@junghanacs/entwurf 0.20.0 → 0.21.0

package/run.sh

@@ -119,8 +119,8 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently)/omp (four units: birth→MCP→tools.xdev setting→receiver, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
-  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
+  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex first-admission Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi outside the existing exact `codex` home, explicit operator-owned app-server PID inside it). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
@@ -137,6 +137,13 @@ Usage:
   ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-omp-fresh-preflight   # #87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle
+  ./run.sh check-codex-sender-identity # Codex tools/call _meta triple agreement + addressable record join + cross-carrier conflict refusal
+  ./run.sh check-codex-bridge-identity # real MCP bridge request identity for entwurf_self/v2/fresh; malformed or conflicting _meta fails loud
+  ./run.sh check-codex-native-push    # app-server WebSocket-over-UDS probe + measured one-shot codex queue delivery; no replay
+  ./run.sh check-codex-birth-hook     # sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers
+  ./run.sh check-codex-fresh-preflight # pre-mutation birth/MCP/thread-title/default-app-server readiness
+  ./run.sh smoke-codex-config-state   # sandboxed MCP + status-line ownership/install/doctor/inverse lifecycle
+  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read (never written), config.toml untouched, foreign/edited/symlink refusals, drift-refusing inverse
   ./run.sh check-harness-admission-parity  # #87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -149,12 +156,13 @@ Usage:
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
-  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 control-socket domain (currently pi; claude/codex/agy=unsupported, not folded), 3-cell intent×liveness table (single verdict, 1 allow/2 reject after the visible-first cut), N1 indeterminate-no-spawn, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
+  ./run.sh check-entwurf-v2-contract   # FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO
   ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
   ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
   ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
   ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
   ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
+  ./run.sh check-compaction-send-guard # deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO
   ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
   ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
   ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
@@ -166,12 +174,14 @@ Usage:
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
+  ./run.sh smoke-codex-fresh-live    # #95 first-admission RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback OUTSIDE the Codex home -> Pi PUBLIC omitted-placement Codex fresh/exact callback INSIDE exact existing `codex` -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement fresh Pi/exact callback IN that home -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL. The PID names the operator-owned app-server inside `codex`; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
-  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine out-of-socket-domain/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
+  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — full-store parse/probe/quarantine/resolve stays intact; #112 bounds expensive receiver/transcript observation to the newest 32 rendered rows while older machine rows say unobserved; Q112 pins full payload + exact observer budget; C-원칙 keeps corruption diagnostic and impossible wiring loud; deps injected, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
@@ -201,7 +211,7 @@ Usage:
   ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-omp-bridge-state        # OMP birth-extension install/doctor/inverse regression: placement, stale-writer detection, honest inverse, no-state refusal (structurally VALID as well as foreign), symlink refusal, ambiguous-agent-dir refusal (ledger M6), and a poisoned PI_CODING_AGENT_DIR that attracts no artifact. Fully sandboxed HOME/PI/XDG. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
-  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry). Offline/hermetic (deps: bash+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry), plus the #110 self-checkout cells: the real `run.sh install <checkout>` drive leaves the tracked .pi/settings.json byte-identical, writes NO project-scope packages[] self-registration, and REPORTS the skip; cell 15 boots the pinned devDep pi against two stand-in checkouts and requires the --entwurf-control collision to APPEAR before asserting its absence. Offline/hermetic (deps: bash+python3+pinned pi)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
@@ -240,6 +250,15 @@ Usage:
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
   ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
+  ./run.sh install-codex-birth        # publish $CODEX_HOME/hooks.json + the helper closure; no root, and the operator trusts the declaration once in their own Codex
+  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; refuses drifted bytes instead of deleting them
+  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + the vendor TRUST receipt for this declaration (--unit-only skips the receipt; sandboxes only)
+  ./run.sh install-codex-mcp          # own only [mcp_servers.entwurf-bridge] in the user's Codex config
+  ./run.sh uninstall-codex-mcp        # remove/restore only the recorded MCP atom
+  ./run.sh doctor-codex-mcp           # effective config + ownership + actual bridge boot
+  ./run.sh install-codex-statusline   # add thread-title to tui.status_line for visible garden ids
+  ./run.sh uninstall-codex-statusline # remove only the recorded status-line atom
+  ./run.sh doctor-codex-statusline    # effective visible-identity config + ownership verdict
   ./run.sh install-agy-statusline     # own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings
   ./run.sh uninstall-agy-statusline   # honest inverse from statusline install-state
   ./run.sh doctor-agy-statusline      # fail-loud statusLine config/bin/state doctor + honest live SKIP
@@ -537,7 +556,28 @@ install_local_package() {
   mkdir -p "$project_dir/.pi"
   # packages[] registration via the shared SSOT — same is_entwurf_source
   # predicate + idempotency as user-scope and remove (not a substring match).
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  #
+  # #110: entwurf's OWN checkout is the one project that never gets this entry.
+  # pi's package identity is `local:<resolved path>` and dedupePackages collapses
+  # only EQUAL identities (package-manager.js getPackageIdentity/dedupePackages),
+  # so a project entry naming this checkout and the user-scope entry naming the
+  # installed root are the same package only while they are the same directory.
+  # In a SECOND checkout (worktree, release scratch) they differ, pi keeps both,
+  # and both copies of pi-extensions/entwurf-control.ts declare
+  # `--entwurf-control`: detectExtensionConflicts gives the flag to whoever
+  # registered first — project scope — and fails the INSTALLED extension while
+  # printing the installed path as the loser, which reads exactly backwards.
+  # user-scope already owns self-registration from any cwd, so the project entry
+  # was only ever a duplicate of it; dropping it removes the second identity in
+  # written bytes, the way the tracked `.pi/settings.json` no longer carries one.
+  # A FOREIGN project still gets its entry — that is what `entwurf install
+  # <project>` is for, and an npm consumer's REPO_DIR is inside node_modules, so
+  # it can never take this branch.
+  if [ "$(cd -P -- "$project_dir" 2>/dev/null && pwd)" = "$REPO_DIR" ]; then
+    echo "install: project-scope packages[] skipped — entwurf's own checkout self-registers through user scope (#110)"
+  else
+    python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  fi
   # entwurfProvider.mcpServers.entwurf-bridge (project scope — checkout-local, NO state; #46
   # Task 2) via the shared register-pi-provider SSOT: normalize the command to the bare stable
   # bin `entwurf-bridge` (ownership-classified: absent/managed-current/managed-legacy adopt, a
@@ -560,6 +600,38 @@ install_local_package() {
 _pi_package_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-package/install-state.json"; }
 _pi_provider_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"; }
 
+_codex_home() { echo "${CODEX_HOME:-$HOME/.codex}"; }
+_codex_config() { echo "$(_codex_home)/config.toml"; }
+_codex_mcp_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-mcp/install-state.json"; }
+_codex_statusline_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-statusline/install-state.json"; }
+
+codex_mcp() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_mcp_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-mcp-config.py" install "$config" "entwurf-bridge" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-mcp-config.py" uninstall "$state" ;;
+    doctor)
+      python3 "$REPO_DIR/scripts/codex-mcp-config.py" doctor-static "$config" "entwurf-bridge" "$state"
+      local invocation
+      invocation="$(python3 "$REPO_DIR/scripts/codex-mcp-config.py" doctor-invocation "$config")"
+      run_ts scripts/probe-bridge-command.ts --invocation-json "$invocation"
+      ;;
+  esac
+}
+
+codex_statusline() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_statusline_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-statusline-config.py" install "$config" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-statusline-config.py" uninstall "$state" ;;
+    doctor) python3 "$REPO_DIR/scripts/codex-statusline-config.py" doctor-static "$config" "$state" ;;
+  esac
+}
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
@@ -707,8 +779,11 @@ remove_local_package() {
   # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
   # that install would never have registered. Same rule, one shape further (#53 B):
   # register only ever WRITES the absolute path, so a settings-RELATIVE entry naming
-  # this repo (the committed `".."` in <repo>/.pi/settings.json) is source, not
-  # install state — remove leaves it and says so instead of editing tracked bytes.
+  # this repo is source an operator hand-wrote, not install state — remove leaves it
+  # and says so instead of editing bytes it never authored. entwurf's own checkout
+  # no longer ships such an entry (#110: user scope owns self-registration), so for
+  # THIS repo the call is a reported no-op; the predicate stays because the shape is
+  # still writable by hand and still must not be over-deleted.
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
   # entwurfProvider.mcpServers.entwurf-bridge cleanup (project scope) via the shared SSOT: strip
   # our-managed shapes (the bare stable bin AND the legacy repo start.sh path — a true user
@@ -807,6 +882,18 @@ smoke_omp_fresh_live() {
   run_ts scripts/smoke-omp-fresh-live.ts
 }
 
+smoke_codex_fresh_live() {
+  # #95 first-admission RELEASE MUST. The explicit operator-owned app-server PID is the
+  # seat authority: validate its Codex app-server argv and /proc TMUX/TMUX_PANE, then use
+  # that exact environment for the record-backed receipt fixture and stable-id cleanup.
+  # Through public MCP calls: fixture opens visible Pi; Pi opens visible Codex, correlates
+  # its exact callback and addresses it through native-push v2; Codex opens visible Pi,
+  # correlates that callback, and sends final evidence. The four actor/seat coordinates
+  # travel in receipts and Codex/app-server-MCP/outbound-Pi sessions must be identical.
+  # LIVE!=1 is the only host-prerequisite SKIP after admission; missing facts FAIL.
+  run_ts scripts/smoke-codex-fresh-live.ts
+}
+
 check_omp_fresh_preflight() {
   # #87 Bundle C. The OMP fresh preflight REPRODUCES two resolvers that already exist
   # in this repo in another language — omp_agent_dir (scripts/omp-bridge-oracle.sh) and
@@ -1195,6 +1282,14 @@ check_entwurf_control_rpc() {
   run_ts scripts/check-entwurf-control-rpc.ts
 }
 
+check_compaction_send_guard() {
+  # Deterministic gate for #111: a compacting Pi citizen is neither idle nor an ordinary
+  # streaming turn. Event-armed refuse is `compacting`; quiet unknown non-idle is `busy`
+  # (`ctx.signal` is not isStreaming). Either token: no pi.sendMessage, no delivered:true.
+  # Pure admission predicate + resident wiring/event source guard. No IO.
+  run_ts scripts/check-compaction-send-guard.ts
+}
+
 check_entwurf_resume_args() {
   # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
   # shape with the VISIBLE one, measured against the runtime before the consumer was written:
@@ -1309,14 +1404,17 @@ check_mux_fresh_call() {
   # could not see: real bridge boot → tools/list schema/description, Rust-regex-family pattern
   # validity on every emitted pattern (the #62 escape), and the schema riding the actual
   # anthropic-messages request body. No fake tmux: the real-window axis is smoke-mux-fresh-call-live.
-  # copilot-fresh-preflight rides here rather than in its own gate: it exists only as
-  # freshCall's pre-mutation branch (#82 RAIL 9), and splitting it would let the two halves
-  # of one refusal be certified in different runs.
+  # copilot-fresh-preflight and codex-fresh-preflight ride here rather than in
+  # separate gates: each exists only as freshCall's pre-mutation branch, and
+  # splitting one would let the two halves of a refusal be certified separately.
   # omp-fresh-bootstrap.contract rides here for the same reason and one more: it is the ONLY
   # place the launcher's payload and the installed birth extension's decoder are read together.
   # They ship in different directories and cannot import each other (#87 Bundle C), so this
   # lane is what keeps a deliberate duplication from becoming drift.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts
+  # tmux-coordinate-row rides here because it is the parse every tmux COORDINATE in this lane's
+  # LIVE siblings depends on, and because it is the only half of a measured LIVE failure that a
+  # deterministic gate can own: the row is the input, so no tmux and no model turn is needed.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1677,11 +1775,13 @@ check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
   # pre-quarantine out-of-socket-domain/socket conflicts → resolveFactList(clean) →
-  # {facts, diagnostics}. Throw-vs-diagnostics policy (GPT힣 C-원칙): expected
-  # corruption (parse failure / gardenId↔socket collision) → diagnostics, listing
-  # survives; impossible wiring invariant (resolveFactList duplicate/unprobed) →
-  # throw, never swallowed. A collision quarantines BOTH the PeerFact and the
-  # socket (gid is the universal address). meta + socket deps injected, no IO.
+  # {facts, diagnostics}. #112 keeps the whole-store parse/probe/diagnostic/payload
+  # while running expensive receiver/transcript observation for exactly the newest
+  # 32 human-rendered rows; older payload rows say unobserved. Q112 pins that budget.
+  # Throw-vs-diagnostics policy (GPT힣 C-원칙): expected corruption (parse failure /
+  # gardenId↔socket collision) → diagnostics, listing survives; impossible wiring
+  # invariant (resolveFactList duplicate/unprobed) → throw, never swallowed. A
+  # collision quarantines BOTH the PeerFact and socket. deps injected, no IO.
   run_ts scripts/check-entwurf-fact-provider.ts
 }
 
@@ -1883,7 +1983,7 @@ assert.equal(peerDepTui, expectedPeer,
 // read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
 // because it was outside this list. Its declaration is a plain range, so the
 // range scan below binds it — no new PROSE_DECL is needed for it.
-const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
+const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
   const text = readFileSync(file, 'utf8');
@@ -1908,7 +2008,6 @@ const PROSE_DECLS = [
   ['demo/README.md', /current floor (\d+\.\d+\.\d+)/, 'current floor <version>'],
   ['ROADMAP.md', /\bpi (\d+\.\d+\.\d+) fence\b/, 'pi <version> fence'],
   ['ROADMAP.md', /floor = \*\*(\d+\.\d+\.\d+)\*\*/, 'floor = **<version>**'],
-  ['AGENTS.md', /devDep exact `(\d+\.\d+\.\d+)`/, 'devDep exact `<version>`'],
 ];
 for (const [file, re, shape] of PROSE_DECLS) {
   const m = readFileSync(file, 'utf8').match(re);
@@ -2060,7 +2159,7 @@ check_claude_floor_coherence() {
   # DERIVE it at runtime through scripts/meta-bridge-claude-floor.sh, so they carry no
   # literal to drift — that shared file is itself part of the contract and is asserted
   # below. What remains are the human-facing declarations (the launcher's refusal
-  # message, docs, AGENTS) plus every fake `claude` CLI stub the gates spawn: a stub
+  # message and docs) plus every fake `claude` CLI stub the gates spawn: a stub
   # that reports a version BELOW the floor would make the doctor legitimately refuse
   # its own fixture, so those are bound too — as `>=`, not equality, since a stub may
   # honestly claim a newer version.
@@ -2100,7 +2199,6 @@ const SITES = [
   ['pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh', /Claude Code >= (\d+\.\d+\.\d+)/g, 1, 'launcher refusal message'],
   ['scripts/meta-bridge-claude-floor.sh', /THE FLOOR IS (\d+\.\d+\.\d+)/g, 1, 'floor helper rationale header'],
   ['docs/setup-clean-host.md', /`>=(\d+\.\d+\.\d+)`\*\* — the exec-form hook floor/g, 1, 'clean-host pin matrix'],
-  ['AGENTS.md', /Claude Code `>=(\d+\.\d+\.\d+)`/g, 1, 'AGENTS rule 14'],
   ['README.md', /supported floor `>=(\d+\.\d+\.\d+)`/g, 1, 'README doctor description'],
   ['scripts/check-hook-launch-topology.ts', /\/(\d+)\\\.(\d+)\\\.(\d+)\//g, 1, 'topology gate floor assertion'],
 ];
@@ -3764,10 +3862,10 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # SAME installed candidate, on a FRESH sandbox home with every harness absent.
   # This is the first living consumer of package-installed `entwurf setup`:
   # mode=installed decided by name before anything else, NO pnpm bootstrap inside
-  # node_modules, pi/claude/agy/copilot/omp explicit zero-state SKIPs, stable bins
-  # PASS as npm-provided, core bridge boundary PASS, computed green, zero
-  # harness/auth writes. Harness probes are pinned absent via the FIVE
-  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN seams so the gate host's real
+  # node_modules, every harness explicit zero-state SKIP, stable bins PASS as
+  # npm-provided, core bridge boundary PASS, computed green, zero
+  # harness/auth writes. Harness probes are pinned absent via the SIX
+  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN/CODEX_BIN seams so the gate host's real
   # harnesses never leak in.
   #
   # OMP_BIN was MISSING here from the 0.16.0 OMP admission until 2026-09-06, while
@@ -3779,7 +3877,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # ambiguous. Nothing was wrong with the product; the fixture was. It stayed
   # invisible because CI runners carry no omp AND `release_gate()` does not run
   # this gate (it is prepublishOnly + the CI install-surface job). The skip probe
-  # below now requires FIVE zero-states, so a sixth harness cannot be admitted
+  # below now requires SIX zero-states, so a seventh harness cannot be admitted
   # while this seam is quietly left behind again.
   local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
   mkdir -p "$setup_home/.pi/agent" "$setup_proj"
@@ -3791,7 +3889,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
     XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" CODEX_BIN="$npm_tmp/definitely-absent" \
     "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
   setup_rc=$?
   set -e
@@ -3811,9 +3909,9 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     return 1
   fi
   local skip_probe
-  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP"; do
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP" "codex: SKIP"; do
     if ! grep -q "$skip_probe" <<<"$setup_out"; then
-      fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
+      fail "[QK:CODEX-PACK-SETUP-ZERO-STATE] [check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
       echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
       return 1
     fi
@@ -3828,7 +3926,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
     return 1
   fi
-  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ]; then
+  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ] || [ -e "$setup_home/.codex" ]; then
     fail "[check-pack-install] installed all-absent setup wrote harness state (must be zero-write)"
     return 1
   fi
@@ -3836,7 +3934,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
     return 1
   fi
-  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 5x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 6x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
 
   # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
   # bin on a fresh sandbox home, with the shared fake vendor
@@ -3862,7 +3960,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
     XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    OMP_BIN="$npm_tmp/definitely-absent" \
+    OMP_BIN="$npm_tmp/definitely-absent" CODEX_BIN="$npm_tmp/definitely-absent" \
     COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
     "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
   setup_rc=$?
@@ -5179,6 +5277,43 @@ setup_all() {
     fi
   fi
 
+
+  # ── codex ── Entwurf owns three configuration atoms, never the harness, its app-server, or
+  # the operator's trust decision. The birth unit is now setup's to install: its paths are the
+  # operator's own, so nothing here needs root — but the VENDOR still has to agree to run the
+  # hook, and only the operator can answer that, once, in their own visible Codex. So a first
+  # setup on a Codex host writes the bytes and is honestly NON-GREEN until that answer exists.
+  # It never writes `[hooks.state]`: forging the receipt in a file we already own would turn a
+  # security prompt into a silent install.
+  local codex_rc
+  if ! command -v "${CODEX_BIN:-codex}" >/dev/null 2>&1; then
+    setup_result codex SKIP "codex not on PATH — zero Codex wiring written"
+  else
+    section "codex units (native harness detected: OpenAI Codex CLI)"
+    codex_rc=0; (cd "$REPO_DIR" && bash scripts/codex-birth-install.sh) || codex_rc=$?
+    if [ "$codex_rc" -ne 0 ]; then
+      setup_result codex-birth FAIL "detected codex, but publishing the SessionStart birth unit did not complete (see above)"
+    else
+      codex_rc=0; (cd "$REPO_DIR" && bash scripts/codex-birth-doctor.sh) >/dev/null || codex_rc=$?
+      if [ "$codex_rc" -eq 0 ]; then
+        setup_harness_result codex-birth "SessionStart birth unit published and trusted by the vendor" "./run.sh doctor-codex-birth"
+      else
+        setup_result codex-birth FAIL "the birth unit is published, but the vendor has recorded no trust receipt for it yet, so the hook is declared and never runs. Open a visible plain Codex, answer its prompt with 'Trust all and continue', send one first turn, then re-run setup (or './run.sh doctor-codex-birth')"
+      fi
+    fi
+    codex_rc=0; codex_mcp install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-mcp "MCP server registered" "./run.sh doctor-codex-mcp"
+    else
+      setup_result codex-mcp FAIL "detected codex, but the MCP registration did not complete (see above)"
+    fi
+    codex_rc=0; codex_statusline install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-statusline "thread-title visible identity enabled" "./run.sh doctor-codex-statusline"
+    else
+      setup_result codex-statusline FAIL "detected codex, but the visible-identity setting did not complete (see above)"
+    fi
+  fi
   # ── core bridge boundary ── deterministic preflight lives in `pnpm run
   # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
   # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
@@ -5683,6 +5818,14 @@ release_gate() {
   # applied from omp onward; it does not retroactively redesign Copilot's operator-metered
   # exclusion.
   run_live_step "smoke-omp-fresh-live (#87 bundle C: entwurf_fresh_call opens omp, exact nonce callback, addressed receive)" gate bash "$self" smoke-omp-fresh-live
+  # #95 first-admission LIVE acceptance. Unlike the older on-demand loaded-thread smoke,
+  # this gate owns all three windows it opens and therefore needs no pre-existing TUI/thread id.
+  # It still does not own the app-server: ENTWURF_CODEX_APP_SERVER_PID explicitly names the
+  # operator-started process, whose /proc TMUX/TMUX_PANE is the only seat authority.
+  # A real initial Pi opens Codex, correlates its callback and addresses it through native-push;
+  # Codex then opens the outbound Pi and correlates that callback. Actor coordinates travel,
+  # and fresh Codex == app-server/MCP inherited session == outbound Pi is a hard check.
+  run_live_step "smoke-codex-fresh-live (#95: visible Pi -> visible Codex/callback/addressed v2 -> visible Pi/callback)" gate bash "$self" smoke-codex-fresh-live
 
   # 4. BEHAVIOR lane (advisory, non-blocking). Model-in-loop gates that probe
   #     whether the model AUTONOMOUSLY drives the MCP entwurf surface. These never
@@ -5775,9 +5918,11 @@ case "$cmd" in
     check_shell_quote
     ;;
   check-install-surface)
-    # 0.12.7 — structural half of the node_modules strip-types fence: run_ts is the only
-    # crossing, every operator subcommand has a compiled twin, bin wrappers branch, dev
-    # gates stay out of the tarball, and offline smokes never touch the real $HOME.
+    # structural half of the node_modules strip-types fence: run_ts is the only crossing,
+    # every operator subcommand has a compiled twin, bin wrappers branch, dev gates stay out
+    # of the tarball, offline smokes carry no OBVIOUS write to the real $HOME (a static
+    # tripwire, never a sandbox proof), and S7 pins the candidate .pi/settings.json — the
+    # shared release skill, the stable bridge bin, and NO packages key (#110).
     # check-pack-install owns the dynamic half (it drives the installed commands).
     run_ts scripts/check-install-surface.ts
     ;;
@@ -5895,6 +6040,9 @@ case "$cmd" in
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
+  check-compaction-send-guard)
+    check_compaction_send_guard
+    ;;
   check-entwurf-v2-production)
     check_entwurf_v2_production
     ;;
@@ -6222,6 +6370,16 @@ case "$cmd" in
     # LIVE!=1. doctor-static preflight FAILs before the agy bridge is wired (③).
     run_ts scripts/smoke-agy-native-push-live.ts
     ;;
+  smoke-codex-native-push-live)
+    # Codex native-push LIVE acceptance. The operator owns both the app-server and visible
+    # attached TUI; this command only proves the shipped record/probe/delivery composition.
+    run_ts scripts/smoke-codex-native-push-live.ts
+    ;;
+  smoke-codex-fresh-live)
+    # First-admission LIVE acceptance: real visible Pi -> Codex -> Pi, using only the
+    # operator-owned app-server explicitly named by ENTWURF_CODEX_APP_SERVER_PID.
+    run_ts scripts/smoke-codex-fresh-live.ts
+    ;;
   smoke-user-scope-citizen)
     # 0.12.6 install-boundary gate: register-pi-package.py is the shared
     # packages[] SSOT for project/user install and remove; user scope makes
@@ -6428,6 +6586,36 @@ case "$cmd" in
     shift || true
     run_ts scripts/omp-receive-facts.ts "$@"
     ;;
+  install-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-install.sh "$@")
+    ;;
+  uninstall-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-uninstall.sh "$@")
+    ;;
+  doctor-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/codex-birth-doctor.sh "$@")
+    ;;
+  install-codex-mcp)
+    codex_mcp install
+    ;;
+  uninstall-codex-mcp)
+    codex_mcp uninstall
+    ;;
+  doctor-codex-mcp)
+    codex_mcp doctor
+    ;;
+  install-codex-statusline)
+    codex_statusline install
+    ;;
+  uninstall-codex-statusline)
+    codex_statusline uninstall
+    ;;
+  doctor-codex-statusline)
+    codex_statusline doctor
+    ;;
   copilot)
     # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
     # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own
@@ -6719,6 +6907,34 @@ case "$cmd" in
     # Hermetic (mkdtemp worlds + the store env seam); no model, no network.
     (cd "$REPO_DIR" && bash scripts/check-fresh-cut-gate.sh "$@")
     ;;
+  check-codex-sender-identity)
+    shift || true
+    run_ts scripts/check-codex-sender-identity.ts "$@"
+    ;;
+  check-codex-bridge-identity)
+    shift || true
+    run_ts scripts/check-codex-bridge-identity.ts "$@"
+    ;;
+  check-codex-native-push)
+    shift || true
+    run_ts scripts/check-codex-native-push.ts "$@"
+    ;;
+  check-codex-birth-hook)
+    shift || true
+    run_ts scripts/check-codex-birth-hook.ts "$@"
+    ;;
+  check-codex-fresh-preflight)
+    shift || true
+    (cd "$REPO_DIR" && pnpm exec vitest run test/codex-fresh-preflight.test.ts "$@")
+    ;;
+  smoke-codex-config-state)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/smoke-codex-config-state.sh "$@")
+    ;;
+  smoke-codex-birth)
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/smoke-codex-birth.sh "$@")
+    ;;
   check-pack)
     check_pack
     ;;

package/scripts/check-acp-usage-accounting.ts

@@ -72,7 +72,7 @@ interface WireUsage {
  * One `_meta.quota.token_count` row. The field NAMES deliberately differ from
  * `PromptResponse.usage`: cache reads are `cachedInputTokens` here because the
  * shape is shared with codex-acp, and `cachedWriteTokens` is Claude's extra
- * sibling (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6493-6502`).
+ * sibling (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6566-6575`).
  * Reading a quota row with the `usage` field names silently yields zeros, so the
  * fixture below spells the vendor's names out rather than reusing `WireUsage`.
  */
@@ -137,7 +137,7 @@ function makeFakeChild() {
  *
  * Each `prompt` call consumes the next TurnScript: it first pushes that turn's
  * `usage_update` notification (the wire the running cost total actually arrives
- * on — read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), then answers the
+ * on — read at claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), then answers the
  * prompt with that turn's `PromptResponse.usage` (the wire the turn aggregate
  * arrives on). Both orderings are the real one: the notification precedes the
  * response, because the SDK emits it from the `result` message that ENDS the turn.
@@ -393,8 +393,8 @@ try {
 	// AGENT LOOP only. `_meta.quota.model_usage` comes from `result.modelUsage` and
 	// also counts Task subagents, sidechains and INTERNAL CALLS SUCH AS COMPACTION;
 	// the vendor states its rows "can total more than `token_count`" and are "the
-	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.75.1
-	// `dist/acp-agent.js:6468-6474`).
+	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.76.0
+	// `dist/acp-agent.js:6541-6547`).
 	//
 	// The wide one is required, not merely nicer, because the DENOMINATOR already
 	// has that scope: turn cost is the adjacent diff of the backend's running total,
@@ -608,8 +608,8 @@ try {
 	// identity that produces the bound is a property of the MAIN AGENT LOOP's
 	// cache breakpoints. `_meta.quota.model_usage` is a WIDER scope: the vendor
 	// states those rows also count Task subagents, sidechains, and INTERNAL
-	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.75.1
-	// `dist/acp-agent.js:6465-6485`). Mixing the two scopes inflates the bound
+	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.76.0
+	// `dist/acp-agent.js:6538-6558`). Mixing the two scopes inflates the bound
 	// through both remaining terms that mention cacheWrite:
 	//   max(0, occupancy − cacheWrite) shrinks as wide cacheWrite grows, so
 	//   less is subtracted; min(rawBound, cacheWrite) rises with it.
@@ -749,9 +749,9 @@ try {
 	// CELL 3 — a turn with NO cost notification holds the baseline.
 	//
 	// Measured upstream: the result-path `usage_update` carries cost (read at
-	// claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), while other
+	// claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), while other
 	// `usage_update` paths can carry `used` without cost (for example the
-	// rate-limit path at `:4269-4277`). A live thinkpad ledger shows such turns
+	// rate-limit path at `:4273-4281`). A live thinkpad ledger shows such turns
 	// really occur. The honest handling is to HOLD the baseline so the amount lands
 	// in the NEXT diff: misattributed by turn, exact by session. Rebaselining to 0
 	// there would double-count the whole prefix.
@@ -831,7 +831,7 @@ try {
 	// CELL 4 — a DECREASING session total is never silently absorbed.
 	//
 	// `conversation_reset` switches the session to a fresh transcript (read at
-	// claude-agent-acp 0.75.1 `dist/acp-agent.js:4282-4289`), but whether that
+	// claude-agent-acp 0.76.0 `dist/acp-agent.js:4286-4293`), but whether that
 	// changes `total_cost_usd` is an SDK-internal value we cannot observe here.
 	// A diff can therefore go negative in a session we are still holding.
 	// Absorbing it quietly would both misreport the turn and destroy the only

package/scripts/check-agy-sender-identity.ts

@@ -466,7 +466,7 @@ try {
 			"probe alive → replyable true",
 			(await probeNativeSenderAlive(
 				identity,
-				adapterWith(async () => ({ status: "alive", route: { lsAddress: "127.0.0.1:1" } })),
+				adapterWith(async () => ({ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:1" } })),
 			)) === true,
 		);