@junghanacs/entwurf 0.19.0 → 0.20.0

package/AGENTS.md

@@ -28,7 +28,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 - **entwurf-core (v2)** owns garden-id addressing, peer facts, liveness interfaces, dispatch decisions, rail choice, and delivery evidence.
 - **Record authority** owns citizen identity. Every addressable citizen uses the same V3 `MetaIdentity` schema. `backend` selects capability/rail behavior; it does not create an identity hierarchy.
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
-- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code and Copilot CLI are mailbox/self-fetch (a Claude hook arms the watch; a forked Copilot extension holds it); Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
+- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code and Copilot CLI are mailbox/self-fetch (a Claude hook arms the watch; a forked Copilot extension holds it); Antigravity is probe-backed native-push. Codex's decline was reversed by GLG on 2026-09-08: lane #95 is open at step 1 (`scripts/raw-codex-measure/`), mints no record, and must not become an ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
 - **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append in the caller's own session, close on its whole SERVER), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), the cwd-aware resume placement composition (`mux-resume-call.ts`), and the import-free leaves they inject (`classify-tmux-cwd.ts`, `resolve-tmux-session.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`, Copilot `--model <name>` beside `--interactive <prompt>` and the explicit `--yolo` policy — a GLG width decision, 2026-08-25, after a callback-only `--allow-tool` grant stopped the sibling at every task tool); the Copilot backend opens through entwurf's OWN managed invocation (`entwurf copilot`), never the bare vendor, and its four required capabilities — birth, MCP hand, receiver, visible footer — are decided by `copilot-fresh-preflight.ts` BEFORE the tmux mutation, so a missing unit is a named refusal instead of a dead window; it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. It also takes ONE optional project seat, `placement.tmuxSession` (#105 — the exact name of an EXISTING session on the caller's OWN server, turned into a `$id` by `resolve-tmux-session.ts` before anything reaches `-t`). **It creates nothing** — `tmux-session-missing`/`tmux-session-name-invalid` are named refusals, no `ifMissing`/`new-session` axis exists (GLG, 2026-09-07), seat and cwd never infer each other, and close binds to the SERVER half since a placed window may sit outside the caller's session. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
 - **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.

package/BASELINE.md

@@ -18,17 +18,28 @@ This table is the operator-facing support/certification view. It complements the
 model interview below; a persuasive answer from the model cannot turn an unmeasured
 host into a certified one. Verdicts are one of **certified** (a real host ran the
 installed doctor green), **shape-only** (gates model the package, no live host),
-or **unverified**.
+or **unverified**. Since 0.20.0 the table also carries two qualifiers:
+**CERTIFIED (CI)** marks a shape-only surface observed green on a CI runner — a
+runner is not a physical host, so bare **certified** still means a physical-host
+doctor green; and **NOT CERTIFIED — pending physical host** marks a rail whose
+missing evidence only a physical host can supply. That is an evidence boundary,
+not **UNSUPPORTED** — the deliberate never, which today is native Windows only.
 
 | Surface | Verdict | Evidence |
 |---|---|---|
 | Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
+| Node 24 macOS package consumer (GitHub Actions runner, not a physical Mac) | shape-only · CERTIFIED (CI) | Required `macos-install-surface` CI run 34303884286 @ `70eda03` (`macos-latest`, 65 s, 10/10 steps): pack → clean consumer install → bin links → `entwurf --help` → `check-bridge` (7 tools) → harness-absent `setup` (all SKIP, computed green, zero no-write-axis writes, `auth.json` byte-identical). Certifies no harness rail. |
 | Claude Code >=2.1.217 exec form | **certified** — supported floor | Topology + floor gates, doctor oracle; B2 live NixOS session |
 | Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
-| macOS Claude meta-bridge | unverified | Installer refuses Darwin; no `/proc` live join |
-| WSL2 / Windows | unverified | None |
+| macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental is postponed past this 0.20.0 cut. |
+| Darwin install fence (meta/copilot/omp-bridge + omp-receive) | portable (Linux or Darwin) | Four installers accept Darwin; python3/node/harness presence holds the seat, not the platform name. A Darwin install is not a rail receipt. |
+| Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
+| setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
+| macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
+| WSL2 | unverified | Counts as Linux evidence, never a Windows surface (AGENTS Hard Rule 17) |
+| native Windows | UNSUPPORTED | Locked pending GLG; a scope decision, not an evidence gap |
 
 Notes the table cannot carry without becoming prose again:
 
