@junghanacs/entwurf 0.15.1 → 0.16.1

package/docs/setup-clean-host.md

@@ -12,9 +12,10 @@ only on Linux because its strict live-owner join uses `/proc`.
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.84.3 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.84.4 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
+| OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
@@ -71,11 +72,12 @@ cd ~/repos/gh/entwurf
 
 This owns `~/.local/bin/entwurf` as a symlink to that checkout's `run.sh` and fails if the
 link is foreign, outside PATH, or shadowed by another command. It detects and wires
-pi/Claude/agy/Copilot by presence and prints a computed per-component PASS/SKIP/FAIL summary — a
+pi/Claude/agy/Copilot/OMP by presence and prints a computed per-component PASS/SKIP/FAIL summary — a
 detected harness that cannot be completed makes setup exit nonzero. A detected `copilot`
 composes all four native units (birth → MCP → receiver → visible footer) with independent
-per-unit verdicts (#86 C3b); §4 keeps the explicit per-unit install/doctor/inverse surfaces for
-repair.
+per-unit verdicts (#86 C3b), and a detected `omp` composes its own four (birth → MCP →
+`tools.xdev` setting → receiver) the same way; §4 and §4b keep the explicit per-unit
+install/doctor/inverse surfaces for repair.
 
 ### 1.1 User-scope ownership (one shared registration, one recorded owner)
 
@@ -108,7 +110,7 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.3
+npm install -g @earendil-works/pi-coding-agent@0.84.4
 pi --version
 
 cd ~/entwurf-smoke
@@ -116,7 +118,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.3 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.84.4 <0.85`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -185,6 +187,123 @@ scanning for that process, checks the receiver, removes inherited pi identity ca
 the model/permission defaults. Birth occurs on the first prompt. `entwurf_fresh_call` uses this
 same managed invocation and requires the birth, MCP, receiver, and visible-identity preflight.
 
+## 4b. Optional OMP (`omp`) native citizen — accepted on one host
+
+Three independently owned surfaces, and a boundary that is part of the instructions rather
+than a footnote. Birth, visible identity, who-sent, the MCP hand and RECEIVE are landed, and
+`entwurf_fresh_call` opens an omp sibling on all three public surfaces. The clause 7 LIVE
+receipt has been taken: `smoke-omp-fresh-live` went green on 2026-08-30 (omp 18.0.0, one
+model, one accepted run), which is what `docs/adding-a-harness.md` step 9 asks for and why
+that smoke is wired as a release-gate MUST — the label was never allowed to move ahead of the
+evidence, and it moved only once the evidence existed. Read the receipt itself in DELIVERY.md's
+OMP row; what it does NOT establish is multi-host, multi-model, or repeated fresh calls in one
+process. Open omp yourself and it is a two-way citizen either way — it sends under its own
+garden id and a reply lands on it.
+
+The first turn of a fresh omp sibling is a TWO-STAGE BOOTSTRAP, not a positional prompt: the
+launcher carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`,
+and the installed birth extension waits until the callback tool is actually callable, sends a
+callback-only prompt, and delivers the operator's task only after that exact call succeeds.
+That is a measured correction — the interactive host defers MCP discovery, so a positional
+first turn began before the tool it named existed.
+
+**One operator setting is load-bearing for fresh, not just for receive.** `tools: xdev: false`
+in the omp agent config is checked by the fresh preflight BEFORE any window opens, because the
+vendor default mounts MCP tools as `xd://` devices whose schemas never reach the prompt: a
+sibling launched onto a default-config host would start, look healthy, and be unable to call
+the callback tool at all. A refusal there names `omp-callback-tool-uncallable` and opens
+nothing.
+
+`setup` composes all four omp units when `omp` is on PATH, and the setting is one of them —
+`entwurf setup` writes `tools: xdev: false` itself. The verbs below are the REPAIR path, not
+the install:
+
+```bash
+entwurf install-omp-bridge     # the birth extension, into <omp agent dir>/extensions/
+entwurf install-omp-mcp        # the omp-native entwurf-bridge server
+entwurf install-omp-config     # the operator setting: tools.xdev: false
+entwurf install-omp-receive    # the receiver extension: mailbox watch + doorbell
+
+entwurf doctor-omp-bridge
+entwurf doctor-omp-mcp         # also owns the tools.xdev runtime axis
+entwurf doctor-omp-receive
+```
+
+The setting writer owns exactly the lines it adds and records them, so `uninstall-omp-config`
+takes back its own bytes and nothing else. It refuses a symlinked config, a config it cannot
+parse, and — deliberately — an EXPLICIT `tools: xdev: true`: that is your decision, not drift,
+so setup names it as a component FAIL for you to resolve instead of overwriting it.
+
+Order matters only in one direction: the receiver JOINS the citizen birth mints, and
+announces a tool the MCP hand provides. Install it without them and it will log
+`arm-deferred`, give up after ~20s, and `doctor-omp-receive` will name the missing sibling
+as a note rather than a fault.
+
+**The receiver arms per session, and only for the visible TUI host.** Opening omp arms it;
+`/new` re-arms it for the replacement citizen and retires the previous one; closing omp
+retires it. A task subagent arms nothing. While nothing is armed, dispatch to that garden
+id is the honest `mailbox-undeliverable` refusal — an unarmed receiver is a legible state,
+not a broken one.
+
+`[측정]` This section used to end by saying `setup` did not compose these and the verbs had to
+be run by hand. That is what v0.16.0 actually shipped, and on an operator host it printed a
+green `setup` summary with OMP entirely absent — no extension, no MCP entry, no visible garden
+id. The composition landed afterwards; `docs/adding-a-harness.md` step 10 is the rule that
+keeps the next harness from repeating it.
+
+Both installers resolve the omp agent directory the way omp itself does, and REFUSE rather
+than guess when an inherited `PI_CODING_AGENT_DIR`, `PI_CONFIG_DIR` or `PI_PROFILE` makes it
+ambiguous: omp is a pi fork and reads pi's env vocabulary, so those names no longer say which
+harness they address. Pass `ENTWURF_OMP_AGENT_DIR` if you genuinely mean a non-default one.
+
+Two things the installers deliberately will NOT do. They never adopt an artifact already
+sitting at their path without entwurf's own ownership state — a directory that merely looks
+like our unit could be yours, and adopting it would overwrite it with no way back — so a
+no-state path is a named refusal you resolve by hand. And the MCP writer's target is exactly
+`<resolved omp agent dir>/mcp.json`; there is no path override, so it can never be aimed at
+another tool's config.
+
+**Where an omp citizen's garden artifacts live.** Under `$HOME/.pi/agent/meta-*`, the same
+garden every other citizen uses — and that stays true under `omp --profile work`. omp is a pi
+fork, so the vendor exports `PI_CODING_AGENT_DIR` for every named profile; for entwurf that
+name means pi's persistence root, so honouring it here would put an omp session's record in a
+different store (or in a pi sandbox). For backend omp it is read as the VENDOR's agent dir
+only, and never as a garden root. Its presence on a live omp is normal and is not a fault.
+The four `ENTWURF_META_*` variables remain the way to relocate the garden roots, and for
+backend omp each one must be **absolute or `~`-rooted** (`~` or `~/…`). A relative value is
+refused by name rather than resolved: it would resolve against each process's own working
+directory, and the omp extension and `doctor-omp-bridge` do not share one — the doctor would
+then report on a directory the extension never writes to. A refused value mints nothing and
+turns the doctor's runtime axis red.
+
+**One vendor setting is required, and the default is wrong for a citizen.** omp's
+`tools.xdev` (default ON) mounts MCP tools as `xd://<tool>` devices and removes them from the
+model's top-level toolset, so `entwurf_v2` is reached by WRITING JSON to a virtual file rather
+than by calling a tool — and with `tools.xdevDocs` at its `builtins` default its schema is not
+in the prompt at all. On that default a plain "send this to garden id X" was measured to list
+peers and then CLAIM the send without ever dispatching. Put this in `~/.omp/agent/config.yml`
+and restart the session:
+
+```yaml
+tools:
+  xdev: false
+```
+
+It disables nothing — it exposes every enabled tool top-level, omp's own `lsp`, `debug`,
+`browser` and `ast_edit` included, which the default was hiding as well. Plan mode and staged
+`xd://resolve` / `xd://propose` finalization keep working. The rationale, the numbers and the
+narrower `tools.xdevInlineDevices` alternative are in
+[`external-mcp-host.md`](./external-mcp-host.md).
+
+Birth happens when the TUI OPENS (not on the first prompt, unlike Copilot), and the garden id
+appears on omp's status line as `🪛 <garden-id> omp`. `/new`, fork and in-TUI resume mint the
+replacement session's own record. Task subagents of that session are refused by design — they
+borrow the host's tools under the host's garden id and never get a second address.
+
+The MCP entry deliberately uses the same server key as any Claude Code import so that it
+SHADOWS it; see [`external-mcp-host.md`](./external-mcp-host.md) for why that key is pinned and
+why `disabledServers` is never the way to hide an import.
+
 ## 5. Optional Antigravity native citizen
 
 Install the three independently owned surfaces:

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -69,14 +69,37 @@ import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provid
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
+import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
+// ============================================================================
+// OMP root policy — FIRST, before any lazy default-root consumer (#87 B1).
+//
+// This runs at module load for one reason: every meta-root consumer below resolves its
+// directory lazily inside a tool handler, and the whole point of the policy is that none
+// of them may ever see the foreign value. It is a no-op for every other child — it fires
+// only when this process carries the exact `external-mcp/omp` provenance label its managed
+// entry writes, and then it removes `PI_CODING_AGENT_DIR` from THIS process alone (the omp
+// HOST keeps it: there the variable is the vendor's own agent dir) and pins the four
+// entwurf-owned meta roots to the shared leaf's answer. See `applyOmpBridgeChildRootPolicy`.
+// ============================================================================
+try {
+    applyOmpBridgeChildRootPolicy(process.env, HOME);
+}
+catch (err) {
+    // FAIL CLOSED, LOUDLY. The policy refuses an ambiguous garden root (a relative
+    // `ENTWURF_META_*` override, #87 A2), and a bridge child that cannot say which store it
+    // is addressing must not boot with a guess — the extension half received the identical
+    // refusal, so proceeding here is exactly the split the policy exists to prevent.
+    console.error(`[entwurf-bridge] fatal: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+}
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
@@ -192,11 +215,17 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         return null;
     const { marker, identity } = trusted;
     // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-    // rail a reply would ride (보정①). The domain comes from nativePushSupported(backend), not
-    // from wakeMode: `direct-inject` also covers codex/pi, which have no native-push adapter.
-    //   self-fetch (claude-code): can this citizen's own inbox wake? → the receiver presence
-    //     marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match means a
-    //     live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    // rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
+    //   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
+    //     codex/pi, which have no native-push adapter.
+    //   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
+    //     with dispatch). A new hardcoded backend list would drift the moment the registry
+    //     admits another self-fetch citizen.
+    //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
+    //     this as self-fetch printed a mailboxPath nothing drains.
+    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
+    //     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
+    //     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
     //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
     //     live app-server conversation, so only an adapter probe can answer. Composing the
     //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -205,7 +234,11 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
     // survive; degrading to null would erase the sender) — only with replyable:false.
     // The rail, named ONCE and reused for both the predicate and the caller's rendering —
     // so entwurf_self can never re-derive it differently from what decided `replyable`.
-    const metaDeliveryDomain = nativePushSupported(identity.backend) ? "native-push" : "self-fetch";
+    const metaDeliveryDomain = nativePushSupported(identity.backend)
+        ? "native-push"
+        : resolveMailboxWakeModeCapability(identity)
+            ? "self-fetch"
+            : "none";
     const facts = metaDeliveryDomain === "native-push"
         ? {
             origin: "meta-session",
@@ -213,17 +246,23 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
             recordBacked: true,
             probeAlive: await probeNativeSenderAlive(identity),
         }
-        : (() => {
-            const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-            const active = receiverMarkerMatchesIdentity(receiver, identity);
-            return {
+        : metaDeliveryDomain === "self-fetch"
+            ? (() => {
+                const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
+                const active = receiverMarkerMatchesIdentity(receiver, identity);
+                return {
+                    origin: "meta-session",
+                    metaDeliveryDomain,
+                    recordBacked: true,
+                    ownerAlive: active,
+                    watchArmed: active,
+                };
+            })()
+            : {
                 origin: "meta-session",
                 metaDeliveryDomain,
                 recordBacked: true,
-                ownerAlive: active,
-                watchArmed: active,
             };
-        })();
     const self = computeSelfAddressability(facts);
     return {
         envelope: {
@@ -428,6 +467,9 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
             else if (rail === "native-push") {
                 lines.push("mailbox:    none — native-push has no inbox; a reply direct-injects only while the adapter probe is alive");
             }
+            else if (rail === "none") {
+                lines.push("mailbox:    none — no inbound rail (no mailbox, no native-push adapter)");
+            }
             else {
                 // Fail-closed, matching computeSelfAddressability's own unsupplied-domain row:
                 // with no rail we cannot say how a reply would travel, so we claim no transport.
@@ -562,24 +604,27 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Three fixed " +
-    "backends only: pi, claude-code, copilot. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+    "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
     "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot). A copilot launch goes through entwurf's own managed invocation and is refused " +
-    "BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. An optional " +
+    "or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
+    "invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
+    "visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
+    "visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
+    "prompt, so the sibling could not call you back at all). An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot"])
-        .describe("Which fixed runtime to open. Only these three; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp"])
+        .describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
     model: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -5,6 +5,7 @@
 		"antigravity": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "conversationId" },
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -17,10 +17,9 @@
 //
 // Fence: imported by the root program with `.js` suffixes, same as the sibling
 // lib/acp modules — no new strip-types fence.
-import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { enrichMcpServersWithEnvelope } from "./config.js";
 import { loadEngraving } from "./engraving.js";
 import { CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./models.js";
@@ -39,19 +38,29 @@ function shellQuote(value) {
 // claude adapter — the first implementation (the rail's reference backend)
 // ---------------------------------------------------------------------------
 const SUPPORTED_CLAUDE_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
-/** Resolve the claude-agent-acp launch — package bin (resolve), env override for debug.
- *  This is the single source for the claude launch spec; backend.ts holds no private copy. */
+/**
+ * Resolve the claude launch — an ENTWURF-OWNED launcher, or the env override for debug.
+ * This is the single source for the claude launch spec; backend.ts holds no private copy.
+ *
+ * The default no longer names the vendor bin directly. `claude-acp-launch.js`
+ * imports it in-process; that file's header carries the reason (#72: a janitor
+ * for another harness selects `claude-agent-acp` by argv substring and SIGTERMs
+ * it by age, and the vendor's own handler erases the signal into exit 0).
+ *
+ * `CLAUDE_AGENT_ACP_COMMAND` is an EXPLICIT operator override and is deliberately
+ * NOT routed through the launcher: an operator who names their own command owns
+ * the result, including the loss of the name split and the signal observation.
+ */
 function resolveClaudeLaunch() {
     const override = process.env.CLAUDE_AGENT_ACP_COMMAND?.trim();
     if (override)
         return { command: "bash", args: ["-lc", override] };
+    // Resolved here (not inside the launcher's own directory lookup) so a missing
+    // vendor package still fails at launch resolution, where it always failed.
     const require = createRequire(import.meta.url);
-    const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
-    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
-    const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
-    if (!binPath)
-        throw new Error("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
-    return { command: process.execPath, args: [join(dirname(pkgJsonPath), binPath)] };
+    require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+    const launcher = fileURLToPath(new URL("./claude-acp-launch.js", import.meta.url));
+    return { command: process.execPath, args: [launcher] };
 }
 export const claudeAdapter = {
     backend: "claude",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -33,10 +33,13 @@
  *  - external-mcp: never replyable — no authoritative reply address.
  *
  * `origin` stays sender-carrier PROVENANCE, never the citizen identity authority and never a rail.
- * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
- * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
- * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is
- * not replyable.
+ * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`.
+ * The caller derives it as three values, never as a native-push-or-self-fetch binary:
+ *   native-push  ← `nativePushSupported(backend)` (the adapter list; NOT wakeMode —
+ *                  `direct-inject` also covers codex/pi, which have no native-push adapter)
+ *   self-fetch   ← `resolveMailboxWakeModeCapability` (the decider's own mailbox seam)
+ *   none         ← neither (omp today: no mailbox drain, no native-push adapter)
+ * Fail-closed: an unsupplied domain is not replyable.
  */
 import { computeMetaReceiverActive, nativePushDeliverable } from "./entwurf-deliverability.js";
 /**
@@ -65,9 +68,11 @@ export function computeSelfAddressability(facts) {
             };
         }
         case "meta-session": {
-            // TWO rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
+            // THREE rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
             // axis — the mailbox receiver atom and the native-push predicate share nothing, so a
-            // mailbox liveness fact can never leak into a backend that has no mailbox.
+            // mailbox liveness fact can never leak into a backend that has no mailbox. `none` is
+            // the remainder: no inbound rail at all (not an unsupplied domain — that stays the
+            // default fail-closed row).
             switch (facts.metaDeliveryDomain) {
                 case "native-push": {
                     const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
@@ -93,6 +98,12 @@ export function computeSelfAddressability(facts) {
                         reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
                     };
                 }
+                case "none":
+                    return {
+                        replyable: false,
+                        socketState: "none",
+                        reason: "no inbound rail — this backend has no mailbox and no native-push adapter",
+                    };
                 default:
                     return {
                         replyable: false,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -46,7 +46,7 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot"];
+export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend