@junghanacs/entwurf 0.15.0 → 0.16.0

package/AGENTS.md

@@ -51,6 +51,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 14. **Native hook ownership is structural.** Claude hooks use the shipped exec-form launcher and provenance token; marker writers/readers share `isPlausibleOwnerPid`; no shell-form fallback, ancestry guess, or retired pid carrier. entwurf requires Claude Code `>=2.1.217` and enforces that floor itself because upstream gives no fail-loud — an older Claude validates the exec manifest, then drops `args` at runtime and reports success. The number is derived from `package.json` `entwurf.claudeCodeFloor`, never retyped as a second source. Currently certified axis is Linux desktop/workstation. Source/gates: `hook-launch.sh`, `meta-session.ts`, `check-hook-launch-topology`, `check-claude-floor-coherence`, `check-meta-doctor-oracle`.
 15. **Crash, don't warn.** Bad config/path/model/store state throws. Empty catches are only for bounded environment probing; operator diagnostics go to stderr.
 16. **mux is launch, never delivery.** A tmux window/pane handle is an ephemeral operator view, not an address: it mints no garden id, stores no record, and reports no liveness. Screen text and keystrokes are never an `entwurf_v2` receipt. Mux owns only placement and fixed-runtime launch; fresh identity correlation stays in callback envelopes, while same-id resume identity/liveness/locking stays on the v2 side of an injected launch seam.
+17. **Entwurf installs itself; setup composes what the operator already chose.** Package installation and source bootstrap supply Entwurf's own bytes, bins, dependencies and development fixtures only. They never install a harness binary, subscription, credential or login — `pi` has no privileged exception. `setup` detects already-present harnesses by capability and completes each detected integration; absence is an explicit zero-state SKIP, while a detected-but-incomplete integration is named non-green rather than cosmetic success. Source-only pinned Pi dev dependencies are build/test fixtures, not a product promise that neutral npm consumers receive Pi. Installation portability and rail/runtime support are separate evidence axes: Linux proof never certifies macOS or native Windows, and WSL counts as Linux rather than Windows.
 
 Detailed incident histories belong in CHANGELOG/issues/BASELINE and source-adjacent comments, not in this prompt. When a concise rule and old archaeology disagree, verify source + gate and repair the stale prose.
 

package/CHANGELOG.md

@@ -4,6 +4,305 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.16.0 - 2026-08-31
+
+This release admits **OMP (`omp`) as the fifth garden backend** and closes the admission
+contract that let a citizen ship without the legs that make it reachable. Bundles A, B and C
+are one arc — birth and identity, addressed receive, visible fresh — and the durable half is
+the general rule they forced: from OMP onward, the FIRST release of a harness admitted under
+the #82 contract owes its clause 7 visible-fresh receipt as a release-gate MUST step, its
+citizen↔fresh parity edge inside `pnpm run check:full`, and two cross-harness dispatch
+receipts. Every OMP LIVE claim below is one Linux host, one model, one accepted run; that
+limit is stated once in Notes and is not softened anywhere above it. (#87)
+
+### Added
+
+- **OMP is an addressable garden citizen.** `omp` enters the backend registry (`wakeMode`
+  `self-fetch`, `deliveryLevel` `D6`, `nativeIdLabel` `sessionId`) and
+  `pi-extensions/meta-bridge-omp.ts` mints it: an omp hook IS an in-process extension, so
+  birth, the scope fence, the status line and the sender marker are one module. Both birth
+  edges are bound — `session_switch` is where `/new`, fork and in-TUI resume re-fire — and
+  every mode but `mode === "tui"` is refused before any write. The fence is the vendor's own
+  mode and nothing else: `hasUI` is true under rpc/rpc-ui/ACP, so a fence built on it would
+  admit exactly the sessions this refuses. A task subagent mints nothing. The step-6 join is
