@junghanacs/entwurf 0.15.1 → 0.16.0

package/CHANGELOG.md

@@ -4,6 +4,235 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.16.0 - 2026-08-31
+
+This release admits **OMP (`omp`) as the fifth garden backend** and closes the admission
+contract that let a citizen ship without the legs that make it reachable. Bundles A, B and C
+are one arc — birth and identity, addressed receive, visible fresh — and the durable half is
+the general rule they forced: from OMP onward, the FIRST release of a harness admitted under
+the #82 contract owes its clause 7 visible-fresh receipt as a release-gate MUST step, its
+citizen↔fresh parity edge inside `pnpm run check:full`, and two cross-harness dispatch
+receipts. Every OMP LIVE claim below is one Linux host, one model, one accepted run; that
+limit is stated once in Notes and is not softened anywhere above it. (#87)
+
+### Added
+
+- **OMP is an addressable garden citizen.** `omp` enters the backend registry (`wakeMode`
+  `self-fetch`, `deliveryLevel` `D6`, `nativeIdLabel` `sessionId`) and
+  `pi-extensions/meta-bridge-omp.ts` mints it: an omp hook IS an in-process extension, so
+  birth, the scope fence, the status line and the sender marker are one module. Both birth
+  edges are bound — `session_switch` is where `/new`, fork and in-TUI resume re-fire — and
+  every mode but `mode === "tui"` is refused before any write. The fence is the vendor's own
+  mode and nothing else: `hasUI` is true under rpc/rpc-ui/ACP, so a fence built on it would
+  admit exactly the sessions this refuses. A task subagent mints nothing. The step-6 join is
+  one process, so the marker is keyed to `process.pid`, never `process.ppid`. Gates:
+  `check-omp-birth-hook`, `smoke-omp-bridge-state`, `scripts/mutants/omp-birth.json`. (#87)
+- **An omp-native MCP hand that shadows the borrowed Claude import.** The writer targets omp's
+  own `<omp agent dir>/mcp.json` in the vendor's own writer shape, and the server key is a
+  PINNED LITERAL `entwurf-bridge` — that pin is the entire mechanism. On a host that ever used
+  Claude Code, omp already imports an `entwurf-bridge` server labeled
+  `external-mcp/claude-code`; native provider priority beats the import and dedupe is
+  first-wins on the key with `equivalent()` never consulted, so a byte-identical key suppresses
+  the import while a different key would load BOTH and one of them would keep introducing an
+  omp session as Claude Code. `disabledServers` is never the hide-import tool — suppression is
+  by name and a suppressed item still claims the key — so the writer refuses to install under a
+  denylist of its own key and the doctor is red while one exists. `doctor-omp-mcp` adds an
+  EFFECTIVE-source read (native-wins / import-wins / both-suppressed / no-entry) and labels it
+  what it is: a configuration read of vendor precedence, never a runtime receipt. Gate:
+  `smoke-omp-mcp-state`. (#87)
+- **OMP receives addressed messages — the garden is no longer one-way for it.**
+  `pi-extensions/meta-bridge-receive-omp.ts` joins the citizen in the SAME process, holds an
+  `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's
+  `pi.sendUserMessage` — measured to live on the factory object rather than the event ctx, and
+  measured to start a turn on an idle host with zero typing. The model drains with
+  `entwurf_inbox_read`, and that read is the receipt. The `/new` unarm is rail-specific: the
+  watch lives inside the operator's TUI, where pid plus start-key cannot see a citizen change
+  underneath a living process, so the old garden id is explicitly unarmed and the replacement
+  armed. Bounded arm defer, watch-error, vanished-signal and overlapping-edge paths are all
+  fail-closed. Install, uninstall and doctor surfaces ship with it, plus
+  `check-omp-receive-arm` with `scripts/mutants/omp-receive.json`, `smoke-omp-receive-state`
+  and `smoke-omp-receive-live`. (#87)
+- **`entwurf_fresh_call` opens omp on all three public surfaces.** A five-axis pre-mutation
+  preflight decides the launch before the tmux window exists, so a missing prerequisite is a
+  named refusal instead of a dead window; the fifth axis is omp-specific (`tools.xdev !==
+  true`). There is NO positional prompt. The fixed registered flag `--entwurf-bootstrap`
+  carries a closed `{v,target,nonce,task}` grammar — an unknown key is a refusal — and the
+  installed birth extension runs a two-stage bootstrap: bounded readiness polling over both
+  public tool snapshots, a callback-ONLY prompt, then the task released only by the exact
+  successful `tool_result` (stored `toolCallId`, tool name, target, nonce and
+  `isError === false` all matching) and delivered at that same session's next `turn_end`. That
+  shape is a measurement, not a preference: the positional candidate opened its window, minted
+  its citizen, received the framing byte-identical, and answered the literal text `ACK` with
+  zero tool calls — the vendor's interactive UI defers MCP discovery while the positional
+  `initialMessage` prompts straight after `mode.init()`, so the turn began roughly 830ms before
+  the tool it was told to call existed. (#87)
+- **`check-harness-admission-parity` — the missing edge between two closed loops.** Every
+  backend in `META_CITIZEN_BACKENDS` must appear in `FRESH_CALL_BACKENDS` or be a declared
+  pre-#82 legacy admission whose exception a reader can find in `DELIVERY.md`. Registry↔citizens
+  and surfaces↔fresh-set each already had a guard, but no file imported both constants, which is
+  how omp could pass the entire floor as a D6 citizen that `entwurf_fresh_call` cannot open. The
+  gate went red on `Unaccounted: omp` the moment it was added and green when Bundle C closed it.
+  It runs inside `check:contracts`, and therefore inside `pnpm run check:full`. (#87)
+- **Two OMP LIVE steps in the release-gate MUST tier.** `smoke-omp-fresh-live` is clause 7's
+  worked instance. `smoke-omp-receive-live` reads the capability registry and decides its own
+  outcome — no drainable mailbox is a protocol SKIP, which `--cut` reads as red; a registry
+  claiming a receive rail with no acceptance body here is a FAIL. Neither is a hardcoded pass,
