@junghanacs/entwurf 0.15.1 → 0.16.0

package/VERIFY.md

@@ -43,7 +43,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
 - **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
   - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
@@ -59,6 +59,8 @@ Verification here is not a benchmark. In production we exchange short turns and
 > Be honest about its cost, because it is a MUST: it spends real model turns on the operator's configured runtimes (two pi siblings, each resumed once, plus one Claude Code sibling), it READS the operator's real runtime config, and the siblings' native session transcripts stay in the real pi agent dir — they are not cleaned up, and they are part of the evidence a resume was real. The fence is per-axis rather than absolute: the four meta roots (records, mailbox, receivers, senders) are fixture for every cell, so no garden record is ever minted outside it; the native pi cell's control socket and v2 lock are fixture too; the ACP pi cell's are REAL and transient (see the paragraph above); and the Claude cell runs its runtime under the real HOME while its mailbox and meta stay fixture. The run ends by proving the operator's SIX real roots — the four meta roots plus `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks` — hold the entry sets they started with, with no fixture garden id anywhere, and that proof now runs on the failure path as well as the green one. Missing prerequisites decline with the protocol SKIP (97), which `release-gate --cut` refuses rather than rounding up.
 >
 > **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
+
+> **A visible-fresh receipt outside the MUST tier is no longer the general rule — it is Copilot's preserved exception.** #87 measured what that wording permitted: because clause 7 sat outside every aggregate, a harness could be admitted as a full D6 citizen that `entwurf_fresh_call` cannot open, carry an honest "not a supported harness" sentence in the delivery matrix, and still pass the whole floor toward a cut. From OMP onward, the FIRST release of a harness admitted under the #82 contract owes its clause 7 receipt as a release-gate MUST step (`smoke-omp-fresh-live`), and the deterministic half of the same rule (`check-harness-admission-parity`, inside `check:full`) makes a citizen backend missing from `FRESH_CALL_BACKENDS` a red floor rather than a documented one. Forward-only by decision: Copilot's row is not reopened. The contract lives in `docs/adding-a-harness.md` step 9, "The release stop"; this note exists so the cost discipline above is not read as permission.
 >
 > The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
@@ -285,6 +287,7 @@ The minimum passing bar:
 7. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
 8. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
 9. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
+10. **New-harness admission closed:** a release that introduces a native harness admitted under the #82 contract has that harness in `FRESH_CALL_BACKENDS` on all three public surfaces, with `check-harness-admission-parity` green and its clause 7 visible-fresh LIVE step green in the MUST tier. That release also owes the cross-harness leg the same release stop names — two dispatch receipts, an existing citizen's live turn delivered into the new citizen and the new citizen's live turn delivered into an existing one — recorded in `DELIVERY.md`; its deterministic half is an owed follow-up, so until that gate lands this half of the condition is prose and is judged by the recorded receipts. Partial evidence is a branch state; an `unsupported` note in `DELIVERY.md` is a description, never a permit.
 
 Passing establishes a **release verification floor**, not an 8-hour/day operational guarantee. The floor says: gates hold, the agent honestly recognizes its environment, no tool surface is normalized away, no identity leaks, no orphans. It does **not** say a real-day workload (50–100+ turns, tool bursts, partial MCP failures, auth/version drift) survives — that needs L3–L5 evidence (appendix).
 

package/docs/acp-backend-rail.md

@@ -92,7 +92,7 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.15.0` | shipped baseline | the package contract these rows belong to |
+| Entwurf package | `0.15.1` | shipped baseline | the package contract these rows belong to |
 | pi runtime | devDep exact `0.84.3`, peer `>=0.84.3 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.3; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.3.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.70.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |

package/docs/external-mcp-host.md

@@ -1,25 +1,25 @@
 # Wiring `entwurf-bridge` into an external MCP host
 
-Per-harness registration for Claude Code, Codex CLI, and Antigravity, plus the
-PATH/env boundary and the external vs garden-native semantics. `README.md` keeps only
+Per-harness registration for Claude Code, Codex CLI, Antigravity, GitHub Copilot CLI and OMP,
+plus the PATH/env boundary and the external vs garden-native semantics. `README.md` keeps only
 the one-line registration; everything an operator needs to actually wire a host is here.
 
-`entwurf-bridge` can also be registered in a separate MCP-aware harness (Claude Code, Codex CLI, Antigravity/`agy`, …). That host does **not** become a pi session and does **not** need to be ACP-backed. There are now two honest cases:
+`entwurf-bridge` can also be registered in a separate MCP-aware harness (Claude Code, Codex CLI, Antigravity/`agy`, GitHub Copilot CLI, OMP, …). That host does **not** become a pi session and does **not** need to be ACP-backed. There are now two honest cases:
 
 - **plain external MCP host**: no garden meta-record / sender marker. It can call the read surfaces (`entwurf_peers`, `entwurf_inbox_read`), but `entwurf_v2` sends are **refused by default** (#50 C4: "if we don't know who sent it, we don't send it"). The operator may wire the explicit hatch below; the send then goes out external/non-replyable.
-- **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy, `userPromptSubmitted`/`sessionStart` for GitHub Copilot CLI. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
+- **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy, `userPromptSubmitted`/`sessionStart` for GitHub Copilot CLI, and for OMP an in-process extension on `session_start`/`session_switch` that mints only a `mode === "tui"` host. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
   **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, or `entwurf` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, `entwurf` or `omp` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor, while OMP is opened as the bare `omp` runtime); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
-Observed: Claude Code, Codex CLI, Antigravity CLI and GitHub Copilot CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude and Copilot become symmetric/replyable through a mailbox-backed meta-session — Claude's watch armed by its own hook, Copilot's by the forked extension it installs; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
+Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude, Copilot and OMP become symmetric/replyable through a mailbox-backed meta-session — Claude's watch armed by its own hook, Copilot's by the forked extension it installs, OMP's by an extension running inside the operator's own TUI process; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
 Prerequisites on the host running the external MCP client:
 
 - A live pi session launched with `--entwurf-control` populates `~/.pi/entwurf-control/<gardenId>.sock` — the key is the **record's** garden id, never a transcript/session id (`PI_SESSION_ID` only carries the id record birth already established). Required for `entwurf_v2` control-socket dispatch and `entwurf_peers`.
 
-> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. No `entwurf_v2` rail launches a process, so this does not affect delivery — but `entwurf_fresh_call` and `entwurf_resume_call` do open a fixed runtime. If that runtime works in your terminal but an external-host call fails with `spawn pi ENOENT`, `spawn claude ENOENT`, or `spawn entwurf ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find the runtime. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
+> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. No `entwurf_v2` rail launches a process, so this does not affect delivery — but `entwurf_fresh_call` and `entwurf_resume_call` do open a fixed runtime. If that runtime works in your terminal but an external-host call fails with `spawn pi ENOENT`, `spawn claude ENOENT`, `spawn entwurf ENOENT`, or `spawn omp ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find the runtime. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
 
 > **Identity-carrier boundary.** A complete `PI_SESSION_ID` + `PI_AGENT_ID` pair wins before a
 > native sender marker in the bridge's authoritative-self resolution. Those variables are correct
@@ -40,6 +40,22 @@ Prerequisites on the host running the external MCP client:
 > and still speak under the parent's garden id, so the flag verdict must not absorb it. The other
 > native launchers have NOT been certified against this failure mode; do not read Copilot's cells
 > as coverage for them.
+>
+> **OMP has both halves, and the strip one is not an omp launcher** (#87 Bundle C). entwurf still
+> owns no managed omp invocation — the bare vendor runtime IS this harness's clause 1 answer, and
+> nothing here argues for a wrapper. The strip sits one level up instead, at the shared launch seam
+> every `entwurf_fresh_call` backend passes through: `SCRUBBED_INHERITED_ENV` empties
+> `PI_SESSION_ID` and `PI_AGENT_ID` on the `new-window` argv itself
+> (`pi-extensions/lib/mux-fresh-call.ts:402`), for all four backends rather than only the one whose
+> measurement surfaced it, because the leak is a property of tmux and not of a vendor. `-e VAR=`
+> sets the variable empty rather than unsetting it — tmux has no per-window unset — and every
+> carrier reader trims and tests truthiness, so empty and absent are the same answer by
+> construction. Pinned by `[QK:FRESHCALL-IDENTITY-SCRUB]` in the `check-mux-fresh-call` vitest lane,
+> inside `check:full`. The DETECT half is unchanged and still load-bearing, because a seam covers
+> only the launches that pass through it: `doctor-omp-bridge` reads `/proc/<pid>/environ` for every
+> live `omp` process and goes RED on its own axis when one carries either carrier. An omp the
+> operator started from a pi citizen's bash never touched the seam and is still unsupported, exactly
+> as this boundary says.
 
 Example env file:
 
@@ -66,7 +82,7 @@ Emergency/manual workaround when the MCP server environment is wrong but an exis
 External/meta-session semantics:
 
 - `entwurf_v2` from a plain external host is **refused by default** (no authoritative sender — #50 C4). With the explicit `ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1` hatch it delivers with `origin: "external-mcp"` / `replyable: false`; there is still no reply address.
-- `entwurf_v2` from a trusted meta-session delivers with `origin: "meta-session"`, and `replyable` is **derived from that sender's own rail — not granted by being trusted**: a self-fetch sender (Claude Code) is replyable only while its receiver is live and armed, and a native-push sender (Antigravity) only while its adapter probe finds the live conversation. Identity survives either way; only `replyable` drops to `false`. When it is `true`, `wants_reply: true` is allowed and the receiver can reply to the sender's garden id.
+- `entwurf_v2` from a trusted meta-session delivers with `origin: "meta-session"`, and `replyable` is **derived from that sender's own rail — not granted by being trusted**: a self-fetch sender (Claude Code, Copilot, OMP) is replyable only while its receiver is live and armed, and a native-push sender (Antigravity) only while its adapter probe finds the live conversation. Identity survives either way; only `replyable` drops to `false`. When it is `true`, `wants_reply: true` is allowed and the receiver can reply to the sender's garden id.
 - `entwurf_v2` never launches a process, so no delivery path needs `pi` on PATH. A dormant pi target is refused as `dormant-fire-forget-unsupported`: the hidden background resume that used to answer there was withdrawn under the visible-first rule, and re-opening the session is the separate `entwurf_resume_call` verb — which DOES need `pi` on PATH, because it starts one.
 - `entwurf_self` returns the same authoritative identity for pi sessions **and** trusted meta-sessions. A plain external host with no pi env and no trusted sender marker still fails because there is no reply address to report.
 
@@ -143,9 +159,131 @@ Unrelated servers, permissions, settings, and hooks are preserved; every adapter
 
 The **global** MCP config live agy reads is `~/.gemini/config/mcp_config.json`. `~/.gemini/antigravity-cli/mcp_config.json` is not the global MCP root; the bridge installer one-way cleans only a stale entwurf-owned entry there. After the first model invocation, the imprint hook binds the native `conversationId` to a garden id, the statusline shows `🪛 <garden-id> agy`, and sends from that MCP child carry `agentId=meta-session/antigravity` with `replyable:true` only when the record exists and the live native-push probe succeeds.
 