+  one process, so the marker is keyed to `process.pid`, never `process.ppid`. Gates:
+  `check-omp-birth-hook`, `smoke-omp-bridge-state`, `scripts/mutants/omp-birth.json`. (#87)
+- **An omp-native MCP hand that shadows the borrowed Claude import.** The writer targets omp's
+  own `<omp agent dir>/mcp.json` in the vendor's own writer shape, and the server key is a
+  PINNED LITERAL `entwurf-bridge` — that pin is the entire mechanism. On a host that ever used
+  Claude Code, omp already imports an `entwurf-bridge` server labeled
+  `external-mcp/claude-code`; native provider priority beats the import and dedupe is
+  first-wins on the key with `equivalent()` never consulted, so a byte-identical key suppresses
+  the import while a different key would load BOTH and one of them would keep introducing an
+  omp session as Claude Code. `disabledServers` is never the hide-import tool — suppression is
+  by name and a suppressed item still claims the key — so the writer refuses to install under a
+  denylist of its own key and the doctor is red while one exists. `doctor-omp-mcp` adds an
+  EFFECTIVE-source read (native-wins / import-wins / both-suppressed / no-entry) and labels it
+  what it is: a configuration read of vendor precedence, never a runtime receipt. Gate:
+  `smoke-omp-mcp-state`. (#87)
+- **OMP receives addressed messages — the garden is no longer one-way for it.**
+  `pi-extensions/meta-bridge-receive-omp.ts` joins the citizen in the SAME process, holds an
+  `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's
+  `pi.sendUserMessage` — measured to live on the factory object rather than the event ctx, and
+  measured to start a turn on an idle host with zero typing. The model drains with
+  `entwurf_inbox_read`, and that read is the receipt. The `/new` unarm is rail-specific: the
+  watch lives inside the operator's TUI, where pid plus start-key cannot see a citizen change
+  underneath a living process, so the old garden id is explicitly unarmed and the replacement
+  armed. Bounded arm defer, watch-error, vanished-signal and overlapping-edge paths are all
+  fail-closed. Install, uninstall and doctor surfaces ship with it, plus
+  `check-omp-receive-arm` with `scripts/mutants/omp-receive.json`, `smoke-omp-receive-state`
+  and `smoke-omp-receive-live`. (#87)
+- **`entwurf_fresh_call` opens omp on all three public surfaces.** A five-axis pre-mutation
+  preflight decides the launch before the tmux window exists, so a missing prerequisite is a
+  named refusal instead of a dead window; the fifth axis is omp-specific (`tools.xdev !==
+  true`). There is NO positional prompt. The fixed registered flag `--entwurf-bootstrap`
+  carries a closed `{v,target,nonce,task}` grammar — an unknown key is a refusal — and the
+  installed birth extension runs a two-stage bootstrap: bounded readiness polling over both
+  public tool snapshots, a callback-ONLY prompt, then the task released only by the exact
+  successful `tool_result` (stored `toolCallId`, tool name, target, nonce and
+  `isError === false` all matching) and delivered at that same session's next `turn_end`. That
+  shape is a measurement, not a preference: the positional candidate opened its window, minted
+  its citizen, received the framing byte-identical, and answered the literal text `ACK` with
+  zero tool calls — the vendor's interactive UI defers MCP discovery while the positional
+  `initialMessage` prompts straight after `mode.init()`, so the turn began roughly 830ms before
+  the tool it was told to call existed. (#87)
+- **`check-harness-admission-parity` — the missing edge between two closed loops.** Every
+  backend in `META_CITIZEN_BACKENDS` must appear in `FRESH_CALL_BACKENDS` or be a declared
+  pre-#82 legacy admission whose exception a reader can find in `DELIVERY.md`. Registry↔citizens
+  and surfaces↔fresh-set each already had a guard, but no file imported both constants, which is
+  how omp could pass the entire floor as a D6 citizen that `entwurf_fresh_call` cannot open. The
+  gate went red on `Unaccounted: omp` the moment it was added and green when Bundle C closed it.
+  It runs inside `check:contracts`, and therefore inside `pnpm run check:full`. (#87)
+- **Two OMP LIVE steps in the release-gate MUST tier.** `smoke-omp-fresh-live` is clause 7's
+  worked instance. `smoke-omp-receive-live` reads the capability registry and decides its own
+  outcome — no drainable mailbox is a protocol SKIP, which `--cut` reads as red; a registry
+  claiming a receive rail with no acceptance body here is a FAIL. Neither is a hardcoded pass,
+  and the receive step was wired while omp was still outbound-only, so the one-way boundary
+  stopped being prose a cut could pass over in silence. (#87)
+- **`docs/adding-a-harness.md` gains the shipped map and the release stop.** A comparative table
+  of the five admitted backends — lineage, receive rail, callback dialect, fresh launch form —
+  sits at the top so the variety is expected rather than re-derived at each admission. It pins
+  two lessons: lineage does not choose the rail (omp is pi underneath and rides Claude's mailbox
+  shape, because the rail follows the measured wake surface; what ancestry does instead is
+  concentrate the danger, since a shared env vocabulary is exactly where a fork splits a store),
+  and the doorbell doctrine — a hard bridge of measured dialects, explicit doorbells and honest
+  rejects is what makes the thing on the other side a peer rather than a disposable worker. The
+  release stop then states both executable halves of the admission rule plus the cross-harness
+  leg. (#87)
+
+### Changed
+
+- **`setup` is the install story on all three entry shapes.** npm global, npm project-local and
+  source clone now lead with `entwurf setup <project>`; `entwurf install <project>` is stated as
+  the narrower pi-wiring repair leaf that composes no harness. The 14-line native-harness paste
+  that read as the install recipe is now "repair and doctors" — one paragraph plus the command
+  names, with every per-unit installer, doctor and inverse retained, because a single broken unit
+  must still be redoable alone. The user-scope ownership matrix and the manual MCP registration
+  paths moved to the documents that already own them. Stale live claim corrected: after an
+  upgrade the operator was told to rerun every owned installer; `setup` re-composes them.
+  `package.json` gains the `copilot` keyword, shipped since 0.15.0 but unlisted. (#86)
+- **OMP meta roots resolve as one indivisible bundle, never through `piAgentDir()`.** omp is a pi
+  fork and inherits pi's env vocabulary, so `PI_CODING_AGENT_DIR` means "pi's persistence root"
+  to entwurf and "my agent dir" to the vendor — a plain `omp --profile work` sets it. One pure
+  resolver leaf now serves both consumers, the in-process birth extension and the omp-labeled
+  bridge child, so agreement is by construction rather than two places computing the same thing.
+  A relative override fails closed instead of letting cwd become an authority: measured, the same
+  relative value resolved to two different stores because the extension's cwd is wherever the
+  operator launched omp while the doctor's is the repository. Installers refuse rather than guess
+  under an inherited `PI_CODING_AGENT_DIR` / `PI_CONFIG_DIR` / `PI_PROFILE`. (#87)
+- **`PI_SESSION_ID` and `PI_AGENT_ID` are scrubbed at the launch seam for every backend.**
+  Measured on the operator host: a tmux server env carrying `PI_SESSION_ID` was inherited
+  verbatim by a new pane, so a sibling's bridge child could phone home under another citizen's
+  identity. The scrub is at the seam, not per backend. (#87)
+- **The deterministic floor composes the omp gates.** `check:hermetic` gains
+  `smoke-omp-bridge-state`, `smoke-omp-mcp-state`, `smoke-omp-receive-state`,
+  `check-omp-receive-arm` and `check-omp-fresh-preflight`; `check:contracts` gains
+  `check-harness-admission-parity`. Both tiers still exclude the separately scheduled
+  `check-gate-qualification`, and `setup` still does not compose omp. (#87)
+- **`docs/adding-a-harness.md` step 5 now says to measure the invocation FORM, not only the tool
+  name.** omp mounts MCP tools as `xd://` virtual devices by default (`tools.xdev`), so a correct
+  tool NAME is still not a callable function: the model must read the device for a schema that
+  `tools.xdevDocs` keeps off-prompt, then write JSON to the same path to execute. Measured on omp
+  18.0.0, a plain send under that default listed peers and then reported delivery with nothing
+  enqueued, and the mount also hid omp's own lsp, debug, browser and ast_edit — 11 devices in
+  all. `tools.xdev: false` restores every enabled tool top-level and leaves plan mode's
+  `xd://propose` finalization intact. (#87)
+
+### Fixed
+
+- **The bridge boot entry was in no typecheck program.** `mcp/tsconfig.json` extended the root
+  config without re-declaring `exclude`, so the inherited `"mcp"` resolved to `<repo>/mcp` and
+  filtered out everything its own `include` added; `mcp/entwurf-bridge/src/index.ts` — the
+  785-line bridge boot entry — was the only tracked `.ts` in the repo in no `tsc --noEmit`
+  program at all, and nothing imports it, so nothing rescued it through the import graph. Orphan
+  census 1 line before, 0 after; the mcp program's repo-file count moved 27 → 54, all product
+  sources. The emit path is untouched, so there is no product runtime change.
