@junghanacs/entwurf 0.15.0 → 0.16.0

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -69,14 +69,37 @@ import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provid
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
+import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
+// ============================================================================
+// OMP root policy — FIRST, before any lazy default-root consumer (#87 B1).
+//
+// This runs at module load for one reason: every meta-root consumer below resolves its
+// directory lazily inside a tool handler, and the whole point of the policy is that none
+// of them may ever see the foreign value. It is a no-op for every other child — it fires
+// only when this process carries the exact `external-mcp/omp` provenance label its managed
+// entry writes, and then it removes `PI_CODING_AGENT_DIR` from THIS process alone (the omp
+// HOST keeps it: there the variable is the vendor's own agent dir) and pins the four
+// entwurf-owned meta roots to the shared leaf's answer. See `applyOmpBridgeChildRootPolicy`.
+// ============================================================================
+try {
+    applyOmpBridgeChildRootPolicy(process.env, HOME);
+}
+catch (err) {
+    // FAIL CLOSED, LOUDLY. The policy refuses an ambiguous garden root (a relative
+    // `ENTWURF_META_*` override, #87 A2), and a bridge child that cannot say which store it
+    // is addressing must not boot with a guess — the extension half received the identical
+    // refusal, so proceeding here is exactly the split the policy exists to prevent.
+    console.error(`[entwurf-bridge] fatal: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+}
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
@@ -192,11 +215,17 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         return null;
     const { marker, identity } = trusted;
     // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-    // rail a reply would ride (보정①). The domain comes from nativePushSupported(backend), not
-    // from wakeMode: `direct-inject` also covers codex/pi, which have no native-push adapter.
-    //   self-fetch (claude-code): can this citizen's own inbox wake? → the receiver presence
-    //     marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match means a
-    //     live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    // rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
+    //   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
+    //     codex/pi, which have no native-push adapter.
+    //   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
+    //     with dispatch). A new hardcoded backend list would drift the moment the registry
+    //     admits another self-fetch citizen.
+    //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
+    //     this as self-fetch printed a mailboxPath nothing drains.
+    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
+    //     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
+    //     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
     //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
     //     live app-server conversation, so only an adapter probe can answer. Composing the
     //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -205,7 +234,11 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
     // survive; degrading to null would erase the sender) — only with replyable:false.
     // The rail, named ONCE and reused for both the predicate and the caller's rendering —
     // so entwurf_self can never re-derive it differently from what decided `replyable`.
-    const metaDeliveryDomain = nativePushSupported(identity.backend) ? "native-push" : "self-fetch";
+    const metaDeliveryDomain = nativePushSupported(identity.backend)
+        ? "native-push"
+        : resolveMailboxWakeModeCapability(identity)
+            ? "self-fetch"
+            : "none";
     const facts = metaDeliveryDomain === "native-push"
         ? {
             origin: "meta-session",
@@ -213,17 +246,23 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
             recordBacked: true,
             probeAlive: await probeNativeSenderAlive(identity),
         }
-        : (() => {
-            const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-            const active = receiverMarkerMatchesIdentity(receiver, identity);
-            return {
+        : metaDeliveryDomain === "self-fetch"
+            ? (() => {
+                const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
+                const active = receiverMarkerMatchesIdentity(receiver, identity);
+                return {
+                    origin: "meta-session",
+                    metaDeliveryDomain,
+                    recordBacked: true,
+                    ownerAlive: active,
+                    watchArmed: active,
+                };
+            })()
+            : {
                 origin: "meta-session",
                 metaDeliveryDomain,
                 recordBacked: true,
-                ownerAlive: active,
-                watchArmed: active,
             };
-        })();
     const self = computeSelfAddressability(facts);
     return {
         envelope: {
@@ -428,6 +467,9 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
             else if (rail === "native-push") {
                 lines.push("mailbox:    none — native-push has no inbox; a reply direct-injects only while the adapter probe is alive");
             }
+            else if (rail === "none") {
+                lines.push("mailbox:    none — no inbound rail (no mailbox, no native-push adapter)");
+            }
             else {
                 // Fail-closed, matching computeSelfAddressability's own unsupplied-domain row:
                 // with no rail we cannot say how a reply would travel, so we claim no transport.
@@ -562,24 +604,27 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Three fixed " +
-    "backends only: pi, claude-code, copilot. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+    "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
     "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot). A copilot launch goes through entwurf's own managed invocation and is refused " +
-    "BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. An optional " +
+    "or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
+    "invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
+    "visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
+    "visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
+    "prompt, so the sibling could not call you back at all). An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot"])
-        .describe("Which fixed runtime to open. Only these three; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp"])
+        .describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
     model: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -5,6 +5,7 @@
 		"antigravity": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "conversationId" },
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -33,10 +33,13 @@
  *  - external-mcp: never replyable — no authoritative reply address.
  *
  * `origin` stays sender-carrier PROVENANCE, never the citizen identity authority and never a rail.
- * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
- * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
- * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is
- * not replyable.
+ * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`.
+ * The caller derives it as three values, never as a native-push-or-self-fetch binary:
+ *   native-push  ← `nativePushSupported(backend)` (the adapter list; NOT wakeMode —
+ *                  `direct-inject` also covers codex/pi, which have no native-push adapter)
+ *   self-fetch   ← `resolveMailboxWakeModeCapability` (the decider's own mailbox seam)
+ *   none         ← neither (omp today: no mailbox drain, no native-push adapter)
+ * Fail-closed: an unsupplied domain is not replyable.
  */
 import { computeMetaReceiverActive, nativePushDeliverable } from "./entwurf-deliverability.js";
 /**
@@ -65,9 +68,11 @@ export function computeSelfAddressability(facts) {
             };
         }
         case "meta-session": {
-            // TWO rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
+            // THREE rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
             // axis — the mailbox receiver atom and the native-push predicate share nothing, so a
-            // mailbox liveness fact can never leak into a backend that has no mailbox.
+            // mailbox liveness fact can never leak into a backend that has no mailbox. `none` is
+            // the remainder: no inbound rail at all (not an unsupplied domain — that stays the
+            // default fail-closed row).
             switch (facts.metaDeliveryDomain) {
                 case "native-push": {
                     const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
@@ -93,6 +98,12 @@ export function computeSelfAddressability(facts) {
                         reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
                     };
                 }
+                case "none":
+                    return {
+                        replyable: false,
+                        socketState: "none",
+                        reason: "no inbound rail — this backend has no mailbox and no native-push adapter",
+                    };
                 default:
                     return {
                         replyable: false,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -46,7 +46,7 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot"];
+export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -76,7 +76,7 @@ export class MetaRecordError extends Error {
  * every write, including its own. `./run.sh doctor-meta-bridge` already flags a
  * stale deployed writer — run it after the change.
  */
-export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot"];
+export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp"];
 export const META_BACKEND_DESCRIPTORS = {
     "claude-code": {
         backend: "claude-code",
@@ -137,6 +137,58 @@ export const META_BACKEND_DESCRIPTORS = {
         deliveryLevel: "D6",
         nativeIdLabel: "sessionId",
     },
+    // SELF-FETCH citizen since #87 bundle B (oh-my-pi v18.0.0). An omp "hook" is an
+    // in-process EXTENSION (`--hook` aliases `--extension`), so BOTH units run inside the
+    // omp host: the birth unit mints on `session_start`/`session_switch`, and the receiver
+    // unit arms a mailbox watch in the same process and rings the doorbell.
+    //   self-fetch  The doorbell announces and the model drains its own inbox with
+    //             `entwurf_inbox_read` — that read is the receipt, and the notice never
+    //             carries the body. `[LIVE 2026-08-30, oracle, omp 18.0.0]` the vendor's
+    //             own wake surface was measured rather than inherited:
+    //             `pi.sendUserMessage(text,{deliverAs:"user"})` (on the FACTORY object, not
+    //             the event ctx) called on an IDLE tui session with zero typing started a
+    //             real turn — `agent_start` +31ms, `turn_start` +64ms, `turn_end` +2.45s,
+    //             model reply in the transcript. It was `direct-inject` while no process
+    //             held a watch; that label was the honest "not a drainable mailbox" bucket,
+    //             and it stopped being true when the receiver unit landed.
+    //             Replyability is still a fact about a LIVE marker, never a constant of this
+    //             backend: with no armed receiver every dispatch is refused
+    //             `mailbox-undeliverable`, which is exactly what an omp host with the birth
+    //             unit and no receiver unit still gets.
+    //   D6        the PRODUCT grade, earned by the LIVE roundtrip of 2026-08-30 on oracle
+    //             (omp 18.0.0). The code landing was NOT the evidence — this number moved
+    //             when the receipt did (`adding-a-harness.md` step 8(c)):
+    //             garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` /
+    //             `lastReadAt 05:08:23.958Z`, doorbell rung on an idle session with zero
+    //             typing, and the citizen's OWN transcript carrying
+    //             `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id — the join
+    //             that makes the drain a fact about THAT session rather than about the clock.
+    //             D3 is PROVEN here rather than pending: with two live omp citizens armed
+    //             (pids 3154765 / 3154835) a single addressed enqueue rang exactly one
+    //             doorbell, and the sibling persisted no transcript and kept an empty
+    //             mailbox. That is the cell the Copilot row still lists as PENDING.
+    //             D7 is PARTIAL, deliberately: `lastReadAt` is observable without scraping,
+    //             but the reply itself is only visible in the transcript, and no completion
+    //             taxonomy or long-haul operation was measured.
+    //             D8 is PARTIAL: fresh-only ring (dedupe), `/new` unarm, watch-error unarm,
+    //             vanished-signal unarm and the identity-guarded teardown are implemented and
+    //             pinned hermetically by `check-omp-receive-arm`; ordering under load, loop
+    //             guards and crash recovery are not measured.
+    //             Replyability stays a fact about a LIVE marker: with no armed receiver every
+    //             dispatch is still refused `mailbox-undeliverable` — re-proved on the same
+    //             day against a garden id whose session had just been replaced by `/new`.
+    //   sessionId the native join key: `ReadonlySessionManager.getSessionId()`
+    //             (`session-manager.ts:1946-1948`), a UUIDv7 minted at
+    //             `mintSessionId()` `:95-97` — NOT the transcript filename, which is
+    //             `<iso>_<uuidv7>.jsonl` (`:1134-1137`). Measured LIVE 2026-08-27:
+    //             host `01a042da-537a-7770-a275-7b8162eecca4`
+    //             (`scripts/raw-omp-measure/README.md` M1).
+    omp: {
+        backend: "omp",
+        wakeMode: "self-fetch",
+        deliveryLevel: "D6",
+        nativeIdLabel: "sessionId",
+    },
 };
 // ---------------------------------------------------------------------------
 // Validation helpers (crash, don't warn)
@@ -209,7 +261,7 @@ function isoNow(now) {
 /** The one live identity schema number. */
 export const META_SCHEMA_VERSION_V3 = 3;
 /** Every backend admitted by the one V3 record-citizen schema. */
-export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "pi"];
+export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi"];
 export function requireCitizenBackend(value) {
     if (typeof value !== "string" || !META_CITIZEN_BACKENDS.includes(value)) {
         throw new MetaRecordError(`meta-record "backend" must be one of ${META_CITIZEN_BACKENDS.join(" | ")} (got ${describe(value)}).`);
@@ -1015,13 +1067,16 @@ export function decideUpsert(existing, input, now = new Date()) {
 // core. Only node builtins beyond the pure layer, so the deterministic gate
 // stays strip-types clean (see module header for why this is not a sibling file).
 // ---------------------------------------------------------------------------
-function expandTilde(p) {
+function expandTildeIn(p, home) {
     if (p === "~")
-        return os.homedir();
+        return home;
     if (p.startsWith("~/"))
-        return path.join(os.homedir(), p.slice(2));
+        return path.join(home, p.slice(2));
     return p;
 }
+function expandTilde(p) {
+    return expandTildeIn(p, os.homedir());
+}
 /**
  * The pi agent dir — the persistence root pi owns. `PI_CODING_AGENT_DIR` lets an
  * isolated install / test relocate it (symmetric with how pi's own sessions
@@ -1101,6 +1156,118 @@ export function defaultMetaReceiversDir() {
         return path.resolve(expandTilde(process.env.ENTWURF_META_RECEIVERS_DIR));
     return path.join(piAgentDir(), "meta-receivers");
 }
+/**
+ * The exact provenance label the omp-native MCP entry carries
+ * (`scripts/omp-mcp-config.py` `EXTERNAL_AGENT_ID`). It is what lets a bridge CHILD know
+ * it is an OMP child — the same string both sides pin, never re-spelled.
+ */
+export const OMP_BRIDGE_PROVENANCE_LABEL = "external-mcp/omp";
+/** `HOME` as the process that owns this env sees it; `os.homedir()` returns exactly this
+ * on POSIX when HOME is set, so a real process and a composed child env agree. */
+function metaRootHome(env) {
+    const home = env.HOME;
+    return home !== undefined && home.length > 0 ? home : os.homedir();
+}
+/**
+ * THE shared OMP root policy — one pure function, two consumers (the in-process birth
+ * extension and the OMP-labeled bridge child). Agreement is by CONSTRUCTION, not by two
+ * places computing the same thing: both read this leaf, and both see the same HOME and the
+ * same four overrides because the vendor composes the child env as parent + entry env
+ * (`oh-my-pi` `packages/coding-agent/src/mcp/transports/stdio.ts:575-607`) and that entry
+ * env is provenance-only.
+ */
+export class MetaRootPolicyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "MetaRootPolicyError";
+    }
+}
+/**
+ * The unambiguous base the OMP bundle hangs off when no override is set. Separate from
+ * {@link ompMetaRoots} because it must NEVER throw: the hook log is a diagnostic, and a
+ * policy refusal still has to be visible somewhere.
+ */
+export function ompMetaRootBase(env = process.env, home = metaRootHome(env)) {
+    // NEVER `piAgentDir()` here: for backend omp that variable is the VENDOR's agent dir.
+    return path.join(home, ".pi", "agent");
+}
+/**
+ * THE OVERRIDE GRAMMAR IS NARROW ON PURPOSE: absolute, or `~` / `~/…`. Anything else —
+ * a relative path, or `~user` — is a NAMED REFUSAL, not a resolution.
+ *
+ * Why fail closed rather than resolve: this bundle has to mean the same thing in two
+ * processes that do not share a working directory. `path.resolve` on a relative value
+ * silently makes CWD an authority, and the OMP extension's cwd is whatever the operator
+ * launched omp from while the doctor's is the repository (`run_ts` cd's there). `[측정]`
+ * the same `ENTWURF_META_SESSIONS_DIR=relative-records` resolved to two different stores
+ * that way, so the doctor could report NOT-YET off an empty directory while the extension's
+ * real store held records (#87 A2, Terra review). Refusing is what keeps cwd from becoming
+ * a garden-root carrier. `~` is allowed because it expands from HOME, which both halves
+ * share by construction.
+ *
+ * The refusal is shared: extension and OMP-labeled bridge child both reach it through this
+ * one leaf, so neither can proceed on a value the other would read differently.
+ */
+export function ompMetaRoots(env = process.env, home = metaRootHome(env)) {
+    const base = ompMetaRootBase(env, home);
+    const surface = (key, leaf) => {
+        const override = env[key];
+        if (override === undefined || override === "")
+            return path.join(base, leaf);
+        if (override === "~" || override.startsWith("~/"))
+            return path.resolve(expandTildeIn(override, home));
+        if (path.isAbsolute(override))
+            return path.resolve(override);
+        throw new MetaRootPolicyError(`omp meta-root policy refuses ${key}=${JSON.stringify(override)}: a garden root must be absolute or ~-rooted ` +
+            "(`~` or `~/…`). A relative value would resolve against each process's own working directory, and the omp " +
+            "extension and its doctor do not share one — set an absolute path, or unset it to use the default under HOME.");
+    };
+    return {
+        sessionsDir: surface("ENTWURF_META_SESSIONS_DIR", "meta-sessions"),
+        mailboxDir: surface("ENTWURF_META_MAILBOX_DIR", "meta-mailbox"),
+        sendersDir: surface("ENTWURF_META_SENDERS_DIR", "meta-senders"),
+        receiversDir: surface("ENTWURF_META_RECEIVERS_DIR", "meta-receivers"),
+    };
+}
+/**
+ * The bridge CHILD half of the same policy, applied to that child's own environment.
+ *
+ * A bridge child selects this by the exact provenance label its managed entry carries —
+ * no probing, no guessing, and no effect on any other harness's child. It then does two
+ * things, in this order and before any lazy default-root consumer has run:
+ *
+ *   1. removes the foreign `PI_CODING_AGENT_DIR` from THIS PROCESS only. The OMP HOST
+ *      keeps it — there it is the vendor's own agent dir and deleting it would rewrite
+ *      vendor path semantics — but the child has no vendor lookup left to do.
+ *   2. pins the four `ENTWURF_META_*_DIR` overrides to this leaf's answer, so every
+ *      `defaultMeta*Dir()` consumer in the bridge reads the OMP bundle literally rather
+ *      than recomputing something that merely happens to match. Idempotent: an override
+ *      the operator already set was honoured by the leaf and is written back unchanged.
+ *
+ * These four are entwurf's OWN documented override vocabulary, set in our own process —
+ * not a new carrier, not a record field, not a marker.
+ *
+ * The in-process birth extension cannot use this and must not try: it runs INSIDE the omp
+ * host, so mutating that process's env is exactly the thing forbidden above. It passes
+ * explicit directories from {@link ompMetaRoots} instead.
+ */
+export function applyOmpBridgeChildRootPolicy(env = process.env, home) {
+    // EXACT equality on the RAW label (#87 A3). Trimming was a courtesy that let a
+    // whitespace-drifted entry — one `doctor-omp-mcp` and the writer both call foreign —
+    // still select OMP root mutation in its child. The writer emits the literal and the
+    // doctor compares the literal; this compares the literal too, so all three agree on
+    // what "our entry" means.
+    if (env.ENTWURF_BRIDGE_EXTERNAL_AGENT_ID !== OMP_BRIDGE_PROVENANCE_LABEL) {
+        return { applied: false, roots: null };
+    }
+    const roots = ompMetaRoots(env, home ?? metaRootHome(env));
+    delete env.PI_CODING_AGENT_DIR;
+    env.ENTWURF_META_SESSIONS_DIR = roots.sessionsDir;
+    env.ENTWURF_META_MAILBOX_DIR = roots.mailboxDir;
+    env.ENTWURF_META_SENDERS_DIR = roots.sendersDir;
+    env.ENTWURF_META_RECEIVERS_DIR = roots.receiversDir;
+    return { applied: true, roots };
+}
 /**
  * A boot-unique identity for a live process: pid is reused, but pid + start-time
  * is unique within a boot. Linux reads `/proc/<pid>/stat` field 22 (starttime in