@junghanacs/entwurf 0.20.0 → 0.21.0

package/scripts/mutants/compaction-send-guard.json

@@ -0,0 +1,103 @@
+{
+	"schemaVersion": 1,
+	"lane": "compaction-send-guard",
+	"mutants": [
+		{
+			"claim": "COMPACT-SEND-NO-MODE",
+			"title": "the predicate grows a mode argument so steer could be admitted while follow_up is refused",
+			"subject": "pi-extensions/lib/compaction-send-guard.ts",
+			"find": [
+				"export function compactionSendReject(guard: CompactionGuard, facts: CompactionSendFacts): CompactionSendReject | null {"
+			],
+			"replace": [
+				"export function compactionSendReject(guard: CompactionGuard, facts: CompactionSendFacts, mode?: string): CompactionSendReject | null {"
+			],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-NO-MODE]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-REJECT-ARMED",
+			"title": "armed compacting-during-stream is treated as an ordinary turn, so auto-compact still gets sendMessage",
+			"subject": "pi-extensions/lib/compaction-send-guard.ts",
+			"find": ["\tif (guard.armed) return COMPACTION_SEND_REJECT;"],
+			"replace": ["\t// armed compacting-during-stream no longer rejects"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-REJECT-ARMED]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-REJECT-QUIET",
+			"title": "quiet unknown non-idle is admitted, so sendMessage runs in the manual-compact start race",
+			"subject": "pi-extensions/lib/compaction-send-guard.ts",
+			"find": ["\tif (!facts.hasAgentSignal) return BUSY_SEND_REJECT;"],
+			"replace": ["\t// quiet unknown no longer rejects"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-REJECT-QUIET]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-ADMIT-IDLE",
+			"title": "idle no longer recovers a missed session_compact, so a later stream stays falsely refused",
+			"subject": "pi-extensions/lib/compaction-send-guard.ts",
+			"find": [
+				"\tif (facts.idle) {",
+				"\t\t// Idle means Pi is neither in an agent run nor compacting. Also recovers a",
+				"\t\t// missed `session_compact` so a later ordinary stream is not stuck refused.",
+				"\t\tguard.armed = false;",
+				"\t\treturn null;",
+				"\t}"
+			],
+			"replace": ["\t// idle no longer admits or disarms"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-ADMIT-IDLE]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-ADMIT-STREAM",
+			"title": "a live agent run is refused, so idle/일반 streaming steer/followUp is no longer preserved",
+			"subject": "pi-extensions/lib/compaction-send-guard.ts",
+			"find": ["\treturn null; // live agent run — steer/followUp unchanged"],
+			"replace": ["\treturn COMPACTION_SEND_REJECT; // live agent run no longer admitted"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-ADMIT-STREAM]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-WIRE",
+			"title": "the send path skips the leaf and still calls pi.sendMessage during compaction",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": [
+				"\t\tconst compactionReject = compactionSendReject(state.compaction, {",
+				"\t\t\tidle: ctx.isIdle(),",
+				"\t\t\thasAgentSignal: ctx.signal !== undefined,",
+				"\t\t});",
+				"\t\tif (compactionReject) {",
+				"\t\t\trespond(false, \"send\", undefined, compactionReject);",
+				"\t\t\treturn;",
+				"\t\t}"
+			],
+			"replace": ["\t\t// compaction send guard removed"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-WIRE]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		},
+		{
+			"claim": "COMPACT-SEND-EVENTS",
+			"title": "session_before_compact no longer arms the resident guard",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\tpi.on(\"session_before_compact\", () => {", "\t\tnoteCompactionBefore(state.compaction);", "\t});"],
+			"replace": ["\t// session_before_compact no longer arms"],
+			"gate": ["bash", "run.sh", "check-compaction-send-guard"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:COMPACT-SEND-EVENTS]",
+			"signatureSource": "scripts/check-compaction-send-guard.ts"
+		}
+	]
+}