+- **`entwurf_self` stopped rendering a mailbox nothing drains.** `metaDeliveryDomain` was derived
+  as native-push or self-fetch, so an omp citizen was handed a `mailboxPath` with no drainer. It
+  now has three values: `nativePushSupported` → native-push, else the decider's mailbox seam →
+  self-fetch, else none. Dispatch and `wakeMode` are untouched. (#87)
+- **`doctor-omp-mcp` reads `tools.xdev` on the runtime axis.** An absent file or key applies the
+  vendor default (xdev on, empty inline allowlist) and is RED while the native hand is the
+  effective source; `xdev: false` is ok and a covering `xdevInlineDevices` glob is
+  ok-with-note. Ownership stays a separate question, and the smoke never touches the host
+  `config.yml`. (#87)
+- **The bootstrap epoch now ends before the birth edge can bail.** Epoch termination depended on
+  reaching `startOmpBootstrap`, so a later birth edge that bailed early — a refused envelope or a
+  throwing upsert — skipped the invalidation, and on a same-id resume both handler fences still
+  passed, leaving the earlier defect shape alive in a narrow window. One rule, one owner:
+  `endBootstrapEpochOnLaterEdge` runs right after the mode fence, before the envelope is read,
+  and the consumed branch delegates to the same helper. Zero new state, zero new exports. (#87)
+- **The omp-fresh qualification manifests were settled by measurement.** The first standalone
+  qualification run on the Bundle C bytes caught what static exactness could not: four mutants
+  whose claim and signature named different cells, one QK token minted twice in its gate source,
+  twelve find hunks left stale by the bundle's own refactor and the amendment's rewiring, and one
+  kill-site guess that died at an anonymous cell. Every repair was adjudicated by
+  apply/gate/revert measurement rather than by guess, and kill sites the floor disputed were
+  moved to where the kill actually lands. Separately, two mutants had been added to the
+  self-address lane without extending `EXPECTED_LANE_MUTANTS` — exactly the drift that assertion
+  exists to catch; the declared contract now says 5. (#87)
+- **Two packaging omissions in the omp units.** `pi/meta-bridge-omp/entwurf-meta-omp/package.json`
+  and `pi/omp-receive/entwurf-receive-omp/package.json` were absent from `files[]`, so
+  `install-omp-receive` died in the installed package while passing from a checkout. (#87)
+- **`check-pack-install` pins the transitive `@earendil-works/pi-telemetry` to 0.84.3.** Upstream
+  published the 0.84.4 family on 2026-08-28; `pi-agent-core@0.84.3` and `pi-ai@0.84.3` both carry
+  a `^0.84.3` caret on it, so the lockfile-less fresh-temp install floated to 0.84.4 and the leak
+  assertion failed closed in the `install-surface` CI job. The pin keeps the verified 0.84.3
+  constellation ours to hold; the leak assertion still guards every other pi package and any
+  future closure growth. The 0.84.4 bump itself remains a separate hard-cut lane.
+- **The omp doctor treated Bundle C's empty tmux scrub as inherited identity.** `tmux -e NAME=`
+  writes `PI_SESSION_ID=` / `PI_AGENT_ID=` present-but-empty; authoritative readers trim and
+  require truthy values, so empty and absent are the same answer. The doctor was presence-testing
+  those names, which turned `check:full` red whenever a visible fresh omp citizen was alive.
+  It now flags only a nonblank value, and the hermetic smoke hands it fixture pids rather than
+  the host `pgrep`. (#87)
+
+### Verification
+
+Each receipt carries its own scope; none of them is transferable to another commit or host.
+
+- **`./run.sh check-gate-qualification`** — **324/324 KILLED, NOT KILLED 0**, standalone on the
+  Bundle C candidate (`fd5e462`), independently re-verified by a second model on the gate
+  predicate plus a full-lane rescan and a 3/3 sample re-kill.
+- **`pnpm run check:full`** — exit 0 in 430s on that same candidate, after the `build-bridge`
+  refresh the stale-dist tripwire demanded.
+- **Clause 7 LIVE** — `smoke-omp-fresh-live` green 2026-08-30, 21 assertions, oracle / omp 18.0.0
+  / `openai-codex/gpt-5.6-sol`. The sibling's garden `20260830T192913-df52b9` came from the
+  CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen;
+  `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`, with the drain visible in that
+  session's own transcript for its own garden id. It took two runs: the first went red on
+  stage-two delivery alone, which is the argument for making it a MUST.
+- **Receive acceptance (D6)** — 2026-08-30, oracle, omp 18.0.0: garden `20260830T140819-116f6a`,
+  `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`. D3 isolation is PROVEN, not
+  pending: with two live armed omp citizens, one addressed enqueue rang exactly one doorbell
+  while the sibling persisted no transcript and kept an empty mailbox.
+- **Cross-harness leg** — 2026-08-31, the first bidirectional live-turn roundtrip on the committed
+  bytes: a claude-code citizen opened a fresh omp sibling through the public surface (callback
+  sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` into it, and the
+  omp citizen's own live turn drained the doorbell and replied into the claude mailbox.
+- **`LIVE=1 ./run.sh release-gate <scratch> --cut`** — **MUST PASS=23 FAIL=0 SKIP=0,
+  BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** `check-gate-qualification` inside the gate
+  killed **325/325** mutants across 36 lanes. Log:
+  `/tmp/entwurf-release-gate-0.16.0.run2.DfMtRj/release-gate.log` (SHA-256
+  `2df4f6d4bddd563431ca41d2a43074f2cb6ccf9926ec6e8c7323de1a6ddf8192`).
+  A first attempt on the same versioned tree (scratch `.../entwurf-release-gate-0.16.0.AyHcIJ`)
+  hit one MUST FAIL in `smoke-entwurf-v2-matrix-live` C1b: the hidden-store resident did not
+  birth a record inside the 30s boot window. The same smoke rerun standalone passed 17 checks
+  in 4.9s; the rerun cut above is the acceptance. `pnpm run check:full` on the versioned tree
+  was exit 0 in 432s before P5.
+
+### Notes
+
+- **Evidence limit.** Every OMP LIVE claim above is one Linux host (oracle, ARM), one model, one
+  accepted run. Multi-host, multi-model and repeated fresh calls inside one process are not
+  claimed and are not evidenced here.
+- **Operator prerequisite.** `tools: xdev: false` in `~/.omp/agent/config.yml`. Under the vendor
+  default the doorbell would name a tool the model cannot call, so both the fresh preflight and
+  the LIVE smokes check it as a precondition. `setup` does not compose omp.
+- Measured against **omp 18.0.0** while the vendor announces 18.0.11. The `mode === "tui"`
+  discriminator, the `xd://` behaviour and the five measurement cells recorded in
+  `scripts/raw-omp-measure/README.md` §M7 are re-measurement targets on upgrade.
+- Copilot's operator-metered clause 7 exception is preserved, not reopened. The release stop
+  applies from OMP onward, forward-only.
+- The cross-harness leg's deterministic half — every post-contract citizen backend having a wired
+  cross-harness LIVE step or a declared metered exception — is an owed follow-up. Until that gate
+  lands the rule is prose, and `docs/adding-a-harness.md` says so in place.
+- Pi `0.84.4` remains a separate hard-cut lane.
+- #90 is measured but unfixed: installed Claude Code sends `model` as a STRING on the interactive
+  `SessionStart` envelope and omits it entirely in print mode, while the reader accepts only the
+  object shape, so claude-code records carry no model. Widening the reader and pinning both shapes
+  in a fixture is a separate lane.
+
+## 0.15.1 — 2026-08-27
+
+This patch is the Linux install-honesty floor for #86: Entwurf installs itself only,
+`setup` composes harnesses the operator already chose, and a detected integration that
+cannot be completed makes the command non-green. It is not a new garden capability.
+macOS and native-Windows implementation move to #78; this cut makes no cross-platform
+support claim.
+
+### Changed
+
+- **`setup` is presence-driven composition, not recruitment.** Mode is a named
+  source-versus-installed branch before any prerequisite check or write. Each detected
+  harness (pi, Claude Code, Copilot, agy) is completed independently; absence is
+  zero-state SKIP; below-floor or incomplete is named FAIL and a nonzero exit. The old
+  unconditional `DONE ... green` is gone — the summary is computed from component
+  outcomes. Pi is optional-by-presence with the package-derived floor `>=0.84.3 <0.85`.
+  A detected Copilot composes all four native units (birth → MCP → receiver → visible
+  footer). Installed-package setup never runs npm/pnpm inside `node_modules`. (#86)
+- **The shared Pi user-scope registration has a recorded owner.** Silent
+  last-writer-wins normalization is retired. A second root's install/setup/remove refuses
+  with zero settings writes and names `takeover-user-scope`; only that explicit operator
+  verb moves the entry (old→new reported). The inverse removes only the recorded owner's
+  exact entry. (#86 C2)
+- **Setup no longer mutates credential stores.** The unconditional `sync_auth` path that
+  copied the Anthropic OAuth object to an `entwurf` alias is removed. Hosts that already
+  ran the legacy path keep the alias and `auth.json.bak` as a documented manual cleanup,
+  not an automated one. (#86 A5)
+
+### Added
+
+- **Copilot birth has a package-owned inverse.** `uninstall-copilot-bridge` uses the
+  qualified `plugin@marketplace` identity, runs a read-only ownership/safety preflight
+  before any vendor write, and refuses to remove an unproven foreign unit. Installer,
+  inverse, and doctor share one structural oracle. (#86 C3a)
+- **Packed-consumer and all-absent setup rows are first-class fixtures.**
+  `smoke-setup-verdict` and the installed `entwurf setup` path inside `check-pack-install`
+  prove absence, independence, false-success refusal, and the named installed-versus-source
+  branch without a model turn. That npm-consumer harness is the Linux install evidence
+  #78 waits on. (#86)
+
+### Fixed
+
+- **Source setup now exposes the `entwurf` operator command Copilot fresh requires.**
+  `./run.sh setup` manages `~/.local/bin/entwurf` as an ownership-checked symlink to the
+  current checkout's `run.sh`, with per-bin state and an honest inverse. npm consumers
+  already received this command through package bin linking; the missing source half caused
+  `entwurf_fresh_call {backend:"copilot"}` to reject `runtime-unresolved` unless an unrelated
+  global package happened to mask the defect. Source setup now fails loud when that
+  operator path is foreign, outside PATH, or shadowed; helper units are attempted
+  independently and a foreign helper is a named FAIL, never a warning followed by cosmetic
+  success. The managed `entwurf copilot` boundary and every fresh/preflight/delivery
+  contract are unchanged. Discovered while rechecking #82. (#86)
+
+### Verification
+
+- **`pnpm run check:full`** — PASS, exit 0, 252s standalone / 247s inside the gate
+  on the 0.15.1 versioned tree (HEAD `4a23af1` + uncommitted changelog/version).
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.15.1.hAAn7U --cut`** —
+  **MUST PASS=21 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.**
+  `check-gate-qualification` inside the gate killed **277/277** mutants across 33
+  lanes. Log: `/tmp/entwurf-release-gate-0.15.1.hAAn7U/release-gate.log`
+  (SHA-256 `aa1364922301e685c650670dd6556a3c27feacdf1481d850d8e2ef56ef5cb23e`).
+
+### Notes
+
+- #78 owns macOS and native-Windows implementation. WSL remains Linux evidence.
+- Native-harness doctors stay the per-leaf live-certification surface. Setup writes
+  artifacts; a new session is still required before `doctor-meta-bridge` / Copilot receive
+  can go green on a host that already had processes open.
+
 ## 0.15.0 — 2026-08-25
 
 This release admits Copilot CLI as a full self-fetch garden citizen — birth, an owned

package/DELIVERY.md

@@ -84,11 +84,12 @@ can be owned without being supported; a supported harness still has to walk
 |---|---|---|---|
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
-| **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. |
+| **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No owned native-citizen install/invocation lane. |
 | **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
-| **Copilot CLI garden citizen** | branch candidate; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
+| **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
+| **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
 | **Copilot CLI TUI+server** — *withdrawn lane, kept as evidence* | rejected | D7; D8 unproven | Older official-SDK probe over hidden `--ui-server`; idle enqueue worked, but loopback RPC authentication was not established. The bundled extension supersedes this candidate without reviving it. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 
@@ -137,7 +138,7 @@ native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wa
 
 ### Copilot CLI: one citizen, two rails, one pending receipt
 
-The branch product owns the native citizen's birth, garden id, statusline, MCP hand,
+The shipped product owns the native citizen's birth, garden id, statusline, MCP hand,
 outbound sender identity — and, since RAIL 5, the receiver. A real Copilot CLI 1.0.80
 session minted a V3 record and sent under that record-backed garden id on 2026-08-21.
 That proved who SENDS. Whether a reply LANDS is a different fact on a different process,