+#### OMP (`omp`, oh-my-pi)
+
+Use the managed install surface rather than editing omp's files by hand:
+
+```bash
+entwurf install-omp-bridge     # the BIRTH extension (a garden id per visible TUI session)
+entwurf install-omp-mcp        # the MCP hand (this section)
+entwurf install-omp-receive    # the RECEIVER extension (mailbox watch + announce-only doorbell)
+
+entwurf doctor-omp-bridge
+entwurf doctor-omp-mcp
+entwurf doctor-omp-receive
+```
+
+Three units, not two. The receiver is what makes the citizen answerable at all — without it omp
+sends under its own garden id and every reply is refused as `mailbox-undeliverable` — and it is
+also a prerequisite of visible fresh: the fresh preflight refuses this host before touching tmux
+when the receive unit is missing, rather than opening a window that can never be reached.
+
+`install-omp-mcp` writes ONE server into omp's own user MCP file,
+`<omp agent dir>/mcp.json` (`~/.omp/agent/mcp.json`, profile-aware), in omp's own writer
+shape — `{command, args?, env?}` with `type` omitted, since stdio is the default:
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/can1357/oh-my-pi/main/packages/coding-agent/src/config/mcp-schema.json",
+  "mcpServers": {
+    "entwurf-bridge": {
+      "command": "bash",
+      "args": ["/absolute/path/to/entwurf/mcp/entwurf-bridge/start.sh"],
+      "env": { "ENTWURF_BRIDGE_EXTERNAL_AGENT_ID": "external-mcp/omp" }
+    }
+  }
+}
+```
+
+**The server key is a pinned literal, and that is the whole point.** omp translates Claude
+Code's `~/.claude.json` as an import provider, so a host that ever used Claude Code already
+has an `entwurf-bridge` — carrying `external-mcp/claude-code`. An omp session riding that
+import introduces itself to the bridge under Claude Code's name. Writing the native entry
+under the byte-identical key shadows it: native provider priority 100 beats claude 80,
+dedupe is first-wins on the server NAME, and on a key hit the equivalence check is never
+consulted, so an entry whose env deliberately differs still suppresses the import outright
+— not both-loaded, not merged, no warning. A different key would load BOTH.
+`[측정]` 2026-08-27, omp/18.0.0: the vendor's own `/mcp list` pane flipped from
+`Claude Code (~/.claude.json): entwurf-bridge ● connected` to
+`User level (~/.omp/agent/mcp.json): entwurf-bridge ● connected [stdio]`, and the spawned
+bridge child's environ flipped with it.
+
+**`disabledServers` is never the way to hide the import.** Suppression is by name and a
+suppressed item still claims the dedupe key, so denylisting `entwurf-bridge` kills the
+native entry and the import together. `[측정]` with that denylist the pane shows
+`entwurf-bridge ○ not connected` and no Claude Code section at all, and no MCP child is
+spawned. The installer refuses to write into a config that denylists its own key, and
+`doctor-omp-mcp` is red while one exists.
+
+**The tool names are omp's dialect, not Claude's.** omp mints `mcp__<server>_<tool>` after
+lowercasing and replacing every `[^a-z_]+` run with `_`, collapsing runs and trimming edges,
+so `entwurf_v2` surfaces as `mcp__entwurf_bridge_entwurf_v` — the trailing digit is eaten by
+the charset, not by the length cap. The live tool list is the acceptance oracle; a live
+session mounts all seven.
+
+**And the NAME is not the invocation. Under omp's default settings an MCP tool is not a
+function the model calls — it is a virtual file it writes to.** `tools.xdev` (boolean,
+**default on**) mounts "discoverable" tools as `xd://<tool>` devices and DROPS them from the
+top-level toolset; the model then reads `xd://<tool>` for the schema and *writes* the JSON
+argument object to `xd://<tool>` to execute it. `tools.xdevDocs` (**default `builtins`**)
+keeps built-in docs inline while MCP and extension schemas stay off-prompt until read. That
+default costs a real capability. `[측정]` 2026-08-28, omp/18.0.0: with the defaults, a plain
+"send this message to garden id X" produced a `write` to `xd://…entwurf_peers` (a LISTING)
+and then the sentence "보냈습니다" — no `entwurf_v2` call, nothing enqueued, `lastEnqueuedAt`
+unchanged. Discovery and delivery share one verb (`write`) and neither schema was in the
+prompt. The vendor has hit the same shape in its own toolset: its changelog records
+`web_search` becoming unreachable under `tools.xdev: true` because the mount dropped it from
+top-level (`Tool web_search not found`, upstream #5973), fixed by pinning it via
+`XDEV_KEEP_TOP_LEVEL` — a pin no MCP tool has.
+
+`read xd://` reports exactly what the default hides. `[측정]` on a host with only this
+bridge registered, **11 devices**: omp's own `ast_edit`, `debug`, `lsp`, `browser`, plus all
+seven `entwurf_*`. So the default does not merely wrap entwurf — it wraps omp's own LSP and
+debugger too.
+
+**Set this on any omp host that is meant to work as a citizen:**
+
+```yaml
+# ~/.omp/agent/config.yml
+tools:
+  xdev: false      # every enabled tool top-level — MCP is MCP again
+```
+
+Nothing is disabled by that: the setting's own text is *"Disable to expose every enabled tool
+top-level"*, and it moves tools rather than removing them. `[측정]` with `xdev: false` the
+same plain-language request produced a first-try `mcp__entwurf_bridge_entwurf_v` function
+call carrying a correct `intent`, the marker landed in the target mailbox, `read xd://`
+answered `xd:// is not mounted in this session.`, and `lsp` / `debug` / `browser` /
+`ast_edit` were all present top-level. The cost is prompt size: the system prompt's
+non-message tokens went 18,707 → 21,834 (+3,127, +17%) on that host.
+
+Two boundaries worth carrying:
+
+- **`xd://` resolution devices survive the switch.** omp's plan mode and every staged-action
+  finalization write to `xd://propose` / `xd://resolve` / `xd://reject`, and its plan prompt
+  names them unconditionally — so "turn xdev off" looks like it should break planning. It
+  does not: the write dispatcher matches the resolution devices BEFORE the mount check.
+  `[측정]` with `xdev: false`, plan mode reached `write xd://propose` and the approval dialog
+  normally.
+- **The narrow alternative keeps the wrapper.** `tools.xdevInlineDevices:
+  ["mcp__entwurf_bridge_*"]` inlines only our schemas (+1,013 tokens instead of +3,127) and
+  also fixed the send in the same measurement — but the 11 devices stay off top-level, `lsp`
+  included, and the listing/delivery verb stays shared. Prefer it only on a host carrying so many MCP servers
+  that the full top-level toolset is the larger problem.
+
+All of the above is measured against omp 18.0.0 and is a setting, not a contract: re-measure
+at a vendor upgrade.
+
+Registration is tools, not identity: sending needs the birth extension
+(`install-omp-bridge`), whose sender marker is keyed to the omp host's OWN pid — omp runs
+its extensions in-process, so the marker's owner, the host, and the MCP child's parent are
+one pid rather than the two-process join Claude and Copilot have. An omp session is a
+citizen only in the operator-visible TUI; task subagents borrow its tools under its garden
+id and never receive a second address.
+
 #### External-host skills and commands
 