+  and the receive step was wired while omp was still outbound-only, so the one-way boundary
+  stopped being prose a cut could pass over in silence. (#87)
+- **`docs/adding-a-harness.md` gains the shipped map and the release stop.** A comparative table
+  of the five admitted backends — lineage, receive rail, callback dialect, fresh launch form —
+  sits at the top so the variety is expected rather than re-derived at each admission. It pins
+  two lessons: lineage does not choose the rail (omp is pi underneath and rides Claude's mailbox
+  shape, because the rail follows the measured wake surface; what ancestry does instead is
+  concentrate the danger, since a shared env vocabulary is exactly where a fork splits a store),
+  and the doorbell doctrine — a hard bridge of measured dialects, explicit doorbells and honest
+  rejects is what makes the thing on the other side a peer rather than a disposable worker. The
+  release stop then states both executable halves of the admission rule plus the cross-harness
+  leg. (#87)
+
+### Changed
+
+- **`setup` is the install story on all three entry shapes.** npm global, npm project-local and
+  source clone now lead with `entwurf setup <project>`; `entwurf install <project>` is stated as
+  the narrower pi-wiring repair leaf that composes no harness. The 14-line native-harness paste
+  that read as the install recipe is now "repair and doctors" — one paragraph plus the command
+  names, with every per-unit installer, doctor and inverse retained, because a single broken unit
+  must still be redoable alone. The user-scope ownership matrix and the manual MCP registration
+  paths moved to the documents that already own them. Stale live claim corrected: after an
+  upgrade the operator was told to rerun every owned installer; `setup` re-composes them.
+  `package.json` gains the `copilot` keyword, shipped since 0.15.0 but unlisted. (#86)
+- **OMP meta roots resolve as one indivisible bundle, never through `piAgentDir()`.** omp is a pi
+  fork and inherits pi's env vocabulary, so `PI_CODING_AGENT_DIR` means "pi's persistence root"
+  to entwurf and "my agent dir" to the vendor — a plain `omp --profile work` sets it. One pure
+  resolver leaf now serves both consumers, the in-process birth extension and the omp-labeled
+  bridge child, so agreement is by construction rather than two places computing the same thing.
+  A relative override fails closed instead of letting cwd become an authority: measured, the same
+  relative value resolved to two different stores because the extension's cwd is wherever the
+  operator launched omp while the doctor's is the repository. Installers refuse rather than guess
+  under an inherited `PI_CODING_AGENT_DIR` / `PI_CONFIG_DIR` / `PI_PROFILE`. (#87)
+- **`PI_SESSION_ID` and `PI_AGENT_ID` are scrubbed at the launch seam for every backend.**
+  Measured on the operator host: a tmux server env carrying `PI_SESSION_ID` was inherited
+  verbatim by a new pane, so a sibling's bridge child could phone home under another citizen's
+  identity. The scrub is at the seam, not per backend. (#87)
+- **The deterministic floor composes the omp gates.** `check:hermetic` gains
+  `smoke-omp-bridge-state`, `smoke-omp-mcp-state`, `smoke-omp-receive-state`,
+  `check-omp-receive-arm` and `check-omp-fresh-preflight`; `check:contracts` gains
+  `check-harness-admission-parity`. Both tiers still exclude the separately scheduled
+  `check-gate-qualification`, and `setup` still does not compose omp. (#87)
+- **`docs/adding-a-harness.md` step 5 now says to measure the invocation FORM, not only the tool
+  name.** omp mounts MCP tools as `xd://` virtual devices by default (`tools.xdev`), so a correct
+  tool NAME is still not a callable function: the model must read the device for a schema that
+  `tools.xdevDocs` keeps off-prompt, then write JSON to the same path to execute. Measured on omp
+  18.0.0, a plain send under that default listed peers and then reported delivery with nothing
+  enqueued, and the mount also hid omp's own lsp, debug, browser and ast_edit — 11 devices in
+  all. `tools.xdev: false` restores every enabled tool top-level and leaves plan mode's
+  `xd://propose` finalization intact. (#87)
+
+### Fixed
+
+- **The bridge boot entry was in no typecheck program.** `mcp/tsconfig.json` extended the root
+  config without re-declaring `exclude`, so the inherited `"mcp"` resolved to `<repo>/mcp` and
+  filtered out everything its own `include` added; `mcp/entwurf-bridge/src/index.ts` — the
+  785-line bridge boot entry — was the only tracked `.ts` in the repo in no `tsc --noEmit`
+  program at all, and nothing imports it, so nothing rescued it through the import graph. Orphan
+  census 1 line before, 0 after; the mcp program's repo-file count moved 27 → 54, all product
+  sources. The emit path is untouched, so there is no product runtime change.
+- **`entwurf_self` stopped rendering a mailbox nothing drains.** `metaDeliveryDomain` was derived
+  as native-push or self-fetch, so an omp citizen was handed a `mailboxPath` with no drainer. It
+  now has three values: `nativePushSupported` → native-push, else the decider's mailbox seam →
+  self-fetch, else none. Dispatch and `wakeMode` are untouched. (#87)
+- **`doctor-omp-mcp` reads `tools.xdev` on the runtime axis.** An absent file or key applies the
+  vendor default (xdev on, empty inline allowlist) and is RED while the native hand is the
+  effective source; `xdev: false` is ok and a covering `xdevInlineDevices` glob is
+  ok-with-note. Ownership stays a separate question, and the smoke never touches the host
+  `config.yml`. (#87)
+- **The bootstrap epoch now ends before the birth edge can bail.** Epoch termination depended on
+  reaching `startOmpBootstrap`, so a later birth edge that bailed early — a refused envelope or a
+  throwing upsert — skipped the invalidation, and on a same-id resume both handler fences still
+  passed, leaving the earlier defect shape alive in a narrow window. One rule, one owner:
+  `endBootstrapEpochOnLaterEdge` runs right after the mode fence, before the envelope is read,
+  and the consumed branch delegates to the same helper. Zero new state, zero new exports. (#87)
+- **The omp-fresh qualification manifests were settled by measurement.** The first standalone
+  qualification run on the Bundle C bytes caught what static exactness could not: four mutants
+  whose claim and signature named different cells, one QK token minted twice in its gate source,
+  twelve find hunks left stale by the bundle's own refactor and the amendment's rewiring, and one
+  kill-site guess that died at an anonymous cell. Every repair was adjudicated by
+  apply/gate/revert measurement rather than by guess, and kill sites the floor disputed were
+  moved to where the kill actually lands. Separately, two mutants had been added to the
+  self-address lane without extending `EXPECTED_LANE_MUTANTS` — exactly the drift that assertion
+  exists to catch; the declared contract now says 5. (#87)
+- **Two packaging omissions in the omp units.** `pi/meta-bridge-omp/entwurf-meta-omp/package.json`
+  and `pi/omp-receive/entwurf-receive-omp/package.json` were absent from `files[]`, so
+  `install-omp-receive` died in the installed package while passing from a checkout. (#87)
+- **`check-pack-install` pins the transitive `@earendil-works/pi-telemetry` to 0.84.3.** Upstream
+  published the 0.84.4 family on 2026-08-28; `pi-agent-core@0.84.3` and `pi-ai@0.84.3` both carry
+  a `^0.84.3` caret on it, so the lockfile-less fresh-temp install floated to 0.84.4 and the leak
+  assertion failed closed in the `install-surface` CI job. The pin keeps the verified 0.84.3
+  constellation ours to hold; the leak assertion still guards every other pi package and any
+  future closure growth. The 0.84.4 bump itself remains a separate hard-cut lane.
+- **The omp doctor treated Bundle C's empty tmux scrub as inherited identity.** `tmux -e NAME=`
+  writes `PI_SESSION_ID=` / `PI_AGENT_ID=` present-but-empty; authoritative readers trim and
+  require truthy values, so empty and absent are the same answer. The doctor was presence-testing
+  those names, which turned `check:full` red whenever a visible fresh omp citizen was alive.
+  It now flags only a nonblank value, and the hermetic smoke hands it fixture pids rather than
+  the host `pgrep`. (#87)
+
+### Verification
+
+Each receipt carries its own scope; none of them is transferable to another commit or host.
+
+- **`./run.sh check-gate-qualification`** — **324/324 KILLED, NOT KILLED 0**, standalone on the
+  Bundle C candidate (`fd5e462`), independently re-verified by a second model on the gate
+  predicate plus a full-lane rescan and a 3/3 sample re-kill.
+- **`pnpm run check:full`** — exit 0 in 430s on that same candidate, after the `build-bridge`
+  refresh the stale-dist tripwire demanded.
+- **Clause 7 LIVE** — `smoke-omp-fresh-live` green 2026-08-30, 21 assertions, oracle / omp 18.0.0
+  / `openai-codex/gpt-5.6-sol`. The sibling's garden `20260830T192913-df52b9` came from the
+  CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen;
+  `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`, with the drain visible in that
+  session's own transcript for its own garden id. It took two runs: the first went red on
+  stage-two delivery alone, which is the argument for making it a MUST.
+- **Receive acceptance (D6)** — 2026-08-30, oracle, omp 18.0.0: garden `20260830T140819-116f6a`,
+  `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`. D3 isolation is PROVEN, not
+  pending: with two live armed omp citizens, one addressed enqueue rang exactly one doorbell
+  while the sibling persisted no transcript and kept an empty mailbox.
+- **Cross-harness leg** — 2026-08-31, the first bidirectional live-turn roundtrip on the committed
+  bytes: a claude-code citizen opened a fresh omp sibling through the public surface (callback
+  sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` into it, and the
+  omp citizen's own live turn drained the doorbell and replied into the claude mailbox.
+- **`LIVE=1 ./run.sh release-gate <scratch> --cut`** — **MUST PASS=23 FAIL=0 SKIP=0,
+  BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** `check-gate-qualification` inside the gate
+  killed **325/325** mutants across 36 lanes. Log:
+  `/tmp/entwurf-release-gate-0.16.0.run2.DfMtRj/release-gate.log` (SHA-256
+  `2df4f6d4bddd563431ca41d2a43074f2cb6ccf9926ec6e8c7323de1a6ddf8192`).
+  A first attempt on the same versioned tree (scratch `.../entwurf-release-gate-0.16.0.AyHcIJ`)
+  hit one MUST FAIL in `smoke-entwurf-v2-matrix-live` C1b: the hidden-store resident did not
+  birth a record inside the 30s boot window. The same smoke rerun standalone passed 17 checks
+  in 4.9s; the rerun cut above is the acceptance. `pnpm run check:full` on the versioned tree
+  was exit 0 in 432s before P5.
+
+### Notes
+
+- **Evidence limit.** Every OMP LIVE claim above is one Linux host (oracle, ARM), one model, one
+  accepted run. Multi-host, multi-model and repeated fresh calls inside one process are not
+  claimed and are not evidenced here.
+- **Operator prerequisite.** `tools: xdev: false` in `~/.omp/agent/config.yml`. Under the vendor
+  default the doorbell would name a tool the model cannot call, so both the fresh preflight and
+  the LIVE smokes check it as a precondition. `setup` does not compose omp.
+- Measured against **omp 18.0.0** while the vendor announces 18.0.11. The `mode === "tui"`
+  discriminator, the `xd://` behaviour and the five measurement cells recorded in
+  `scripts/raw-omp-measure/README.md` §M7 are re-measurement targets on upgrade.
+- Copilot's operator-metered clause 7 exception is preserved, not reopened. The release stop
+  applies from OMP onward, forward-only.
+- The cross-harness leg's deterministic half — every post-contract citizen backend having a wired
+  cross-harness LIVE step or a declared metered exception — is an owed follow-up. Until that gate
+  lands the rule is prose, and `docs/adding-a-harness.md` says so in place.
+- Pi `0.84.4` remains a separate hard-cut lane.
+- #90 is measured but unfixed: installed Claude Code sends `model` as a STRING on the interactive
+  `SessionStart` envelope and omits it entirely in print mode, while the reader accepts only the
+  object shape, so claude-code records carry no model. Widening the reader and pinning both shapes
+  in a fixture is a separate lane.
+
 ## 0.15.1 — 2026-08-27
 
 This patch is the Linux install-honesty floor for #86: Entwurf installs itself only,

package/DELIVERY.md

@@ -84,11 +84,12 @@ can be owned without being supported; a supported harness still has to walk
 |---|---|---|---|
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
-| **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. |
+| **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No owned native-citizen install/invocation lane. |
 | **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
+| **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
 | **Copilot CLI TUI+server** — *withdrawn lane, kept as evidence* | rejected | D7; D8 unproven | Older official-SDK probe over hidden `--ui-server`; idle enqueue worked, but loopback RPC authentication was not established. The bundled extension supersedes this candidate without reviving it. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 
@@ -137,7 +138,7 @@ native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wa
 
 ### Copilot CLI: one citizen, two rails, one pending receipt
 
-The branch product owns the native citizen's birth, garden id, statusline, MCP hand,
+The shipped product owns the native citizen's birth, garden id, statusline, MCP hand,
 outbound sender identity — and, since RAIL 5, the receiver. A real Copilot CLI 1.0.80
 session minted a V3 record and sent under that record-backed garden id on 2026-08-21.
 That proved who SENDS. Whether a reply LANDS is a different fact on a different process,

package/README.md

@@ -10,10 +10,10 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code and GitHub Copilot CLI are shipped as mailbox-backed self-fetch meta-sessions; Antigravity (`agy`) is shipped as a native-push citizen with automatic `PreInvocation` birth, ambient garden-id status, and a managed MCP/permission install surface. Codex has a launch-mode-specific verified delivery probe documented in [DELIVERY.md](./DELIVERY.md), but no managed native-citizen install lane yet. The ACP plugin ships two backends through one adapter rail: Claude (the reference) and Snowflake Cortex Code (landed in 0.13.0 under the measured contract in [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)).
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code and GitHub Copilot CLI are shipped as mailbox-backed self-fetch meta-sessions; Antigravity (`agy`) is shipped as a native-push citizen with automatic `PreInvocation` birth, ambient garden-id status, and a managed MCP/permission install surface. OMP (`omp`) is a self-fetch citizen on the same rail as Claude and Copilot, opened by `entwurf_fresh_call` and accepted under the step 9 visible-fresh contract on 2026-08-30 — its first turn is a two-stage in-process bootstrap rather than an argv prompt, because the vendor connects its MCP tools in the background after the session starts. Codex has a launch-mode-specific verified delivery probe documented in [DELIVERY.md](./DELIVERY.md), but no managed native-citizen install lane yet. The ACP plugin ships two backends through one adapter rail: Claude (the reference) and Snowflake Cortex Code (landed in 0.13.0 under the measured contract in [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)).
 
 ```text
-Claude Code / Copilot / Codex / agy / pi
+Claude Code / Copilot / Codex / agy / omp / pi
   → garden id
     → entwurf_v2
       → control-socket | meta-mailbox | native-push
@@ -59,10 +59,11 @@ native Antigravity / agy
   ↔ entwurf_v2 native-push
 ```
 
-Claude's `install-meta-bridge`, Copilot's four `install-copilot-*` surfaces, and agy's
-`install-agy-{bridge,statusline,hooks}` are distinct because their lifecycle and delivery
-transports are genuinely different. Codex remains verified probe evidence, not a shipped managed
-native-citizen lane; see [DELIVERY.md](./DELIVERY.md).
+Claude's `install-meta-bridge`, Copilot's four `install-copilot-*` surfaces, agy's
+`install-agy-{bridge,statusline,hooks}` and OMP's three `install-omp-{bridge,mcp,receive}` units
+(each with its own `doctor-omp-*`) are distinct because their lifecycle and delivery transports are
+genuinely different. Codex remains verified probe evidence, not a shipped managed native-citizen
+lane; see [DELIVERY.md](./DELIVERY.md).
 
 > **Direction.** Inverse of [`pi-acp`](https://github.com/svkozak/pi-acp). `pi-acp` lets external ACP clients talk *to* pi; `entwurf` lets garden citizens talk across harness boundaries — with pi as one adapter, not the center.
 
@@ -71,17 +72,20 @@ native-citizen lane; see [DELIVERY.md](./DELIVERY.md).
 A few words that look unusual for a coding tool.
 
 - **Entwurf** (기투, projection-of-self) — sibling sessions with their own runtime boundary. Not "delegate," not "worker," not "sub-agent." Opening a visible sibling (`entwurf_fresh_call`), live peer messaging (`entwurf_v2`) and reopening a dormant one (`entwurf_resume_call`) are first-class; the hidden background resume that preceded the last of those was withdrawn under the visible-first rule.
-- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted from an authoritative lifecycle hook — Claude `SessionStart`, Copilot's first-prompt birth hook, agy `PreInvocation`). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, a mailbox-backed native session, or a native-push conversation, so callers discover facts with `entwurf_peers` and deliver with `entwurf_v2` instead of choosing a transport by hand.
+- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted from an authoritative lifecycle hook — Claude `SessionStart`, Copilot's first-prompt birth hook, agy `PreInvocation`, and for OMP an in-process extension bound to both session edges that mints only the visible `mode === "tui"` host). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, a mailbox-backed native session, or a native-push conversation, so callers discover facts with `entwurf_peers` and deliver with `entwurf_v2` instead of choosing a transport by hand.
 - **Engraving** — optional short operator text delivered through each backend's native identity carrier. Not a giant hidden prompt, not a tool catalog.
-- **MCP** — in this repo, MCP is just the transport by which ACP-backed sessions receive pi capabilities that native pi exposes directly as extensions. It is not a general MCP platform. Explicit `entwurfProvider.mcpServers` only; no ambient `~/.mcp.json` scanning, no automatic retrieval. The same `entwurf-bridge` entry can also be wired into another host's MCP catalog (Claude Code, Copilot, Codex, Antigravity, …) when the operator chooses. `entwurf_self` returns an authoritative pi-session or trusted meta-session identity envelope; `entwurf_v2` requires an authoritative sender by default (#50 C4) — a plain external MCP host with no identity lane is refused unless the operator explicitly wires the documented anonymous hatch, and even then it is never replyable.
+- **MCP** — in this repo, MCP is just the transport by which ACP-backed sessions receive pi capabilities that native pi exposes directly as extensions. It is not a general MCP platform. Explicit `entwurfProvider.mcpServers` only; no ambient `~/.mcp.json` scanning, no automatic retrieval. The same `entwurf-bridge` entry can also be wired into another host's MCP catalog (Claude Code, Copilot, Codex, Antigravity, OMP, …) when the operator chooses. `entwurf_self` returns an authoritative pi-session or trusted meta-session identity envelope; `entwurf_v2` requires an authoritative sender by default (#50 C4) — a plain external MCP host with no identity lane is refused unless the operator explicitly wires the documented anonymous hatch, and even then it is never replyable.
 - **Session persistence** — re-attaches pi to the same remote ACP session. Does not hydrate backend transcripts into pi history.
 