package/scripts/mutants/entwurf-peers.json

@@ -0,0 +1,19 @@
+{
+	"schemaVersion": 1,
+	"lane": "entwurf-peers",
+	"mutants": [
+		{
+			"claim": "PEERS-OBSERVATION-BUDGET",
+			"title": "the peers presentation limit is accepted but the full historical store is still observed",
+			"subject": "pi-extensions/lib/entwurf-fact-provider.ts",
+			"find": [
+				"\t\tselectedObserve = (identity) => (observedGardenIds.has(identity.gardenId) ? observe(identity) : UNOBSERVED_PEER);"
+			],
+			"replace": ["\t\tselectedObserve = observe;"],
+			"gate": ["bash", "run.sh", "check-entwurf-fact-provider"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PEERS-OBSERVATION-BUDGET]",
+			"signatureSource": "scripts/check-entwurf-fact-provider.ts"
+		}
+	]
+}

package/scripts/mutants/mux-fresh-call.json

@@ -147,7 +147,7 @@
 			"title": "native pi drops the required model field from fresh-call while the composition still expects one",
 			"subject": "pi-extensions/entwurf-control.ts",
 			"find": [
-				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t}),\n"
+				"\t\t\tmodel: Type.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 200,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._/:\\\\[\\\\]-]*$\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t}),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -160,7 +160,7 @@
 			"title": "the MCP bridge reads the caller garden id straight out of env instead of its authoritative self envelope",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\tconst self = await buildAuthoritativeSelfEnvelope();\n\t\t\tcallerGardenId = self.envelope.sessionId;"
+				"\t\t\tconst self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });\n\t\t\tcallerGardenId = self.envelope.sessionId;"
 			],
 			"replace": ["\t\t\tcallerGardenId = process.env.PI_SESSION_ID ?? null;"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -173,7 +173,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).\",\n\t\t\t),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -312,8 +312,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
 			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\"])"],
-			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\"])"],
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\"])"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
@@ -432,13 +432,24 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI",
 			"title": "a backend the composition can open is missing from the native pi surface enum — an in-process pi session cannot name a capability the module already opens",
 			"subject": "pi-extensions/entwurf-control.ts",
-			"find": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\", \"omp\"], {"],
-			"replace": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\"], {"],
+			"find": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"], {"],
+			"replace": ["\t\t\tbackend: StringEnum([\"pi\", \"claude-code\", \"copilot\", \"omp\"], {"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		},
+		{
+			"claim": "FRESHCALL-CODEX-HOME-DEFAULT",
+			"title": "an omitted Codex seat falls back to the caller's session instead of the one supported `codex` home topology",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tif (backend === \"codex\") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: \"codex-home\" };"],
+			"replace": ["\tif (backend === \"pi\") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: \"codex-home\" };"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-CODEX-HOME-DEFAULT]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
 		{
 			"claim": "TMUXSESSION-LOOKUP-ENGINE",
 			"title": "the seat lookup goes back to the `-f` filter engine, which was measured to match EVERY session when the name contains a '}' — a fresh sibling then opens in whichever session tmux listed first",
@@ -512,7 +523,7 @@
 			"title": "one surface drops the optional seat from its schema, so opening a sibling in the operator's project session works from pi and silently cannot exist from the MCP bridge",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.\",\n\t\t\t),\n"
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],

package/scripts/mutants/omp-fresh.json

@@ -6,8 +6,10 @@
 			"claim": "ADMISSION-FRESH-PARITY",
 			"title": "a post-#82 harness admitted as a full D6 citizen while entwurf_fresh_call cannot open it — the exact state the Bundle A+B candidate shipped in, where every gate was green and only prose said the backend was unsupported. This is the defect the whole gate exists for: without it, an `unsupported` note reads as a partial-release permit",
 			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\"] as const;"],
-			"replace": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\"] as const;"],
+			"find": [
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"] as const;"
+			],
+			"replace": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\"] as const;"],
 			"gate": ["bash", "run.sh", "check-harness-admission-parity"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:ADMISSION-FRESH-PARITY]",
@@ -117,8 +119,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL",
 			"title": "a backend added to the composition and both schema surfaces but not to the operator skill — the third public surface step 9 names, and the one that had no gate at all. The skill is what an operator reads to decide what can be opened, so a stale list makes the backend unreachable in practice exactly the way a missing enum value makes it unreachable in schema",
 			"subject": ".claude/skills/entwurf-dev/SKILL.md",
-			"find": ["backend는 정확히 `pi | claude-code | copilot | omp`이고"],
-			"replace": ["backend는 정확히 `pi | claude-code | copilot`이고"],
+			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex`이고"],
+			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp`이고"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL]",

package/scripts/mutants/pi-package-ownership.json

@@ -87,6 +87,32 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:MISSING-OWNER-AUTO-TAKEOVER]",
 			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "SECOND-CHECKOUT-EXTENSION-COLLISION",
+			"title": "entwurf's own checkout ships a project-scope self-registration again, so any SECOND checkout registers a rival copy of pi-extensions beside the installed one and wins --entwurf-control while the installed extension fails, printing the installed path as the loser (#110)",
+			"subject": ".pi/settings.json",
+			"find": ["\"skills\": [\"../.claude/skills\"],\n\t\"entwurfProvider\": {"],
+			"replace": ["\"skills\": [\"../.claude/skills\"],\n\t\"packages\": [\"..\"],\n\t\"entwurfProvider\": {"],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SECOND-CHECKOUT-EXTENSION-COLLISION]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "SELF-CHECKOUT-PROJECT-REGISTRATION",
+			"title": "install registers entwurf project-scope into entwurf's OWN checkout, so `./run.sh setup` writes back the self-registration the tracked file no longer carries — the same #110 collision, arriving through the writer instead of through committed bytes",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$(cd -P -- \"$project_dir\" 2>/dev/null && pwd)\" = \"$REPO_DIR\" ]; then\n    echo \"install: project-scope packages[] skipped — entwurf's own checkout self-registers through user scope (#110)\"\n  else\n    python3 \"$REPO_DIR/scripts/register-pi-package.py\" \"$project_dir/.pi/settings.json\" \"$REPO_DIR\"\n  fi"
+			],
+			"replace": [
+				"  python3 \"$REPO_DIR/scripts/register-pi-package.py\" \"$project_dir/.pi/settings.json\" \"$REPO_DIR\""
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SELF-CHECKOUT-PROJECT-REGISTRATION]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
 		}
 	]
 }

package/scripts/mutants/release-gate.json

@@ -214,6 +214,19 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:PI-DOCTOR-IS-RELEASE-MUST]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CODEX-FIRST-ADMISSION-IS-RELEASE-MUST",
+			"title": "the Codex first-admission smoke stays listed but bypasses run_live_step, so a missing LIVE prerequisite returns SKIP into a branch that never classifies it and the cut reads green",
+			"subject": "run.sh",
+			"find": [
+				"  run_live_step \"smoke-codex-fresh-live (#95: visible Pi -> visible Codex/callback/addressed v2 -> visible Pi/callback)\" gate bash \"$self\" smoke-codex-fresh-live"
+			],
+			"replace": ["  bash \"$self\" smoke-codex-fresh-live"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-FIRST-ADMISSION-IS-RELEASE-MUST]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		}
 	]
 }

package/scripts/mutants/v2-surface.json

@@ -127,12 +127,64 @@
 				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
 			],
 			"replace": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-DESC-FITS-HOST-CAP]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "NATIVE-PUSH-SENDER-ENVELOPE",
+			"title": "native-push direct injection reverts to the raw plan message, so a directly-injected citizen receives a body with no sender envelope and cannot name who called it",
+			"subject": "pi-extensions/lib/entwurf-v2-native-push.ts",
+			"find": [
+				"\t\tconst content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;"
+			],
+			"replace": ["\t\tconst content = plan.message;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-production"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:NATIVE-PUSH-SENDER-ENVELOPE]",
+			"signatureSource": "scripts/check-entwurf-v2-production.ts"
+		},
+		{
+			"claim": "NATIVE-PUSH-SENDER-PROVIDER-WIRING",
+			"title": "the production factory stops handing its one senderProvider to the native-push hand, so the render is reachable but never fed and every direct injection silently falls back to raw",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": [
+				"\t\tsendNativePush: makeNativePushSend({\n\t\t\tresolveAdapter: io.resolveNativePushAdapter,\n\t\t\tsenderProvider: opts.senderProvider,\n\t\t}),"
+			],
+			"replace": ["\t\tsendNativePush: makeNativePushSend({ resolveAdapter: io.resolveNativePushAdapter }),"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-production"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:NATIVE-PUSH-SENDER-PROVIDER-WIRING]",
+			"signatureSource": "scripts/check-entwurf-v2-production.ts"
+		},
+		{
+			"claim": "NATIVE-PUSH-SENDER-BEFORE-ADAPTER",
+			"title": "the send hand resolves the native-push adapter before the sender envelope, so a failing envelope source fails with the target's adapter already in hand instead of before anything was touched",
+			"subject": "pi-extensions/lib/entwurf-v2-native-push.ts",
+			"find": [
+				"\t\tconst sender = senderProvider?.();\n\t\tconst content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;\n\t\tconst adapter = resolveAdapter(plan.backend);"
+			],
+			"replace": [
+				"\t\tconst adapter = resolveAdapter(plan.backend);\n\t\tconst sender = senderProvider?.();\n\t\tconst content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-production"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:NATIVE-PUSH-SENDER-BEFORE-ADAPTER]",
+			"signatureSource": "scripts/check-entwurf-v2-production.ts"
+		},
+		{
+			"claim": "NATIVE-PUSH-RETRY-BYTE-IDENTITY",
+			"title": "the one permitted retry decorates the replayed body, so the second attempt delivers bytes that disagree with the first attempt the target may already have accepted",
+			"subject": "pi-extensions/lib/entwurf-v2-native-push.ts",
+			"find": ["\t\tawait adapter.send(reprobe.route, nativeSessionId, content);"],
+			"replace": ["\t\tawait adapter.send(reprobe.route, nativeSessionId, `${content} (retry)`);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-native-push"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY]",
+			"signatureSource": "scripts/check-entwurf-v2-native-push.ts"
 		}
 	]
 }

package/scripts/pi_settings_io.py

@@ -7,7 +7,9 @@ Both Python writers touch the SAME file (`<repo>/.pi/settings.json` at project s
   - register-pi-provider.py  → entwurfProvider.mcpServers.entwurf-bridge
 
 A settings file can be tracked and owned by a formatter (this repo's own is: tab
-indented, biome-governed, pinned byte-for-byte by check-install-surface S7b–S7d), so a
+indented, biome-governed, its skills/packages/provider-bin invariants pinned by
+check-install-surface S7b-S7d and its bytes pinned end to end by smoke-user-scope-citizen
+cell 14b), so a
 writer that re-serializes it in its own house style turns `install` into a source edit.
 #53 B closed that for the packages writer and left the provider writer open — the same
 file, the same defect, one function call away. The rules therefore live HERE rather than

package/scripts/raw-async-delivery/README.md

@@ -551,7 +551,8 @@ send-message-v2` spins a fresh thread, not the live one.
 
 Copilot is a GitHub **harness** (issues, PR, CI, model `auto`, mode `autopilot`,
 remote/delegate), not a second GPT provider next to pi. This makes a native lane
-product-distinct from the declined Codex lane: Copilot can own GitHub work while
+product-distinct from Codex's separate native-push lane (#95, unreleased candidate):
+Copilot can own GitHub work while
 implementation checkpoints arrive from another garden id. That split is operator
 etiquette plus dispatch, not a substrate role system.
 

package/scripts/raw-codex-measure/README.md

@@ -4,10 +4,10 @@ Lane: `docs/adding-a-harness.md` step 1 (six measurements) + §3.5 citizen scope
 tool-name dialect + step 6's join. The oracle is the vendor artifact or the vendor process,
 never our assembler.
 
-This file is a MEASUREMENT-ONLY ledger. Nothing here was written by an entwurf installer,
-no meta-record was minted, and no operator config was edited. The one entwurf-owned artifact
-touched at all is the pre-existing `[mcp_servers.entwurf-bridge]` entry in the operator's own
-`~/.codex/config.toml`, which was READ, not written.
+This file is a MEASUREMENT-ONLY ledger of the **2026-09-08 step-1 state**. At that
+measurement date, nothing here had been written by an Entwurf Codex installer, no
+Codex meta-record had been minted, and no operator config had been edited. Later #95
+candidate work exists; this dated ledger is evidence for it, not current product status.
 
 Evidence-state vocabulary: **[source]** = read at `file:line` in the vendor checkout;
 **[host]** = measured on this host (`oracle`, 2026-09-08 KST) with the receipt named;
@@ -207,11 +207,11 @@ it carried is what S1b-B was run to settle.)*
 (`thread/queue/add|start|list|…`) that did not exist at 0.136. No hook or extension wake
 surface was added (see M1). The measured route is unchanged and green: **M-B** below.
 
-## M5 — Parent process topology (the step-6 join)
+## M5 — Parent process topology (measured refutation of a universal join)
 
-The join `docs/adding-a-harness.md` step 6 requires is `hook.ppid == mcp.ppid == the harness
-host pid`. **It holds on Codex — but WHICH process is the host depends on the launch mode, and
-that difference is the finding.**
+The then-current `docs/adding-a-harness.md` step 6 asked whether
+`hook.ppid == mcp.ppid == harness host pid`. The measurement below preserves the
+answer and explains why that equality is not a universal sender-identity contract.
 
 **Embedded mode** (a standalone `codex` TUI with its own `CODEX_HOME`, no app-server):
 
@@ -240,23 +240,20 @@ pid=1733 (entwurf-bridge) ppid=1393   # 1393 = codex app-server --listen
 pid=1616                              # = the plain codex TUI. Not the parent.
 ```
 
-So in the delivery-capable mode the join still holds — `hook.ppid == mcp.ppid` — but both
-resolve to the app-server.
+In the delivery-capable mode, `hook.ppid == mcp.ppid`, but both resolve to the
+app-server rather than to an attached TUI.
 
-**That the app-server is SHARED across citizens was an inference in the first draft, and it
-was published without a label.** `[source]` supports it
-(`app-server/src/request_processors/initialize_processor.rs:63-68` is a multi-client
-shared-thread surface), but the run above shows the parent of ONE attached TUI; reading N from
-one is not a measurement. Independent audit (terra, 2026-09-08) caught the missing label.
-**It has since been measured directly — see S1b-C below — and the answer is the one the
-inference guessed:** two live threads on one app-server, two separate visible TUIs, and every
-hook and every MCP child of BOTH threads reports the same `ppid`.
+The first draft inferred that this app-server was shared across citizens. Independent
+audit caught the missing evidence label; **S1b-C** then measured it directly: two live
+threads, two visible TUIs, and every hook/MCP child of both threads reported the same
+parent pid.
 
-**[host]** So this is now a measured fact rather than a structural read: **a sender marker
-keyed by parent pid would be one marker for N citizens**, which is precisely the uniqueness the
-V3 store contract (Hard Rule 7, `nativeSessionId` ownership) forbids. **This is the
-load-bearing result of the whole step**, and it is a design input for step 6, not a defect to
-fix here.
+That is the result: a parent-pid marker would be one marker for N Codex citizens. The
+topology is useful negative evidence, not the Codex join. **S1b-D** found the
+vendor-authoritative alternative on each MCP request, and the current candidate strictly
+joins that request metadata to `record.nativeSessionId`. Other measured harnesses still
+use pid/start-key markers where their vendor topology makes that carrier authoritative;
+the general doctrine is the vendor-authoritative record join.
 
 **[host]** A second consequence, measured on the same two runs: the hook's environment is the
 HOST process's snapshot, so it changes with the mode.
@@ -646,11 +643,11 @@ identifier**, and `record.nativeSessionId = threadId` needs no mapping layer. Th
 `nativeIdLabel: "threadId"` in `pi/entwurf-capabilities.json` is, on this axis, correct — which
 is worth saying precisely, because its `deliveryLevel: "D6"` on the same row still is not.
 
-**What this changes.** The step-6 question "who sent this?" does not need a parent-pid marker on
-codex, and the answer S1b-C ruled out was the wrong shape rather than a dead end: the caller is
-named on every call. `[source]` today's bridge reads a `PI_SESSION_ID`/`PI_AGENT_ID` pair or a
-native marker looked up by parent pid, and neither exists here — so consuming `_meta` would be
-new bridge code. **That is step 6, and nothing here implements it.**
+**What this changed on 2026-09-08.** The step-6 question did not need a parent-pid
+marker on Codex: every call named the thread. At that measurement date the bridge only
+read a complete pi env pair or a native pid marker, so consuming `_meta` still required
+new code. The later #95 candidate implements a strict request-metadata join; that later
+implementation is not evidence supplied by this ledger.
 
 One vendor fact this run also surfaced, recorded because it belongs to step 9 clause 2: the
 first `tools/call` raised an interactive approval prompt —
@@ -660,24 +657,95 @@ beside the model-facing `mcp__entwurf_bridge__entwurf_peers`. Copilot's "one too
 lesson repeats here. `entwurf_peers` itself answered from that session, which is the plain
 external-MCP-host row of `docs/external-mcp-host.md` behaving as designed.
 
-## What this measurement does NOT establish
-
-- The source layer WAS independently audited on 2026-09-08 (terra, on commit `87ac7ad`):
-  **20/20 quotations CONFIRMED, 0 corrected, 0 unverifiable**, tag identity re-derived
-  independently (`rust-v0.153.4^{}` = `3d2ee51ca2d5db578f328aa75e20aa22c0197c9a`). Three prose
-  defects it raised are folded in above and marked as corrections; none was a wrong vendor
-  fact. The S1b-* sections were added AFTER that audit and carry no second reader yet.
-- Evidence level L4 at best: one Linux host (`oracle`, aarch64, NixOS), one CLI version, one
-  run per claim except M-B (three runs).
-- **No entwurf unit was built or installed.** No record, no hook, no marker, no doctor.
-  Steps 3–10 are untouched by design; this ledger is step 1 only.
-- **Step 2 is a pre-existing surprise, not this lane's work, and it is wrong.** `codex` is
-  ALREADY in `META_BACKENDS` (`pi-extensions/lib/meta-session.ts:84`) and
-  `META_CITIZEN_BACKENDS` (`:308`), and `pi/entwurf-capabilities.json` grades it
-  `wakeMode: "direct-inject"`, `deliveryLevel: "D6"`, `nativeIdLabel: "threadId"` — a grade
-  with no channel behind it, the exact failure `docs/adding-a-harness.md` step 8(c) names.
-  It is also the declared pre-#82 legacy exception `check-harness-admission-parity` reads out
-  of `DELIVERY.md`. Nothing here changes it; a reader should not take that D6 as evidence.
+## S1c — vendor queue and visible-fresh argv (2026-09-10)
+
+Codex 0.153.4 has the narrow delivery primitive this lane was missing:
+
+```sh
+codex queue \
+  --remote unix://$SOCKET \
+  --thread 01a08bb0-999a-71b2-be36-357eedc26542 \
+  --message 'Reply exactly CODEX-QUEUE-Q1'
+```
+
+The command exited 0 and printed one explicit acceptance receipt:
+
+```text
+Queued message 01a08bb2-c70f-75f3-88c6-48cdffa4d64d for thread 01a08bb0-999a-71b2-be36-357eedc26542.
+```
+
+The attached TUI produced `CODEX-QUEUE-Q1`. A second run queued a turn that executed
+`sleep 12`; a third message was queued immediately while that turn was active. The CLI returned
+two different message ids, and the TUI completed `CODEX-QUEUE-Q2` before
+`CODEX-QUEUE-Q3`. **The vendor owns queue serialization and message identity.** Entwurf should
+exec this command once and validate its receipt; it should not recreate `turn/start`, a second
+queue, or an idempotency ledger. A nonexistent thread exited 1 with
+`thread/queue/add failed: failed to read thread: invalid thread-store request: no rollout found`
+and no acceptance receipt.
+
+The ordinary pnpm-installed binary also owns the usable app-server shape:
+
+```sh
+codex app-server --listen unix://$SOCKET
+```
+
+It created a mode-0600 UDS and served WebSocket JSON-RPC. By contrast,
+`codex app-server daemon start` refused this installation because its managed-daemon path
+requires `~/.codex/packages/standalone/current/codex`. Entwurf must not install that separate
+vendor runtime or hide this distinction behind a wrapper: the lightweight contract is to
+detect one already-running ordinary app-server at the fixed vendor socket.
+
+The complete fresh argv was then exercised against that app-server:
+
+```sh
+codex \
+  --remote unix://$SOCKET \
+  --model gpt-5.6-sol \
+  --dangerously-bypass-approvals-and-sandbox \
+  --no-alt-screen \
+  'Call mcp__entwurf_bridge__entwurf_peers as your first action …'
+```
+
+The visible TUI reported `gpt-5.6-sol high` and `YOLO`; MCP startup completed; the first turn
+called `entwurf-bridge.entwurf_peers` successfully. `--no-alt-screen` was only an observation
+aid and is not part of the launch contract. The fixed launch facts are `--remote`, explicit
+`--model`, the explicit task-wide permission token, and one positional first prompt. Unlike the
+OMP race, the Codex MCP tool was callable on that first turn.
+
+The same socket accepted
+`thread/name/set {threadId,name:"20260910T235959-codex"}` with `{}` and the attached TUI
+immediately rendered `Session renamed to 20260910T235959-codex`; a second call restored the
+captured preimage `Entwirf raw queue probe Q1`. This closes the naming primitive only. The
+current footer did not include `thread-title`, so the separate user-config atom remains necessary
+before a garden id is continuously visible.
+
+One lifecycle caveat is now bounded rather than hidden. Closing a TUI client does not
+immediately remove its thread from `thread/loaded/list`; the vendor keeps a loaded thread after
+the last subscriber disconnects and unloads it after 30 minutes without subscribers or thread
+activity (`app-server/README.md`, `thread/unsubscribe`). During that vendor-owned loaded lifetime
+`codex queue` remains the acceptance boundary. This is not a pane/process liveness claim and must
+not be re-described as one.
+
+These observations make 0.153.4 the first measured coordinate, **not a hard product floor**.
+No silent older-version failure has been measured, so Entwurf should report drift and fail a
+missing capability, not invent a lower-bound promise.
+
+## What this dated measurement did NOT establish
+
+- The source layer was independently audited on 2026-09-08 (terra, commit `87ac7ad`):
+  **20/20 quotations CONFIRMED**. The later S1b sections had no second reader then.
+- Evidence was L4 at best: one Linux host (`oracle`, aarch64, NixOS), Codex 0.153.4,
+  one run per claim except M-B.
+- **As of the 2026-09-08 measurement**, no Entwurf Codex unit had been built or
+  installed, no product record/doctor existed, and steps 3–10 were untouched by that
+  lane. These are historical scope statements, not claims about the later candidate.
+- Step 2 was already present but unearned at that date: registry/capability rows named
+  Codex before a production channel existed. Later #95 code supplies the candidate
+  record/native-push/fresh path; its parser, env-boundary, setup, preflight, and clause-7
+  amendments plus deep/installed-host acceptance are outside this raw ledger.
+- The hook-trust and visible-name questions were closed by S1b-A/B. The remaining
+  release evidence is owned by the current candidate's gates and actual host, not by
+  reinterpreting these measurements.
 - *(Two entries lived here until 2026-09-08 and are now **closed by measurement**, not moved:
   "clause 4 has no working candidate" was retired by **S1b-B**, and "the hook trust gate has no
   measured non-interactive path" by **S1b-A**. What each one costs is stated in its section.)*