@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/copilot-bridge-oracle.sh

@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+# copilot-bridge-oracle.sh — the ONE structural oracle for an assembled Copilot birth
+# unit (#86 C3a). Sourced by the installer (adoption preflight) and the doctor
+# (ownership axis) so "valid assembly" cannot mean two different things: a unit the
+# doctor would flag must never be silently adopted as ours.
+#
+# copilot_assembly_valid <asm-root> <plugin-name>
+#   rc 0  = the assembly at <asm-root> is a complete, baked unit
+#   rc 1  = it is not; the first failing reason is printed to stderr
+#
+# copilot_state_read <state_file> <qualified> <mkt_name> <asm>
+#   Fail-closed EXACT-schema reader for the ownership state — one validator for the
+#   installer, the inverse and the doctor so "valid state" cannot drift into three
+#   copies. rc 0 prints `<ownedMarketplace> <ownedAssembly> <pluginVersion>`; any
+#   missing/unknown key, wrong type, empty string, relative assemblyPath, constant
+#   drift or effective-ASM mismatch is rc 1 with the reason on stderr. Flags are never
+#   coerced: a missing or non-boolean owned* refuses instead of defaulting to false.
+#
+# copilot_marketplace_local_path <mkt-list-text> <mkt-name>
+#   The one exact marketplace-row grammar (see its own header below): absent /
+#   exactly-one Local path / malformed-non-Local-or-duplicate refusal.
+#
+# Deliberately BOUNDED: structure, one state schema, one plugin list-row grammar, one
+# marketplace list-row grammar. Registration, records, and hook-log truth stay with
+# the doctor's own axes.
+copilot_state_read() {
+	local state_file="$1" qualified="$2" mkt="$3" asm="$4"
+	STATE_FILE_ENV="$state_file" QUALIFIED_ENV="$qualified" MKT_ENV="$mkt" ASM_ENV="$asm" python3 - <<'PY'
+import json, os, sys
+try:
+    state = json.load(open(os.environ["STATE_FILE_ENV"]))
+except (OSError, json.JSONDecodeError) as err:
+    print(f"state parse failed: {err}", file=sys.stderr)
+    sys.exit(1)
+EXACT_KEYS = {
+    "schemaVersion", "qualifiedId", "marketplaceName", "assemblyPath",
+    "pluginVersion", "ownedMarketplace", "ownedAssembly", "installedAt",
+}
+if not isinstance(state, dict) or set(state) != EXACT_KEYS:
+    print(f"state keyset drifted: {sorted(state) if isinstance(state, dict) else type(state).__name__} != {sorted(EXACT_KEYS)}", file=sys.stderr)
+    sys.exit(1)
+if state["schemaVersion"] != 1:
+    print(f"state schemaVersion is {state['schemaVersion']!r}, want the literal 1", file=sys.stderr)
+    sys.exit(1)
+for key in ("qualifiedId", "marketplaceName", "assemblyPath", "pluginVersion", "installedAt"):
+    if not isinstance(state[key], str) or not state[key]:
+        print(f"state {key} must be a nonempty string, got {state[key]!r}", file=sys.stderr)
+        sys.exit(1)
+if any(ord(c) < 0x21 or ord(c) == 0x7f for c in state["pluginVersion"]):
+    # C3a amendment (B defect 4): these facts travel space-separated and consumers
+    # cut field 3, so a version carrying whitespace/control would silently truncate
+    # into a FABRICATED value (and a fabricated drift reason downstream). Refuse the
+    # state instead of shipping an ambiguous transport.
+    print(f"state pluginVersion contains whitespace/control characters: {state['pluginVersion']!r} — "
+          "the space-separated fact transport would truncate it into a fabricated version", file=sys.stderr)
+    sys.exit(1)
+for key in ("ownedMarketplace", "ownedAssembly"):
+    if not isinstance(state[key], bool):
+        print(f"state {key} must be a boolean, got {state[key]!r} — flags are never coerced", file=sys.stderr)
+        sys.exit(1)
+if not os.path.isabs(state["assemblyPath"]):
+    print(f"state assemblyPath must be absolute, got {state['assemblyPath']!r}", file=sys.stderr)
+    sys.exit(1)
+for key, want in (("qualifiedId", os.environ["QUALIFIED_ENV"]), ("marketplaceName", os.environ["MKT_ENV"])):
+    if state[key] != want:
+        print(f"state {key} is {state[key]!r}, want {want!r}", file=sys.stderr)
+        sys.exit(1)
+if state["assemblyPath"] != os.path.abspath(os.environ["ASM_ENV"]):
+    print(f"state assemblyPath is {state['assemblyPath']!r}, but this host's effective assembly is {os.path.abspath(os.environ['ASM_ENV'])!r}", file=sys.stderr)
+    sys.exit(1)
+print(f"{'true' if state['ownedMarketplace'] else 'false'} {'true' if state['ownedAssembly'] else 'false'} {state['pluginVersion']}")
+PY
+}
+
+# copilot_exact_row_version <list-text> <qualified>
+#   The finer read of the SAME row grammar (final amendment): reports whether the exact
+#   QUALIFIED is absent, present exactly once with a parsed nonempty version, or in a
+#   shape nobody may act on. rc 0 prints `absent` or `one <version>`; rc 1 with the
+#   reason on stderr for a MALFORMED exact row (claims our qualified id but does not
+#   parse as `<qualified> (v<nonempty>)`) or MULTIPLE exact rows. Longer tokens that
+#   merely contain the qualified id remain foreign and are ignored, same as above.
+copilot_exact_row_version() {
+	local list_text="$1" qualified="$2"
+	LIST_TEXT_ENV="$list_text" QUALIFIED_ENV="$qualified" python3 - <<'PY'
+import os, sys
+qualified = os.environ["QUALIFIED_ENV"]
+versions = []
+for raw in os.environ["LIST_TEXT_ENV"].splitlines():
+    row = raw.strip()
+    for glyph in ("•", "◆", "-"):
+        if row.startswith(glyph):
+            row = row[len(glyph):].strip()
+    # C3a amendment (B defect 3): the claim test is the exact QUALIFIED as the row's
+    # first whitespace-delimited token. Every claiming row must then parse as the one
+    # measured form `<qualified> (v<nonempty>)` IN FULL — a truncated/garbled tail
+    # (e.g. `(v0.1` with no closing paren) used to fall through the old
+    # startswith/endswith pair and round to ABSENT, which the inverse reads as
+    # retry-safe absence. Malformed is malformed; nothing rounds to absent.
+    parts = row.split(None, 1)
+    if not parts or parts[0] != qualified:
+        continue  # foreign row, including longer ids that merely contain ours
+    rest = parts[1] if len(parts) == 2 else ""
+    if not (rest.startswith("(v") and rest.endswith(")")):
+        print(f"malformed exact row for {qualified}: {row!r} does not parse as '<qualified> (v<version>)'", file=sys.stderr)
+        sys.exit(1)
+    version = rest[2:-1]
+    if not version:
+        print(f"malformed exact row for {qualified}: empty version in {row!r}", file=sys.stderr)
+        sys.exit(1)
+    if any(ord(c) < 0x21 or ord(c) == 0x7f for c in version):
+        # Same transport rule as the state validator: the parsed version rides
+        # space-separated verdicts (`one <version>`), so an embedded whitespace or
+        # control character is ambiguity, not a version.
+        print(f"malformed exact row for {qualified}: version {version!r} carries whitespace/control characters", file=sys.stderr)
+        sys.exit(1)
+    versions.append(version)
+if len(versions) > 1:
+    print(f"multiple exact rows for {qualified}: versions {versions} — nobody may act on an ambiguous listing", file=sys.stderr)
+    sys.exit(1)
+print(f"one {versions[0]}" if versions else "absent")
+PY
+}
+
+# copilot_marketplace_local_path <mkt-list-text> <mkt-name>
+#   The ONE exact marketplace-row grammar (C3a amendment, B defects 1+2) — installer,
+#   inverse and doctor all read the `plugin marketplace list` output through THIS
+#   parser instead of three copy-pasted `grep|head -1` pipelines that silently took
+#   the first of several same-named rows. rc 0 prints `absent` or `one <local abs
+#   path>`; rc 1 with the reason on stderr when a row claims the exact name but does
+#   not parse as the measured `<name> (Local: <path>)` form (a non-Local source is
+#   not provably ours), or when MULTIPLE rows claim the name (duplicates are
+#   ambiguity nobody may act on — never "the first one"). Rows whose first token
+#   merely contains the name remain foreign and are ignored. Path-vs-assembly drift
