@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/register-pi-provider.py

@@ -28,11 +28,40 @@ Scope asymmetry (봉인계약 4·6, REASONED — not the unfounded asymmetry dev
            our-managed shapes (the bare bin AND the legacy repo path). project-scope state is a
            NAMED FOLLOW-UP (NEXT), deliberately out of this lane.
 
+USER-SCOPE OWNER BINDING (#86 C2): the user install-state additionally records
+`installerRoot` (the repo/package root that installed the key), so an old root's
+inverse can no longer delete the CURRENT stable provider key. Schema stays
+version 1 — installerRoot is an optional field, judged by ONE typed classifier
+(pi_settings_io.classify_installer_root, shared with the doctor-pi-package
+coupling): absent/null is LEGACY, a non-empty string is the owner, and every
+OTHER type (empty string, number, bool, object, array) is CORRUPT — install and
+remove both refuse it (exit 4) before any write, because a state MORE
+unattributed than legacy must never be treated MORE leniently than legacy:
+  - install, legacy state          → safe ADOPTION: proceed and rewrite the state
+                                     with installerRoot = this root (named on stdout);
+  - install, installerRoot ≠ root  → REFUSE (exit 6), zero settings write, unless
+                                     the operator-explicit --takeover replaces it
+                                     (old root reported);
+  - remove, installerRoot == root  → today's honest inverse;
+  - remove, installerRoot ≠ root, owner LIVE    → REFUSE (exit 6);
+  - remove, installerRoot ≠ root, owner MISSING → REFUSE unless --orphan-cleanup,
+    which only run.sh's aligned remove-user-scope path passes (package entry +
+    package state + provider installerRoot all naming that same missing root);
+  - remove, legacy state (no installerRoot) → REFUSE (fail-closed): an
+    unattributed key accepts no inverse; a same-root install/setup ADOPTS the
+    state first (named), then remove works.
+  - takeover over a USER-OVERRIDE key → split verdict: the override is preserved
+    and stays unowned, the stale ownership state is cleared, and the report says
+    "package owner moved; provider override preserved" — never a false both-owned.
+`--preflight` runs the SAME ownership decision READ-ONLY (identical exit codes,
+zero writes) so run.sh can complete both the package and provider preflights
+before either writer runs (atomic user-scope operations).
+
 Subcommands:
-  install <settings_path> <repo_dir> --scope <user|project> [--state <state_path>]
-  remove  <settings_path> <repo_dir> --scope <user|project> [--state <state_path>]
+  install <settings_path> <repo_dir> --scope <user|project> [--state <state_path>] [--takeover] [--preflight]
+  remove  <settings_path> <repo_dir> --scope <user|project> [--state <state_path>] [--orphan-cleanup] [--preflight]
 
-Exit codes: 0 ok · 2 no-state · 3 refuse-symlink · 4 invalid-json · 5 usage.
+Exit codes: 0 ok · 2 no-state · 3 refuse-symlink · 4 invalid-json/corrupt-state · 5 usage · 6 ownership-refusal.
 """
 
 import json
@@ -47,7 +76,7 @@ import sys
 # holds this directory when the script is run by path (how run.sh and the gates invoke
 # it); the explicit insert keeps the import true under any other invocation form.
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from pi_settings_io import detect_indent, dumps, unchanged  # noqa: E402
+from pi_settings_io import classify_installer_root, detect_indent, dumps, unchanged  # noqa: E402
 
 SERVER_KEY = "entwurf-bridge"
 BARE_COMMAND = "entwurf-bridge"
@@ -172,12 +201,49 @@ def _provider_servers(data: dict, create: bool):
     return provider, servers
 
 
-def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str) -> None:
+def _load_state_file(state_path: str) -> dict | None:
+    if not state_path or not os.path.exists(state_path):
+        return None
+    state = _load(state_path)
+    return state
+
+
+def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str, takeover: bool = False,
+                preflight: bool = False) -> None:
     if os.path.islink(settings_path):
         target = os.readlink(settings_path)
         _die(3, f"register-pi-provider: refusing to adopt {settings_path} — it is a symlink to {target} "
                 f"(someone else's SSOT). Manage it there, or replace it with a regular file, then retry.")
 
+    # Owner binding BEFORE any settings mutation (#86 C2): a user-scope state whose
+    # installerRoot names another root refuses the whole install — zero settings
+    # bytes — unless the operator-explicit takeover replaces it.
+    prior_state = _load_state_file(state_path) if scope == "user" else None
+    prior_kind, prior_root = ("legacy", None)
+    if scope == "user" and isinstance(prior_state, dict):
+        # State↔target binding (#86 C2 final amendment): the state names WHICH
+        # settings file it manages; an operation targeting a different file is an
+        # ownership mismatch — fail closed before either writer runs.
+        prior_managed = prior_state.get("managedSettingsPath")
+        if not isinstance(prior_managed, str):
+            _die(4, f"register-pi-provider: install-state {state_path} has no managedSettingsPath string")
+        if os.path.abspath(prior_managed) != os.path.abspath(settings_path):
+            _die(6, f"register-pi-provider: install-state {state_path} manages {prior_managed}, but this "
+                    f"operation targets {settings_path} — ownership record and target disagree; zero settings bytes written.")
+        # One typed installerRoot verdict (#86 C2 corrective amendment, B blocker 3):
+        # a wrong-TYPE value used to fall between the isinstance(str) arm and the
+        # is-None legacy arm and proceed unattributed — now it is CORRUPT, refused
+        # before any settings or state write.
+        prior_kind, prior_root = classify_installer_root(prior_state)
+        if prior_kind == "corrupt":
+            _die(4, f"register-pi-provider: install-state {state_path} has a CORRUPT installerRoot — expected "
+                    "a non-empty string (owner) or null/absent (legacy). Refusing to install over an "
+                    "unattributed state; repair or remove the state file first — zero settings bytes written.")
+    if scope == "user" and prior_kind == "owner" and prior_root != repo_dir and not takeover:
+        _die(6, f"register-pi-provider: the user-scope {SERVER_KEY} key is owned by another root: {prior_root}. "
+                "Normal install never replaces another owner — zero settings bytes written. "
+                "Use './run.sh takeover-user-scope' to move it explicitly.")
+
     raw = _read(settings_path)
     # Parsed TWICE on purpose: everything below mutates in place, so `before` has to be
     # an independent document or the comparison would be against itself.
@@ -189,12 +255,28 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str)
     existing_cmd = existing.get("command") if isinstance(existing, dict) else existing
     ownership = _classify(existing_cmd, repo_dir)
 
+    if preflight:
+        # Read-only half of the atomic user-scope operation: the ownership decision
+        # above already refused a foreign installerRoot; everything past this point
+        # would write, so report the classification and stop.
+        sys.stdout.write(f"preflight: install ok (ownership={ownership}{', takeover' if takeover else ''})\n")
+        return
+
     if ownership == "user-override":
         # DO NOT overwrite our key, DO NOT own it (no state). doctor reports it as unowned. Still
         # persist IF the legacy prune above (or a materialized parent) actually changed something.
         sys.stdout.write(
             f"install: preserved entwurfProvider.mcpServers.{SERVER_KEY} (user override, NOT owned: {existing_cmd!r})\n"
         )
+        if scope == "user" and takeover and state_path and os.path.exists(state_path):
+            # Split verdict (#86 C2): the package half moved, but the provider key is
+            # the OPERATOR'S override — preserve it, and clear the stale ownership
+            # state so no root claims a key nobody manages. Never a false "both owned".
+            os.remove(state_path)
+            sys.stdout.write(
+                "takeover: provider override preserved, unowned — stale provider ownership state cleared "
+                "(package owner moved; the provider key remains the operator's)\n"
+            )
         if not _persist(settings_path, before, data, raw):
             sys.stdout.write(f"install: no change — {settings_path} left untouched (bytes and mtime stable)\n")
         return
@@ -219,6 +301,16 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str)
 
     if scope == "user":
         if state_path:
+            if prior_state is not None and prior_kind == "legacy":
+                # LEGACY v1 state (pre-#86 C2, no installerRoot): safe adoption — the
+                # rewrite below binds it to this root, and the adoption is named.
+                sys.stdout.write(
+                    f"install: adopted legacy provider install-state (no installerRoot recorded) — now bound to {repo_dir}\n"
+                )
+            if takeover and prior_kind == "owner" and prior_root != repo_dir:
+                sys.stdout.write(
+                    f"takeover: user-scope {SERVER_KEY} provider ownership moved {prior_root} -> {repo_dir}\n"
+                )
             state = {
                 "schemaVersion": STATE_SCHEMA_VERSION,
                 "managedSettingsPath": os.path.abspath(settings_path),
@@ -226,6 +318,7 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str)
                 "key": f"entwurfProvider.mcpServers.{SERVER_KEY}",
                 "command": BARE_COMMAND,
                 "ownership": ownership,       # absent | managed-current | managed-legacy
+                "installerRoot": repo_dir,     # #86 C2: the root whose inverse may remove this key
                 "preimage": existing,          # raw prior value (audit only; NOT restored)
                 "installedAt": _now(),
             }
@@ -237,22 +330,66 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str)
         )
 
 
-def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str) -> None:
+def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str, orphan: bool = False,
+               preflight: bool = False) -> None:
     if scope == "user":
         if not state_path or not os.path.exists(state_path):
             sys.stdout.write("remove: no install-state — nothing to undo (never owned, or already removed).\n")
             return
         state = _load(state_path)
+        # Same-owner-only inverse (#86 C2): a state bound to another root must not
+        # let that OTHER root's stale inverse delete the CURRENT stable key. The
+        # typed classifier (B blocker 3) closes the wrong-TYPE gap: corrupt refuses
+        # BEFORE the foreign/legacy arms, so no value can fall between them.
+        installer_kind, installer_root = classify_installer_root(state)
+        if installer_kind == "corrupt":
+            _die(4, f"register-pi-provider: install-state {state_path} has a CORRUPT installerRoot — expected "
+                    "a non-empty string (owner) or null/absent (legacy). Refusing to remove on an unattributed "
+                    "state; repair or remove the state file first — zero settings bytes written.")
+        if installer_kind == "owner" and installer_root != repo_dir:
+            if os.path.isdir(installer_root):
+                _die(6, f"register-pi-provider: the user-scope {SERVER_KEY} key is owned by another LIVE root: "
+                        f"{installer_root}. This root's inverse must not remove it — zero settings bytes written.")
+            if not orphan:
+                _die(6, f"register-pi-provider: the recorded owner root is MISSING: {installer_root}. "
+                        "Refusing outside run.sh's aligned orphan path (remove-user-scope checks package entry, "
+                        "package state and provider installerRoot together).")
+            if not preflight:
+                sys.stdout.write(
+                    f"remove: orphan cleanup — proceeding for the MISSING owner {installer_root}\n"
+                )
+        elif installer_kind == "legacy":
+            # LEGACY v1 state (no installerRoot): fail-closed (#86 C2 amendment). An
+            # unattributed state must not let ANY root's inverse — least of all an old
+            # checkout's — delete the current stable key. Adoption is install-only:
+            # run install/setup from the owning root first, then remove.
+            _die(6, f"register-pi-provider: install-state {state_path} is LEGACY (no installerRoot recorded) — "
+                    "refusing to remove an unattributed key. Run './run.sh setup' or 'entwurf install' from the "
+                    "owning root first (named adoption binds the state), then remove.")
+        # PREFLIGHT COMPLETENESS (#86 C2 final amendment): everything the writer
+        # would check is checked HERE, before any green — managedSettingsPath shape
+        # and target equality, the symlink refusal, and settings/provider
+        # parseability — so a run.sh caller that saw this preflight green cannot
+        # have its provider writer break after the package writer already wrote.
         managed = state.get("managedSettingsPath")
         if not isinstance(managed, str):
             _die(4, f"register-pi-provider: install-state {state_path} has no managedSettingsPath")
+        if os.path.abspath(managed) != os.path.abspath(settings_path):
+            _die(6, f"register-pi-provider: install-state {state_path} manages {managed}, but this operation "
+                    f"targets {settings_path} — ownership record and target disagree; zero settings bytes written.")
         if os.path.islink(managed):
             _die(3, f"register-pi-provider: refusing to uninstall — {managed} became a symlink since install.")
+        raw = ""
+        before = data = provider = servers = None
         if os.path.exists(managed):
             raw = _read(managed)
-            before = _parse_settings(managed, raw)
+            before = _parse_settings(managed, raw)     # dies 4 on corrupt — preflight and writer alike
             data = _parse_settings(managed, raw)
             provider, servers = _provider_servers(data, create=False)
+        if preflight:
+            sys.stdout.write("preflight: remove ok (owner verified; managed target bound and parseable)\n")
+            return
+        if os.path.exists(managed):
             # honest inverse: absent/managed-* → remove OUR key (a legacy repo path is NOT
             # restored — it was our old managed value, not a user value).
             if isinstance(servers, dict):
@@ -304,8 +441,9 @@ def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str) -
 
 
 def _parse(argv: list):
-    # positional: settings_path repo_dir ; flags: --scope <s> [--state <p>]
+    # positional: settings_path repo_dir ; flags: --scope <s> [--state <p>] [--takeover] [--orphan-cleanup] [--preflight]
     pos, scope, state_path = [], None, ""
+    takeover, orphan, preflight = False, False, False
     i = 0
     while i < len(argv):
         a = argv[i]
@@ -315,17 +453,23 @@ def _parse(argv: list):
         elif a == "--state":
             i += 1
             state_path = argv[i] if i < len(argv) else ""
+        elif a == "--takeover":
+            takeover = True
+        elif a == "--orphan-cleanup":
+            orphan = True
+        elif a == "--preflight":
+            preflight = True
         else:
             pos.append(a)
         i += 1
-    return pos, scope, state_path
+    return pos, scope, state_path, takeover, orphan, preflight
 
 
 def main(argv: list) -> None:
     if len(argv) < 2:
         _die(5, "usage: register-pi-provider.py <install|remove> <settings_path> <repo_dir> --scope <user|project> [--state <path>]")
     sub = argv[1]
-    pos, scope, state_path = _parse(argv[2:])
+    pos, scope, state_path, takeover, orphan, preflight = _parse(argv[2:])
     if sub not in ("install", "remove"):
         _die(5, f"register-pi-provider.py: unknown subcommand {sub!r}")
     if len(pos) != 2:
@@ -335,10 +479,16 @@ def main(argv: list) -> None:
     settings_path, repo_dir = pos[0], str(os.path.abspath(pos[1]))
     if scope == "user" and not state_path:
         _die(5, "register-pi-provider.py: --state is required for --scope user")
+    if (takeover or orphan or preflight) and scope != "user":
+        _die(5, "register-pi-provider.py: --takeover/--orphan-cleanup/--preflight require --scope user")
+    if takeover and sub != "install":
+        _die(5, "register-pi-provider.py: --takeover is an install action")
+    if orphan and sub != "remove":
+        _die(5, "register-pi-provider.py: --orphan-cleanup is a remove action")
     if sub == "install":
-        cmd_install(settings_path, repo_dir, scope, state_path)
+        cmd_install(settings_path, repo_dir, scope, state_path, takeover, preflight)
     else:
-        cmd_remove(settings_path, repo_dir, scope, state_path)
+        cmd_remove(settings_path, repo_dir, scope, state_path, orphan, preflight)
 
 
 if __name__ == "__main__":

package/scripts/smoke-agy-install-state.sh

@@ -20,12 +20,14 @@
 #   - CREATE-NEW → uninstall removes the file it created.
 #   - SETUP INTEGRATION (막힘 ①): the `wire_agy_bridge` wrapper folded into `./run.sh setup` —
 #     agy absent → honest skip + NO state; agy present + regular → idempotent install + state;
-#     agy present + symlink/corrupt → NON-FATAL WARN + continue (exit 0, reason-specific, no
-#     clobber, no state). Driven via the hidden `wire-agy-bridge` subcommand with AGY_BIN pinned.
+#     agy present + symlink/corrupt → reason-specific WARN + leaf EXIT NONZERO (#86 C6/C7:
+#     named component FAIL, aggregate keeps later components alive; no clobber, no state).
+#     Driven via the hidden `wire-agy-bridge` subcommand with AGY_BIN pinned.
 #   - DEV BIN (막힘 ②): the managed `entwurf-bridge` symlink dev-bin.sh exposes so the agy
 #     config's BARE command resolves in a dev checkout — ownership-checked link (REFUSE a
 #     foreign bin, never a blind ln -sf), state + honest inverse (remove only OUR link), and
-#     the NON-FATAL setup wrapper (foreign → WARN + continue). Isolated bin dir + fake target.
+#     the truthful setup wrapper (foreign → WARN + rc=3, every unit still attempted — #86 C10).
+#     Isolated bin dir + fake target.
 #   - ⓪ discipline day-one: the checkout stays byte-identical (nothing written under $REPO).
 # Offline + deterministic (deps: bash + python3).
 set -euo pipefail
@@ -377,13 +379,16 @@ want "cache-prune(symlink): symlinked legacy cache left intact (not clobbered)"
   "[ -L '$CACHE/pi-tools-bridge' ] && [ -d '$SB/foreign-cache' ]"
 bash "$BRIDGE" uninstall >/dev/null; rm -f "$CACHE/pi-tools-bridge" "$GLOBAL" "$STATE"
 
-# ── I: setup integration — wire_agy_bridge (막힘 ①: detection-gated, NON-FATAL) ─────
+# ── I: setup integration — wire_agy_bridge (막힘 ①: detection-gated, truthful) ─────
 # The setup wrapper folded into `./run.sh setup`. Driven here via the hidden `wire-agy-bridge`
 # subcommand with AGY_BIN pinned (a fake agy / a nonexistent path) so detection is hermetic
-# regardless of the CI/dev host's real agy. Locks: agy absent → honest skip + NO state; agy
-# present + regular → idempotent install + state; agy present + symlink/corrupt → NON-FATAL
-# WARN + continue (exit 0 — an optional harness must never brick a pi/Claude setup), reason-
-# specific, no clobber, no state. Clean slate here (H left no config/state).
+# regardless of the CI/dev host's real agy. Locks (#86 C6/C7): agy absent → honest skip + NO
+# state + exit 0; agy present + regular → idempotent install + state + exit 0; agy present +
+# symlink/corrupt → reason-specific WARN, no clobber, no state, and EXIT NONZERO — the leaf
+# reports a detected-incomplete integration truthfully, and the aggregate setup records the
+# named component FAIL while keeping the remaining components alive. The old NON-FATAL exit-0
+# posture was the false-green shape this contract retires. Clean slate here (H left no
+# config/state).
 rm -f "$GLOBAL" "$LEGACY" "$STATE"
 printf '#!/usr/bin/env bash\necho fake-agy\n' > "$SB/bin/agy"; chmod +x "$SB/bin/agy"
 
@@ -408,11 +413,12 @@ want "wire(agy+regular, re-run): config still valid + entwurf-bridge present" \
 want "wire(agy+regular, re-run): unrelated server still preserved" "grep -q '\"other\"' '$GLOBAL'"
 bash "$BRIDGE" uninstall >/dev/null; rm -f "$GLOBAL"
 
-# I-3: agy PRESENT + SYMLINK config → NON-FATAL WARN + continue (exit 0), no clobber, no state
+# I-3: agy PRESENT + SYMLINK config → reason-specific WARN + EXIT NONZERO (component FAIL),
+# no clobber, no state
 printf '{"mcpServers":{}}\n' > "$SB/real_wire_cfg.json"
 ln -s "$SB/real_wire_cfg.json" "$GLOBAL"
 set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-bridge 2>&1)"; RC=$?; set -e
-want "wire(agy+symlink): exits 0 (NON-FATAL — setup not bricked)" "[ '$RC' -eq 0 ]"
+want "wire(agy+symlink): exits nonzero (detected agy + refused config = component FAIL, not cosmetic green) [QK:SETUP-AGY-COSMETIC-RETURN]" "[ '$RC' -ne 0 ]"
 want "wire(agy+symlink): reason-specific WARN names the symlink/SSOT" \
   "printf '%s' \"\$OUT\" | grep -qi 'symlink'"
 want "wire(agy+symlink): linked SSOT NOT clobbered" \
@@ -420,31 +426,69 @@ want "wire(agy+symlink): linked SSOT NOT clobbered" \
 want "wire(agy+symlink): NO state written" "[ ! -f '$STATE' ]"
 rm -f "$GLOBAL"
 
-# I-4: agy PRESENT + CORRUPT config (invalid JSON) → NON-FATAL WARN + continue, corrupt-specific
+# I-4: agy PRESENT + CORRUPT config (invalid JSON) → reason-specific WARN + EXIT NONZERO,
+# corrupt-specific
 printf 'this is not json{{{' > "$GLOBAL"
 set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-bridge 2>&1)"; RC=$?; set -e
-want "wire(agy+corrupt): exits 0 (NON-FATAL)" "[ '$RC' -eq 0 ]"
+want "wire(agy+corrupt): exits nonzero (detected agy + corrupt config = component FAIL)" "[ '$RC' -ne 0 ]"
 want "wire(agy+corrupt): reason-specific WARN flags invalid JSON (not a silent skip)" \
   "printf '%s' \"\$OUT\" | grep -qi 'invalid JSON'"
 want "wire(agy+corrupt): NO state written" "[ ! -f '$STATE' ]"
 rm -f "$GLOBAL" "$SB/bin/agy"
 
 # ── J: dev bin exposure — dev-bin.sh (막힘 ②: managed stable-bin symlinks) ─────────
-# dev-bin.sh now manages MULTIPLE bins (entwurf-bridge + entwurf-agy-statusline), each with its
-# OWN <name>.install-state.json. J drives the entwurf-bridge bin by NAME so these locks stay
-# byte-for-byte the pre-multi-bin regression (무회귀 판정): ownership-checked link (REFUSE
-# foreign, never a blind ln -sf), state + honest inverse, remove only OUR link, NON-FATAL setup
-# wrapper on a foreign bin. J-5 adds the new legacy-state migration. Isolated: a sandbox bin dir
-# + fake executable targets + the sandbox XDG state.
+# dev-bin.sh manages multiple package commands, each with its OWN <name>.install-state.json.
+# J-0 drives the NO-ARG setup composition and proves the source checkout supplies the operator
+# command Copilot fresh resolves (`entwurf` → this checkout's run.sh-equivalent target), including
+# a real argv-preserving invocation through PATH. J-1 onward keeps the older entwurf-bridge
+# ownership regression byte-for-byte: REFUSE foreign, state + honest inverse, remove only OUR
+# link, the truthful setup wrapper (rc=3 propagated), and legacy-state migration. Isolated:
+# sandbox bin/targets/XDG.
 DEVBIN="$REPO_DIR/scripts/dev-bin.sh"
 DBIN_DIR="$SB/devbin"
 DLINK="$DBIN_DIR/entwurf-bridge"
 DSTATE="$XDG_DATA_HOME/entwurf/dev-bin/entwurf-bridge.install-state.json"   # bin-scoped state
+OLINK="$DBIN_DIR/entwurf"
+OSTATE="$XDG_DATA_HOME/entwurf/dev-bin/entwurf.install-state.json"
 printf '#!/usr/bin/env bash\necho fake-bridge\n' > "$SB/fake-start.sh"; chmod +x "$SB/fake-start.sh"
 printf '#!/usr/bin/env bash\necho fake-status\n' > "$SB/fake-status.sh"; chmod +x "$SB/fake-status.sh"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$@" > "${ENTWURF_OPERATOR_ARGV_LOG:?}"\n' > "$SB/fake-entwurf.sh"; chmod +x "$SB/fake-entwurf.sh"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$SB/fake-aux.sh"; chmod +x "$SB/fake-aux.sh"
 export ENTWURF_DEV_BIN_DIR="$DBIN_DIR"
+export ENTWURF_OPERATOR_TARGET="$SB/fake-entwurf.sh"
 export ENTWURF_BRIDGE_TARGET="$SB/fake-start.sh"
-export ENTWURF_AGY_STATUSLINE_TARGET="$SB/fake-status.sh"   # for the no-arg setup wrapper (two bins)
+export ENTWURF_AGY_STATUSLINE_TARGET="$SB/fake-status.sh"
+export ENTWURF_AGY_IMPRINT_TARGET="$SB/fake-aux.sh"
+export ENTWURF_COPILOT_STATUSLINE_TARGET="$SB/fake-aux.sh"
+
+# J-0: the setup wrapper calls no-arg expose. This is the cross-contract cell the #82 regression
+# lacked: an npm consumer gets `entwurf` from package bin linking, and source setup must expose the
+# same operator command without a second global package install.
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "source setup exposes the managed Copilot runtime on PATH [QK:SOURCE-OPERATOR-BIN]" \
+  "[ '$RC' -eq 0 ] && [ -L '$OLINK' ] && [ \"\$(readlink '$OLINK')\" = '$SB/fake-entwurf.sh' ] && [ -f '$OSTATE' ]"
+want "source operator bin resolves through the sandbox PATH" \
+  "PATH='$DBIN_DIR':\"\$PATH\" command -v entwurf | grep -Fx '$OLINK' >/dev/null"
+OPERATOR_ARGV="$SB/operator.argv"
+ENTWURF_OPERATOR_ARGV_LOG="$OPERATOR_ARGV" "$OLINK" copilot --model auto
+want "source operator bin reaches its target with argv byte-for-byte" \
+  "python3 -c 'import sys; sys.exit(0 if open(sys.argv[1]).read().splitlines() == [\"copilot\",\"--model\",\"auto\"] else 1)' '$OPERATOR_ARGV'"
+bash "$DEVBIN" remove >/dev/null 2>&1
+want "source operator inverse removes its link and state" "[ ! -e '$OLINK' ] && [ ! -f '$OSTATE' ]"
+bash "$DEVBIN" remove entwurf >/dev/null 2>&1
+ok "source operator inverse is idempotent"
+printf 'FOREIGN OPERATOR\n' > "$OLINK"
+if bash "$DEVBIN" expose entwurf >/dev/null 2>&1; then die "dev-bin: entwurf expose should REFUSE a foreign operator bin"; fi
+want "source operator expose leaves a foreign bin untouched" "[ \"\$(cat '$OLINK')\" = 'FOREIGN OPERATOR' ]"
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "source setup fails loud when it cannot own its operator command [QK:SOURCE-OPERATOR-FAILS-LOUD]" \
+  "[ '$RC' -ne 0 ] && printf '%s' \"\$OUT\" | grep -q 'source command is not the PATH winner owned by this checkout'"
+rm -f "$OLINK"
+bash "$DEVBIN" expose entwurf >/dev/null 2>&1
+set +e; OUT="$(PATH="$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "source setup fails for the operator-certification reason when its managed bin directory is outside PATH" \
+  "[ '$RC' -ne 0 ] && printf '%s' \"\$OUT\" | grep -q 'source command is not the PATH winner owned by this checkout'"
+bash "$DEVBIN" remove >/dev/null 2>&1
 
 # J-1: expose the entwurf-bridge bin BY NAME → creates the managed symlink + state (created-new)
 bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1
@@ -479,11 +523,20 @@ if bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1; then die "dev-bin: expo
 ok "dev-bin expose: refused a foreign bin (nonzero exit)"
 want "dev-bin expose: foreign bin NOT clobbered" "[ \"\$(cat '$DLINK')\" = 'FOREIGN NPM BIN' ]"
 want "dev-bin expose: no state written on foreign refuse" "[ ! -f '$DSTATE' ]"
-# the NON-FATAL setup wrapper (no-arg → all bins) turns that refuse into a WARN + continue. The
-# foreign entwurf-bridge is the FIRST managed bin, so the wrapper stops there (statusline unreached).
-set +e; OUT="$(bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
-want "dev-bin wrapper(foreign): setup wrapper exits 0 (NON-FATAL)" "[ '$RC' -eq 0 ]"
-want "dev-bin wrapper(foreign): WARNs about a foreign bin (not ours)" "printf '%s' \"\$OUT\" | grep -qi 'not ours'"
+# The setup wrapper exposes/certifies the CORE operator, and dev-bin attempts EVERY unit
+# independently (#86 C10): a foreign helper no longer aborts the loop or hides behind a WARN —
+# the wrapper propagates rc=3, the summary reports attempted/ok/refused truthfully, later units
+# are still attempted, and the aggregate setup records a named bins FAIL. A helper conflict must
+# still not erase the operator command the source lane needs.
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "dev-bin wrapper(helper foreign): rc=3 with the source operator still certified" \
+  "[ '$RC' -eq 3 ] && [ \"\$(readlink '$OLINK')\" = '$SB/fake-entwurf.sh' ]"
+want "dev-bin wrapper(helper foreign): WARNs about a foreign bin (not ours)" "printf '%s' \"\$OUT\" | grep -qi 'not ours'"
+want "dev-bin wrapper(helper foreign): later units were still attempted (loop did not stop at the refusal) [QK:DEV-BIN-ATTEMPTS-ALL]" \
+  "[ -L '$DBIN_DIR/entwurf-agy-statusline' ] && [ -L '$DBIN_DIR/entwurf-copilot-statusline' ]"
+want "dev-bin wrapper(helper foreign): truthful attempted/refused summary names the refused unit" \
+  "printf '%s' \"\$OUT\" | grep -q 'refused=1: entwurf-bridge'"
+bash "$DEVBIN" remove >/dev/null 2>&1   # clear the attempted helper links/states for the cells below
 rm -f "$DLINK"
 
 # J-4: remove is honest-inverse — removes ONLY our link, refuses a link that became foreign
@@ -523,7 +576,9 @@ printf '{"linkPath":"%s/something-else","target":"x"}\n' "$DBIN_DIR" > "$LEGACY"
 if bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1; then die "dev-bin migrate: foreign legacy should REFUSE"; fi
 ok "dev-bin migrate: foreign legacy refused (linkPath basename != entwurf-bridge)"
 rm -f "$LEGACY" "$DLINK" "$DSTATE"
-unset ENTWURF_DEV_BIN_DIR ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
+bash "$DEVBIN" remove >/dev/null 2>&1
+unset ENTWURF_DEV_BIN_DIR ENTWURF_OPERATOR_TARGET ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
+unset ENTWURF_AGY_IMPRINT_TARGET ENTWURF_COPILOT_STATUSLINE_TARGET
 
 # ── K: permission grant — the OTHER half of a usable bridge ───────────────────
 # Registering the server only makes the tools REACHABLE. agy defaults every `mcp` action to Ask, so
@@ -872,15 +927,16 @@ want "permission: a symlinked settings.json is left untouched (someone else's SS
   "! has_rule '$SB/foreign-settings.json'"
 want "permission: no permission state is written for a refused symlink" "[ ! -e '$PSTATE' ]"
 
-# …and the SAME failure, seen from setup: NON-FATAL, reason-specific, never silent.
+# …and the SAME failure, seen from setup: reason-specific, never silent, and truthful (#86
+# C6/C7): a detected agy whose grant cannot be written is a component FAIL, so the wrapper
+# exits NONZERO and the aggregate setup records it while later components stay attempted.
 # Detection must be hermetic here exactly as it is in section I: re-mint the fake agy (I tore it
 # down at its end) and pin AGY_BIN at it. Unpinned, the wrapper falls back to the host's PATH —
-# it finds a real agy on a dev box and degrades honestly, but on a CI runner with no agy it takes
-# the skip branch and exits 0 with no WARN. The exit-0 assertion below passes either way; only the
-# NOT-GRANTED one can tell a degrade from a skip, which is the whole point of this pair.
+# on a CI runner with no agy it would take the skip branch (exit 0, no WARN) and only the
+# NOT-GRANTED assertion could tell a degrade from a skip.
 printf '#!/usr/bin/env bash\necho fake-agy\n' > "$SB/bin/agy"; chmod +x "$SB/bin/agy"
 set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-bridge 2>&1)"; RC=$?; set -e
-want "permission(setup): the wrapper keeps setup alive (exit 0) despite the failed grant" "[ '$RC' -eq 0 ]"
+want "permission(setup): the wrapper exits nonzero on the failed grant (detected FAIL, not cosmetic green)" "[ '$RC' -ne 0 ]"
 want "permission(setup): the wrapper says the bridge is REGISTERED but NOT GRANTED (no silent pass)" \
   "printf '%s' \"\$OUT\" | grep -q 'NOT GRANTED'"
 rm -f "$SETTINGS" "$PSTATE" "$STATE" "$GLOBAL" "$SB/bin/agy"

package/scripts/smoke-agy-statusline-state.sh

@@ -16,7 +16,8 @@
 #   - CREATE-NEW → uninstall removes the file it created.
 #   - SETUP INTEGRATION: the wire-agy-statusline wrapper — agy absent → honest skip + NO state;
 #     agy present + regular → idempotent install + state; agy present + symlink/corrupt →
-#     NON-FATAL WARN + continue (exit 0, reason-specific, no clobber, no state).
+#     reason-specific WARN + leaf EXIT NONZERO (#86 C6/C7: the aggregate records a named
+#     component FAIL and keeps later components alive), no clobber, no state.
 #   - checkout stays byte-identical (nothing written under $REPO).
 # Offline + deterministic (deps: bash + python3).
 set -euo pipefail
@@ -201,7 +202,7 @@ want "create-new: state removed" "[ ! -f '$STATE' ]"
 bash "$BRIDGE" uninstall >/dev/null 2>&1
 ok "idempotent: uninstall with no state exits 0 (nothing to undo)"
 
-# ── I: setup integration — wire-agy-statusline (detection-gated, NON-FATAL) ──
+# ── I: setup integration — wire-agy-statusline (detection-gated, truthful) ──
 rm -f "$SET" "$STATE"
 printf '#!/usr/bin/env bash\necho fake-agy\n' > "$SB/bin/agy"; chmod +x "$SB/bin/agy"
 
@@ -222,21 +223,23 @@ set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline
 want "wire(agy+regular, re-run): idempotent exit 0" "[ '$RC' -eq 0 ]"
 bash "$BRIDGE" uninstall >/dev/null; rm -f "$SET"
 
-# I-3: agy PRESENT + SYMLINK settings → NON-FATAL WARN + continue (exit 0), no clobber, no state
+# I-3: agy PRESENT + SYMLINK settings → reason-specific WARN + EXIT NONZERO (detected component
+# FAIL — the aggregate keeps later components alive), no clobber, no state
 printf '{"model":"x"}\n' > "$SB/real_wire_set.json"
 ln -s "$SB/real_wire_set.json" "$SET"
 set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
-want "wire(agy+symlink): exits 0 (NON-FATAL — setup not bricked)" "[ '$RC' -eq 0 ]"
+want "wire(agy+symlink): exits nonzero (detected agy + refused settings = component FAIL, not cosmetic green)" "[ '$RC' -ne 0 ]"
 want "wire(agy+symlink): reason-specific WARN names the symlink" "printf '%s' \"\$OUT\" | grep -qi 'symlink'"
 want "wire(agy+symlink): linked SSOT NOT clobbered" \
   "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if \"statusLine\" not in d else 1)' '$SB/real_wire_set.json'"
 want "wire(agy+symlink): NO state written" "[ ! -f '$STATE' ]"
 rm -f "$SET"
 
-# I-4: agy PRESENT + CORRUPT settings (invalid JSON) → NON-FATAL WARN + continue
+# I-4: agy PRESENT + CORRUPT settings (invalid JSON) → reason-specific WARN + EXIT NONZERO,
+# corrupt-specific
 printf 'not json{{{' > "$SET"
 set +e; OUT="$(AGY_BIN="$SB/bin/agy" bash "$REPO_DIR/run.sh" wire-agy-statusline 2>&1)"; RC=$?; set -e
-want "wire(agy+corrupt): exits 0 (NON-FATAL)" "[ '$RC' -eq 0 ]"
+want "wire(agy+corrupt): exits nonzero (detected agy + corrupt settings = component FAIL)" "[ '$RC' -ne 0 ]"
 want "wire(agy+corrupt): reason-specific WARN flags invalid JSON" "printf '%s' \"\$OUT\" | grep -qi 'invalid JSON'"
 want "wire(agy+corrupt): NO state written" "[ ! -f '$STATE' ]"
 rm -f "$SET" "$SB/bin/agy"