@junghanacs/entwurf 0.20.0 → 0.21.0

package/scripts/smoke-codex-native-push-live.ts

@@ -0,0 +1,75 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { makeProductionEntwurfV2Deps } from "../pi-extensions/lib/entwurf-v2-production.ts";
+import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import { upsertMetaSession } from "../pi-extensions/lib/meta-session.ts";
+import { probeCodexThread } from "../pi-extensions/lib/native-push/codex-ws-client.ts";
+import { skipLive } from "./lib/live-skip.ts";
+
+if (process.env.LIVE !== "1") {
+	skipLive(
+		"smoke-codex-native-push-live",
+		"set LIVE=1 + CODEX_LIVE_THREAD_ID to run (sends a real turn to an already-loaded Codex thread).",
+	);
+}
+
+const threadId = process.env.CODEX_LIVE_THREAD_ID?.trim();
+if (!threadId) {
+	skipLive(
+		"smoke-codex-native-push-live",
+		"set CODEX_LIVE_THREAD_ID to a thread loaded by a TUI attached to the default Codex app-server.",
+	);
+}
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-codex-live-"));
+process.on("exit", () => fs.rmSync(root, { recursive: true, force: true }));
+const sessionsDir = path.join(root, "meta-sessions");
+const born = upsertMetaSession({
+	dir: sessionsDir,
+	input: {
+		backend: "codex",
+		nativeSessionId: threadId,
+		cwd: process.cwd(),
+		model: process.env.CODEX_LIVE_MODEL?.trim() || null,
+		transcriptPath: path.join(root, "codex-live-transcript.jsonl"),
+	},
+});
+
+const before = await probeCodexThread(threadId);
+assert.equal(before.status, "alive", `[QK:CODEX-LIVE-PROBE] ${before.status === "alive" ? "" : before.reason}`);
+
+const token = `CODEX-NATIVE-LIVE-${Date.now()}`;
+const result = await runEntwurfV2(
+	{
+		target: born.record.gardenId,
+		intent: "fire-and-forget",
+		wantsReply: true,
+		message: `Entwurf native-push live acceptance. Reply with exactly ${token}`,
+	},
+	makeProductionEntwurfV2Deps({
+		senderProvider: () => ({
+			sessionId: born.record.gardenId,
+			agentId: "meta-session/codex",
+			cwd: process.cwd(),
+			timestamp: new Date().toISOString(),
+			origin: "meta-session",
+			replyable: true,
+		}),
+		sessionsDir,
+		mailboxDir: path.join(root, "mailbox"),
+		controlSocketDir: path.join(root, "control"),
+		lockDir: path.join(root, "locks"),
+	}),
+);
+assert.equal(result.kind, "executed", `[QK:CODEX-LIVE-PUBLIC-DISPATCH] ${JSON.stringify(result)}`);
+assert.equal(result.kind === "executed" ? result.transport : null, "native-push");
+const after = await probeCodexThread(threadId);
+assert.equal(after.status, "alive", "Codex thread remains loaded after the one-shot queue acceptance");
+
+console.log(`smoke-codex-native-push-live: delivered ${token}`);
+console.log(`  gardenId: ${born.record.gardenId}`);
+console.log(`  threadId: ${threadId}`);
+console.log(`  socket:   ${before.status === "alive" ? before.route.socketPath : "unreachable"}`);
+console.log("  verify the exact token appears in that visible Codex TUI; the delivery receipt is not the model result");

package/scripts/smoke-setup-verdict.sh

@@ -16,6 +16,9 @@
 #                             core and later components still attempted
 #   S-8 omp present         → the four omp units compose (birth/MCP/tools.xdev
 #                             setting/receiver), states exist, second run idempotent
+#   S-8c codex present      → birth publishes but stays a named FAIL until the vendor trust
+#                             receipt exists; all three atoms compose twice, preserve foreign
+#                             config, stay idempotent, and go green on the trusted rerun
 #   S-5 installed mode      → the installed-vs-source branch is a NAMED verdict
 #                             printed before anything else, and never reaches
 #                             the source pnpm bootstrap
@@ -27,12 +30,15 @@
 # below-floor and false-green shapes as living end-to-end evidence.
 #
 # Deterministic: no model, no network, no cost. Presence probes are pinned via
-# PI_BIN / CLAUDE_BIN / AGY_BIN / COPILOT_BIN / OMP_BIN (the same hermetic seam
+# PI_BIN / CLAUDE_BIN / AGY_BIN / COPILOT_BIN / OMP_BIN / CODEX_BIN (the same hermetic seam
 # smoke-agy-install-state
 # uses), and every write root is sandboxed: HOME, XDG roots, the pi agent dir,
-# and the dev-bin dir. The source bootstrap (`pnpm install --frozen-lockfile`)
-# runs against the ALREADY-INSTALLED checkout, which is a verified no-op under a
-# sandbox HOME (measured 2026-08-26).
+# and the dev-bin dir. Source-mode cells put a strict fixture `pnpm` first on PATH:
+# it accepts the no-op `install --frozen-lockfile` and the source-owned `run build-bridge`
+# emit only. Package-manager behavior belongs to the package gates. This is load-bearing
+# under mutation qualification, whose snapshot shares node_modules read-only — a real pnpm
+# follows that symlink and attempts to rewrite the origin checkout. Any dist this gate had
+# to build is removed on exit, restoring the snapshot's pre-gate surface.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -51,7 +57,13 @@ esac
 export PYTHONDONTWRITEBYTECODE=1
 
 SB="$(mktemp -d -t entwurf-setup-verdict.XXXXXX)"
-cleanup() { rm -rf "$SB"; }
+DIST_ROOT="$REPO_DIR/mcp/entwurf-bridge/dist"
+DIST_PREEXISTED=0
+[ -d "$DIST_ROOT" ] && DIST_PREEXISTED=1
+cleanup() {
+  [ "$DIST_PREEXISTED" -eq 1 ] || rm -rf "$DIST_ROOT"
+  rm -rf "$SB"
+}
 trap cleanup EXIT
 
 export HOME="$SB/home"
@@ -62,12 +74,27 @@ export XDG_CONFIG_HOME="$SB/home/.config"
 export PI_CODING_AGENT_DIR="$SB/home/.pi/agent"
 export ENTWURF_DEV_BIN_DIR="$SB/bin"
 export PATH="$SB/bin:$PATH"
-mkdir -p "$HOME" "$PI_CODING_AGENT_DIR" "$SB/bin" "$SB/harness"
+mkdir -p "$HOME" "$PI_CODING_AGENT_DIR" "$SB/bin" "$SB/harness" "$SB/bootstrap-bin"
+cat > "$SB/bootstrap-bin/pnpm" <<'SH'
+#!/bin/sh
+if [ "$#" -eq 2 ] && [ "$1" = install ] && [ "$2" = --frozen-lockfile ]; then
+  exit 0
+fi
+if [ "$#" -eq 2 ] && [ "$1" = run ] && [ "$2" = build-bridge ]; then
+  # The qualification snapshot is process-exclusive. Invoke the source-owned emit
+  # directly so the production lock wrapper cannot leave its ignored parent dir.
+  exec bash scripts/build-bridge.sh
+fi
+echo "fixture pnpm accepts only: install --frozen-lockfile | run build-bridge" >&2
+exit 64
+SH
+chmod +x "$SB/bootstrap-bin/pnpm"
+export PATH="$SB/bootstrap-bin:$PATH"
 
 # Presence pins: default every harness to a definitely-absent path; each cell
 # re-pins what it needs. Production leaves these unset.
 ABSENT="$SB/harness/definitely-absent"
-export PI_BIN="$ABSENT" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="$ABSENT" OMP_BIN="$ABSENT"
+export PI_BIN="$ABSENT" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="$ABSENT" OMP_BIN="$ABSENT" CODEX_BIN="$ABSENT"
 
 PASS=0
 ok()   { PASS=$((PASS + 1)); printf '  ok    %s\n' "$*"; }
@@ -94,7 +121,8 @@ echo "[smoke-setup-verdict] S-1 all-harness-absent setup"
 PROJ1="$SB/proj1"; mkdir -p "$PROJ1"
 seed_auth
 set +e; OUT="$(bash "$REPO_DIR/run.sh" setup "$PROJ1" 2>&1)"; RC=$?; set -e
-want "S-1: all-absent setup exits 0 (core green is still green)" "[ '$RC' -eq 0 ]"
+want "S-1: all-absent setup exits 0 with a Codex SKIP" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
 want "S-1: mode is a named source-checkout branch, printed first" \
   "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: source checkout'"
 want "S-1: pi absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP'"
@@ -112,6 +140,7 @@ want "S-1: no user-scope pi settings were created" "[ ! -e '$PI_CODING_AGENT_DIR
 want "S-1: no agy config was created" "[ ! -e '$HOME/.gemini' ]"
 want "S-1: no Copilot config/units were created" "[ ! -e '$HOME/.copilot' ]"
 want "S-1: no OMP config/units were created" "[ ! -e '$HOME/.omp' ]"
+want "S-1: no Codex config/units were created" "[ ! -e '$HOME/.codex' ]"
 want_auth_untouched "S-1"
 
 # ── S-2: pi resolvable but BELOW floor → detected FAIL, never SKIP, no writes ──
@@ -287,6 +316,90 @@ rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/
   "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
   "$XDG_DATA_HOME/entwurf/meta-bridge-omp" "$XDG_DATA_HOME/entwurf/omp-receive"
 