-MCP registration gives the external harness the tools; the host still needs workflow guidance. Put the Mitsein-over-MCP (cross-harness collaboration) rules in that host's instruction file or, when supported, as a host-native skill. Do not assume pi slash commands are portable across external hosts — if a workflow must work across Claude Code, Codex CLI, Antigravity, and future hosts, make it a skill or MCP tool rather than a command shortcut.
+MCP registration gives the external harness the tools; the host still needs workflow guidance. Put the Mitsein-over-MCP (cross-harness collaboration) rules in that host's instruction file or, when supported, as a host-native skill. Do not assume pi slash commands are portable across external hosts — if a workflow must work across Claude Code, Codex CLI, Antigravity, OMP, and future hosts, make it a skill or MCP tool rather than a command shortcut.
 
 For the maintained multi-harness setup and skill/command packaging details, see
 [agent-config](https://github.com/junghan0611/agent-config). See also the

package/docs/setup-clean-host.md

@@ -15,6 +15,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | pi | optional-by-presence, `>=0.84.3 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
+| OMP (`omp`) | optional, operator-installed; three units (birth/MCP/receiver) plus `tools: xdev: false` in the agent config | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
@@ -185,6 +186,110 @@ scanning for that process, checks the receiver, removes inherited pi identity ca
 the model/permission defaults. Birth occurs on the first prompt. `entwurf_fresh_call` uses this
 same managed invocation and requires the birth, MCP, receiver, and visible-identity preflight.
 
+## 4b. Optional OMP (`omp`) native citizen — accepted on one host
+
+Three independently owned surfaces, and a boundary that is part of the instructions rather
+than a footnote. Birth, visible identity, who-sent, the MCP hand and RECEIVE are landed, and
+`entwurf_fresh_call` opens an omp sibling on all three public surfaces. The clause 7 LIVE
+receipt has been taken: `smoke-omp-fresh-live` went green on 2026-08-30 (omp 18.0.0, one
+model, one accepted run), which is what `docs/adding-a-harness.md` step 9 asks for and why
+that smoke is wired as a release-gate MUST — the label was never allowed to move ahead of the
+evidence, and it moved only once the evidence existed. Read the receipt itself in DELIVERY.md's
+OMP row; what it does NOT establish is multi-host, multi-model, or repeated fresh calls in one
+process. Open omp yourself and it is a two-way citizen either way — it sends under its own
+garden id and a reply lands on it.
+
+The first turn of a fresh omp sibling is a TWO-STAGE BOOTSTRAP, not a positional prompt: the
+launcher carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`,
+and the installed birth extension waits until the callback tool is actually callable, sends a
+callback-only prompt, and delivers the operator's task only after that exact call succeeds.
+That is a measured correction — the interactive host defers MCP discovery, so a positional
+first turn began before the tool it named existed.
+
+**One operator setting is load-bearing for fresh, not just for receive.** `tools: xdev: false`
+in the omp agent config is checked by the fresh preflight BEFORE any window opens, because the
+vendor default mounts MCP tools as `xd://` devices whose schemas never reach the prompt: a
+sibling launched onto a default-config host would start, look healthy, and be unable to call
+the callback tool at all. A refusal there names `omp-callback-tool-uncallable` and opens
+nothing.
+
+```bash
+entwurf install-omp-bridge     # the birth extension, into <omp agent dir>/extensions/
+entwurf install-omp-mcp        # the omp-native entwurf-bridge server
+entwurf install-omp-receive    # the receiver extension: mailbox watch + doorbell
+
+entwurf doctor-omp-bridge
+entwurf doctor-omp-mcp
+entwurf doctor-omp-receive
+```
+
+Order matters only in one direction: the receiver JOINS the citizen birth mints, and
+announces a tool the MCP hand provides. Install it without them and it will log
+`arm-deferred`, give up after ~20s, and `doctor-omp-receive` will name the missing sibling
+as a note rather than a fault.
+
+**The receiver arms per session, and only for the visible TUI host.** Opening omp arms it;
+`/new` re-arms it for the replacement citizen and retires the previous one; closing omp
+retires it. A task subagent arms nothing. While nothing is armed, dispatch to that garden
+id is the honest `mailbox-undeliverable` refusal — an unarmed receiver is a legible state,
+not a broken one.
+
+The admission work has landed and `setup` still does not compose these: the three omp
+units stay operator-selectable installs, so run them yourself on an omp host.
+
+Both installers resolve the omp agent directory the way omp itself does, and REFUSE rather
+than guess when an inherited `PI_CODING_AGENT_DIR`, `PI_CONFIG_DIR` or `PI_PROFILE` makes it
+ambiguous: omp is a pi fork and reads pi's env vocabulary, so those names no longer say which
+harness they address. Pass `ENTWURF_OMP_AGENT_DIR` if you genuinely mean a non-default one.
+
+Two things the installers deliberately will NOT do. They never adopt an artifact already
+sitting at their path without entwurf's own ownership state — a directory that merely looks
+like our unit could be yours, and adopting it would overwrite it with no way back — so a
+no-state path is a named refusal you resolve by hand. And the MCP writer's target is exactly
+`<resolved omp agent dir>/mcp.json`; there is no path override, so it can never be aimed at
+another tool's config.
+
+**Where an omp citizen's garden artifacts live.** Under `$HOME/.pi/agent/meta-*`, the same
+garden every other citizen uses — and that stays true under `omp --profile work`. omp is a pi
+fork, so the vendor exports `PI_CODING_AGENT_DIR` for every named profile; for entwurf that
+name means pi's persistence root, so honouring it here would put an omp session's record in a
+different store (or in a pi sandbox). For backend omp it is read as the VENDOR's agent dir
+only, and never as a garden root. Its presence on a live omp is normal and is not a fault.
+The four `ENTWURF_META_*` variables remain the way to relocate the garden roots, and for
+backend omp each one must be **absolute or `~`-rooted** (`~` or `~/…`). A relative value is
+refused by name rather than resolved: it would resolve against each process's own working
+directory, and the omp extension and `doctor-omp-bridge` do not share one — the doctor would
+then report on a directory the extension never writes to. A refused value mints nothing and
+turns the doctor's runtime axis red.
+
+**One vendor setting is required, and the default is wrong for a citizen.** omp's
+`tools.xdev` (default ON) mounts MCP tools as `xd://<tool>` devices and removes them from the
+model's top-level toolset, so `entwurf_v2` is reached by WRITING JSON to a virtual file rather
+than by calling a tool — and with `tools.xdevDocs` at its `builtins` default its schema is not
+in the prompt at all. On that default a plain "send this to garden id X" was measured to list
+peers and then CLAIM the send without ever dispatching. Put this in `~/.omp/agent/config.yml`
+and restart the session:
+
+```yaml
+tools:
+  xdev: false
+```
+
+It disables nothing — it exposes every enabled tool top-level, omp's own `lsp`, `debug`,
+`browser` and `ast_edit` included, which the default was hiding as well. Plan mode and staged
+`xd://resolve` / `xd://propose` finalization keep working. The rationale, the numbers and the
+narrower `tools.xdevInlineDevices` alternative are in
+[`external-mcp-host.md`](./external-mcp-host.md).
+
+Birth happens when the TUI OPENS (not on the first prompt, unlike Copilot), and the garden id
+appears on omp's status line as `🪛 <garden-id> omp`. `/new`, fork and in-TUI resume mint the
+replacement session's own record. Task subagents of that session are refused by design — they
+borrow the host's tools under the host's garden id and never get a second address.
+
+The MCP entry deliberately uses the same server key as any Claude Code import so that it
+SHADOWS it; see [`external-mcp-host.md`](./external-mcp-host.md) for why that key is pinned and
+why `disabledServers` is never the way to hide an import.
+
 ## 5. Optional Antigravity native citizen
 