@@ -36,13 +47,20 @@ Notes the table cannot carry without becoming prose again:
   candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen
   package root, the path+sha256 regular-file fence, and a strict doctor fixture. Its
   planted Claude cache/owner/bridge are synthetic — no real Claude lifecycle runs there.
+- **A CI runner is not a physical host.** The macOS consumer row is `macos-latest`
+  — an image, not the NixOS/Ubuntu "host" of the certified rows. Its green covers
+  the Entwurf-only install surface (pack, install, bins, `--help`, `check-bridge`,
+  harness-absent `setup`); it cannot log into a harness, so no rail, marker join,
+  ACP turn, or mux lifecycle is certified by it.
 - **Both certified hosts are certified for the published repair artifact only**, including
   physical `entwurf_v2` delivery and the live owner join. Stable cuts earn their own host
   proof; hand-patched hooks and `plugin validate` output are never acceptance.
 - **The maintainer host first went doctor-RED** on a managed dev-bin shadowing the registry
   bridge, and now runs dev wiring again.
-- **macOS is not permanently excluded.** Future native validation may reopen it, and the
-  package-level `os` field stays unrestricted.
+- **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
+  CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
+  physical host (rental postponed past this cut). The package-level `os` field stays
+  unrestricted, and native Windows is UNSUPPORTED.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released
 artifact, restart every old Claude process, open a new session, and run the doctor

package/CHANGELOG.md

@@ -4,6 +4,242 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.20.0 - 2026-09-09
+
+This range carries three lanes that are not one cause: the macOS
+install-surface axis (#78), `claude-fable-5-1` on the curated ACP surface,
+and the Cortex `realHome` path-flavor fix (PR #77). GLG (2026-09-09)
+deferred the physical-Mac loan: this cut is honest about a **CERTIFIED (CI)**
+install surface and does not pretend the harness rails are certified.
+
+**macOS in this release.** This release adds macOS support for Entwurf's
+install surface: the npm package installs, `entwurf --help` and `entwurf
+check-bridge` boot, and `entwurf setup` composes the integrations it finds.
+The four installers that previously rejected Darwin by platform name no longer
+do. We validated that surface only in macOS CI because the developers did not
+have a physical Mac. So macOS native-harness rails—marker join, an ACP turn,
+and mux included—are not yet certified; setup writes their wiring but reports
+them non-green. Linux's certified rail status is unchanged.
+
+### Upgrade note — this one asks something of the operator
+
+**On Darwin, `entwurf setup` no longer prints `result: green` when a harness
+is already present.** Opening the four Darwin install fences (below) had a
+side-effect the command an operator actually types did not stay honest for:
+the installer that used to refuse on a platform name now writes the wiring,
+and setup graded that `PASS` / `result: green` — while every harness doctor
+still refuses on Darwin, and setup runs no doctor. That is cosmetic success
+against Hard Rule 17 ("a detected-but-incomplete integration is named
+non-green rather than cosmetic success").
+
+All 13 harness units now ask one predicate
+(`harness_rail_certified_platform`). On an uncertified platform they emit a
+named non-green (FAIL) whose wording is lexically disjoint from an install
+failure — `entwurf setup` says so by name:
+
+`<unit> FAIL — the wiring WAS written and nothing failed to install, but this
+harness rail is NOT CERTIFIED — pending physical host on <uname>. setup runs
+no doctor; the rail axis is owned by '<doctor>'. Tracking: #78.`
+
+`bins` and `core` are not rail axes and still PASS. A Darwin host with no
+harness still five-SKIPs and `result: green` — that is the path
+`macos-install-surface` asserts, and it did not move. Linux is unchanged: a
+completed rail install is still PASS.
+`[QK:SETUP-DARWIN-RAIL-COSMETIC-PASS]` plants the restoration of "a completed
+install always PASSes" and was KILLED at that signature.
+
+The four installers that used to refuse Darwin (`entwurf install-meta-bridge`,
+`install-copilot-bridge`, `install-omp-bridge`, `install-omp-receive`) now
+run; their own refusal is the toolchain check (python3 / node / harness
+presence), never the platform name. A green Darwin install certifies the
+install surface only, never a harness rail.
+
+Hosts with no detected harness, and every Linux host, see no new prompt.
+
+### Added
+
+- **`claude-fable-5-1` joins the curated ACP model surface.** The `entwurf` provider now registers
+  three unprefixed Claude ids (`claude-opus-5`, `claude-sonnet-5`, `claude-fable-5-1`) beside the
+  four `cortex-` rows. Routing needed no change: `backend-adapter.ts` derives `SUPPORTED_CLAUDE_IDS`
+  from the same constant, and `curatedClaudeModels()` filters the pi-ai registry — which carries
+  `claude-fable-5-1` (measured: `getModels("anthropic")` lists it beside `claude-fable-5`). The
+  curation comment's "verify across both axes" commitment is met by a live citizen: GLG opened B on
+  `entwurf/claude-fable-5-1` (garden `20260908T181437-30802a`, `backend=pi`, `liveness=alive`) and a
+  fire-and-forget send to it went out on the control-socket rail.
+- **Two exact-set pins moved with the surface, and one of them was the real gap.**
+  `check-acp-provider-surface` counts the curated constants (6 → 7) and
+  `check-pack-install` enumerates the installed provider's own model list — that second one is a
+  package gate in `check:full`/`prepublishOnly` and would have gone red on the next release with a
+  drift message rather than a missing-support message. `check-acp-cortex` asks presence
+  (`includes`), not an exact set, so it needed nothing.
+- **`[QK:CLAUDE-CURATED-THREE-ROWS]` — the claude curated list gets its own oracle.** The cortex list
+  has had `CORTEX-CURATED-FOUR-ROWS` since 0.13.0; the claude list had none, and it could not borrow
+  the exact-set comparison beside it: `expectedIds` derives from the same constant, so a dropped
+  claude row moves expected and captured together and that assertion stays green. The independent
+  count is what catches it, so the count now carries the claim and a committed mutant plants the
+  real defect (dropping `claude-fable-5-1` from `SUPPORTED_ANTHROPIC_MODEL_IDS`). Lane inventory
+  `acp-cortex` 12 → 13; total 386 → 387.
+
+- **macOS gets its own evidence axis — an install surface, not a support claim.**
+  The `macos-install-surface` CI job (GitHub Actions `macos-latest`) was promoted
+  from non-voting to required after its first green at commit `70eda03`
+  (run 34303884286, 65 s, 10/10 steps): npm pack → checkout-invisible clean
+  consumer install → bin links → `entwurf --help` → `check-bridge` (direct MCP
+  smoke, 246 ms, the seven tools + `test.sh`) → harness-absent `setup` (pi/Claude/agy/Copilot/
+  OMP all SKIP, bins/core PASS, computed verdict green, zero writes on the five
+  no-write axes and `auth.json` byte-identical). Platform vocabulary across
+  README/BASELINE now separates three states: the Entwurf-only install surface on
+  macOS is **CERTIFIED (CI)** — a CI runner, never a physical host; the harness
+  rails (Claude/Copilot/OMP/agy wiring, marker join, a real ACP turn, mux) are
+  **NOT CERTIFIED — pending physical host**; native Windows is **UNSUPPORTED**.
+- **`scripts/raw-macos-measure/` — the borrowed-Mac measurement ledger.** `probe.sh`
+  (`/bin/sh`, cells M1–M9) measures one host and writes nothing: no install, no
+  record, no state. The README maps each cell to the surface it measures and keeps a
+  `[host-linux]` control run so the probe itself is never the thing under test. Opened
+  by the promotion above; it is where a borrowed Mac produces the physical-host
+  evidence the CI runner cannot.
+- **`scripts/raw-codex-measure/` — Codex 0.153.4 vendor measurement (#95 step 1).**
+  Nothing is installed: no birth hook, no record, no marker, no doctor, and
+  `entwurf_fresh_call` still cannot open a codex sibling. GLG reversed the
+  2026-08-01 decline on 2026-09-08; live claims that still said otherwise
+  were repaired. The ledger closes step 1: SessionStart fires on the first
+  turn, not at window open; a fourth callback spelling
+  (`mcp__entwurf_bridge__entwurf_v2`); the delivery-capable app-server join
+  cannot use parent-pid as a citizen key; hook-trust is an ownership cost
+  (`/etc/codex`, root-owned), not a capability gap; clause 4 is
+  `thread/name/set` plus a status_line config. Step 2 is not opened.
+  `PIN_CODEX_MINOR` 0.144 → 0.153 is a re-verification of the archived drift
+  probe, not a product pin.
+
+### Changed
+
+- **`[QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]` → `[QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]`.** The claim's
+  substance is "the compiled entry registers the EXACT union of every adapter's curated rows", which
+  is count-independent; the old id carried a row count that this change made false and that any
+  future curation change would falsify again. Gate assertion, mutant manifest (`claim` +
+  `signature`), the `acp-provider.ts` comment and the `run.sh` usage line moved together. The
+  mutant's `find`/`replace` are untouched — it still plants the same defect (filtering the cortex
+  rows out of the real entry).
+- **Four install fences now accept `Linux | Darwin`** — `meta-bridge-install.sh`,
+  `copilot-bridge-install.sh`, `omp-bridge-install.sh`, `omp-receive-install.sh`
+  (the `meta-bridge-uninstall.sh` precedent). The installers' own refusal is the
+  toolchain check (python3/node/harness presence), never the platform name. A green
+  Darwin install certifies the install surface only, never a harness rail —
+  installation portability and rail certification are separate axes (Hard Rule 17).
+- **Doctor python `start_key`/`parent` now mint the same two-tier key the TS core
+  mints** (`/proc` stat field 22 → `linux:<ticks>`, else `ps -o lstart=` /
+  `ps -o ppid=`, the same argv vectors `meta-session.ts` uses). Darwin's remaining
+  doctor reason is per-process environment DISCOVERY, not start-key.
+  The `ps:` format is unchanged: 1-second resolution against `linux:` at
+  10 ms, but a same-second pid reuse needs a full PID_MAX wrap inside one
+  second (≈99,900 spawn/s vs a measured pathological ceiling of 14,873/s).
+  Coarsening can mint a false `live` and never a false `dead`. The migration
+  axis is empty — 1,248 marker files, all `linux:`, zero `ps:`. Widening the
+  key with argv was measured insufficient (two same-argv children share it,
+  and same-argv restart is the normal harness shape).
+- **Operator-surface portability substitutions (audit P1).** `grep -P` negative
+  lookaheads moved to awk (6 sites); `sha256sum` moved to the in-repo python3
+  hashlib helper (3 sites) — not a second `shasum` convention. `readlink -f` on the
+  operator path (`agy-imprint.sh`, `copilot-launch.sh`) replaced with the POSIX
+  symlink walk `mcp/entwurf-bridge/start.sh` already ships, and `agy-bridge.sh`
+  advice no longer prints a GNU-only command.
+
+### Fixed
+
+- **The Cortex overlay's `realHome` guard now states path-flavor absoluteness, not the host it runs
+  on.** `ensureCortexDualHomeOverlay` refused a non-absolute `realHome` with `startsWith("/")`, so a
+  drive/UNC path (`C:\Users\x`, `\\server\share`) read as relative. The guard is now
+  `isAbsolute(realHome) || win32.isAbsolute(realHome)`; the error text and the D10 contract sentence
+  are unchanged. First evidence: PR #77 (@yizixu) found the defect. The flavor-explicit form is what
+  makes it killable on a Linux host — `check-acp-cortex` gained two positive cells (drive and UNC,
+  `realSnowflakeHome` pinned under tmp so only the guard is exercised) plus an empty-string negative
+  cell, and mutant `CORTEX-REALHOME-PLATFORM-NEUTRAL` replants `startsWith("/")` and dies at
+  `[QK:CORTEX-REALHOME-PLATFORM-NEUTRAL]`. This claims no native-Windows support; the certified
+  platform axis is unchanged.
+- **Doctors no longer call an unmeasured host clean.** When `/proc` is absent, the
+  Copilot launch-flag and OMP identity-carrier doctors used to fail OPEN — a `note`
+  and a green verdict. They now emit `UNVERIFIABLE` through the existing `bad` path:
+  no new severity, emitter, or exit code. The same contract is pinned one step
+  further — absent and unknowable are no longer collapsed: a failed enumeration
+  (`pgrep` rc 2) or an unreadable `cmdline` is UNKNOWN and stays non-green, while a
+  genuine no-match or a vanished process remains the benign note it always was.
+  That distinction is bidirectional and holds on Linux too, where `/proc`'s presence
+  had merely hidden the defect.
+- **Recovered-host selectors moved from GNU BRE alternation to ERE**
+  (`omp-bridge-doctor.sh`, `copilot-bridge-doctor.sh`), so BSD grep cannot report a
+  recovered host as unrecovered (a false RED that only Darwin's grep would mint).
+- **A red or interrupted gate no longer leaves its children and temp roots
+  behind.** Teardown written as the last line ran only on the green path;
+  gates throw to go red, and `^C`/SIGTERM runs no statement. Measured on
+  oracle: 360 reparented Node receivers from the copilot-receive stub and
+  ~9,200 stale temp roots (3.8 G), one of them minted by a `pnpm check` that
+  had just reported clean. Teardown now belongs to `process.on("exit")` plus
+  the three signals (`scripts/lib/reclaim-on-exit.ts`); the SDK stub gains
+  the parent-death watchdog production already has.
+  `[QK:COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT]` carries the watchdog.
+  The release skill gains P9 (prefix-blind census; delete only prefixes this
+  checkout's `mkdtempSync` calls mint), run at the release-gate verdict, at
+  the end of prepare, and after the publish smoke.
+
+### Verification
+
+Lane receipts (oracle, 2026-09-09) plus prepare P4/P5 on this host. There is
+**no** physical-Mac receipt.
+
+- **`pnpm run check:full`** exit 0, 461 s (`9cc5b09`) / 469 s (`e09b84e`) /
+  465 s (prepare P4, this worktree).
+- **Prepare P5** `LIVE=1 ./run.sh release-gate --cut`:
+  scratch `/tmp/entwurf-release-gate-0.20.0.rerun`, **MUST PASS=23 FAIL=0
+  SKIP=0**, BEHAVIOR PASS=1, `cut: OK`. Qualification **391/391 KILLED**
+  inside that gate. The first attempt was `cut: BLOCKED` (MUST FAIL=2):
+  host `STALE writer` on the deployed omp-receive unit, and the omp-fresh
+  nonce callback captured by the preparing session's `PI_SESSION_ID`.
+  Rerun after `install-meta-bridge` / `install-omp-bridge` /
+  `install-omp-receive` and `env -u PI_SESSION_ID -u PI_AGENT_ID -u
+  CLAUDE_CONFIG_DIR`.
+- **`check-gate-qualification` 390/390 → 391/391 KILLED** (`9cc5b09` then
+  `e09b84e`). New claims this range: `CLAUDE-CURATED-THREE-ROWS`,
+  `CORTEX-REALHOME-PLATFORM-NEUTRAL`,
+  `COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT`,
+  `OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE`,
+  `COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE`,
+  `SETUP-DARWIN-RAIL-COSMETIC-PASS`.
+- **`check-pack-install`** exit 0. **`check-install-container`** exit 0.
+- The macos-install-surface cell replayed against the packed candidate on
+  Linux: all 12 pins HOLD (`9cc5b09`).
+- Doctors (4 files) HEAD-vs-worktree output IDENTICAL (`9cc5b09`).
+- CI run
+  [`34303884286`](https://github.com/junghan0611/entwurf/actions/runs/34303884286)
+  @ `70eda03` — `macos-install-surface` required, `macos-latest`, 65 s,
+  steps 10/10.
+- CI run
+  [`34316688064`](https://github.com/junghan0611/entwurf/actions/runs/34316688064)
+  @ `9cc5b09` — 4 jobs + qualification step `success`.
+- Land exact-SHA CI run
+  [`34329931791`](https://github.com/junghan0611/entwurf/actions/runs/34329931791)
+  @ `a5a6dfe`, `event=workflow_dispatch` — 4 jobs + qualification body
+  `success` (the push run at this SHA skipped the body; L3 dispatch recovered it).
+
+### Notes
+
+- **What this cut claims about macOS, and what it does not.** Claimed: the
+  Entwurf-only install surface is **CERTIFIED (CI)**; the shipped operator
+  path is portable (no `readlink -f`, no `grep -P`, no `sha256sum`, no GNU BRE
+  alternation on recovered-host selectors); doctors fail closed on an
+  uncertified discovery axis (`UNVERIFIABLE`, not a green note). Not claimed:
+  harness rails, marker join, a real ACP turn, mux, or a physical-host doctor
+  green — all **NOT CERTIFIED — pending physical host**. native Windows is
+  **UNSUPPORTED**. A CI `macos-latest` runner has no logged-in harness; it
+  cannot mint the stronger `certified`. macOS is never UNSUPPORTED.
+- **Two cells are unmeasured, by name.** Whether Darwin can read another
+  process's environ (`ps -Eww`), and whether macOS `python3` is the
+  CommandLineTools stub. Both are cells the borrowed-Mac probe
+  (`scripts/raw-macos-measure/probe.sh`, M6 and M3) is built to answer. Do
+  not fill them from a CI image spec.
+- **Codex is not a garden backend in this cut.** Step 1 of #95 closed as
+  measurement; step 2 is not opened. `entwurf_fresh_call` still cannot open a
+  codex sibling.
+
 ## 0.19.0 - 2026-09-07
 
 One lane: #105 slice ①, the project seat. `entwurf_fresh_call` gains an optional

package/DELIVERY.md

@@ -80,13 +80,16 @@ axis; neither word is an admission grade or a synonym of *supported*. A pre-cont
 can be owned without being supported; a supported harness still has to walk
 [`docs/adding-a-harness.md`](./docs/adding-a-harness.md) step 9.
 
+Every row in this table is Linux evidence. macOS rails are NOT CERTIFIED — pending
+physical host. Do not read a D-level cell as a Darwin receipt.
+
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
-| **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No owned native-citizen install/invocation lane. |
-| **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
+| **Codex app-server-backed TUI** | verified probe, re-verified at 0.153.4 | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. Re-run as shipped on 2026-09-08 at codex-cli **0.153.4** (garden lane #95): idle plain `codex` auto-attached to a bare `codex app-server --listen`, woke with zero typing, and the model replied in the same visible session — `{"ok": true, "threadId": "01a08145-ce6d-77d0-b7a4-cfb57c608282", "turnId": "01a08146-7c06-7b83-9e65-32e3814ee490", "status_seen": ["active","active","idle"]}`. No owned native-citizen install/invocation lane. Step 1 measurement only — the lane is open (#95) but nothing is installed, so this row stays the declared pre-#82 exception `check-harness-admission-parity` reads. |
+| **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. Re-checked in source at 0.153.4: the hook vocabulary grew to 12 events but still has no `watchPaths`/`FileChanged`/`asyncRewake` analogue, so the negative stands. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
 | **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
@@ -131,10 +134,60 @@ in [BASELINE.md](./BASELINE.md); deterministic ownership and sender gates run in
 
 Do not describe “Codex” as one delivery shape. The measured app-server-backed TUI can
 accept `turn/start` for a live thread and report completion; the standalone embedded
-TUI exposed no equivalent receive route. This remains archived method evidence, not a
-shipping commitment: GLG declined to own a native Codex invocation/install lane on 2026-08-01 because pi
-already supplies the official GPT provider path. Entwurf will not duplicate it as a
-native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wake.
+TUI exposed no equivalent receive route. `turn/steer` is active-turn steering, not idle wake.
+
+**The 2026-08-01 decline is reversed.** GLG re-opened the Codex native lane on 2026-09-08
+(“코덱스 레일 들어가자”) as one of the two 사용자층 확보 axes; the lane is
+`#95` and the pi-already-supplies-GPT argument no longer settles it. Nothing here is a
+support claim: no codex record has ever been minted, there is no birth hook, no sender or
+receiver marker, and `entwurf_fresh_call` cannot open a codex sibling.
+
+**But step 2 is already spent, and it is spent WRONG.** `codex` is in `META_BACKENDS`
+(`meta-session.ts:84`) and `META_CITIZEN_BACKENDS` (`:308`), and `pi/entwurf-capabilities.json`
+grades it `wakeMode: "direct-inject"`, `deliveryLevel: "D6"`, `nativeIdLabel: "threadId"`.
+That D6 is a **registry promise with no channel behind it** — precisely the shape
+`docs/adding-a-harness.md` step 8(c) names — and it predates this lane. Correcting the grade
+is step 8 work; it is recorded here so the next reader does not inherit a D6 as evidence.
+
+**Current coordinates are 0.153.4** (source `~/repos/3rd/codex` at `rust-v0.153.4`), measured
+2026-09-08 in `scripts/raw-codex-measure/` — step 1 of `docs/adding-a-harness.md` only. The
+0.136.0 rows above are preserved history. What the re-measurement changed:
+
+- **Delivery survives 17 minor lines unchanged.** The shipped raw probe ran as-is (receipt in
+  the matrix row above). One method note: at 0.153.4 the rollout JSONL is materialized lazily,
+  so `thread/loaded/list` — not newest-rollout scraping — is the reliable `threadId` source.
+- **Birth timing is first-turn, not window-open**, and the gap is ~47s wide on a live TUI.
+- **A subagent raises `SubagentStart`, never `SessionStart`**, so §3.5's top-level predicate is
+  vendor-authoritative and costs nothing.
+- **The callback dialect is `mcp__entwurf_bridge__entwurf_v2`** — a fourth spelling; the
+  sanitizer maps `-` to `_` but keeps the digit that omp's charset eats.
+- **The step-6 join holds in both launch modes, but its owner moves — and in the
+  delivery-capable mode it cannot separate citizens.** Embedded:
+  `hook.ppid == mcp.ppid == the TUI`. App-server-attached: both resolve to the app-server, and
+  that is now measured rather than inferred — two live threads on one app-server, two separate
+  visible windows, **one `ppid` for every hook and every MCP child of both**, neither TUI in
+  the chain. A parent-pid sender marker would be one marker for N citizens, which Hard Rule 7's
+  `nativeSessionId` uniqueness forbids. **A different key was then found, and it is not a
+  marker at all:** every `tools/call` carries `_meta.threadId` plus an
+  `x-codex-turn-metadata.{session_id,thread_id,turn_id}` block, so the caller names itself on
+  each call — and that id is byte-identical to the hook's `session_id`, so birth, delivery and
+  tool calls share ONE identifier and `record.nativeSessionId = threadId` needs no mapping.
+  Both halves are vendor-traced, not just captured: `core/src/mcp_tool_call.rs:1328-1349`
+  inserts `threadId` unconditionally (constant at `:1184`) from the call site at `:506-516`,
+  and `:1238-1263` carries the turn-metadata block.
+  (The registry's pre-existing `nativeIdLabel: "threadId"` is right on that axis; its `D6` on
+  the same row still is not.) Consuming `_meta` is new bridge code and is step 6, unstarted.
+- **Both admission questions this lane opened have since been CLOSED by measurement**, and
+  neither cost a design decision. The **hook trust prompt** has a real non-interactive path: a
+  hook in the managed `/etc/codex/config.toml` layer runs with no prompt, in both launch modes,
+  with `turn/start` wake intact — while `--dangerously-bypass-hook-trust` runs the hook but
+  kills auto-attach and is therefore unusable here. The remaining constraint is ownership:
+  `/etc/codex/` is root-owned, so that is a root-level operator step, not something `setup`
+  writes (Hard Rule 17). **Clause 4** has a working carrier: `thread/name/set` plus
+  `[tui] status_line = ["thread-title", …]` renders a garden id and survives turns in both
+  orderings, because the vendor's auto-titler is guarded on the thread being unnamed
+  (`tui/src/app/thread_routing.rs:1841`). It is reachable only over the app-server, and the
+  config key needs a writer that owns exactly it.
 
 ### Copilot CLI: one citizen, two rails, one pending receipt
 

package/README.md

@@ -79,6 +79,33 @@ A few words that look unusual for a coding tool.
 
 ## Install
 
+**Platform evidence, in one breath.** The Entwurf-only install surface on
+macOS is CERTIFIED (CI) (`macos-install-surface`). On macOS every
+garden-native harness rail (pi, Claude, Copilot, OMP, agy), marker join,
+ACP turn, and mux is NOT CERTIFIED — pending physical host; on Linux those
+same rails are the certified axis. native Windows is UNSUPPORTED.
+CERTIFIED (CI) is weaker than a physical-host doctor green.
+The npm package has no `os` restriction; that is installability, not a
+support claim.
+
+**macOS in this release.** This release adds macOS support for Entwurf's
+install surface: the npm package installs, `entwurf --help` and `entwurf
+check-bridge` boot, and `entwurf setup` composes the integrations it finds.
+The four installers that previously rejected Darwin by platform name no longer
+do. We validated that surface only in macOS CI because the developers did not
+have a physical Mac. So macOS native-harness rails—marker join, an ACP turn,
+and mux included—are not yet certified; setup writes their wiring but reports
+them non-green. Linux's certified rail status is unchanged.
+
+On Darwin, `entwurf setup` that detects a harness is intentionally
+non-green: the wiring WAS written and nothing failed to install, but the
+harness rail is NOT CERTIFIED — pending physical host. That FAIL is not
+an install defect. An Entwurf-only host (no harness on PATH) stays green.
+
+A physical Mac can send host facts without installing or logging in:
+`scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s). Measurement,
+not certification.
+
 `entwurf` is a neutral npm package first. Get the package, then run **`entwurf setup
 <project>`** — one command, the same front door from an npm global install, an npm
 project-local install, or a source checkout. It composes every harness it finds on the
@@ -187,6 +214,9 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 
 ### Pi adapter / ACP plugin lane
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host (control sockets, mux, ACP plugin hosting).
+
 To use the `entwurf` provider inside pi, install a compatible pi binary
 separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
 the npm-installed package or development clone:
@@ -217,10 +247,10 @@ for every harness it detects — you do not paste this list to install. This is
 surface: each unit has its own installer, its own doctor with a named refusal, and its own
 inverse, so a single broken unit can be redone without touching the rest.
 
-- **Claude Code** (Linux-certified axis) — `install-meta-bridge`, `doctor-meta-bridge`.
-- **Antigravity / agy** — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
-- **GitHub Copilot CLI** — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
-- **OMP (`omp`)** — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
+- **Claude Code** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-meta-bridge`, `doctor-meta-bridge`.
+- **Antigravity / agy** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
+- **GitHub Copilot CLI** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
+- **OMP (`omp`)** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
@@ -275,10 +305,10 @@ Copilot units included — and restart its existing processes; reach for a singl
 only when a **new** session using the
 installed artifact makes `doctor-meta-bridge` exit 0 with the live owner join.
 
-Linux is the only currently certified Claude meta-bridge axis. New macOS wiring is
-refused because the strict live-owner doctor depends on `/proc`; Darwin uninstall
-remains available for legacy cleanup, and the neutral package itself has no `os`
-restriction. Detailed diagnosis and clean-host steps live in
+The Claude meta-bridge rail is CERTIFIED on Linux. On macOS it is
+NOT CERTIFIED — pending physical host. The Darwin install fence is
+open; uninstall was already open. Detailed diagnosis and clean-host
+steps live in
 [docs/setup-clean-host.md](./docs/setup-clean-host.md).
 
 The active citizen store is V3-only. A store that fails certification is never
@@ -303,7 +333,8 @@ host evidence boundaries are [VERIFY.md](./VERIFY.md) and [BASELINE.md](./BASELI
 2. **`require.resolve(...)` against the bundled package dependency** (`@agentclientprotocol/claude-agent-acp`). This is the default path; no extra global install needed.
 3. **`PATH:claude-agent-acp` fallback** — used when the package resolution fails (e.g. a hand-edited `node_modules`).
 
-The curated model registry exposes unprefixed Claude ids plus `cortex-` rows.
+The curated model registry exposes unprefixed Claude ids — `claude-opus-5`, `claude-sonnet-5`,
+`claude-fable-5-1` — plus the `cortex-` rows below.
 Codex is not an ACP backend or a shipped managed citizen lane: it has verified
 native-delivery probe evidence only. No managed Codex support is claimed; lifecycle,
 identity, installation, and doctors remain prerequisites for any such lane.

package/VERIFY.md

@@ -77,6 +77,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
+| macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven current `entwurf-bridge` MCP tools), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
@@ -155,6 +156,13 @@ Expected tail on a fully green host: `DONE: entwurf setup — result: green (com
 
 The wiring / meta-bridge / smoke steps are internal building blocks of `setup` (`install_local_package`, `scripts/meta-bridge-install.sh`, `validate_entwurf_bridge`) — call `setup`, never the parts. Consumers who `npm install @junghanacs/entwurf` get the obvious npm surface; that path is not the developer concern here.
 
+Installation portability and rail certification are separate axes (Hard Rule 17).
+A harness-absent `setup` on the macOS CI runner reaching `result: green` is
+CERTIFIED (CI) for the Entwurf-only install surface only. On a platform that is
+not certified, a detected harness is named non-green (FAIL) whose wording is
+not an install failure: the wiring WAS written, but the rail is NOT CERTIFIED —
+pending physical host. That FAIL is the honest setup verdict, not a skip.
+
 ### 1.1 Variables (optional)
 
 ```bash
@@ -286,7 +294,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 The minimum passing bar:
 
 1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus a `./run.sh check-gate-qualification` green on the same candidate.
-2. **All three CI jobs green on the exact release commit:** `check`, `install-surface`, and the required Linux `artifact-consumer`; preserve the latter's tarball digest and image identity.
+2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.

package/docs/acp-backend-rail.md

@@ -197,7 +197,7 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
 | Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
@@ -256,6 +256,14 @@ Cortex containment was measured against the live CLI rather than copied from Cla
   exact-writes an overlay-private `cortex/mcp.json`. Non-stdio declarations fail before
   spawn. Only the `entwurf-bridge` entry receives the real operator HOME required to
   see the garden store.
+- **`realHome` absoluteness:** the D10 guard judges the captured `realHome` in BOTH
+  path flavors (POSIX and win32), so the refusal rule states the contract rather than
+  the host it happens to run on. This claims no native-Windows support — native
+  Windows is UNSUPPORTED. The certified ACP axis remains Linux
+  desktop/workstation; macOS ACP turns are NOT CERTIFIED — pending physical
+  host. The flavor-explicit form only stops a POSIX host from reading a
+  drive/UNC path as relative, which is what made the defect unkillable on
+  Linux (PR #77).
 - **Carrier:** Cortex has no `_meta.systemPrompt` contract. The engraving is placed at
   the head of the first-user augment; claiming a system-prompt engraving is false.
 

package/docs/external-mcp-host.md

@@ -52,9 +52,12 @@ Prerequisites on the host running the external MCP client:
 > carrier reader trims and tests truthiness, so empty and absent are the same answer by
 > construction. Pinned by `[QK:FRESHCALL-IDENTITY-SCRUB]` in the `check-mux-fresh-call` vitest lane,
 > inside `check:full`. The DETECT half is unchanged and still load-bearing, because a seam covers
-> only the launches that pass through it: `doctor-omp-bridge` reads `/proc/<pid>/environ` for every
-> live `omp` process and goes RED on its own axis when one carries either carrier. An omp the
-> operator started from a pi citizen's bash never touched the seam and is still unsupported, exactly
+> only the launches that pass through it: `doctor-omp-bridge` reads each live `omp`
+> process's environment (on Linux, `/proc/<pid>/environ`) and goes RED on its own
+> axis when one carries either carrier. The remaining uncertified Darwin axis is
+> per-process environment DISCOVERY, not `/proc` absence; macOS rails are
+> NOT CERTIFIED — pending physical host. An omp the operator started
+> from a pi citizen's bash never touched the seam and is still unsupported, exactly
 > as this boundary says.
 
 Example env file: