@junghanacs/entwurf 0.15.0 → 0.15.1

package/scripts/mutants/pi-package-ownership.json

@@ -0,0 +1,92 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-package-ownership",
+	"mutants": [
+		{
+			"claim": "SILENT-TAKEOVER",
+			"title": "a normal user-scope install silently replaces another LIVE root's registration, resurrecting the last-writer-wins takeover the #86 C2 ownership contract retires (only the operator-explicit takeover-user-scope may move the shared entry)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        if os.path.isdir(owner):\n            _refuse(6, \"register-pi-package: the user-scope entwurf registration is owned by another LIVE root: \"\n                       f\"{owner}. Normal install/setup never replaces another owner — zero settings bytes written. \"\n                       f\"Run './run.sh takeover-user-scope' from {repo_dir} to explicitly move the shared entry.\")"
+			],
+			"replace": [
+				"        if os.path.isdir(owner):\n            return register_user(settings_path, repo_dir_arg, state_path, True)"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SILENT-TAKEOVER]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "FOREIGN-INVERSE-REMOVE",
+			"title": "an old root's inverse removes the CURRENT live owner's user-scope registration, so one stale checkout's remove-user-scope deletes the shared entry every other project depends on",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        if os.path.isdir(owner):\n            _refuse(6, \"register-pi-package: the user-scope registration is owned by another LIVE root: \"\n                       f\"{owner}. This root's inverse must not remove someone else's registration — zero settings \"\n                       \"bytes written. Run remove from that root, or take the entry over first.\")"
+			],
+			"replace": [
+				"        if os.path.isdir(owner):\n            n, kept = remove(settings_path, owner)\n            state_path.unlink()\n            print(f\"remove: removed {n} entries (foreign owner ignored)\")\n            return 0"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:FOREIGN-INVERSE-REMOVE]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "BROAD-INSTALL-COLLAPSE",
+			"title": "a same-owner user-scope install routes through the broad project-scope register() collapse, so a second entwurf-shaped root in the GLOBAL packages[] is silently deleted as collateral of an ordinary install — the exact transition B reproduced against 096a5cd (#86 C2 corrective amendment, blocker 1)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"            _require_user_owner_entry(settings_path, owner)\n            if preflight:\n                print(\"preflight: install ok (this root owns one unambiguous registration)\")\n                return 0\n            print(f\"install: entwurf package already registered (no-op) -> {repo_dir}\")\n            return 0"
+			],
+			"replace": [
+				"            if preflight:\n                print(\"preflight: install ok (this root owns one unambiguous registration)\")\n                return 0\n            register(settings_path, repo_dir_arg)\n            print(f\"install: entwurf package already registered (no-op) -> {repo_dir}\")\n            return 0"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:BROAD-INSTALL-COLLAPSE]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "BROAD-DOCTOR-GREEN",
+			"title": "doctor-pi-package judges the recorded owner through the broad entwurf-shape matcher, so a store whose exact owner entry is GONE but which still holds some other entwurf-shaped root reads owned/exit-0 while the inverse refuses the very same state — contradictory verdicts on one store (#86 C2 corrective amendment, blocker 2)",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"    owner_exact, owner_extra = _classify_user_owner_entries(settings_path, owner)\n    if len(owner_exact) != 1 or owner_extra:\n        print(f\"doctor-pi-package: mismatch — owner state records {owner} but the settings hold \"\n              f\"{len(owner_exact)} exact entr{'y' if len(owner_exact) == 1 else 'ies'} and \"\n              f\"{len(owner_extra)} additional entwurf-shaped entr{'y' if len(owner_extra) == 1 else 'ies'} \"\n              \"(expected exactly one exact entry and no other entwurf-shaped root)\")\n        return 1"
+			],
+			"replace": [
+				"    owner_matches = _entwurf_matches(packages, owner, settings_dir)\n    if not owner_matches:\n        print(f\"doctor-pi-package: mismatch — owner state records {owner} but no packages[] entry names it\")\n        return 1"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:BROAD-DOCTOR-GREEN]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "PROVIDER-ROOT-TYPE-FAIL-OPEN",
+			"title": "the typed installerRoot classifier reports a wrong-TYPE value (number, empty string, bool, object, array) as LEGACY instead of CORRUPT, so provider install adopts and rebinds an unattributed state, remove proceeds on it, and the doctor coupling stays silent — the fall-through B reproduced against 096a5cd (#86 C2 corrective amendment, blocker 3)",
+			"subject": "scripts/pi_settings_io.py",
+			"find": ["    if isinstance(root, str) and root:\n        return \"owner\", root\n    return \"corrupt\", None"],
+			"replace": [
+				"    if isinstance(root, str) and root:\n        return \"owner\", root\n    return \"legacy\", None"
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PROVIDER-ROOT-TYPE-FAIL-OPEN]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "MISSING-OWNER-AUTO-TAKEOVER",
+			"title": "a normal install auto-claims a MISSING owner's registration, turning every moved or deleted checkout into a silent ownership transfer instead of the named missing-owner verdict plus explicit takeover/orphan path",
+			"subject": "scripts/register-pi-package.py",
+			"find": [
+				"        _refuse(6, \"register-pi-package: the user-scope entwurf registration is owned by a MISSING root: \"\n                   f\"{owner} (doctor verdict: missing-owner). Normal install/setup still refuses — zero settings \"\n                   \"bytes written. Use './run.sh takeover-user-scope' to claim it explicitly, or \"\n                   \"'./run.sh remove-user-scope' for the aligned orphan cleanup.\")"
+			],
+			"replace": ["        return register_user(settings_path, repo_dir_arg, state_path, True)"],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MISSING-OWNER-AUTO-TAKEOVER]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		}
+	]
+}

package/scripts/mutants/setup-verdict.json

@@ -0,0 +1,148 @@
+{
+	"schemaVersion": 1,
+	"lane": "setup-verdict",
+	"mutants": [
+		{
+			"claim": "SETUP-FALSE-GREEN",
+			"title": "aggregate setup prints its computed NON-GREEN summary but exits 0 again, resurrecting the retired whole-host false success in the only surface an operator reads",
+			"subject": "run.sh",
+			"find": [
+				"    echo \"DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup.\"\n    return 1"
+			],
+			"replace": [
+				"    echo \"DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup.\"\n    return 0"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-FALSE-GREEN]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-PI-FLOOR-SKIP",
+			"title": "a resolvable pi below the supported floor is relabeled zero-state SKIP, so a stale-harness host reads green instead of being told its detected integration is incomplete",
+			"subject": "run.sh",
+			"find": [
+				"      setup_result pi FAIL \"detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup\""
+			],
+			"replace": [
+				"      setup_result pi SKIP \"detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup\""
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-PI-FLOOR-SKIP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-INSTALLED-NO-BOOTSTRAP",
+			"title": "installed-package setup re-enters the source pnpm bootstrap inside node_modules, so the mode-first contract collapses and a neutral npm consumer's setup dies or mutates the installed tree",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$mode\" = \"source\" ]; then\n    # Source bootstrap is the ONLY install-mode difference (#86): the pinned"
+			],
+			"replace": [
+				"  if [ -n \"$mode\" ]; then\n    # Source bootstrap is the ONLY install-mode difference (#86): the pinned"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-INSTALLED-NO-BOOTSTRAP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-CREDENTIAL-FREE",
+			"title": "a credential-store write (auth.json backup) resurrects inside aggregate setup, re-violating the corrected installation rule that setup never reads, copies, aliases or backs up harness credentials",
+			"subject": "run.sh",
+			"find": ["  SETUP_RESULTS=()\n\n  if [ \"$mode\" = \"source\" ]; then"],
+			"replace": [
+				"  SETUP_RESULTS=()\n  local _auth=\"${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}/auth.json\"\n  if [ -f \"$_auth\" ]; then cp \"$_auth\" \"$_auth.bak\"; fi\n\n  if [ \"$mode\" = \"source\" ]; then"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-CREDENTIAL-FREE]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "DEV-BIN-ATTEMPTS-ALL",
+			"title": "the no-arg dev-bin expose loop aborts at the first foreign refusal again, so units after it are never attempted while the caller's summary implies they ran",
+			"subject": "scripts/dev-bin.sh",
+			"find": [
+				"    rc=0; expose_one \"$b\" || rc=$?\n    if [ \"$rc\" -eq 0 ]; then exposed=$((exposed + 1)); else refused=\"$refused $b\"; fi"
+			],
+			"replace": [
+				"    rc=0; expose_one \"$b\" || rc=$?\n    if [ \"$rc\" -eq 0 ]; then exposed=$((exposed + 1)); else warn \"[dev-bin] REFUSE aborts the loop\"; exit 3; fi"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:DEV-BIN-ATTEMPTS-ALL]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SETUP-INSTALLED-NO-PNPM",
+			"title": "installed setup regains an unconditional pnpm requirement, so a neutral npm consumer without pnpm is refused by an accidental Missing-command instead of composing — the mode decision stops being independent of the source toolchain",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$mode\" = \"source\" ]; then\n    # Source-only dev fixtures: the pinned repo dependencies are build/test\n    # fixtures, never a product promise that consumers receive them (#86 A4).\n    require_cmd pnpm\n  fi"
+			],
+			"replace": ["  require_cmd pnpm"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-INSTALLED-NO-PNPM]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-ABSENT-SKIP",
+			"title": "the copilot presence gate collapses to always-detected, so an absent-copilot host loses its zero-state SKIP and setup composes (and writes) Copilot units nobody asked for",
+			"subject": "run.sh",
+			"find": [
+				"  if ! command -v \"${COPILOT_BIN:-copilot}\" >/dev/null 2>&1; then\n    setup_result copilot SKIP \"copilot not on PATH — zero Copilot wiring written\""
+			],
+			"replace": [
+				"  if false; then\n    setup_result copilot SKIP \"copilot not on PATH — zero Copilot wiring written\""
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-ABSENT-SKIP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-INDEPENDENT",
+			"title": "a failed Copilot birth aborts the whole composition, so the MCP/receiver/footer units are silently never attempted while the operator reads only the first failure",
+			"subject": "run.sh",
+			"find": [
+				"      setup_result copilot-birth FAIL \"detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup\"\n    fi"
+			],
+			"replace": [
+				"      setup_result copilot-birth FAIL \"detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup\"\n      return 1\n    fi"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-INDEPENDENT]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-COSMETIC-PASS",
+			"title": "the birth unit's failure capture is swallowed, so a refused vendor preflight reads as copilot-birth PASS and a broken detected integration reports a green composition",
+			"subject": "run.sh",
+			"find": ["    copilot_rc=0; (cd \"$REPO_DIR\" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?"],
+			"replace": ["    copilot_rc=0; (cd \"$REPO_DIR\" && bash scripts/copilot-bridge-install.sh) || true"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-COSMETIC-PASS]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-AGY-COSMETIC-RETURN",
+			"title": "wire_agy_bridge's failed-install path returns 0 again, restoring the WARN-then-success mechanism that let a detected-but-refused agy integration read as a green setup",
+			"subject": "run.sh",
+			"find": [
+				"      echo \"[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues.\" >&2\n      ;;\n  esac\n  return 1\n}"
+			],
+			"replace": [
+				"      echo \"[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues.\" >&2\n      ;;\n  esac\n  return 0\n}"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SETUP-AGY-COSMETIC-RETURN]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		}
+	]
+}

package/scripts/mutants/source-install.json

@@ -0,0 +1,32 @@
+{
+	"schemaVersion": 1,
+	"lane": "source-install",
+	"mutants": [
+		{
+			"claim": "SOURCE-OPERATOR-BIN",
+			"title": "source setup again omits the entwurf operator command, so Copilot fresh rejects runtime-unresolved unless an unrelated global package happens to mask the defect",
+			"subject": "scripts/dev-bin.sh",
+			"find": [
+				"MANAGED_BINS=\"entwurf entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline\""
+			],
+			"replace": [
+				"MANAGED_BINS=\"entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline\""
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-OPERATOR-BIN]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-OPERATOR-FAILS-LOUD",
+			"title": "source setup reports green after the managed operator command is foreign, shadowed, or outside PATH, recreating the runtime-unresolved incident behind a cosmetic success",
+			"subject": "run.sh",
+			"find": ["  if ! bash \"$REPO_DIR/scripts/dev-bin.sh\" verify entwurf; then\n    return 1\n  fi"],
+			"replace": ["  if ! bash \"$REPO_DIR/scripts/dev-bin.sh\" verify entwurf; then\n    return 0\n  fi"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-OPERATOR-FAILS-LOUD]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		}
+	]
+}

package/scripts/pi_settings_io.py

@@ -63,3 +63,25 @@ def unchanged(before: dict, after: dict) -> bool:
     writers mutate in place, so they parse the raw text twice rather than aliasing it.
     """
     return before == after
+
+
+def classify_installer_root(state: dict) -> "tuple[str, str | None]":
+    """ONE typed verdict for a user-scope install-state's `installerRoot` (#86 C2).
+
+    Shared by register-pi-provider install/remove and the doctor-pi-package ownership
+    coupling, because two per-site checks (`isinstance(str)` in one arm, `is None` in
+    another) let every OTHER type — a number, an empty string, a bool, an object, an
+    array — fall between them and proceed unattributed. A state MORE unattributed than
+    legacy must never be treated MORE leniently than legacy.
+
+      ("legacy", None)   key absent, or an explicit null — the pre-#86 shape; each
+                         caller names its own adoption/refusal contract for it.
+      ("owner", root)    a non-empty string — the recorded owner root.
+      ("corrupt", None)  everything else — fail-closed before any write.
+    """
+    if "installerRoot" not in state or state["installerRoot"] is None:
+        return "legacy", None
+    root = state["installerRoot"]
+    if isinstance(root, str) and root:
+        return "owner", root
+    return "corrupt", None