [ -f '$XDG_DATA_HOME/entwurf/copilot-receive/install-state.json' ] && [ -f '$XDG_DATA_HOME/entwurf/copilot-statusline/install-state.json' ]"
+want "S-6: the receiver unit was deployed from the compiled dist closure" \
+  "[ -f '$HOME/.copilot/extensions/entwurf-receive/extension.mjs' ] && [ -f '$HOME/.copilot/extensions/entwurf-receive/lib/meta-session.js' ]"
+want "S-6: MCP config and footer settings landed in the sandbox HOME" \
+  "grep -q 'entwurf-bridge' '$HOME/.copilot/mcp-config.json' && grep -q 'entwurf-copilot-statusline' '$HOME/.copilot/settings.json'"
+want_auth_untouched "S-6"
+# Reset the composed Copilot state so the next cell decides on a clean host.
+rm -rf "$HOME/.copilot" "$XDG_DATA_HOME/entwurf/copilot-bridge" "$XDG_DATA_HOME/entwurf/copilot-mcp" \
+  "$XDG_DATA_HOME/entwurf/copilot-receive" "$XDG_DATA_HOME/entwurf/copilot-statusline" \
+  "$XDG_DATA_HOME/entwurf/meta-bridge-copilot"
+
+# ── S-7: copilot present but vendor lists FAIL → birth is a NAMED FAIL, the other ──
+# three units are still attempted (independent outcomes), and the aggregate is
+# NON-GREEN + nonzero. A failing `plugin list` is UNKNOWN, never absence (#86
+# C3a), so the composition must not relabel it SKIP or cosmetic PASS.
+echo "[smoke-setup-verdict] S-7 copilot present, vendor list failing"
+PROJ7="$SB/proj7"; mkdir -p "$PROJ7"
+BROKEN_COP="$SB/harness/copilot-broken"; mkdir -p "$BROKEN_COP"
+printf '#!/usr/bin/env bash\necho "not authenticated" >&2\nexit 1\n' > "$BROKEN_COP/copilot"
+chmod +x "$BROKEN_COP/copilot"
+seed_auth
+set +e; OUT="$(COPILOT_BIN="$BROKEN_COP/copilot" PATH="$BROKEN_COP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ7" 2>&1)"; RC=$?; set -e
+want "S-7: the failing-vendor birth is a NAMED component FAIL, never SKIP or PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'copilot-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP'"
+want "S-7: the other three units were still attempted independently" \
+  "printf '%s' \"\$OUT\" | grep -q 'copilot-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'copilot-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'copilot-statusline: PASS'"
+want "S-7: the detected birth failure owns a nonzero setup exit" "[ '$RC' -ne 0 ]"
+want "S-7: summary is NON-GREEN naming copilot-birth" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: copilot-birth)'"
+want "S-7: later components were still attempted (core bridge smoke ran)" \
+  "printf '%s' \"\$OUT\" | grep -q 'core: PASS'"
+want "S-7: the refused birth wrote no vendor ownership state" \
+  "[ ! -e '$XDG_DATA_HOME/entwurf/copilot-bridge/install-state.json' ]"
+want_auth_untouched "S-7"
+rm -rf "$HOME/.copilot" "$XDG_DATA_HOME/entwurf/copilot-mcp" "$XDG_DATA_HOME/entwurf/copilot-receive" \
+  "$XDG_DATA_HOME/entwurf/copilot-statusline"
+
+# ── S-5: installed mode is a NAMED first verdict, never the source bootstrap ──
+# A bare copy of run.sh under a fake node_modules root pins the mode seam
+# cheaply: the copy is NOT a runnable installed package (no dist), so this cell
+# asserts only that the installed-vs-source branch is decided and printed before
+# any prerequisite check and the source-only pnpm bootstrap is never reached.
+# The REAL packed installed-package `setup` consumer (all-absent SKIP, computed
+# green, zero writes) lives in check-pack-install's installed all-absent setup
+# row; the no-bootstrap KILL attribution lives in the oracle
+# scripts/check-setup-qualification.sh (round 3).
+echo "[smoke-setup-verdict] S-5 installed-mode named branch (pnpm-scrubbed)"
+FAKE_PKG="$SB/node_modules/@junghanacs/entwurf"
+mkdir -p "$FAKE_PKG" "$SB/proj5"
+cp "$REPO_DIR/run.sh" "$FAKE_PKG/run.sh"; chmod +x "$FAKE_PKG/run.sh"
+cp "$REPO_DIR/package.json" "$FAKE_PKG/package.json"
+# The Missing-pnpm assertion was vacuous while the fixture inherited a PATH that
+# still resolved pnpm (review round 2, 2026-08-26). Build a GENUINELY scrubbed
+# PATH: shim the tools the pre-death setup path needs (resolved BEFORE the
+# scrub, so a host that co-locates pnpm with node — e.g. corepack — still keeps
+# node), then keep only the PATH directories that do NOT carry an executable
+# pnpm, and PROVE the scrub before running the cell.
+SCRUB_SHIMS="$SB/pnpm-scrub-shims"; mkdir -p "$SCRUB_SHIMS"
+for _tool in bash node python3 head tr cut sed grep dirname readlink cat mkdir cp chmod rm env sha256sum; do
+  _src="$(command -v "$_tool" 2>/dev/null || true)"
+  [ -n "$_src" ] && ln -s "$_src" "$SCRUB_SHIMS/$_tool"
+done
+SCRUBBED_PATH="$SCRUB_SHIMS"
+IFS=':' read -r -a _path_dirs <<<"$PATH"
+for _d in "${_path_dirs[@]}"; do
+  [ -n "$_d" ] || continue
+  [ -x "$_d/pnpm" ] && continue
+  SCRUBBED_PATH="$SCRUBBED_PATH:$_d"
+done
+unset _path_dirs _d _tool _src
+want "S-5: the scrub itself holds — pnpm does NOT resolve on the scrubbed PATH" \
+  "! PATH=\"$SCRUBBED_PATH\" command -v pnpm >/dev/null 2>&1"
+want "S-5: the scrub preserved the tools the cell needs (bash/node/python3)" \
+  "PATH=\"$SCRUBBED_PATH\" command -v bash >/dev/null && PATH=\"$SCRUBBED_PATH\" command -v node >/dev/null && PATH=\"$SCRUBBED_PATH\" command -v python3 >/dev/null"
+set +e; OUT="$(PATH="$SCRUBBED_PATH" bash "$FAKE_PKG/run.sh" setup "$SB/proj5" 2>&1)"; RC=$?; set -e
+want "S-5: installed mode is the FIRST named line, before any prerequisite check" \
+  "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: installed package'"
+want "S-5: installed mode never runs the source pnpm bootstrap" \
+  "! printf '%s' \"\$OUT\" | grep -qi 'pnpm install\|Lockfile is up to date\|Progress: resolved'"
+want "S-5: installed setup never requires pnpm merely to decide/compose" \
+  "! printf '%s' \"\$OUT\" | grep -q 'Missing command: pnpm'"
+
+echo ""
+echo "smoke-setup-verdict: $PASS checks passed"