+# ── S-8c: codex PRESENT → setup publishes birth, and stays NON-GREEN until the vendor agrees ──
+# The birth unit's paths are the operator's own, so setup installs it here for real, inside the
+# fixture's HOME/CODEX_HOME/XDG. What setup CANNOT do is answer the vendor's one-time trust
+# prompt: that is the operator's, in their own visible Codex. So the first run writes every
+# byte and is honestly non-green, the two config atoms compose anyway, and the run after a
+# vendor receipt appears is green and byte-idempotent. Nothing here ever writes [hooks.state] —
+# the receipt is forged by the FIXTURE to stand in for the vendor, never by setup.
+echo "[smoke-setup-verdict] S-8c codex present — incomplete three-unit composition"
+PROJ8C="$SB/proj8c"; mkdir -p "$PROJ8C"
+FAKE_CODEX="$SB/harness/codex-fake"; mkdir -p "$FAKE_CODEX"
+printf '#!/usr/bin/env bash\necho "codex-cli 0.153.4"\n' > "$FAKE_CODEX/codex"
+chmod +x "$FAKE_CODEX/codex"
+CODEX_HOME_SANDBOX="$HOME/.codex"
+mkdir -p "$CODEX_HOME_SANDBOX"
+cat > "$CODEX_HOME_SANDBOX/config.toml" <<'TOML'
+model = "operator-model"
+
+[projects."/operator/keep"]
+trust_level = "trusted"
+
+[mcp_servers.operator-owned]
+command = "/operator/bin/server"
+args = ["--keep"]
+
+[tui]
+status_line = ["model-with-reasoning"]
+TOML
+REAL_BASH="$(command -v bash)"
+CODEX_BIRTH_UNIT_ROOT="$XDG_DATA_HOME/entwurf/codex-birth"
+seed_auth
+set +e
+OUT="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC=$?
+set -e
+want "[QK:CODEX-SETUP-NEVER-PRESEEDS-TRUST] S-8c: setup wrote NO vendor trust receipt of its own" \
+  "! grep -q 'hooks.state' '$CODEX_HOME_SANDBOX/config.toml' && ! grep -q 'trusted_hash' '$CODEX_HOME_SANDBOX/config.toml'"
+want "S-8c: detected-incomplete Codex is a named nonzero result, never an absent SKIP [QK:CODEX-SETUP-BIRTH-COSMETIC-PASS]" \
+  "[ '$RC' -ne 0 ] && printf '%s' \"\$OUT\" | grep -q 'codex-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
+want "S-8c: both user-owned Codex atoms still compose independently as PASS [QK:CODEX-SETUP-BIRTH-INDEPENDENT]" \
+  "printf '%s' \"\$OUT\" | grep -q 'codex-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'codex-statusline: PASS'"
+want "S-8c: summary is NON-GREEN and attributes it to the untrusted birth unit" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: codex-birth)' && ! printf '%s' \"\$OUT\" | grep -q 'result: green'"
+want "S-8c: the reason names the operator's one-time answer, not a repair setup could have made" \
+  "printf '%s' \"\$OUT\" | grep -q 'no trust receipt' && printf '%s' \"\$OUT\" | grep -q 'Trust all and continue'"
+want "S-8c: setup PUBLISHED the birth unit — declaration, launcher closure and ownership state" \
+  "[ -f '$CODEX_HOME_SANDBOX/hooks.json' ] && [ -x '$CODEX_BIRTH_UNIT_ROOT/helper/codex-birth-launch.sh' ] && [ -f '$CODEX_BIRTH_UNIT_ROOT/install-state.json' ]"
+CODEX_MCP_STATE="$XDG_DATA_HOME/entwurf/codex-mcp/install-state.json"
+CODEX_STATUSLINE_STATE="$XDG_DATA_HOME/entwurf/codex-statusline/install-state.json"
+want "S-8c: both user atoms wrote their package-owned install states inside the sandbox" \
+  "[ -f '$CODEX_MCP_STATE' ] && [ -f '$CODEX_STATUSLINE_STATE' ] && grep -q '\"atom\": \"codex-mcp\"' '$CODEX_MCP_STATE' && grep -q '\"atom\": \"codex-statusline\"' '$CODEX_STATUSLINE_STATE'"
+want "S-8c: MCP and visible-identity atoms landed in the sandbox Codex config" \
+  "grep -q '\\[mcp_servers\\.entwurf-bridge\\]' '$CODEX_HOME_SANDBOX/config.toml' && grep -q 'status_line = \\[\"thread-title\", \"model-with-reasoning\"\\]' '$CODEX_HOME_SANDBOX/config.toml'"
+want "S-8c: unrelated operator config survives both atom writers" \
+  "grep -q 'model = \"operator-model\"' '$CODEX_HOME_SANDBOX/config.toml' && grep -q '\\[mcp_servers\\.operator-owned\\]' '$CODEX_HOME_SANDBOX/config.toml' && grep -q 'command = \"/operator/bin/server\"' '$CODEX_HOME_SANDBOX/config.toml'"
+CODEX_CONFIG_AFTER="$(sha256sum "$CODEX_HOME_SANDBOX/config.toml" | cut -d' ' -f1)"
+CODEX_MCP_STATE_AFTER="$(sha256sum "$CODEX_MCP_STATE" | cut -d' ' -f1)"
+CODEX_STATUSLINE_STATE_AFTER="$(sha256sum "$CODEX_STATUSLINE_STATE" | cut -d' ' -f1)"
+set +e
+OUT2="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC2=$?
+set -e
+want "S-8c: second setup still reports the untrusted birth FAIL and both user atoms PASS" \
+  "[ '$RC2' -ne 0 ] && printf '%s' \"\$OUT2\" | grep -q 'codex-birth: FAIL' && printf '%s' \"\$OUT2\" | grep -q 'codex-mcp: PASS' && printf '%s' \"\$OUT2\" | grep -q 'codex-statusline: PASS'"
+want "S-8c: second setup is byte-idempotent for config and both ownership receipts" \
+  "[ \"\$(sha256sum '$CODEX_HOME_SANDBOX/config.toml' | cut -d' ' -f1)\" = '$CODEX_CONFIG_AFTER' ] && [ \"\$(sha256sum '$CODEX_MCP_STATE' | cut -d' ' -f1)\" = '$CODEX_MCP_STATE_AFTER' ] && [ \"\$(sha256sum '$CODEX_STATUSLINE_STATE' | cut -d' ' -f1)\" = '$CODEX_STATUSLINE_STATE_AFTER' ]"
+want "S-8c: second setup rechecks rather than faking the missing receipt" \
+  "! printf '%s' \"\$OUT2\" | grep -q 'codex-birth: PASS' && ! grep -q 'trusted_hash' '$CODEX_HOME_SANDBOX/config.toml'"
+
+# The vendor answers. Written by the FIXTURE, exactly as the vendor writes it after one
+# 'Trust all': the receipt keyed to this declaration, carrying its own hash.
+printf '\n[hooks.state."%s/hooks.json:session_start:0:0"]\ntrusted_hash = "sha256:%s"\n' \
+  "$CODEX_HOME_SANDBOX" "$(printf '4%.0s' $(seq 64))" >> "$CODEX_HOME_SANDBOX/config.toml"
+CODEX_CONFIG_TRUSTED="$(sha256sum "$CODEX_HOME_SANDBOX/config.toml" | cut -d' ' -f1)"
+set +e
+OUT3="$(CODEX_BIN="$FAKE_CODEX/codex" CODEX_HOME="$CODEX_HOME_SANDBOX" PATH="$FAKE_CODEX:$PATH" "$REAL_BASH" "$REPO_DIR/run.sh" setup "$PROJ8C" 2>&1)"
+RC3=$?
+set -e
+want "[QK:CODEX-SETUP-TRUSTED-RERUN-GREEN] S-8c: once the vendor receipt exists the same setup is GREEN" \
+  "[ '$RC3' -eq 0 ] && printf '%s' \"\$OUT3\" | grep -q 'codex-birth: PASS' && printf '%s' \"\$OUT3\" | grep -q 'result: green'"
+want "S-8c: the trusted rerun is byte-idempotent — it neither rewrote the config nor touched the receipt" \
+  "[ \"\$(sha256sum '$CODEX_HOME_SANDBOX/config.toml' | cut -d' ' -f1)\" = '$CODEX_CONFIG_TRUSTED' ]"
+want_auth_untouched "S-8c"
+rm -rf "$HOME/.codex" "$XDG_DATA_HOME/entwurf/codex-mcp" "$XDG_DATA_HOME/entwurf/codex-statusline" "$CODEX_BIRTH_UNIT_ROOT"
+
 # ── S-9: rail certification is a SEPARATE axis from install success (#78 D1) ──
 # The 0.20.0 macOS lane opened the installers to Darwin (meta-bridge-install.sh's
 # platform gate became its own python3/node dependency instead of the platform
@@ -379,8 +492,8 @@ PROJ9C="$SB/proj9c"; mkdir -p "$PROJ9C"
 seed_auth
 set +e; OUT="$(PATH="$FAKE_UNAME:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9C" 2>&1)"; RC=$?; set -e
 want "S-9c: a harness-free uncertified host still exits 0" "[ '$RC' -eq 0 ]"
-want "S-9c: all five harness probes are still zero-state SKIPs" \
-  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP'"
+want "S-9c: all six harness probes are still zero-state SKIPs" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP'"
 want "S-9c: core still PASSes and the computed summary is still green" \
   "printf '%s' \"\$OUT\" | grep -q 'core: PASS' && printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
 want "S-9c: an absent harness is never given a rail verdict it did not earn" \

package/scripts/smoke-user-scope-citizen.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # smoke-user-scope-citizen — deterministic gate for pi packages[] citizen
-# registration/removal (register-pi-package.py). Offline/hermetic: a fake
-# settings file + a fake REPO_DIR under $TMP, no pi, no network, no ~/.pi touched.
+# registration/removal (register-pi-package.py). Offline/hermetic: fake settings
+# files and fake REPO_DIRs under $TMP, sandboxed HOME/PI_CODING_AGENT_DIR/XDG,
+# no network, nothing of the operator's ~/.pi read or written.
 #
 # Guards the wiring that dropped when `pi install` was removed from setup
 # (2026-07-03: `--entwurf-control` / `--emacs-agent-socket` unknown in a foreign
@@ -10,10 +11,14 @@
 # in another repo. This gate is that missing tripwire: if the registration ever
 # regresses, `pnpm run check:full` goes red.
 #
-# Cells 11–13 close the second omission (#53 B): every case here drove a fake
-# settings file with ABSOLUTE entries, so the portable, settings-relative form this
-# repo actually commits was never registered against — and `setup` duplicated and
-# restyled the tracked file for four cuts without a single gate seeing it.
+# Cells 11–13 close the second omission (#53 B): every case before them drove a fake
+# settings file with ABSOLUTE entries, so the portable, settings-relative form was
+# never registered against — and `setup` duplicated and restyled a tracked file for
+# four cuts without a single gate seeing it.
+#
+# Cell 15 closes the third (#110), and it is the one cell here that SPAWNS pi: the
+# defect is not a byte, it is which of two checkouts wins `--entwurf-control`, and
+# only the real loader can say. It uses the pinned devDep pi, never PATH.
 set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1 # snapshot purity: no ignored scripts/__pycache__ writes under qualification
 
@@ -193,69 +198,64 @@ assert d['defaultProvider']=='openai-codex', 'run.sh remove-user-scope dropped a
 # idempotent: a second remove-user-scope is a clean no-op (no crash on absent entry)
 if XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1; then ok "run.sh remove-user-scope is idempotent (no-op second run)"; else bad "run.sh remove-user-scope second run crashed"; fi
 
-# ── 11–13. #53 B: install must not dirty a tracked, formatter-governed settings file
+# ── 11–13. #53 B: a settings-relative self entry is source, never install state
 # The cell whose ABSENCE let this ship. Every case above drove a fake settings file
-# with absolute entries, so the one shape this repo actually commits — the portable,
-# settings-relative `".."` that check-install-surface S7c pins — was never registered
-# against. `setup` therefore appended the absolute path BESIDE it and rewrote the
-# tracked, biome-owned bytes at indent=2, and `pnpm check` died at step 1 reading
-# "format error" instead of "install wrote this".
+# with ABSOLUTE entries, so the portable, settings-relative form — the one shape
+# register never WRITES, and must therefore never duplicate, absolutize or restyle —
+# was never registered against. `setup` appended the absolute path BESIDE it and
+# rewrote the file at indent=2, and `pnpm check` died at step 1 reading "format
+# error" instead of "install wrote this".
 #
-# The seed is the repo's OWN committed settings, copied into a stand-in checkout so
-# `".."` resolves to that clone rather than to the real repo (nothing here touches
-# $REPO). Setup landing is PROVEN before any product verdict: if the seed is not the
-# portable form, this says SETUP MISS in its own name instead of blaming the code.
+# The seed is a FIXTURE. It used to be this repo's OWN committed `.pi/settings.json`,
+# because the repo shipped `packages: [".."]`; #110 retired that entry (entwurf's own
+# checkout self-registers through user scope alone, so a second checkout can no
+# longer register a rival copy of pi-extensions). A witness that depends on us still
+# SHIPPING the shape it tests dies with the shape — and the shape it tests did not
+# die. An operator may hand-write a settings-relative entry, and
+# `is_settings_relative_self` is also what stops an unrelated relative package
+# (`../../repos/gh/andenken`) from being read as ours. Dropping the fixture to a
+# literal here makes the reason honest: the predicate is the subject, not our bytes.
 CLONE="$TMP/selfclone"; mkdir -p "$CLONE/.pi"
 CS="$CLONE/.pi/settings.json"
-seed_src=""
-if (cd "$REPO" && git show :.pi/settings.json) > "$CS" 2>/dev/null && [ -s "$CS" ]; then
-  seed_src="candidate index"
-elif cp "$REPO/.pi/settings.json" "$CS" 2>/dev/null; then
-  seed_src="worktree"
+# Tab-indented with a compact array on purpose: cell 13 pins that a genuine rewrite
+# preserves the file's own indent unit, and 11b below pins that this file is not
+# rewritten at all. A seed written in the writer's default style could not tell the
+# two apart.
+printf '{\n\t"skills": ["../.claude/skills"],\n\t"packages": [".."]\n}\n' > "$CS"
+BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
+OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
+AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
+if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
+  ok "11 register against a settings-relative self entry is a no-op"
+else
+  bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
 fi
-if [ ! -s "$CS" ]; then
-  bad "11 SETUP MISS: could not seed this repo's own .pi/settings.json (no git object, no worktree file)"
-elif ! python3 -c "
-import json,sys
-p=json.load(open(sys.argv[1])).get('packages')
-sys.exit(0 if p==['..'] else 1)" "$CS"; then
-  bad "11 SETUP MISS: the seed ($seed_src) is not the committed portable form (packages != ['..']) — product verdict withheld"
+if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
+  ok "11b the formatter-governed bytes are UNCHANGED (sha256 + mtime)"
 else
-  BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
-  OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
-  AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
-  if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
-    ok "11 register against this repo's OWN committed settings is a no-op (seed: $seed_src)"
-  else
-    bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
-  fi
-  if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
-    ok "11b the tracked, formatter-governed bytes are UNCHANGED (sha256 + mtime)"
-  else
-    bad "11b install rewrote the tracked settings file (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
-  fi
-  # The inverse direction of the same asymmetry: the shared matcher now RECOGNIZES
-  # `".."`, so an uninstall that deleted it would edit committed source — the same
-  # defect pointed the other way. remove leaves it and says so; dry-run agrees,
-  # because both ask one predicate.
-  BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
-  OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
-  OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
-  if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
-    ok "11c --remove does NOT delete the committed portable entry (bytes unchanged)"
-  else
-    bad "11c --remove edited the repo's committed settings source" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
-    ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
-  else
-    bad "11d --remove left the entry without saying so" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
-    ok "11e --dry-run agrees with remove (one predicate, no over-report)"
-  else
-    bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
-  fi
+  bad "11b register rewrote a settings file it only recognizes (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
+fi
+# The inverse direction of the same asymmetry: the shared matcher RECOGNIZES `".."`,
+# so an uninstall that deleted it would edit source it never wrote — the same defect
+# pointed the other way. remove leaves it and says so; dry-run agrees, because both
+# ask one predicate.
+BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
+OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
+OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
+if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
+  ok "11c --remove does NOT delete a settings-relative self entry (bytes unchanged)"
+else
+  bad "11c --remove edited settings source it never authored" "$OUT_RM"
+fi
+if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
+  ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
+else
+  bad "11d --remove left the entry without saying so" "$OUT_RM"
+fi
+if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
+  ok "11e --dry-run agrees with remove (one predicate, no over-report)"
+else
+  bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
 fi
 
 # 12. the state a pre-fix `setup` already left on real hosts: the portable entry AND
@@ -291,12 +291,20 @@ if grep -q $'^\t"packages"' "$S"; then ok "13 a rewrite preserves the file's tab
 # indent=2 — semantically a no-op, byte-wise a RED `pnpm check` diagnosed as "formatting".
 # A per-writer cell can never see that; only the real drive can. So this one runs
 # `run.sh install <checkout>` for real and demands sha256 + mtime invariance.
-#
 # The checkout is a stand-in: run.sh resolves its OWN symlinks to find REPO_DIR, so
 # run.sh is COPIED (a link would point the drive back at the operator's real repo) while
 # the trees it only reads are linked. That makes REPO_DIR == the stand-in, which is the
-# shape that matters — `".."` in <checkout>/.pi/settings.json resolves to the very repo
-# being registered, exactly as it does in a dev clone.
+# shape that matters — the drive installs entwurf INTO entwurf's own checkout, exactly
+# as `./run.sh setup` does from a dev clone (PROJECT_DIR_DEFAULT=$(pwd)).
+#
+# #110 raised what this cell demands. "install is a no-op here" used to hold because
+# the committed `packages: [".."]` already satisfied the writer. That entry is gone,
+# so the writer must instead RECOGNIZE that the project it is installing into IS this
+# root and skip project scope entirely — user scope already registers it, and a second
+# entry naming a different checkout is what made pi load two rival copies of
+# pi-extensions/entwurf-control.ts. The invariant, tested end to end below: entwurf's
+# own checkout carries no project-scope self-registration, in tracked bytes OR in
+# bytes a writer produced.
 CK="$TMP/checkout"
 mkdir -p "$CK/.pi"
 cp "$REPO/run.sh" "$CK/run.sh"
@@ -317,8 +325,8 @@ if [ ! -s "$CKS" ]; then
 elif ! python3 -c "
 import json,sys
 d=json.load(open(sys.argv[1]))
-sys.exit(0 if d.get('packages')==['..'] and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
-  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed portable form (packages ['..'] + entwurfProvider)"
+sys.exit(0 if d.get('packages') is None and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
+  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed form (no packages key + entwurfProvider)"
 else
   CK_BEFORE="$(sha256sum "$CKS" | cut -d' ' -f1)"; CK_MT="$(stat -c %Y "$CKS")"
   sleep 1
@@ -359,6 +367,124 @@ else
     else
       bad "14d the user-scope citizen was not written under the sandboxed PI_CODING_AGENT_DIR" "$ck_out"
     fi
+    # The invariant, read off the file the drive just wrote through: no writer put a
+    # project-scope self-registration back. 14b already pins the bytes, but a writer
+    # that ADDED `packages` to a file with no `packages` key would fail 14b for a
+    # reason a reader could mistake for formatting; this says the thing #110 is about,
+    # in its own words.
+    L14E="14e install into entwurf's OWN checkout wrote no project-scope packages[] self-registration [QK:SELF-CHECKOUT-PROJECT-REGISTRATION]"
+    if python3 -c "
+import json,sys
+sys.exit(0 if json.load(open(sys.argv[1])).get('packages') is None else 1)" "$CKS"; then
+      ok "$L14E"
+    else
+      bad "$L14E — violated: install self-registered this checkout, so a second checkout will load a rival copy of pi-extensions" "$(cat "$CKS")"
+    fi
+    case "$ck_out" in
+      *"project-scope packages[] skipped"*) ok "14f the drive REPORTS the skip (a silent skip and a silent write read alike)" ;;
+      *) bad "14f install skipped project scope without saying so — 14e cannot tell that apart from a writer that never ran" "$ck_out" ;;
+    esac
+  fi
+fi
+
+# ── 15. #110: the operator-observable this whole contract exists for ───────────
+# Cells 11–14 read settings bytes. Bytes are the mechanism; the SYMPTOM is what pi
+# does with them, and that is what nobody could see: a second checkout booted pi,
+# printed all seven `entwurf` model rows, and looked fine, while `--entwurf-control`
+# — the flag that makes a pi session a garden citizen — was being served by the
+# branch copy, and the INSTALLED extension failed to load with an error naming the
+# installed path as the loser. Not silent. Designed to be misread.
+#
+# pi's package identity is `local:<resolved path>` and dedupePackages collapses only
+# EQUAL identities (package-manager.js getPackageIdentity/dedupePackages), so two
+# real checkouts can never merge — no realpath rule, ours or pi's, would fix this.
+# The only lever is not registering the second one.
+#
+# The cell is control-then-assert on purpose. A sandbox where pi loads no project
+# settings at all (untrusted cwd, missing extension deps, a probe that dies early)
+# would report "no conflicts" for reasons that have nothing to do with the contract,
+# and that green would be a lie. So it first PLANTS the retired entry and demands the
+# conflict APPEAR; only a cell that has just watched the defect happen is allowed to
+# assert its absence.
+# Two different absences, and only one of them is allowed to be quiet. A tree with no
+# `node_modules` at all is a genuinely reduced checkout and the property is untestable
+# there — a named skip. A tree that HAS dependencies but no pinned pi is a broken dev
+# checkout, and skipping it would hide the breakage behind an exit-0 gate, so that one
+# fails loud. (The qualification snapshot is the first case only in principle: it
+# symlinks the origin's node_modules in after its baseline commit — mutation-qualify.ts
+# createRepoSnapshot — so cell 15 really runs there, which is what lets the two mutants
+# below cover this skip. A skip nobody can reach with a planted defect would be exactly
+# the quiet green this cell is built to refuse.)
+PI_BIN_PINNED="$REPO/node_modules/.bin/pi"
+if [ ! -d "$REPO/node_modules" ]; then
+  echo "  skip  15 second-checkout probe skipped: this tree has no node_modules (reduced checkout); the property is untestable here, not violated"
+elif [ ! -x "$PI_BIN_PINNED" ]; then
+  bad "15 the pinned pi is missing from a checkout that HAS dependencies ($PI_BIN_PINNED) — a broken dev checkout, not a reduced one; re-run pnpm install"
+else
+  A15="$TMP/dual/installed"; B15="$TMP/dual/second"
+  AG15="$TMP/agent15"
+  mkdir -p "$A15/.pi" "$B15/.pi" "$AG15"
+  # pi-extensions is COPIED into each root, not linked: the defect is two DISTINCT
+  # real paths declaring the same flag, and a shared symlink target would be one path
+  # wearing two names — a fixture that cannot reproduce what two checkouts do.
+  for root in "$A15" "$B15"; do
+    cp -R "$REPO/pi-extensions" "$root/pi-extensions"
+    for entry in node_modules package.json protocol.js; do
+      [ -e "$REPO/$entry" ] && ln -s "$REPO/$entry" "$root/$entry"
+    done
+  done
+  # user scope registers the INSTALLED root, absolutely — what `register_user_scope_citizen`
+  # writes on a real host. Trust is seeded for the second checkout because `.pi/` is a
+  # trust-gated input: an untrusted cwd loads no project settings, which would silence
+  # the control below and make the assertion vacuous.
+  printf '{"packages": ["%s"]}\n' "$A15" > "$AG15/settings.json"
+  printf '{"%s": true}\n' "$B15" > "$AG15/trust.json"
+  # Two fences on the probe child, and BOTH are load-bearing.
+  #
+  # `< /dev/null`: `pi --print` reads a non-tty stdin as piped prompt input, so it
+  # inherits whatever the CALLER handed this gate. Under an interactive shell or a
+  # /dev/null stdin that ends immediately and the probe returns in ~2s; under a
+  # supervised runner — which hands the process an open socket — it blocks forever.
+  # Measured 2026-09-10: a release-gate run sat 1h56m on this line with `pi` alive
+  # and no output, and the gate has no timeout of its own to catch it. A gate must
+  # read the loader, never the stdin of whoever started it.
+  #
+  # `timeout 60`: even so, a probe that cannot finish must go RED rather than hang.
+  # 124 lands in the captured output, the conflict grep misses, and the cell fails
+  # with its own name — the honest outcome for "the loader never answered".
+  #
+  # Ambient identity carriers are stripped for the same reason: a live pi/ACP session
+  # exports PI_SESSION_ID/PI_AGENT_ID and CLAUDE_CONFIG_DIR into children.
+  probe15() {
+    (cd "$B15" && env -u PI_SESSION_ID -u PI_AGENT_ID -u CLAUDE_CONFIG_DIR \
+      HOME="$TMP/home" PI_CODING_AGENT_DIR="$AG15" \
+      XDG_DATA_HOME="$TMP/xdg" XDG_STATE_HOME="$TMP/state" XDG_CACHE_HOME="$TMP/cache" \
+      timeout 60 "$PI_BIN_PINNED" --model zzz-no-such-provider/zzz-no-such-model --print x \
+      </dev/null 2>&1 || true)
+  }
+  # CONTROL: the retired shape, re-planted. `".."` resolves against <B>/.pi, so the
+  # project entry names B while user scope names A — two identities, both loaded.
+  printf '{"packages": [".."]}\n' > "$B15/.pi/settings.json"
+  OUT15_CTL="$(probe15)"
+  if printf '%s' "$OUT15_CTL" | grep -q 'conflicts with'; then
+    ok "15 control: a second checkout that registers itself DOES collide on the extension flags"
+  else
+    bad "15 SETUP MISS: the planted second registration produced no conflict — this sandbox cannot observe the defect, so 15b would be vacuous" "$OUT15_CTL"
+  fi
+  # ASSERT: this repo's real `.pi/settings.json`, read from the WORKING TREE — not
+  # from the candidate index the way cells 11/14 read theirs. The subject here is
+  # what pi's loader does with the file that exists ON DISK when a session starts;
+  # the index is a different question and check-install-surface S7c already owns it.
+  # Reading the index here also made this cell blind to its own replant: a mutation
+  # writes the file, git show reads the staged bytes, and the gate stayed green over
+  # a planted defect (measured — qualification reported SURVIVED, 2026-09-10).
+  cp "$REPO/.pi/settings.json" "$B15/.pi/settings.json"
+  OUT15="$(probe15)"
+  L15B="15b a second checkout of this repo boots pi with zero extension conflicts [QK:SECOND-CHECKOUT-EXTENSION-COLLISION]"
+  if printf '%s' "$OUT15" | grep -q 'conflicts with'; then
+    bad "$L15B — violated: the branch copy wins --entwurf-control and the INSTALLED extension fails, printing the installed path as the loser" "$OUT15"
+  else
+    ok "$L15B"
   fi
 fi
 
@@ -740,14 +866,16 @@ if [ "$RC34B" -ne 0 ] && printf '%s' "$OUT34B" | grep -q 'CORRUPT'; then
   ok "34b doctor coupling FAILs on a wrong-type provider installerRoot (named CORRUPT) $QK34"
 else bad "34b doctor stayed green/silent over a corrupt installerRoot (rc=$RC34B): $OUT34B $QK34"; fi
 
-# 15. WIRING: both writers of this one file must share the serializer, not copy it.
+# 35. WIRING: both writers of this one file must share the serializer, not copy it.
 #     A duplicated indent-detector is how the provider writer stayed open after the
 #     package writer was closed; a parity check is cheaper than a third round.
+#     (Numbered 35, after the ownership block: it used to be a second "15", which
+#     stopped being merely untidy once #110 added the real cell 15 above.)
 for w in register-pi-package.py register-pi-provider.py; do
   if grep -q "from pi_settings_io import" "$REPO/scripts/$w"; then
-    ok "15 $w routes through the shared pi_settings_io serializer"
+    ok "35 $w routes through the shared pi_settings_io serializer"
   else
-    bad "15 $w serializes settings on its own again (copied rule = the #53 B shape)"
+    bad "35 $w serializes settings on its own again (copied rule = the #53 B shape)"
   fi
 done
 

package/scripts/tsconfig.json

@@ -31,6 +31,7 @@
 		"../pi-extensions/model-lock.ts",
 		"../pi-extensions/meta-bridge-hook.ts",
 		"../pi-extensions/meta-bridge-hook-copilot.ts",
+		"../pi-extensions/meta-bridge-hook-codex.ts",
 		"../pi-extensions/meta-bridge-omp.ts",
 		"../pi-extensions/meta-bridge-receive-omp.ts",
 		"../mcp/entwurf-bridge/src/resume-mode.ts"