 Install the three independently owned surfaces:

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -69,14 +69,37 @@ import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provid
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
+import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
+// ============================================================================
+// OMP root policy — FIRST, before any lazy default-root consumer (#87 B1).
+//
+// This runs at module load for one reason: every meta-root consumer below resolves its
+// directory lazily inside a tool handler, and the whole point of the policy is that none
+// of them may ever see the foreign value. It is a no-op for every other child — it fires
+// only when this process carries the exact `external-mcp/omp` provenance label its managed
+// entry writes, and then it removes `PI_CODING_AGENT_DIR` from THIS process alone (the omp
+// HOST keeps it: there the variable is the vendor's own agent dir) and pins the four
+// entwurf-owned meta roots to the shared leaf's answer. See `applyOmpBridgeChildRootPolicy`.
+// ============================================================================
+try {
+    applyOmpBridgeChildRootPolicy(process.env, HOME);
+}
+catch (err) {
+    // FAIL CLOSED, LOUDLY. The policy refuses an ambiguous garden root (a relative
+    // `ENTWURF_META_*` override, #87 A2), and a bridge child that cannot say which store it
+    // is addressing must not boot with a guess — the extension half received the identical
+    // refusal, so proceeding here is exactly the split the policy exists to prevent.
+    console.error(`[entwurf-bridge] fatal: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+}
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
@@ -192,11 +215,17 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         return null;
     const { marker, identity } = trusted;
     // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-    // rail a reply would ride (보정①). The domain comes from nativePushSupported(backend), not
-    // from wakeMode: `direct-inject` also covers codex/pi, which have no native-push adapter.
-    //   self-fetch (claude-code): can this citizen's own inbox wake? → the receiver presence
-    //     marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match means a
-    //     live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    // rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
+    //   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
+    //     codex/pi, which have no native-push adapter.
+    //   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
+    //     with dispatch). A new hardcoded backend list would drift the moment the registry
+    //     admits another self-fetch citizen.
+    //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
+    //     this as self-fetch printed a mailboxPath nothing drains.
+    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
+    //     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
+    //     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
     //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
     //     live app-server conversation, so only an adapter probe can answer. Composing the
     //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -205,7 +234,11 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
     // survive; degrading to null would erase the sender) — only with replyable:false.
     // The rail, named ONCE and reused for both the predicate and the caller's rendering —
     // so entwurf_self can never re-derive it differently from what decided `replyable`.
-    const metaDeliveryDomain = nativePushSupported(identity.backend) ? "native-push" : "self-fetch";
+    const metaDeliveryDomain = nativePushSupported(identity.backend)
+        ? "native-push"
+        : resolveMailboxWakeModeCapability(identity)
+            ? "self-fetch"
+            : "none";
     const facts = metaDeliveryDomain === "native-push"
         ? {
             origin: "meta-session",
@@ -213,17 +246,23 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
             recordBacked: true,
             probeAlive: await probeNativeSenderAlive(identity),
         }
-        : (() => {
-            const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-            const active = receiverMarkerMatchesIdentity(receiver, identity);
-            return {
+        : metaDeliveryDomain === "self-fetch"
+            ? (() => {
+                const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
+                const active = receiverMarkerMatchesIdentity(receiver, identity);
+                return {
+                    origin: "meta-session",
+                    metaDeliveryDomain,
+                    recordBacked: true,
+                    ownerAlive: active,
+                    watchArmed: active,
+                };
+            })()
+            : {
                 origin: "meta-session",
                 metaDeliveryDomain,
                 recordBacked: true,
-                ownerAlive: active,
-                watchArmed: active,
             };
-        })();
     const self = computeSelfAddressability(facts);
     return {
         envelope: {
@@ -428,6 +467,9 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
             else if (rail === "native-push") {
                 lines.push("mailbox:    none — native-push has no inbox; a reply direct-injects only while the adapter probe is alive");
             }
+            else if (rail === "none") {
+                lines.push("mailbox:    none — no inbound rail (no mailbox, no native-push adapter)");
+            }
             else {
                 // Fail-closed, matching computeSelfAddressability's own unsupplied-domain row:
                 // with no rail we cannot say how a reply would travel, so we claim no transport.
@@ -562,24 +604,27 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Three fixed " +
-    "backends only: pi, claude-code, copilot. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+    "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
     "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot). A copilot launch goes through entwurf's own managed invocation and is refused " +
-    "BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. An optional " +
+    "or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
+    "invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
+    "visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
+    "visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
+    "prompt, so the sibling could not call you back at all). An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot"])
-        .describe("Which fixed runtime to open. Only these three; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp"])
+        .describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
     model: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -5,6 +5,7 @@
 		"antigravity": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "conversationId" },
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -33,10 +33,13 @@
  *  - external-mcp: never replyable — no authoritative reply address.
  *
  * `origin` stays sender-carrier PROVENANCE, never the citizen identity authority and never a rail.
- * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
- * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
- * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is
- * not replyable.
+ * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`.
+ * The caller derives it as three values, never as a native-push-or-self-fetch binary:
+ *   native-push  ← `nativePushSupported(backend)` (the adapter list; NOT wakeMode —
+ *                  `direct-inject` also covers codex/pi, which have no native-push adapter)
+ *   self-fetch   ← `resolveMailboxWakeModeCapability` (the decider's own mailbox seam)
+ *   none         ← neither (omp today: no mailbox drain, no native-push adapter)
+ * Fail-closed: an unsupplied domain is not replyable.
  */
 import { computeMetaReceiverActive, nativePushDeliverable } from "./entwurf-deliverability.js";
 /**
@@ -65,9 +68,11 @@ export function computeSelfAddressability(facts) {
             };
         }
         case "meta-session": {
-            // TWO rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
+            // THREE rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
             // axis — the mailbox receiver atom and the native-push predicate share nothing, so a
-            // mailbox liveness fact can never leak into a backend that has no mailbox.
+            // mailbox liveness fact can never leak into a backend that has no mailbox. `none` is
+            // the remainder: no inbound rail at all (not an unsupplied domain — that stays the
+            // default fail-closed row).
             switch (facts.metaDeliveryDomain) {
                 case "native-push": {
                     const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
@@ -93,6 +98,12 @@ export function computeSelfAddressability(facts) {
                         reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
                     };
                 }
+                case "none":
+                    return {
+                        replyable: false,
+                        socketState: "none",
+                        reason: "no inbound rail — this backend has no mailbox and no native-push adapter",
+                    };
                 default:
                     return {
                         replyable: false,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -46,7 +46,7 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot"];
+export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend