@junghanacs/entwurf 0.16.0 → 0.16.1

package/scripts/check-acp-launch-namespace.ts

@@ -0,0 +1,127 @@
+// Deterministic gate — the Claude ACP child launches under a name entwurf OWNS.
+//
+// WHY THIS IS A GATE AND NOT A COMMENT (#72). The vendor bin is called
+// `claude-agent-acp`, and that name belongs to the package, not to us: any
+// harness on the host spawning the same package produces a process with the
+// same name. On GLG's oracle host a janitor installed for a DIFFERENT harness
+// selects `claude-agent-acp` by argv SUBSTRING and SIGTERMs anything older than
+// 900s. Because entwurf RETAINS its child across turns, its age is the age of
+// the session — 12 of 12 anomalous terminations across two boots were that
+// janitor (receipts: scripts/raw-acp-child-exit-measure/README.md §ANSWERED).
+//
+// The defense is a launcher whose own name carries no vendor substring. That is
+// a property of a STRING, which is exactly the kind of thing that rots silently
+// under a rename or a "harmless" revert — hence a gate that fails loudly.
+//
+// The second half matters as much: the launcher must remain TRANSPARENT. The
+// vendor reads `--cli` / `--version` from `process.argv` and builds its own
+// re-invocation command from `process.argv.slice(1)`. A launcher that consumed
+// a flag of its own, or failed to start the vendor at all, would trade one
+// silent breakage for another — so we RUN it and require the vendor to answer.
+
+import { strict as assert } from "node:assert";
+import { execFileSync } from "node:child_process";
+import { rmdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/** The substring the janitor matches on — the thing our launch argv must not contain. */
+const VENDOR_PROCESS_MATCHER = "claude-agent-acp";
+
+const TMP_EMIT = ".tmp-verify/acp-launch-namespace";
+rmSync(TMP_EMIT, { recursive: true, force: true });
+try {
+	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
+		stdio: "pipe",
+	});
+	const adapterUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend-adapter.js")).href;
+	const mod = (await import(adapterUrl)) as {
+		claudeAdapter: {
+			resolveLaunch: (p: { cwd: string; modelId: string; nativeModelId: string; config: unknown }) => {
+				command: string;
+				args: string[];
+			};
+		};
+	};
+
+	const launch = mod.claudeAdapter.resolveLaunch({
+		cwd: process.cwd(),
+		modelId: "claude-sonnet-5",
+		nativeModelId: "claude-sonnet-5",
+		config: {},
+	});
+
+	// ----------------------------------------------------------------------
+	// The claim: nothing a name-matching janitor scans contains the vendor name.
+	// We check the WHOLE argv the way `ps` presents it, because that is what the
+	// janitor's awk actually reads — not just the basename.
+	// ----------------------------------------------------------------------
+	const psLine = [launch.command, ...launch.args].join(" ");
+	assert.ok(
+		!psLine.includes(VENDOR_PROCESS_MATCHER),
+		`[QK:CLAUDE-LAUNCH-IS-NAMESPACED] the default Claude ACP launch must not put "${VENDOR_PROCESS_MATCHER}" anywhere ` +
+			"in its argv: a janitor installed for another harness selects that substring by age and SIGTERMs it, which is " +
+			`the whole of #72. Got: ${JSON.stringify(psLine)}`,
+	);
+	assert.ok(
+		launch.args.length === 1 && launch.args[0].endsWith("claude-acp-launch.js"),
+		"the default launch is the entwurf-owned launcher and NOTHING else — an extra argv entry would be a flag of our " +
+			`own, which the vendor's argv.slice(1) self-reinvocation cannot survive. Got: ${JSON.stringify(launch.args)}`,
+	);
+
+	// ----------------------------------------------------------------------
+	// The launcher must still BE the vendor. A name split that stopped starting
+	// the agent would pass every string assertion above and ship a dead backend,
+	// so run it and make the vendor answer through it.
+	// ----------------------------------------------------------------------
+	const version = execFileSync(process.execPath, [...launch.args, "--version"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+		timeout: 60_000,
+	}).trim();
+	assert.match(
+		version,
+		/^\d+\.\d+\.\d+/,
+		"[QK:CLAUDE-LAUNCH-IS-TRANSPARENT] the launcher must pass argv through untouched and start the real vendor — " +
+			`\`--version\` has to reach it and answer. Got: ${JSON.stringify(version)}`,
+	);
+
+	// ----------------------------------------------------------------------
+	// The debug override is an EXPLICIT operator choice and must stay literal:
+	// an operator who names their own command owns the result, including losing
+	// the name split. Routing it through the launcher would silently overrule them.
+	// ----------------------------------------------------------------------
+	process.env.CLAUDE_AGENT_ACP_COMMAND = "echo overridden";
+	try {
+		const overridden = mod.claudeAdapter.resolveLaunch({
+			cwd: process.cwd(),
+			modelId: "claude-sonnet-5",
+			nativeModelId: "claude-sonnet-5",
+			config: {},
+		});
+		assert.deepEqual(
+			[overridden.command, ...overridden.args],
+			["bash", "-lc", "echo overridden"],
+			"CLAUDE_AGENT_ACP_COMMAND must stay verbatim — the launcher is the DEFAULT, never an override of the operator",
+		);
+	} finally {
+		delete process.env.CLAUDE_AGENT_ACP_COMMAND;
+	}
+} finally {
+	rmSync(TMP_EMIT, { recursive: true, force: true });
+	try {
+		// A leftover EMPTY parent dir reads as IMPURE tree drift in the
+		// qualification harness; a concurrent sibling gate's emit keeps it alive
+		// and this rmdir simply fails.
+		rmdirSync(".tmp-verify");
+	} catch {
+		// non-empty or already gone — fine either way
+	}
+}
+
+console.log(
+	"[check-acp-launch-namespace] ok — the default Claude ACP launch carries no vendor process name in its argv (so a " +
+		"name-matching janitor installed for another harness cannot select it), is exactly the entwurf-owned launcher " +
+		"with no flag of its own, still starts the real vendor through argv passed untouched, and leaves an explicit " +
+		"CLAUDE_AGENT_ACP_COMMAND override verbatim",
+);

package/scripts/check-acp-prompt-lifecycle.ts

@@ -77,6 +77,7 @@ function deferred<T>(): Deferred<T> {
 function makeFakeChild() {
 	const exitListeners: Array<(...args: unknown[]) => void> = [];
 	const stderrListeners: Array<(chunk: Buffer) => void> = [];
+	const stderrCloseListeners: Array<() => void> = [];
 	const kills: Array<NodeJS.Signals | number | undefined> = [];
 	const pipe = () => ({ destroy() {}, unref() {} });
 	const child = {
@@ -90,6 +91,9 @@ function makeFakeChild() {
 			on(_event: "data", listener: (chunk: Buffer) => void) {
 				stderrListeners.push(listener);
 			},
+			once(_event: "close", listener: () => void) {
+				stderrCloseListeners.push(listener);
+			},
 			destroy() {},
 			unref() {},
 		},
@@ -105,10 +109,11 @@ function makeFakeChild() {
 		writeStderr(text: string) {
 			for (const listener of [...stderrListeners]) listener(Buffer.from(text));
 		},
-		/** driver: the backend process ends. */
+		/** driver: the backend process ends. Its stderr pipe closes with it. */
 		die(code: number | null, signal: NodeJS.Signals | null = null) {
 			child.exitCode = code;
 			child.signalCode = signal;
+			for (const listener of stderrCloseListeners.splice(0)) listener();
 			for (const listener of exitListeners.splice(0)) listener(code, signal);
 		},
 	};
@@ -656,6 +661,141 @@ try {
 		);
 	}
 
+	// ----------------------------------------------------------------------
+	// CELL 12 — a signal the LAUNCHER caught survives the vendor erasing it.
+	//
+	// #72's whole difficulty: the vendor turns SIGTERM into `dispose(); exit(0)`,
+	// so an external kill and a clean vendor shutdown reach us as the SAME facts
+	// (code 0, signal null). CELL 10 can only separate a signal that was NOT
+	// caught. `claude-acp-launch.js` records the catch before the vendor erases
+	// it; this cell holds that the record reaches the operator, on its own line,
+	// and that the tail stays vendor-only.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("reaped from outside"), { sessionId: "life-eof-launchsig" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("VENDOR-TAIL-MARK\n");
+		h.children[0].writeStderr("ENTWURF_ACP_LAUNCH_SIGNAL=SIGTERM\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("launch observed SIGTERM before child exit"),
+			"[QK:LAUNCH-SIGNAL-EVIDENCE-STRUCTURED] a caught SIGTERM must reach the operator even though the vendor " +
+				`normalized it to exit 0 — otherwise an external kill is indistinguishable from a clean close. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("sender not attributed"),
+			"the observation must NOT claim who sent the signal — attribution needs the host journal, which this " +
+				`process cannot read. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("exit code 0") && message.includes("VENDOR-TAIL-MARK"),
+			`the exit fact and the vendor tail both survive alongside the observation. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			!message.includes("ENTWURF_ACP_LAUNCH_SIGNAL="),
+			"[QK:LAUNCH-FRAME-NOT-IN-TAIL] the raw control frame must be CONSUMED, not echoed into the vendor tail — " +
+				`the tail is vendor evidence and the observation is ours, and #72 was made of confusing the two. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 13 — NEGATIVE SIBLING: vendor prose can never manufacture the fact.
+	//
+	// The oracle for CELL 12's exactness. Vendor stderr is free text and it does
+	// mention signals; if a loose test (`includes("SIGTERM")`, or a prefix match
+	// without the enum) fed the observation, entwurf would report an entwurf-owned
+	// fact it never observed — a worse failure than reporting nothing, because it
+	// would be trusted. Both a near-miss frame and prose must produce NOTHING.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("vendor mentions a signal"), { sessionId: "life-eof-nosig" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("shutting down after SIGTERM; ENTWURF_ACP_LAUNCH_SIGNAL=SIGQUIT\n");
+		h.children[0].writeStderr("  ENTWURF_ACP_LAUNCH_SIGNAL=SIGTERM (quoted in prose, not a frame)\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			!message.includes("launch observed"),
+			"[QK:LAUNCH-SIGNAL-EXACT-FRAME-ONLY] neither vendor prose containing 'SIGTERM', an unknown signal value, nor " +
+				"an indented near-miss may produce a launch observation — the frame is an exact full line with a fixed " +
+				`enum, and anything looser lets vendor text forge our own evidence. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("SIGQUIT") && message.includes("quoted in prose"),
+			`text that is not our frame stays in the vendor tail verbatim. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 14 — the child's LAST words survive having no trailing newline.
+	//
+	// Filtering our control frame out of the tail means reading stderr by LINE,
+	// and a process dying mid-write does not finish its line. That fragment is
+	// exactly the dying words the tail exists for, so holding it in a line buffer
+	// forever would trade #72's diagnosis for a worse blindness. The stream's
+	// close must flush it VERBATIM.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("dies mid-write"), { sessionId: "life-eof-nonl" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("FATAL dying words with no newline");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("FATAL dying words with no newline"),
+			"[QK:STDERR-TAIL-FLUSHES-PARTIAL-LINE] a child that dies mid-write leaves its last line unterminated, and " +
+				"that fragment IS the dying words the tail exists for — line-buffering to strip our own frame must not " +
+				`swallow it. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 15 — a frame split across two reads is still recognised exactly.
+	//
+	// Pipe chunk boundaries fall wherever the kernel put them, so the frame can
+	// arrive in pieces. This is the reason the filter buffers by line at all;
+	// without a cell for it, an implementation that matched per-CHUNK would pass
+	// every other test here and then miss the real signal in the field.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("frame arrives split"), { sessionId: "life-eof-split" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("ENTWURF_ACP_LAUNCH_SI");
+		h.children[0].writeStderr("GNAL=SIGTERM\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("launch observed SIGTERM before child exit"),
+			"[QK:LAUNCH-FRAME-SPANS-CHUNKS] the frame must be recognised across a chunk boundary — the kernel, not the " +
+				`writer, decides where a read ends. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			!message.includes("ENTWURF_ACP_LAUNCH_SI"),
+			`neither half of a split frame may leak into the vendor tail. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
 	// ----------------------------------------------------------------------
 	// CELL 11 — a child that never reports an end says SO, bounded.
 	//
@@ -771,7 +911,10 @@ console.log(
 		"reported with its exit status AND stderr tail on BOTH the new and the reuse path; a death BETWEEN turns is " +
 		"announced once by the next turn while a teardown WE performed stays silent; the child's end survives the " +
 		"temporal order the field showed too (transport EOF first, exit one tick later, alongside the opposite order), " +
-		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; and pi's " +
+		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; a signal the " +
+		"LAUNCHER caught survives the vendor normalizing it to exit 0 and is reported on its own line without claiming " +
+		"who sent it, while its raw control frame is consumed out of the vendor tail and vendor prose mentioning a " +
+		"signal can never forge that observation; and pi's " +
 		"own isRetryableAssistantError refuses to classify any of those failures as transient while still matching " +
 		"the retired 600s text",
 );

package/scripts/check-copilot-birth-hook.ts

@@ -495,7 +495,7 @@ function makeFakeHost(label: string, opts: FakeOpts): FakeHost {
 				? '  "plugin list") echo "not authenticated" >&2; exit 1 ;;'
 				: opts.pluginListRaw !== undefined
 					? `  "plugin list") echo "Installed plugins:"; cat ${JSON.stringify(rawList)}; exit 0 ;;`
-					: '  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/$/ (v$VER)/" "$STATE"; exit 0 ;;',
+					: '  "plugin list") echo "Live Plugins (loaded from a local marketplace directory, never copied):"; sed "s/^/  • /;s/$/ (v$VER) (enabled)/" "$STATE"; exit 0 ;;',
 			'  "plugin uninstall")',
 			opts.uninstallFails
 				? '    echo "boom" >&2; exit 1 ;;'
@@ -1065,6 +1065,33 @@ function writeBoundState(host: FakeHost): void {
 		inst.status !== 0 && (inst.stderr ?? "").includes("malformed") && !existsSync(instHost.stateFile),
 	);
 }
+{
+	// Copilot CLI 1.0.81 (measured 2026-08-31) appends its own state token after the
+	// version and an indented `from <path>` continuation line. The grammar admits that
+	// ONE optional `(enabled)`/`(disabled)` token — reading it as part of the version
+	// made every surface refuse a perfectly healthy host. Anything else in the tail
+	// stays malformed, so the admission cannot widen into "ignore whatever follows".
+	const liveRaw = `Live Plugins (loaded from a local marketplace directory, never copied):\n  • ${OURS} (v${SHIPPED_VERSION}) (enabled)\n      from /home/nobody/.assembled`;
+	const docHost = makeFakeHost("doctor-state-token-row", { installed: [OURS], pluginListRaw: liveRaw });
+	writeBoundState(docHost);
+	writeFileSync(docHost.mktState, `${MKT}\t${docHost.asm}\n`);
+	mkdirSync(path.join(docHost.asm, PLUGIN), { recursive: true });
+	const doc = runVerb(docHost, "doctor-copilot-bridge");
+	ok(
+		"[QK:COPILOT-ROW-STATE-TOKEN-ADMITTED] a `(vX) (enabled)` row plus its `from` continuation line parses as the installed version — no malformed refusal on a healthy 1.0.81 host",
+		doc.stdout.includes(`${OURS} (v${SHIPPED_VERSION}) is registered in Copilot`) &&
+			!doc.stdout.includes("malformed") &&
+			!(doc.stderr ?? "").includes("malformed"),
+	);
+	const foreignHost = makeFakeHost("install-foreign-tail-row", {
+		pluginListRaw: `  • ${OURS} (v${SHIPPED_VERSION}) (whatever)`,
+	});
+	const foreign = runVerb(foreignHost, "install-copilot-bridge");
+	ok(
+		"an UNKNOWN trailing token is still malformed — the admission is exactly the two measured state words",
+		foreign.status !== 0 && (foreign.stderr ?? "").includes("malformed") && !existsSync(foreignHost.stateFile),
+	);
+}
 {
 	// B defect 4: a pluginVersion carrying whitespace would be truncated by the
 	// space-separated fact transport (`cut -d' ' -f3`) into a FABRICATED version and a

package/scripts/check-gate-qualification.ts

@@ -799,8 +799,9 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
 		"acp-augment": 10,
 		"acp-cortex": 12,
+		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
-		"acp-prompt-lifecycle": 10,
+		"acp-prompt-lifecycle": 15,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
 		"agy-permission": 6,
@@ -829,7 +830,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
-		"setup-verdict": 10,
+		"setup-verdict": 13,
 		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,

package/scripts/check-omp-fresh-preflight.ts

@@ -155,6 +155,16 @@ function pythonXdev(agentDir: string): "false" | "true" | "unreadable" {
 		["a top-level xdev outside tools", "xdev: false\ntools:\n  approvalMode: yolo\n"],
 		["tab indentation (not YAML for the vendor)", "tools:\n\txdev: false\n"],
 		["broken flow scalar", "tools: [oops\n"],
+		// The shape the VENDOR's own settings writer produces: `key:` on one line with an
+		// indented flow collection under it. The python leaf's block-only reader returned
+		// None for the WHOLE file here, so an untouched operator config classified as
+		// `unreadable` and doctor-omp-mcp went RED for a reason unrelated to tools.xdev
+		// (measured on a real host, omp 18.0.0). Agreement alone could never catch it —
+		// both halves collapse `unreadable` and `true` into "not false" — so the direct
+		// assertion below is the one that holds the reader to the vendor's own output.
+		["the vendor's own writer output (empty flow map sibling)", "modelRoles: \n  {}\ntools: \n  xdev: false\n"],
+		["a populated flow map sibling", "modelRoles: \n  {default: xai/grok}\ntools: \n  xdev: false\n"],
+		["a flow sequence sibling", "disabledProviders: \n  [openrouter, google]\ntools: \n  xdev: false\n"],
 	];
 	const root = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-omp-xdev-"));
 	try {
@@ -173,6 +183,23 @@ function pythonXdev(agentDir: string): "false" | "true" | "unreadable" {
 				pythonSaysFalse === (ts === false),
 			);
 		}
+		// Agreement is not enough on the vendor's own shapes: two readers that BOTH fail
+		// closed agree perfectly and still leave the doctor red on a healthy host. These
+		// name the answer instead of comparing the halves.
+		for (const [label, yaml] of CONFIGS) {
+			if (
+				!label.startsWith("the vendor's own writer output") &&
+				!label.startsWith("a populated flow map") &&
+				!label.startsWith("a flow sequence")
+			)
+				continue;
+			const dir = fs.mkdtempSync(path.join(root, "vendor-"));
+			fs.writeFileSync(path.join(dir, "config.yml"), yaml as string);
+			ok(
+				`[QK:OMP-XDEV-VENDOR-SHAPE-READABLE] the python leaf READS tools.xdev on ${label} — a flow collection elsewhere in the file is not an unreadable config`,
+				pythonXdev(dir) === "false",
+			);
+		}
 	} finally {
 		fs.rmSync(root, { recursive: true, force: true });
 	}

package/scripts/check-setup-qualification.sh

@@ -42,11 +42,23 @@ for _f in copilot-bridge-install.sh copilot-bridge-oracle.sh copilot-mcp-bridge.
   copilot-receive-bridge.sh copilot-statusline-bridge.sh copilot-statusline-config.py; do
   cp "$REPO_DIR/scripts/$_f" "$PKG/scripts/$_f"
 done
+# OMP composition surface (Cells E/F): same discipline — every omp unit script is a real
+# tracked file here, because the claims are about what the composition actually reaches.
+for _f in omp-bridge-install.sh omp-bridge-oracle.sh omp-mcp-bridge.sh omp-mcp-config.py \
+  omp-tool-surface.py omp-config-xdev.sh omp-config-xdev.py omp-receive-install.sh; do
+  cp "$REPO_DIR/scripts/$_f" "$PKG/scripts/$_f"
+done
 cp -r "$REPO_DIR/pi" "$PKG/pi"
 cp "$REPO_DIR/pi-extensions/lib/session-id.js" "$PKG/pi-extensions/lib/session-id.js"
 printf '%s\n' '// dist stub: copied+digested by the receive installer, never executed here' \
   > "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
 cp "$PKG/pi-extensions/lib/session-id.js" "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/session-id.js"
+# The omp units select the same compiled closure in installed mode. Same stub discipline:
+# the installers copy and digest these bytes, they never execute them here.
+for _e in meta-bridge-omp.js meta-bridge-receive-omp.js; do
+  printf '%s\n' '// dist stub: copied+digested by the omp installers, never executed here' \
+    > "$PKG/mcp/entwurf-bridge/dist/pi-extensions/$_e"
+done
 
 # Fake pnpm: resolvable (so an unconditional require_cmd would pass), but any
 # INVOCATION writes a marker and exits uniquely — the bootstrap tripwire.
@@ -56,12 +68,12 @@ printf '#!/usr/bin/env bash\necho invoked > "%s"\nexit 97\n' "$MARKER" > "$SB/bi
 chmod +x "$SB/bin/pnpm"
 
 ABSENT="$SB/definitely-absent"
-run_setup() { # $1=HOME-root $2=project $3=PATH $4=PI_BIN $5=COPILOT_BIN(optional, default absent) → OUT/RC
+run_setup() { # $1=HOME-root $2=project $3=PATH $4=PI_BIN $5=COPILOT_BIN(opt) $6=OMP_BIN(opt) → OUT/RC
   mkdir -p "$1/.pi/agent" "$2"
   set +e
   # ONE physical line by contract: check-install-surface S5c is a line-scoped static tripwire,
   # so the sandbox env assignments must ride the same line as the run.sh drive they guard.
-  OUT="$(HOME="$1" XDG_DATA_HOME="$1/.local/share" XDG_STATE_HOME="$1/.local/state" XDG_CACHE_HOME="$1/.cache" XDG_CONFIG_HOME="$1/.config" PI_CODING_AGENT_DIR="$1/.pi/agent" PATH="$3" PI_BIN="$4" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="${5:-$ABSENT}" bash "$PKG/run.sh" setup "$2" 2>&1)"
+  OUT="$(HOME="$1" XDG_DATA_HOME="$1/.local/share" XDG_STATE_HOME="$1/.local/state" XDG_CACHE_HOME="$1/.cache" XDG_CONFIG_HOME="$1/.config" PI_CODING_AGENT_DIR="$1/.pi/agent" PATH="$3" PI_BIN="$4" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="${5:-$ABSENT}" OMP_BIN="${6:-$ABSENT}" ENTWURF_OMP_AGENT_DIR="$1/.omp/agent" bash "$PKG/run.sh" setup "$2" 2>&1)"
   RC=$?
   set -e
 }
@@ -79,6 +91,8 @@ want "A: no auth.json.bak and credential bytes identical [QK:SETUP-CREDENTIAL-FR
   "[ ! -e '$HOME_A/.pi/agent/auth.json.bak' ] && [ \"\$(sha256sum '$HOME_A/.pi/agent/auth.json' | cut -d' ' -f1)\" = '$AUTH_SHA' ]"
 want "A: an absent copilot is one zero-state SKIP — no unit composed, no .copilot written [QK:SETUP-COPILOT-ABSENT-SKIP]" \
   "printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && [ ! -e '$HOME_A/.copilot' ]"
+want "A: an absent omp is one zero-state SKIP — no unit composed, no .omp written [QK:SETUP-OMP-ABSENT-SKIP]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && [ ! -e '$HOME_A/.omp' ]"
 want "A control: mode named first, pi/claude/agy SKIP, bins PASS, core FAIL, NON-GREEN summary" \
   "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: installed package' && printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'bins: PASS' && printf '%s' \"\$OUT\" | grep -q 'core: FAIL' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
 
@@ -122,5 +136,29 @@ want "D: the failing-vendor birth is a named FAIL, never a cosmetic PASS [QK:SET
 want "D control: detected copilot never reads SKIP, and the summary names copilot-birth NON-GREEN" \
   "! printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN' && printf '%s' \"\$OUT\" | grep -q 'copilot-birth'"
 
+# ── Cell E: omp PRESENT — the four units compose, and the SETTING is a real writer ──
+# The omp unit scripts never spawn the vendor (they probe `omp` on PATH and write into the
+# agent dir), so a stub binary is a faithful presence pin. Two claims live here: the
+# composition reaches omp at all, and the tools.xdev writer refuses an EXPLICIT operator
+# `true` by name rather than overwriting a decision it disagrees with.
+STUB_OMP="$SB/stub-omp"; mkdir -p "$STUB_OMP"
+printf '#!/usr/bin/env bash\necho "omp/18.0.0"\n' > "$STUB_OMP/omp"
+chmod +x "$STUB_OMP/omp"
+run_setup "$SB/home-e" "$SB/proj-e" "$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+# One assertion on purpose: the four PASS rows AND the artifacts behind them. Split in two,
+# the row half alone passes a composition that reports PASS without running the unit.
+want "E: a detected omp composes all four units — own rows, each backed by its ARTIFACT rather than an exit code [QK:SETUP-OMP-INDEPENDENT]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-config: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && ! printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && [ -d '$SB/home-e/.omp/agent/extensions/entwurf-meta-omp' ] && [ -d '$SB/home-e/.omp/agent/extensions/entwurf-receive-omp' ] && [ -f '$SB/home-e/.omp/agent/mcp.json' ]"
+want "E control: the setting reached the config the vendor reads (effective xdev-off)" \
+  "[ \"\$(python3 '$PKG/scripts/omp-tool-surface.py' '$SB/home-e/.omp/agent' | awk '/^verdict /{print \$2}')\" = 'xdev-off' ]"
+# Now the disagreement branch: an operator who wrote xdev: true explicitly owns that value.
+mkdir -p "$SB/home-f/.omp/agent"
+printf 'tools: \n  xdev: true\n' > "$SB/home-f/.omp/agent/config.yml"
+run_setup "$SB/home-f" "$SB/proj-f" "$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+want "F: an EXPLICIT operator tools.xdev:true is refused by name, never overwritten [QK:SETUP-OMP-CONFIG-NO-OVERWRITE]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-config: FAIL' && grep -q 'xdev: true' '$SB/home-f/.omp/agent/config.yml' && ! grep -q 'xdev: false' '$SB/home-f/.omp/agent/config.yml'"
+want "F control: the disagreement is a component FAIL that leaves the other omp units composed" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
+
 echo ""
 echo "check-setup-qualification: $PASS checks passed (mutation-attribution oracle only — behavior evidence lives in smoke-setup-verdict and check-pack-install)"

package/scripts/copilot-bridge-oracle.sh

@@ -77,13 +77,20 @@ PY
 #   QUALIFIED is absent, present exactly once with a parsed nonempty version, or in a
 #   shape nobody may act on. rc 0 prints `absent` or `one <version>`; rc 1 with the
 #   reason on stderr for a MALFORMED exact row (claims our qualified id but does not
-#   parse as `<qualified> (v<nonempty>)`) or MULTIPLE exact rows. Longer tokens that
-#   merely contain the qualified id remain foreign and are ignored, same as above.
+#   parse as `<qualified> (v<nonempty>)`, optionally followed by the vendor's own
+#   `(enabled)`/`(disabled)` state token — measured on Copilot CLI 1.0.81) or MULTIPLE
+#   exact rows. Longer tokens that merely contain the qualified id remain foreign and
+#   are ignored, same as above.
 copilot_exact_row_version() {
 	local list_text="$1" qualified="$2"
 	LIST_TEXT_ENV="$list_text" QUALIFIED_ENV="$qualified" python3 - <<'PY'
-import os, sys
+import os, re, sys
 qualified = os.environ["QUALIFIED_ENV"]
+# The measured row tail. Copilot CLI 1.0.81 appends its own state token after the
+# version (`... (v0.1.0) (enabled)`), so the grammar carries that OPTIONAL trailing
+# `(enabled)`/`(disabled)` explicitly instead of reading it as a garbled version.
+# Anything else in the tail is still malformed.
+ROW_TAIL = re.compile(r"\(v(?P<version>[^()]*)\)(?:[ \t]+\((?:enabled|disabled)\))?\Z")
 versions = []
 for raw in os.environ["LIST_TEXT_ENV"].splitlines():
     row = raw.strip()
@@ -100,10 +107,11 @@ for raw in os.environ["LIST_TEXT_ENV"].splitlines():
     if not parts or parts[0] != qualified:
         continue  # foreign row, including longer ids that merely contain ours
     rest = parts[1] if len(parts) == 2 else ""
-    if not (rest.startswith("(v") and rest.endswith(")")):
-        print(f"malformed exact row for {qualified}: {row!r} does not parse as '<qualified> (v<version>)'", file=sys.stderr)
+    match = ROW_TAIL.fullmatch(rest)
+    if match is None:
+        print(f"malformed exact row for {qualified}: {row!r} does not parse as '<qualified> (v<version>)' with an optional '(enabled)'/'(disabled)' state token", file=sys.stderr)
         sys.exit(1)
-    version = rest[2:-1]
+    version = match.group("version")
     if not version:
         print(f"malformed exact row for {qualified}: empty version in {row!r}", file=sys.stderr)
         sys.exit(1)

package/scripts/fake-copilot-vendor.sh

@@ -4,7 +4,9 @@
 # cannot drift: smoke-setup-verdict's copilot-present cell and check-pack-install's
 # installed copilot-present consumer row. The answer shapes are the MEASURED CLI's
 # (copilot 1.0.80, 2026-08-27) — the same shapes check-copilot-birth-hook.ts bakes
-# into its own TS fake: `plugin list` prints qualified ids with a `(vX)` suffix,
+# into its own TS fake: `plugin list` prints qualified ids with a `(vX)` suffix
+# followed by the vendor's `(enabled)` state token and an indented `from <path>`
+# continuation line (measured on copilot 1.0.81, 2026-08-31),
 # `plugin marketplace list` prints `<name> (Local: <abs path>)`, and `--force`
 # anywhere is refused loudly (the real `marketplace remove --force` uninstalls that
 # marketplace's plugins as a side effect; no entwurf surface may reach for it).
@@ -51,7 +53,7 @@ case "\$1 \$2 \$3" in
   "plugin marketplace remove") awk -F"\t" -v n="\$4" '\$1 != n' "\$MKTS" > "\$MKTS.tmp"; mv "\$MKTS.tmp" "\$MKTS"; exit 0 ;;
 esac
 case "\$1 \$2" in
-  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/\$/ (v\$VER)/" "\$STATE"; exit 0 ;;
+  "plugin list") echo "Live Plugins (loaded from a local marketplace directory, never copied):"; while read -r id; do [ -n "\$id" ] && { echo "  • \$id (v\$VER) (enabled)"; echo "      from $dir"; }; done < "\$STATE"; exit 0 ;;
   "plugin uninstall") grep -Fvx "\$3" "\$STATE" > "\$STATE.tmp"; mv "\$STATE.tmp" "\$STATE"; exit 0 ;;
   "plugin install") echo "\$3" >> "\$STATE"; exit 0 ;;
 esac

package/scripts/mutants/acp-launch-namespace.json

@@ -0,0 +1,34 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-launch-namespace",
+	"mutants": [
+		{
+			"claim": "CLAUDE-LAUNCH-IS-NAMESPACED",
+			"title": "the default launch names the vendor bin directly again — the child re-enters the process-name space a janitor for another harness scans by substring, which is the whole of #72",
+			"subject": "pi-extensions/lib/acp/backend-adapter.ts",
+			"find": ["\tconst launcher = fileURLToPath(new URL(\"./claude-acp-launch.js\", import.meta.url));"],
+			"replace": ["\tconst launcher = require.resolve(\"@agentclientprotocol/claude-agent-acp/dist/index.js\");"],
+			"gate": ["bash", "run.sh", "check-acp-launch-namespace"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:CLAUDE-LAUNCH-IS-NAMESPACED]",
+			"signatureSource": "scripts/check-acp-launch-namespace.ts"
+		},
+		{
+			"claim": "CLAUDE-LAUNCH-IS-TRANSPARENT",
+			"title": "the launcher consumes an argv slot of its own — the vendor's argv.slice(1) self-reinvocation and its own flags stop working behind a name split that still looks correct",
+			"subject": "pi-extensions/lib/acp/claude-acp-launch.js",
+			"find": ["\tawait import(pathToFileURL(join(dirname(pkgJsonPath), binPath)).href);"],
+			"replace": [
+				"\tif (process.argv.includes(\"--version\")) {",
+				"\t\tconsole.log(\"entwurf launcher\");",
+				"\t\tprocess.exit(0);",
+				"\t}",
+				"\tawait import(pathToFileURL(join(dirname(pkgJsonPath), binPath)).href);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-launch-namespace"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:CLAUDE-LAUNCH-IS-TRANSPARENT]",
+			"signatureSource": "scripts/check-acp-launch-namespace.ts"
+		}
+	]
+}