+#   stays with the callers: this parser reports the exact registered path, and each
+#   surface names its own refusal when that path is not its assembly.
+copilot_marketplace_local_path() {
+	local list_text="$1" mkt_name="$2"
+	LIST_TEXT_ENV="$list_text" MKT_NAME_ENV="$mkt_name" python3 - <<'PY'
+import os, sys
+name = os.environ["MKT_NAME_ENV"]
+paths = []
+for raw in os.environ["LIST_TEXT_ENV"].splitlines():
+    row = raw.strip()
+    for glyph in ("•", "◆", "-"):
+        if row.startswith(glyph):
+            row = row[len(glyph):].strip()
+    parts = row.split(None, 1)
+    if not parts or parts[0] != name:
+        continue  # foreign row, including longer names that merely contain ours
+    rest = parts[1] if len(parts) == 2 else ""
+    if not (rest.startswith("(Local: ") and rest.endswith(")")):
+        print(f"malformed marketplace row for {name}: {row!r} does not parse as '<name> (Local: <path>)' — "
+              "a non-Local or garbled registration is not provably ours", file=sys.stderr)
+        sys.exit(1)
+    path = rest[len("(Local: "):-1]
+    if not path:
+        print(f"malformed marketplace row for {name}: empty Local path in {row!r}", file=sys.stderr)
+        sys.exit(1)
+    paths.append(path)
+if len(paths) > 1:
+    print(f"multiple marketplace rows named {name}: paths {paths} — duplicates are ambiguity nobody may act on", file=sys.stderr)
+    sys.exit(1)
+print(f"one {paths[0]}" if paths else "absent")
+PY
+}
+
+copilot_assembly_valid() {
+	local asm="$1" plugin="$2"
+	local unit="$asm/$plugin"
+	local launcher="$unit/scripts/copilot-hook-launch.sh"
+	local hooks="$unit/hooks/hooks.json"
+	[ -d "$unit" ] || { echo "structural oracle: unit dir missing: $unit" >&2; return 1; }
+	[ -x "$launcher" ] || { echo "structural oracle: launcher missing or not executable: $launcher" >&2; return 1; }
+	if grep -q "__NODE_BIN__\|__HOOK_ENTRY__" "$launcher"; then
+		echo "structural oracle: launcher still carries an installer placeholder (unbaked): $launcher" >&2
+		return 1
+	fi
+	local baked_node
+	baked_node="$(sed -n 's/^NODE_BIN="\(.*\)"$/\1/p' "$launcher" | head -1)"
+	[ -n "$baked_node" ] && [ -x "$baked_node" ] || {
+		echo "structural oracle: baked node missing or not executable: ${baked_node:-(unparsed)}" >&2
+		return 1
+	}
+	local baked_entry
+	baked_entry="$(sed -n 's|^HOOK_ENTRY="\$PLUGIN_ROOT/\(.*\)"$|\1|p' "$launcher" | head -1)"
+	[ -n "$baked_entry" ] && [ -f "$unit/$baked_entry" ] || {
+		echo "structural oracle: hook entry missing beside the launcher: ${baked_entry:-(unparsed)}" >&2
+		return 1
+	}
+	[ -f "$unit/entwurf-capabilities.json" ] || {
+		echo "structural oracle: capability registry missing at the plugin root" >&2
+		return 1
+	}
+	[ -f "$hooks" ] || { echo "structural oracle: hooks.json missing: $hooks" >&2; return 1; }
+	if ! HOOKS_PATH="$hooks" ORACLE_LAUNCHER="$launcher" python3 - <<'PY'
+import json, os, sys
+from pathlib import Path
+try:
+    hooks = json.loads(Path(os.environ["HOOKS_PATH"]).read_text(encoding="utf-8"))
+except (OSError, json.JSONDecodeError) as err:
+    print(f"structural oracle: hooks.json unreadable: {err}", file=sys.stderr)
+    sys.exit(1)
+launcher = os.environ["ORACLE_LAUNCHER"]
+if hooks.get("version") != 1:
+    print("structural oracle: hooks.json version is not the literal 1", file=sys.stderr)
+    sys.exit(1)
+events = hooks.get("hooks") or {}
+if set(events) != {"sessionStart", "userPromptSubmitted"}:
+    print(f"structural oracle: hook events drifted: {sorted(events)}", file=sys.stderr)
+    sys.exit(1)
+for name, entries in events.items():
+    for i, entry in enumerate(entries if isinstance(entries, list) else []):
+        exec_value = entry.get("exec")
+        if not isinstance(exec_value, str) or exec_value != launcher or "args" in entry:
+            print(f"structural oracle: hooks.{name}[{i}] is not the baked exec-string form", file=sys.stderr)
+            sys.exit(1)
+sys.exit(0)
+PY
+	then
+		return 1
+	fi
+	return 0
+}

package/scripts/copilot-bridge-uninstall.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# copilot-bridge-uninstall.sh — the package-owned INVERSE of copilot-bridge-install.sh
+# (#86 C3a). Removes exactly what the ownership state records this package installed —
+# the qualified plugin, the local marketplace registration, the assembly — and nothing
+# else. The stale Claude unit is INSTALL-ONLY territory; this inverse never touches it.
+#
+# ORDER AND AUTHORITY (amendment: the ownership preflight is COMPLETE before any vendor
+# mutation). The state is required and validated fail-closed against this package's
+# constants and the effective assembly path; both vendor lists are read next and a
+# failing list is UNKNOWN (an unknown host is not an empty one — refuse); then EVERY
+# ownership and safety fact — marketplace name/path/recorded ownership, assembly path
+# safety, exact plugin row presence — is decided read-only. Only after all of it passes
+# may the first vendor write run. So a refusal, any refusal, is zero vendor/filesystem
+# writes with the state retained. Vendor steps run before filesystem steps, the state
+# is deleted LAST, and any failure stops with the state retained so a rerun can finish
+# the job. `--force` is forbidden: `marketplace remove --force` uninstalls that
+# marketplace's plugins as a side effect (measured 2026-08-27).
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MKT_NAME="meta-bridge-copilot-local"
+PLUGIN="entwurf-meta-receive-copilot"
+QUALIFIED="$PLUGIN@$MKT_NAME"
+ASM="${ENTWURF_COPILOT_ASM:-${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-copilot/.assembled}"
+STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/copilot-bridge"
+STATE_FILE="$STATE_DIR/install-state.json"
+
+die() { echo "[copilot-bridge-uninstall] $*" >&2; exit 1; }
+
+[ $# -eq 0 ] || die "unknown argument: $1 (this inverse takes no arguments; --force does not exist here)"
+command -v copilot >/dev/null 2>&1 || die "the 'copilot' CLI is not on PATH."
+command -v python3 >/dev/null 2>&1 || die "python3 is required and is not on PATH."
+
+# shellcheck source=copilot-bridge-oracle.sh
+. "$HERE/copilot-bridge-oracle.sh"
+
+# --- 1. the ownership state is the sole removal authority --------------------
+[ -L "$STATE_FILE" ] && die "ownership state $STATE_FILE is a symlink — refusing to trust it."
+[ -f "$STATE_FILE" ] || die "no ownership state at $STATE_FILE — nothing this package provably owns to remove. A legacy no-state installation is adopted by './run.sh install-copilot-bridge' first, then removed."
+STATE_FACTS="$(copilot_state_read "$STATE_FILE" "$QUALIFIED" "$MKT_NAME" "$ASM")" \
+  || die "ownership state $STATE_FILE is corrupt or names a different installation (see above) — refusing with zero vendor/filesystem writes."
+OWNED_MKT="$(printf '%s' "$STATE_FACTS" | cut -d' ' -f1)"
+OWNED_ASM="$(printf '%s' "$STATE_FACTS" | cut -d' ' -f2)"
+STATE_PLUGIN_VERSION="$(printf '%s' "$STATE_FACTS" | cut -d' ' -f3)"
+
+# --- 2. read-only vendor facts (a failing list is UNKNOWN, never absence) ----
+if ! INSTALLED_LIST="$(copilot plugin list 2>/dev/null)"; then
+  die "'copilot plugin list' failed, so this host's installed plugins are UNKNOWN — refusing with zero writes. Fix the Copilot CLI error and re-run."
+fi
+if ! MKT_LIST="$(copilot plugin marketplace list 2>/dev/null)"; then
+  die "'copilot plugin marketplace list' failed, so this host's marketplaces are UNKNOWN — refusing with zero writes. Fix the Copilot CLI error and re-run."
+fi
+
+# --- 3. COMPLETE ownership/safety preflight, read-only, before ANY mutation --
+# 3a. the marketplace half: exact name must sit at the recorded path AND be recorded
+#     as ours. Refusing HERE — before the plugin uninstall — is the amendment's point:
+#     the same qualified id could have been installed from a same-named marketplace at
+#     another path, and an inverse that had already uninstalled the plugin would have
+#     removed someone else's unit before discovering that.
+MKT_PRESENT=0
+# ONE marketplace-row grammar (C3a amendment, B defects 1+2): the shared oracle
+# refuses malformed/non-Local rows and DUPLICATE same-named rows instead of silently
+# acting on the first — an inverse steered at the wrong same-named marketplace would
+# remove a registration it cannot attribute.
+MKT_ROW="$(copilot_marketplace_local_path "$MKT_LIST" "$MKT_NAME")" \
+  || die "the 'copilot plugin marketplace list' rows for '$MKT_NAME' are malformed, non-Local, or duplicated (see above) — refusing with zero vendor/filesystem writes."
+if [ "$MKT_ROW" != "absent" ]; then
+  MKT_PRESENT=1
+  MKT_PATH="${MKT_ROW#one }"
+  if [ "$MKT_PATH" != "$ASM" ]; then
+    die "a marketplace named '$MKT_NAME' is registered at '$MKT_PATH', not at the recorded assembly ($ASM). That registration is not provably ours — refusing with zero vendor/filesystem writes; inspect 'copilot plugin marketplace list' manually."
+  fi
+  if [ "$OWNED_MKT" != "true" ]; then
+    die "marketplace '$MKT_NAME' is registered at our recorded path, but the ownership state does not record marketplace ownership. Completing this inverse would leave a registered marketplace pointing at removed backing — refusing with zero vendor/filesystem writes (plugin, marketplace, assembly and state all preserved). Resolve the marketplace registration manually, or re-run './run.sh install-copilot-bridge' to re-bind ownership."
+  fi
+fi
+# 3b. assembly delete safety, decided BEFORE any vendor write: the recorded path must
+#     be a sane rm target or nothing at all may start.
+if [ "$OWNED_ASM" = "true" ]; then
+  case "$ASM" in
+    /) die "recorded assembly path is '/' — refusing everything." ;;
+    /*) : ;;
+    *) die "recorded assembly path is not absolute: $ASM — refusing everything." ;;
+  esac
+  [ -L "$ASM" ] && die "recorded assembly path $ASM is a symlink — refusing everything; the inverse removes only the real recorded directory."
+  if [ -e "$ASM" ] && [ ! -d "$ASM" ]; then
+    die "recorded assembly path $ASM exists but is not a directory — refusing everything."
+  fi
+fi
+# 3c. the plugin half (final amendment): the exact QUALIFIED must be ABSENT (a previous
+#     run got that far — retry-safe) or present EXACTLY ONCE at the state's recorded
+#     version. A different version is `version-drift` — something other than the
+#     recorded install put it there, and this inverse must not remove what it cannot
+#     prove it installed. Malformed/multiple exact rows refuse too. Longer tokens that
+#     merely contain the qualified id remain foreign, same as everywhere.
+PLUGIN_PRESENT=0
+LISTED_ROW="$(copilot_exact_row_version "$INSTALLED_LIST" "$QUALIFIED")" \
+  || die "the 'copilot plugin list' rows for $QUALIFIED are malformed or ambiguous (see above) — refusing with zero vendor/filesystem writes."
+case "$LISTED_ROW" in
+  absent) : ;;
+  "one $STATE_PLUGIN_VERSION") PLUGIN_PRESENT=1 ;;
+  one\ *)
+    die "version-drift: $QUALIFIED is listed at ${LISTED_ROW#one }, but the ownership state recorded v$STATE_PLUGIN_VERSION. This inverse removes only what it provably installed — refusing with zero vendor/filesystem writes (plugin, marketplace, assembly and state all preserved). Re-run './run.sh install-copilot-bridge' to re-bind ownership, then remove." ;;
+  *) die "unexpected exact-row verdict '$LISTED_ROW' — refusing with zero writes." ;;
+esac
+
+# --- 4. vendor mutation (licensed by the complete preflight above) -----------
+if [ "$PLUGIN_PRESENT" -eq 1 ]; then
+  copilot plugin uninstall "$QUALIFIED" >/dev/null \
+    || die "'copilot plugin uninstall $QUALIFIED' failed — stopping with the state retained; re-run to finish."
+  echo "[copilot-bridge-uninstall] uninstalled $QUALIFIED"
+else
+  echo "[copilot-bridge-uninstall] $QUALIFIED (v$STATE_PLUGIN_VERSION) is already absent from 'copilot plugin list' (a previous run got this far) — continuing"
+fi
+if [ "$MKT_PRESENT" -eq 1 ]; then
+  copilot plugin marketplace remove "$MKT_NAME" >/dev/null \
+    || die "'copilot plugin marketplace remove $MKT_NAME' failed (never retried with --force) — stopping with the state retained; re-run to finish."
+  echo "[copilot-bridge-uninstall] removed marketplace $MKT_NAME"
+else
+  echo "[copilot-bridge-uninstall] marketplace $MKT_NAME is already absent (a previous run got this far) — continuing"
+fi
+
+# --- 5. the assembly: only the recorded directory, only when owned -----------
+if [ "$OWNED_ASM" = "true" ]; then
+  if [ -d "$ASM" ]; then
+    rm -rf "$ASM"
+    echo "[copilot-bridge-uninstall] removed assembly $ASM"
+  else
+    echo "[copilot-bridge-uninstall] assembly already absent at $ASM (a previous run got this far) — continuing"
+  fi
+else
+  echo "[copilot-bridge-uninstall] state does not record assembly ownership — preserving $ASM"
+fi
+
+# --- 6. the state, LAST ------------------------------------------------------
+rm -f "$STATE_FILE"
+echo "[copilot-bridge-uninstall] DONE — ownership state cleared ($STATE_FILE). The stale Claude unit, if any, was deliberately not touched (install-only territory)."

package/scripts/dev-bin.sh

@@ -7,8 +7,9 @@
 # each recorded in its OWN checkout-OUTSIDE install-state (<name>.install-state.json) for an
 # honest inverse.
 #
-# Managed bins (both are BARE names that configs record — no repo/checkout path is EVER written
-# into any config; this only makes the bare name RESOLVE in a dev checkout):
+# Managed bins (all are BARE names — no repo/checkout path is EVER written into a harness
+# config; this only makes each package command RESOLVE in a dev checkout):
+#   entwurf                 -> run.sh                          (operator command / managed Copilot runtime)
 #   entwurf-bridge          -> mcp/entwurf-bridge/start.sh    (agy mcp_config command)
 #   entwurf-agy-statusline  -> scripts/agy-statusline.sh      (agy settings.statusLine command)
 #   entwurf-agy-imprint     -> scripts/agy-imprint.sh         (agy PreInvocation birth hook)
@@ -27,12 +28,16 @@
 # name on a later expose is re-reported (drift visibility).
 #
 #   expose [name]   create/refresh managed link(s) (idempotent; REFUSE foreign → exit 3).
-#                   no name = all managed bins.
+#                   no name = all managed bins, each attempted INDEPENDENTLY (#86 C1): one
+#                   foreign refusal no longer aborts the loop, the trailing summary reports
+#                   attempted/ok/refused truthfully, and any refusal still exits 3.
 #   remove [name]   honest inverse from state (remove only OUR link; REFUSE if it became foreign).
 #                   no name = all managed bins.
+#   verify <name>   require OUR symlink → target and that exact link as the PATH winner.
 #
 # Overridable for the isolated smoke:
-#   ENTWURF_DEV_BIN_DIR            link location (default: ~/.local/bin — where agy itself lives)
+#   ENTWURF_DEV_BIN_DIR           link location (default: ~/.local/bin — where agy itself lives)
+#   ENTWURF_OPERATOR_TARGET       entwurf target (default: $REPO/run.sh)
 #   ENTWURF_BRIDGE_TARGET         entwurf-bridge target (default: $REPO/mcp/entwurf-bridge/start.sh)
 #   ENTWURF_AGY_STATUSLINE_TARGET entwurf-agy-statusline target (default: $REPO/scripts/agy-statusline.sh)
 #   ENTWURF_AGY_IMPRINT_TARGET    entwurf-agy-imprint target (default: $REPO/scripts/agy-imprint.sh)
@@ -47,7 +52,7 @@ BIN_DIR="${ENTWURF_DEV_BIN_DIR:-$HOME/.local/bin}"
 STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/dev-bin"
 LEGACY_STATE="$STATE_DIR/install-state.json"   # pre-multi-bin single state == entwurf-bridge
 
-MANAGED_BINS="entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
+MANAGED_BINS="entwurf entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
 
 log()  { printf '%s\n' "$*"; }
 warn() { printf '%s\n' "$*" >&2; }
@@ -55,6 +60,7 @@ fail() { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
 
 bin_target() {  # $1 = name → prints target path (env-overridable for smoke)
   case "$1" in
+    entwurf)                echo "${ENTWURF_OPERATOR_TARGET:-$REPO_DIR/run.sh}" ;;
     entwurf-bridge)         echo "${ENTWURF_BRIDGE_TARGET:-$REPO_DIR/mcp/entwurf-bridge/start.sh}" ;;
     entwurf-agy-statusline) echo "${ENTWURF_AGY_STATUSLINE_TARGET:-$REPO_DIR/scripts/agy-statusline.sh}" ;;
     entwurf-agy-imprint)    echo "${ENTWURF_AGY_IMPRINT_TARGET:-$REPO_DIR/scripts/agy-imprint.sh}" ;;
@@ -139,7 +145,9 @@ PY
   fi
 }
 
-expose_one() {  # $1 = name
+expose_one() {  # $1 = name; a foreign link RETURNS 3 (no exit) so the no-arg
+                # composition can attempt every unit independently (#86 C1) —
+                # a broken checkout (missing/unknown target) still fails loud.
   local name="$1" target link sf detect
   target="$(bin_target "$name")" || fail "unknown managed bin: $name"
   link="$BIN_DIR/$name"; sf="$(state_file_for "$name")"
@@ -149,7 +157,7 @@ expose_one() {  # $1 = name
   [ -x "$target" ] || fail "target is not an executable file: $target (is this a dev checkout?)"
   if ! link_is_ours "$link" "$target" "$sf"; then
     warn "[dev-bin] REFUSE ($name): $link exists and is NOT ours (a foreign file/symlink — e.g. a real npm consumer bin). Not clobbering someone else's SSOT."
-    exit 3
+    return 3
   fi
   detect="created-new"; [ -L "$link" ] && detect="refresh-ours"
   mkdir -p "$BIN_DIR"
@@ -161,6 +169,21 @@ expose_one() {  # $1 = name
   fi
 }
 
+verify_one() {  # $1 = name
+  local name="$1" target link resolved
+  target="$(bin_target "$name")" || fail "unknown managed bin: $name"
+  link="$BIN_DIR/$name"
+  resolved="$(command -v "$name" 2>/dev/null || true)"
+  if [ ! -L "$link" ] || [ "$(readlink "$link" 2>/dev/null || true)" != "$target" ] || [ "$resolved" != "$link" ]; then
+    warn "[dev-bin] FAIL ($name): source command is not the PATH winner owned by this checkout."
+    warn "  expected: $link -> $target"
+    warn "  resolved: ${resolved:-<none>}"
+    warn "  fix: remove a foreign/shadowing bin or put $BIN_DIR on PATH, then re-run setup."
+    return 1
+  fi
+  log "[dev-bin verify] $name → $target (PATH winner: $link)"
+}
+
 remove_one() {  # $1 = name
   local name="$1" target link sf recorded
   target="$(bin_target "$name")" || fail "unknown managed bin: $name"
@@ -185,7 +208,24 @@ remove_one() {  # $1 = name
 
 do_expose() {  # $1 = optional bin name
   migrate_legacy
-  if [ -n "${1:-}" ]; then expose_one "$1"; else for b in $MANAGED_BINS; do expose_one "$b"; done; fi
+  if [ -n "${1:-}" ]; then expose_one "$1"; return $?; fi
+  # No-arg = the setup composition. Attempt EVERY unit independently (#86 C1):
+  # the old loop stopped at the first foreign refusal while the caller's warning
+  # claimed only that one bin was left as-is — units after it were never
+  # attempted. Now each refusal is recorded, later units still run, and the
+  # summary line reports attempted/ok/refused so no caller can claim less than
+  # what happened. Any refusal keeps the loop's exit 3 contract.
+  local attempted=0 exposed=0 refused="" rc b
+  for b in $MANAGED_BINS; do
+    attempted=$((attempted + 1))
+    rc=0; expose_one "$b" || rc=$?
+    if [ "$rc" -eq 0 ]; then exposed=$((exposed + 1)); else refused="$refused $b"; fi
+  done
+  if [ -n "$refused" ]; then
+    warn "[dev-bin expose] summary: attempted=$attempted ok=$exposed refused=$((attempted - exposed)):$refused (every unit was attempted independently)"
+    return 3
+  fi
+  log "[dev-bin expose] summary: attempted=$attempted ok=$exposed refused=0"
 }
 do_remove() {  # $1 = optional bin name
   if [ -n "${1:-}" ]; then remove_one "$1"; else for b in $MANAGED_BINS; do remove_one "$b"; done; fi
@@ -194,5 +234,6 @@ do_remove() {  # $1 = optional bin name
 case "${1:-}" in
   expose) shift; do_expose "${1:-}" ;;
   remove) shift; do_remove "${1:-}" ;;
-  *) echo "usage: dev-bin.sh <expose|remove> [bin-name]" >&2; exit 2 ;;
+  verify) shift; [ -n "${1:-}" ] || fail "verify requires one managed bin name"; verify_one "$1" ;;
+  *) echo "usage: dev-bin.sh <expose|remove> [bin-name] | verify <bin-name>" >&2; exit 2 ;;
 esac

package/scripts/fake-copilot-vendor.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# fake-copilot-vendor.sh — ONE factory for the stateful fake Copilot CLI the
+# aggregate-setup gates drive (#86 C3b). Two consumers share it so their fakes
+# cannot drift: smoke-setup-verdict's copilot-present cell and check-pack-install's
+# installed copilot-present consumer row. The answer shapes are the MEASURED CLI's
+# (copilot 1.0.80, 2026-08-27) — the same shapes check-copilot-birth-hook.ts bakes
+# into its own TS fake: `plugin list` prints qualified ids with a `(vX)` suffix,
+# `plugin marketplace list` prints `<name> (Local: <abs path>)`, and `--force`
+# anywhere is refused loudly (the real `marketplace remove --force` uninstalls that
+# marketplace's plugins as a side effect; no entwurf surface may reach for it).
+#
+# This factory models the SUCCESS host only. A failing-list vendor is two lines and
+# stays inline in the cell that needs it (check-setup-qualification Cell D).
+#
+# usage: bash scripts/fake-copilot-vendor.sh <dir> <plugin_json>
+#
+# EXECUTE this file; do not source it. `_check_pack_install_impl` holds a
+# `trap … RETURN` around its temp roots, and bash fires a RETURN trap when a
+# `.`/`source` finishes too — sourcing this factory there deleted the whole
+# npm sandbox mid-gate (measured 2026-08-27). A child process cannot.
+#
+#   Writes <dir>/copilot (executable) plus its state files into <dir>:
+#     installed.txt      qualified ids `plugin install` appended
+#     marketplaces.txt   `<name>\t<path>` rows `plugin marketplace add` appended
+#     calls.log          every argv line the fake answered
+#   The advertised version is read from <plugin_json> (the same file the real
+#   installer reads), so the post-install exact-row check joins on one SSOT.
+set -euo pipefail
+
+make_fake_copilot() { # $1 = dir, $2 = plugin.json path
+	local dir="$1" plugin_json="$2" ver
+	ver="$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["version"])' "$plugin_json")" || return 1
+	mkdir -p "$dir"
+	: > "$dir/installed.txt"
+	: > "$dir/marketplaces.txt"
+	: > "$dir/calls.log"
+	cat > "$dir/copilot" <<FAKE
+#!/usr/bin/env bash
+STATE="$dir/installed.txt"
+MKTS="$dir/marketplaces.txt"
+LOG="$dir/calls.log"
+VER="$ver"
+echo "\$*" >> "\$LOG"
+for a in "\$@"; do [ "\$a" = "--force" ] && { echo "fake copilot: --force is forbidden here" >&2; exit 99; }; done
+case "\$1 \$2 \$3" in
+  "plugin marketplace list")
+    echo "Included with GitHub Copilot:"
+    while IFS=\$'\t' read -r n p; do [ -n "\$n" ] && echo "  • \$n (Local: \$p)"; done < "\$MKTS"
+    exit 0 ;;
+  "plugin marketplace add") printf "%s\t%s\n" "meta-bridge-copilot-local" "\$4" >> "\$MKTS"; exit 0 ;;
+  "plugin marketplace remove") awk -F"\t" -v n="\$4" '\$1 != n' "\$MKTS" > "\$MKTS.tmp"; mv "\$MKTS.tmp" "\$MKTS"; exit 0 ;;
+esac
+case "\$1 \$2" in
+  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/\$/ (v\$VER)/" "\$STATE"; exit 0 ;;
+  "plugin uninstall") grep -Fvx "\$3" "\$STATE" > "\$STATE.tmp"; mv "\$STATE.tmp" "\$STATE"; exit 0 ;;
+  "plugin install") echo "\$3" >> "\$STATE"; exit 0 ;;
+esac
+exit 0
+FAKE
+	chmod +x "$dir/copilot"
+}
+
+if [ "$#" -ne 2 ]; then
+	echo "usage: fake-copilot-vendor.sh <dir> <plugin_json>" >&2
+	exit 2
+fi
+make_fake_copilot "$1" "$2"

package/scripts/inventory-verification-surface.ts

@@ -90,7 +90,7 @@ const H_FS = /from\s+["']node:fs["']|require\(["']node:fs["']\)/;
 // "process.env.LIVE"; it spawns no live turn of its own. So the predicate runs on the
 // CODE-ONLY projection (comments and inert literals blanked, shell expansions kept)
 // and matches a variable READ or an assignment, never prose.
-const H_LIVE = /process\.env\.LIVE\b|\$\{LIVE[:}\-]|\$LIVE\b|(?:^|\n)\s*(?:export\s+)?LIVE=1\b/;
+const H_LIVE = /process\.env\.LIVE\b|\$\{LIVE[:}-]|\$LIVE\b|(?:^|\n)\s*(?:export\s+)?LIVE=1\b/;
 
 /**
  * Blank what cannot gate execution, so H_LIVE reads code and not prose.

package/scripts/meta-bridge-hook-log.sh

@@ -15,10 +15,18 @@
 # would make the CLAUDE doctor permanently red for a refusal on a different rail, with
 # a prescription pointing at a Claude wake failure that never happened (cross-review,
 # glm, 2026-08-21). Copilot's own recovery rule lives in copilot-bridge-doctor.sh.
+#
+# The OMP birth unit (#87) joins the same file tagged `LEVEL [omp]`, and the rule extends
+# for the same reason plus a sharper one: omp's own scope fence writes a line for EVERY
+# task subagent it refuses (`INFO [omp] scope-refused`), which is the designed answer, and
+# its failures are mint/marker faults on a rail whose recovery token — `create`/`attach` —
+# is not `armed watch` either. omp's recovery rule lives in omp-bridge-doctor.sh. Excluding
+# a backend here is never a way to quiet a red: it is how each doctor keeps judging only
+# the evidence it owns.
 meta_bridge_hook_log_status() {
   local log="$1"
   local own
-  own="$(grep -v ' \[copilot\] ' "$log" 2>/dev/null || true)"
+  own="$(grep -v -e ' \[copilot\] ' -e ' \[omp\] ' "$log" 2>/dev/null || true)"
   if ! printf '%s\n' "$own" | grep -q ' ERROR '; then
     echo "no-error"
     return 0