 ## Install
 
-`entwurf` is a neutral npm package first. Install the package with `npm` (or
-`pnpm`/`yarn`) and then wire the harness you want to use. Pi is still the
-adapter that hosts the ACP plugin and live control-socket surface, but the base
-install is **not** `pi install npm:...` anymore.
+`entwurf` is a neutral npm package first. Get the package, then run **`entwurf setup
+<project>`** — one command, the same front door from an npm global install, an npm
+project-local install, or a source checkout. It composes every harness it finds on the
+host and reports each one PASS / SKIP / FAIL. You are not meant to assemble the parts by
+hand; the per-harness installers further down are the repair surface for when one unit
+needs to be redone alone. Pi is still the adapter that hosts the ACP plugin and live
+control-socket surface, but the base install is **not** `pi install npm:...` anymore.
 
 The package exposes six bins:
 
@@ -95,7 +99,7 @@ The package exposes six bins:
 The bridge/renderers/hook use stable bin names so package upgrades do not bake versioned package-store paths into native-harness settings.
 
 Installing Entwurf installs **Entwurf only**: its package bytes, six bins, bridge, and
-integration artifacts. It does not install `pi`, Claude Code, Copilot CLI, Codex, agy, Cortex,
+integration artifacts. It does not install `pi`, Claude Code, Copilot CLI, Codex, agy, omp, Cortex,
 or any other harness runtime. Those are operator choices and may all be absent. The bridge also
 does not provide credentials, tokens, subscription access, or an auth bypass; whatever an
 operator-installed harness already trusts is what Entwurf can use. `setup` is composition, not
@@ -107,15 +111,12 @@ look complete.
 ```bash
 npm install -g @junghanacs/entwurf
 
-# wire a target project for the pi adapter / ACP plugin lane
-cd /path/to/your-project
-entwurf install .
+entwurf setup /path/to/your-project
 entwurf check-bridge
 ```
 
-This writes `.pi/settings.json` in the target project with the absolute path to
-the installed `entwurf-bridge` launcher. (The old `~/.pi/agent/` target-registry
-link is gone — #50 C3; nothing reads it.) The global install is the easiest path when
+`setup` wires the target project for the pi adapter / ACP plugin lane and composes
+whatever native harnesses are present. The global install is the easiest path when
 Claude Code's USER-scope MCP registration should work from every cwd.
 
 ### From npm — project-local install
@@ -124,27 +125,25 @@ Claude Code's USER-scope MCP registration should work from every cwd.
 cd /path/to/your-project
 npm install --save-dev @junghanacs/entwurf
 
-npx entwurf install .
+npx entwurf setup .
 npx entwurf check-bridge
 ```
 
-For an npm upgrade, rerun the install command in the same scope (use
+For an npm upgrade, rerun `setup` in the same scope (use
 `@junghanacs/entwurf@latest` when you want the registry's stable line explicitly),
 then make the first check from that same scope: `entwurf check-bridge` for a global
 install or `npx entwurf check-bridge` for a project-local install. Native-harness
-installers and process restarts remain a separate post-upgrade step below.
-
-For manual MCP registration from a project-local install, point the host at:
-
-```text
-/path/to/your-project/node_modules/.bin/entwurf-bridge
-```
+repair and process restarts remain a separate post-upgrade step below.
 
-or at the package launcher directly:
+`entwurf install <project>` is the narrower repair leaf: it writes only
+`.pi/settings.json` in the target project, with the absolute path to the installed
+`entwurf-bridge` launcher, and composes no harness. Reach for it when the pi wiring
+alone needs redoing. (The old `~/.pi/agent/` target-registry link is gone — #50 C3;
+nothing reads it.)
 
-```text
-/path/to/your-project/node_modules/@junghanacs/entwurf/mcp/entwurf-bridge/start.sh
-```
+To register the bridge in an MCP host by hand from a project-local install, point it at
+`node_modules/.bin/entwurf-bridge` — see
+[External MCP registration](#external-mcp-registration).
 
 ### From source — development clone
 
@@ -164,29 +163,19 @@ and a detected harness that cannot be completed (including a below-floor `pi`) i
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
 store. It also exposes stable commands under `~/.local/bin`, including `entwurf` → this
 checkout's `run.sh`, so managed Copilot fresh does not depend on an unrelated global npm/pnpm
-installation. A detected `copilot` composes all four native units (birth → MCP → receiver →
-visible footer) independently; the explicit `install-copilot-*` surfaces below remain the
-per-unit repair and inverse path. Package consumers
+installation. A detected `copilot` composes all four of its native units (birth → MCP →
+receiver → visible footer) in one go. Package consumers
 run the same `entwurf setup <project>` through their npm-provided bin: installed mode is decided
 by name first, skips the source-only pnpm bootstrap entirely, and reports the stable commands as
-already provided by npm bin linking; `entwurf install` remains the narrower pi-wiring repair
-leaf.
+already provided by npm bin linking.
 
 The pi user-scope registration is ONE shared entry with a recorded owner (#86 C2): installing
 from a second checkout or npm root does not silently steal it — normal `install`/`setup` refuse
-(zero settings writes, live or missing owner alike), `entwurf takeover-user-scope` is the
-operator-explicit move (old→new reported), `entwurf doctor-pi-package` names the ownership
-verdict (including `missing-owner` for a moved/deleted root), and `entwurf remove-user-scope`
-is same-owner-only with a reported orphan cleanup when entry, package state and provider
-installerRoot all name the same missing root. User-scope operations are atomic across the
-package and provider halves (read-only preflights first — a refusal on one side writes nothing
-on the other); a takeover over an operator's provider override reports a split verdict (package
-moved, override preserved unowned) and a legacy unattributed provider state must be adopted by
-a same-root `setup`/`install` before it can be removed. Both halves' install-states also record
-exactly WHICH settings file they manage (`managedSettingsPath`): an operation targeting a
-different, symlinked or unparseable file is a zero-write refusal before either half goes green,
-and the owned/orphan inverse removes only the recorded owner's exact `packages[]` entry —
-0 or 2+ exact entries refuse, so an npm spec or another `.../entwurf` path is never collateral.
+with zero settings bytes written, `entwurf takeover-user-scope` is the operator-explicit move,
+`entwurf doctor-pi-package` names the ownership verdict, and `entwurf remove-user-scope` is
+same-owner-only. The full contract — atomicity across the package and provider halves, the
+split verdict over an operator's own override, legacy adoption, and the `managedSettingsPath`
+binding — is [docs/setup-clean-host.md §1.1](./docs/setup-clean-host.md#11-user-scope-ownership-one-shared-registration-one-recorded-owner).
 
 A development clone runs the bridge source through Node's strip-types path;
 an npm-installed package runs the prebuilt JS under `mcp/entwurf-bridge/dist/`
@@ -214,41 +203,30 @@ For daily operator sessions, launch pi with `--entwurf-control` — no id
 injection; the meta-record mints the garden address (see [Garden launcher](#garden-launcher)). Older pi
 versions may silently miss the provider/extension surface, so treat the pi floor
 as release-critical for the ACP/plugin lane. A host that only uses
-`entwurf-bridge` from Claude Code / Copilot / Codex / Antigravity does not need pi at all for
-delivery: no `entwurf_v2` rail launches a pi process. That external-only shape works with the same
+`entwurf-bridge` from Claude Code / Copilot / Codex / Antigravity / OMP does not need pi at all for
+delivery: no `entwurf_v2` rail launches a pi process. OMP is a pi fork, but it is its own binary and
+resolves its own agent directory, so that lineage does not reintroduce a `pi` requirement either. That external-only shape works with the same
 `setup` command: pi is optional-by-presence there, so a pi-less host simply gets an explicit pi
 SKIP while the detected harnesses are composed.
 
-### Native harness install and doctors
+### Native harness repair and doctors
 
 A plain MCP registration exposes the bridge tools; a **garden-native** session also
-needs entwurf's lifecycle hook and identity marker. Use the managed installers rather
-than editing native-harness state by hand:
-
-```bash
-# Claude Code (Linux-certified axis)
-entwurf install-meta-bridge
-entwurf doctor-meta-bridge
-
-# Antigravity / agy
-entwurf install-agy-bridge
-entwurf install-agy-statusline
-entwurf install-agy-hooks
-entwurf doctor-agy-bridge
-entwurf doctor-agy-statusline
-entwurf doctor-agy-hooks
-
-# GitHub Copilot CLI — four independent surfaces, four independent failure modes
-# (`setup` composes all four when `copilot` is on PATH; these remain the per-unit repair/inverse surfaces)
-entwurf install-copilot-bridge      # birth: garden id + who-sent, on the first prompt (owns an install-state; inverse: uninstall-copilot-bridge)
-entwurf install-copilot-mcp         # the entwurf tool hand (entwurf_inbox_read lives here)
-entwurf install-copilot-receive     # the receiver extension: doorbell + receiver marker
-entwurf install-copilot-statusline  # optional for a manual citizen; required for supported fresh
-entwurf doctor-copilot-bridge
-entwurf doctor-copilot-mcp
-entwurf doctor-copilot-receive
-entwurf doctor-copilot-statusline
-```
+needs entwurf's lifecycle hook and identity marker. `setup` already composes all of that
+for every harness it detects — you do not paste this list to install. OMP is the one
+exception and it is deliberate: its units are operator-selectable installs that `setup`
+does not compose, so the three `install-omp-*` commands below are how an omp host gets
+wired. Otherwise this is the repair surface: each unit has its own installer, its own
+doctor with a named refusal, and its own inverse, so a single broken unit can be redone
+without touching the rest.
+
+- **Claude Code** (Linux-certified axis) — `install-meta-bridge`, `doctor-meta-bridge`.
+- **Antigravity / agy** — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
+- **GitHub Copilot CLI** — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
+- **OMP (`omp`)** — three units, all in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `doctor-omp-*` and `uninstall-omp-*`. One OPERATOR setting sits beside them and is not ours to write: `tools: xdev: false` in the omp agent config, without which the vendor mounts MCP tools as `xd://` devices the model cannot call.
+
+Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
+walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
 
 #### Launching Copilot as a garden citizen — `entwurf copilot`
 
@@ -294,8 +272,10 @@ the default permission prompts — which an idle, unattended session is not ther
 
 Claude Code uses the supported floor `>=2.1.217`; older versions silently discard the
 exec-hook `args`, so install and doctor fail loud rather than falling back. After any
-upgrade, rerun every owned installer for the native harness you use (all four for Copilot) and
-restart its existing processes. A claimed Claude host is certified only when a **new** session using the
+upgrade, rerun `entwurf setup <project>` — it re-composes every detected harness, all four
+Copilot units included — and restart its existing processes; reach for a single
+`install-*` only when one unit needs repair on its own. A claimed Claude host is certified
+only when a **new** session using the
 installed artifact makes `doctor-meta-bridge` exit 0 with the live owner join.
 
 Linux is the only currently certified Claude meta-bridge axis. New macOS wiring is
@@ -409,7 +389,7 @@ Reference shape lives in [`pi/settings.reference.json`](./pi/settings.reference.
 ### External MCP registration
 
 `entwurf-bridge` can also be registered in a separate MCP-aware harness (Claude Code,
-Copilot CLI, Codex CLI, Antigravity). Two shapes exist and they are not interchangeable:
+Copilot CLI, Codex CLI, Antigravity, OMP). Two shapes exist and they are not interchangeable:
 
 - **plain external MCP host** — no garden meta-record or sender marker. It can read the
   surfaces, but `entwurf_v2` is **refused by default**: there is no authoritative sender.
@@ -421,7 +401,10 @@ claude mcp add --scope user entwurf-bridge entwurf-bridge
 ```
 
 Per-harness registration (Claude Code `~/.mcp.json`, Codex `~/.codex/config.toml`, the
-managed `install-agy-*` surfaces), the PATH/env boundary for GUI-launched MCP servers, the
+managed `install-agy-*` surfaces, and OMP's managed `install-omp-mcp` into `<omp agent dir>/mcp.json`
+— whose pinned server key is what shadows a borrowed Claude import, see
+[docs/external-mcp-host.md](./docs/external-mcp-host.md) §OMP), the PATH/env boundary for
+GUI-launched MCP servers, the
 anonymous-sender hatch, and the full external/meta-session semantics are in
 [docs/external-mcp-host.md](./docs/external-mcp-host.md).
 For the maintained multi-harness setup and skill/command packaging details, see `agent-config`. See also the MCP entry in [Concept primer](#concept-primer), the sender envelope contract in [AGENTS.md](./AGENTS.md), and [Custom skills](#custom-skills) for the in-pi ACP skill surface.
@@ -527,7 +510,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / Claude-or-Copilot-meta-mailbox / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, or `copilot`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -544,9 +527,9 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 | dead / indeterminate native-push conversation | fire-and-forget | **reject** (`native-push-target-dead` / `native-push-probe-indeterminate`) |
 | record-less control socket (no meta-record) | any | **reject** (`record-less-socket` — pre-probe; diagnostic state, #50 C4) |
 
-**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code or Copilot, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
+**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, or Copilot runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.