@junghanacs/entwurf 0.20.1 → 0.21.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/codex-fresh-preflight.js

@@ -0,0 +1,326 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse } from "smol-toml";
+import { checkCodexSocketFile, realCodexProtocolOpener, resolveCodexDefaultSocketPath, } from "./native-push/codex-ws-client.js";
+export const CODEX_PREFLIGHT_HINT = {
+    "codex-birth-unit-missing": "the Codex SessionStart birth unit is absent, drifted from its recorded digests, or unsafely owned; run `entwurf install-codex-birth`, then `entwurf doctor-codex-birth`",
+    "codex-birth-trust-missing": "the vendor has recorded no trust receipt for this birth declaration, so the hook is declared and never runs; open a visible plain Codex, answer its prompt with `Trust all and continue`, send one first turn, then `entwurf doctor-codex-birth`",
+    "codex-mcp-hand-missing": "the Codex user config does not expose the managed entwurf bridge; run `entwurf install-codex-mcp`, then `entwurf doctor-codex-mcp`",
+    "codex-visible-identity-missing": "Codex tui.status_line does not include thread-title; run `entwurf install-codex-statusline`, then `entwurf doctor-codex-statusline`",
+    "codex-app-server-unavailable": "the operator-owned Codex app-server default socket is absent or unsafe; start `codex app-server --listen unix://$CODEX_HOME/app-server-control/app-server-control.sock` and retry",
+};
+/**
+ * The unit's paths are the operator's own, derived from the SAME environment the installer
+ * reads — never a system location and never a flag. A preflight that resolved them any other
+ * way could pass while the installed unit sat somewhere else.
+ */
+function unitPaths(env) {
+    const home = env.HOME?.trim() ?? "";
+    const codexHome = env.CODEX_HOME?.trim() || path.join(home, ".codex");
+    const dataHome = env.XDG_DATA_HOME?.trim() || path.join(home, ".local", "share");
+    const unitRoot = path.join(dataHome, "entwurf", "codex-birth");
+    return {
+        hooksFile: path.join(codexHome, "hooks.json"),
+        helperDir: path.join(unitRoot, "helper"),
+        stateFile: path.join(unitRoot, "install-state.json"),
+    };
+}
+const CODEX_MCP_ENV_VARS = [
+    "CODEX_HOME",
+    "ENTWURF_DIR",
+    "PI_CODING_AGENT_DIR",
+    "ENTWURF_META_SESSIONS_DIR",
+    "ENTWURF_META_MAILBOX_DIR",
+    "ENTWURF_META_SENDERS_DIR",
+    "ENTWURF_META_RECEIVERS_DIR",
+    "TMUX",
+    "TMUX_PANE",
+];
+function isSafeOwnedFile(file, expectedUid, executable = false) {
+    try {
+        const stat = fs.lstatSync(file);
+        return (stat.isFile() &&
+            !stat.isSymbolicLink() &&
+            stat.uid === expectedUid &&
+            (stat.mode & 0o022) === 0 &&
+            (!executable || (stat.mode & 0o111) !== 0));
+    }
+    catch {
+        return false;
+    }
+}
+function isSafeOwnedDir(dir, expectedUid) {
+    try {
+        const stat = fs.lstatSync(dir);
+        return stat.isDirectory() && !stat.isSymbolicLink() && stat.uid === expectedUid && (stat.mode & 0o022) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The unit's own ownership state, read as the digest inventory it is. Bytes that merely
+ * EXIST prove nothing: the launcher codex is about to exec must be the one this unit
+ * published, so every recorded member is compared to its recorded digest before a sibling
+ * is opened. No digest is computed for the VENDOR here — that is a different axis below.
+ */
+function closureDriftedFromState(paths, expectedUid) {
+    // The directory holding the state carries the state's authority: anyone who can write it
+    // can replace the inventory every digest below is compared against.
+    if (!isSafeOwnedDir(path.dirname(paths.stateFile), expectedUid))
+        return true;
+    if (!isSafeOwnedDir(path.dirname(path.dirname(paths.stateFile)), expectedUid))
+        return true;
+    if (!isSafeOwnedFile(paths.stateFile, expectedUid))
+        return true;
+    let state;
+    try {
+        state = JSON.parse(fs.readFileSync(paths.stateFile, "utf8"));
+    }
+    catch {
+        return true;
+    }
+    if (state.schema !== "codex-birth-install-state/v1" || state.status !== "installed")
+        return true;
+    if (state.hooksFile !== paths.hooksFile || state.helperDir !== paths.helperDir)
+        return true;
+    const digest = (file) => {
+        try {
+            return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+        }
+        catch {
+            return null;
+        }
+    };
+    if (typeof state.hooksSha256 !== "string" || digest(paths.hooksFile) !== state.hooksSha256)
+        return true;
+    const members = state.helperFiles;
+    if (!Array.isArray(members))
+        return true;
+    // Exactly the closure the installer publishes: a short inventory would leave a member
+    // nothing compares, which is the same hole as not checking digests at all.
+    const named = members.map((raw) => raw?.path);
+    const expected = [
+        "codex-birth-launch.sh",
+        "meta-bridge-hook-codex.ts",
+        "lib/meta-session.ts",
+        "lib/native-push/codex-ws-client.ts",
+        "lib/session-id.js",
+        "entwurf-capabilities.json",
+    ];
+    if (named.length !== expected.length)
+        return true;
+    if (expected.some((name) => !named.includes(name)))
+        return true;
+    if (named.some((name, index) => named.indexOf(name) !== index))
+        return true;
+    for (const raw of members) {
+        const member = raw;
+        const rel = member.path;
+        if (typeof rel !== "string" || rel.length === 0 || rel.startsWith("/") || rel.split("/").includes("..")) {
+            return true;
+        }
+        if (typeof member.sha256 !== "string" || digest(path.join(paths.helperDir, rel)) !== member.sha256)
+            return true;
+    }
+    return false;
+}
+function birthMissing(paths, expectedUid) {
+    const launcher = path.join(paths.helperDir, "codex-birth-launch.sh");
+    const directories = [
+        path.dirname(paths.hooksFile),
+        paths.helperDir,
+        path.join(paths.helperDir, "lib"),
+        path.join(paths.helperDir, "lib", "native-push"),
+    ];
+    if (directories.some((dir) => !isSafeOwnedDir(dir, expectedUid)))
+        return true;
+    if (!isSafeOwnedFile(paths.hooksFile, expectedUid))
+        return true;
+    const closure = [
+        [launcher, true],
+        [path.join(paths.helperDir, "meta-bridge-hook-codex.ts"), false],
+        [path.join(paths.helperDir, "lib", "meta-session.ts"), false],
+        [path.join(paths.helperDir, "lib", "native-push", "codex-ws-client.ts"), false],
+        [path.join(paths.helperDir, "lib", "session-id.js"), false],
+        [path.join(paths.helperDir, "entwurf-capabilities.json"), false],
+    ];
+    if (closure.some(([file, executable]) => !isSafeOwnedFile(file, expectedUid, executable)))
+        return true;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(paths.hooksFile, "utf8"));
+        const events = parsed.hooks?.SessionStart;
+        if (!Array.isArray(events) || events.length !== 1)
+            return true;
+        const group = events[0];
+        if ("matcher" in group || !Array.isArray(group.hooks) || group.hooks.length !== 1)
+            return true;
+        const hook = group.hooks[0];
+        if (Object.keys(hook).sort().join(",") !== "command,timeout,type")
+            return true;
+        if (hook.type !== "command" || hook.command !== `'${launcher}'` || hook.timeout !== 30)
+            return true;
+    }
+    catch {
+        return true;
+    }
+    return closureDriftedFromState(paths, expectedUid);
+}
+/**
+ * The vendor's own receipt for THIS declaration, read and never written. The key the vendor
+ * writes is `<declaration path>:<event>:<group>:<handler>`; the value must be a
+ * `trusted_hash` of the shape `sha256:<64 hex>`. What this asserts is that a receipt EXISTS
+ * for our declaration identity — never that the hash is correct, which only the vendor can
+ * say, and never by launching Codex to find out.
+ */
+function trustReceiptMissing(config, hooksFile) {
+    const hooks = config.hooks;
+    if (hooks == null || typeof hooks !== "object" || Array.isArray(hooks))
+        return true;
+    const state = hooks.state;
+    if (state == null || typeof state !== "object" || Array.isArray(state))
+        return true;
+    const entry = state[`${hooksFile}:session_start:0:0`];
+    if (entry == null || typeof entry !== "object" || Array.isArray(entry))
+        return true;
+    const digest = entry.trusted_hash;
+    return typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest);
+}
+function readConfig(env) {
+    try {
+        const text = fs.readFileSync(path.join(env.CODEX_HOME?.trim() || path.join(env.HOME ?? "", ".codex"), "config.toml"), "utf8");
+        const value = parse(text);
+        return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function mcpMissing(config) {
+    const servers = config.mcp_servers;
+    if (servers == null || typeof servers !== "object" || Array.isArray(servers))
+        return true;
+    const entry = servers["entwurf-bridge"];
+    if (entry == null || typeof entry !== "object" || Array.isArray(entry))
+        return true;
+    const server = entry;
+    if (Object.keys(server).sort().join(",") !== "command,env,env_vars")
+        return true;
+    const envVars = server.env_vars;
+    if (!Array.isArray(envVars) ||
+        envVars.length !== CODEX_MCP_ENV_VARS.length ||
+        envVars.some((name, index) => name !== CODEX_MCP_ENV_VARS[index]))
+        return true;
+    const env = server.env;
+    if (env == null || typeof env !== "object" || Array.isArray(env))
+        return true;
+    const serverEnv = env;
+    return (server.command !== "entwurf-bridge" ||
+        Object.keys(serverEnv).join(",") !== "ENTWURF_BRIDGE_NATIVE_HOST" ||
+        serverEnv.ENTWURF_BRIDGE_NATIVE_HOST !== "codex");
+}
+function visibleIdentityMissing(config) {
+    const tui = config.tui;
+    if (tui == null || typeof tui !== "object" || Array.isArray(tui))
+        return true;
+    const statusLine = tui.status_line;
+    return !Array.isArray(statusLine) || !statusLine.includes("thread-title");
+}
+const DEFAULT_APP_SERVER_TIMEOUT_MS = 5_000;
+function withTimeout(promise, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("codex app-server exchange timed out")), timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+/**
+ * A bounded real initialize/liveness exchange over the app-server's own JSON-RPC. The inode
+ * check above only proves a socket FILE with the right owner and mode exists — a dead
+ * app-server's stale socket a new process has not reclaimed yet passes that check identically
+ * to a live one. Only a real connection plus a real `initialize` round trip distinguishes them.
+ * Any failure — refused/hung connection, a response that never lands within the bound, or a
+ * reply the transport itself rejects — answers identically: not live. This is deliberately not
+ * `probeCodexThread`: preflight asks "is the app-server there to talk to", never "is a specific
+ * thread loaded", so it carries no thread id and no retry/backoff policy.
+ */
+async function appServerIsLive(socketPath, openProtocol, timeoutMs) {
+    let protocol;
+    const opening = openProtocol.open(socketPath);
+    try {
+        protocol = await withTimeout(opening, timeoutMs);
+    }
+    catch {
+        // The bound expired (or the connect failed), but a slow open can still LAND afterwards.
+        // Nothing else holds that handle, so a late success would leave a live connection to the
+        // operator's app-server open for the rest of this process. Close it when it arrives —
+        // the answer stays "not live" either way; this only refuses to leak.
+        void opening.then((late) => {
+            try {
+                late.close();
+            }
+            catch {
+                // best-effort: the socket may already be gone.
+            }
+        }, () => {
+            // The open failed; there is nothing to close.
+        });
+        return false;
+    }
+    try {
+        await withTimeout(protocol.request("initialize", {
+            clientInfo: { name: "entwurf-fresh-preflight", title: "entwurf-fresh-preflight", version: "0" },
+            capabilities: { experimentalApi: true, requestAttestation: false },
+        }), timeoutMs);
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            protocol.close();
+        }
+        catch {
+            // best-effort: the socket may already be gone.
+        }
+    }
+}
+/**
+ * Async because the app-server axis now performs a real bounded protocol exchange, not just an
+ * inode check (see `appServerIsLive`). Every other axis stays synchronous filesystem/config
+ * work; only the last `await` point can suspend.
+ */
+export async function codexFreshPreflight(env, deps = {}) {
+    const paths = deps.unitPathsOverride ?? unitPaths(env);
+    // A relative root would make the declaration's launcher path — the very string the vendor
+    // keys its trust receipt to — depend on this process's cwd.
+    if (!path.isAbsolute(paths.hooksFile) || !path.isAbsolute(paths.helperDir) || !path.isAbsolute(paths.stateFile)) {
+        return "codex-birth-unit-missing";
+    }
+    if (birthMissing(paths, deps.operatorUid ?? process.getuid?.() ?? -1)) {
+        return "codex-birth-unit-missing";
+    }
+    const config = readConfig(env);
+    // The vendor receipt is a SEPARATE reject from our bytes: perfect bytes the vendor will
+    // not run and absent bytes are two different repairs, and folding them would send the
+    // operator to the installer for something only they can answer in their own Codex.
+    if (config === null || trustReceiptMissing(config, paths.hooksFile))
+        return "codex-birth-trust-missing";
+    if (mcpMissing(config))
+        return "codex-mcp-hand-missing";
+    if (visibleIdentityMissing(config))
+        return "codex-visible-identity-missing";
+    const socketPath = resolveCodexDefaultSocketPath(env);
+    const socket = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+    if (!socket.ok)
+        return "codex-app-server-unavailable";
+    const live = await appServerIsLive(socketPath, deps.openProtocol ?? realCodexProtocolOpener, deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS);
+    return live ? null : "codex-app-server-unavailable";
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -26,7 +26,7 @@
  * a same-gid socket exists would be half a lie. Both leave the normal output;
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
-import { isOutOfSocketDomainGardenIdConflict, resolveFactList, } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict, resolveFactList, UNOBSERVED_PEER, } from "./entwurf-facts.js";
 import { observePeerFacts } from "./entwurf-peer-observe.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
@@ -130,9 +130,29 @@ export async function listEntwurfFacts(deps) {
     // 4. resolveFactList over CLEAN inputs only. Its throws (duplicate identity /
     //    unprobed in-domain citizen) are impossible wiring invariants — left to
     //    fire as the last line of defense, never caught here.
+    //
+    //    A peers surface may bound observation to its SAME newest rendered rows. Receiver
+    //    observation can inspect process state and historical Claude markers, so doing it
+    //    for every retained record made bounded text grow linearly with history. The generic
+    //    provider stays unbounded when no limit is supplied. Either way the full clean
+    //    identity/probe arrays reach the core: certification, duplicate detection,
+    //    diagnostics, liveness, and the machine payload remain complete. Only an observation
+    //    not performed becomes `unobserved`.
     const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
     const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-    const facts = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
+    const observe = deps.observe ?? observePeerFacts;
+    let selectedObserve = observe;
+    if (deps.observationLimit !== undefined) {
+        if (!Number.isSafeInteger(deps.observationLimit) || deps.observationLimit < 0) {
+            throw new Error("listEntwurfFacts: observationLimit must be a non-negative safe integer");
+        }
+        const observedGardenIds = new Set([...cleanIdentities]
+            .sort((a, b) => (a.gardenId < b.gardenId ? -1 : a.gardenId > b.gardenId ? 1 : 0))
+            .slice(Math.max(0, cleanIdentities.length - deps.observationLimit))
+            .map((identity) => identity.gardenId));
+        selectedObserve = (identity) => (observedGardenIds.has(identity.gardenId) ? observe(identity) : UNOBSERVED_PEER);
+    }
+    const facts = resolveFactList(cleanIdentities, cleanProbes, selectedObserve);
     // 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
     //    section. One diagnostic per socket (subjects aggregate at render, F8);
     //    the message is liveness-keyed so same-state sockets group into one line.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peers-render.js

@@ -22,6 +22,8 @@
  *     socketPath rows — the pre-record socket-scan worldview) is gone with the
  *     `controlDir` it exposed. Socket paths are dispatch-internal transport.
  */
+/** Human rows and expensive provider observations share this one presentation budget. */
+export const ENTWURF_PEERS_RENDER_LIMIT = 32;
 // `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
 // found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
 // about it. They earn a column because for every claude-code row `liveness` reads
@@ -102,7 +104,7 @@ function renderDiagnosticLines(diagnostics) {
     }
     return lines;
 }
-function compactLines(lines, max = 32) {
+function compactLines(lines, max = ENTWURF_PEERS_RENDER_LIMIT) {
     if (lines.length <= max)
         return lines;
     const omitted = lines.length - max;

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -110,13 +110,12 @@ export function isLivenessSupported(backend) {
 }
 // ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
 // A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
-// live app-server conversation probe — antigravity's LS gRPC), NOT a control
-// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS: an agy session
-// is `unsupported` on the socket FACT axis (entwurf_peers) yet fully
-// measured + deliverable on the native-push axis. The two are separate rails on
-// purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
-// (a backend can never be in both domains).
-export const NATIVE_PUSH_BACKENDS = ["antigravity"];
+// live vendor app-server target probe), NOT a control socket. This domain is DISJOINT
+// from LIVENESS_DOMAIN_BACKENDS: an Antigravity or Codex session is `unsupported` on
+// the socket FACT axis (entwurf_peers) yet independently measured on the native-push
+// axis. The two are separate rails on purpose — check-entwurf-facts pins both sets
+// and asserts their intersection is ∅ (a backend can never be in both domains).
+export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"];
 export function nativePushSupported(backend) {
     return NATIVE_PUSH_BACKENDS.includes(backend);
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-native-push.js

@@ -5,23 +5,21 @@
  * ROUTING (the NATIVE_PUSH_DISPATCH_TABLE did) and carries NO release seam — a native-push
  * plan is the LOCK-FREE path (봉인 4), so a lock leak is structurally impossible here.
  *
- * This is where the 1-shot retry lives — NOT in the adapter leaf (봉인 3). The decider
- * probed a fresh route and planted it in the plan; the executor sends over it, and on a
- * failure it re-probes ONCE (the volatile LS port may have shifted between decide and
- * execute) and re-sends. A second failure is fail-loud (no infinite loop). This mirrors the
- * control-socket send-fallback pattern: the decider stays pure, the hand owns the retry.
+ * Retry is an adapter capability, not a rail-wide assumption. Antigravity re-probes once
+ * because its volatile LS port can shift before send. Codex never retries: `codex queue`
+ * may have accepted the message before its receipt failed, so replay could duplicate it.
+ * The decider stays pure; this hand enforces the adapter's declared policy.
  *
  * A native-push send has NO in-band refuse (there is no live receiver to answer
  * success:false) — like a mailbox enqueue, it either succeeds or THROWS. The hand never
  * folds a throw into {success:false}; the runner maps a thrown error to execution-failed.
  */
+import { formatMetaMailboxBody } from "./meta-mailbox-body.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /**
- * Deliver `content` into the conversation, owning the 1-shot retry (봉인 3). Send over the
- * planted (decider-probed) route first; on failure re-probe ONCE and re-send over the fresh
- * route; a second failure PROPAGATES (fail-loud). If the re-probe finds the target no longer
- * alive, throw — a failed send into a now-dead conversation is an honest non-delivery, never
- * a silent success. The re-probe is the ONLY re-derivation of the volatile route.
+ * Deliver `content` through the decider-probed route. A non-retriable adapter propagates
+ * the first failure unchanged. A retriable adapter re-probes once and sends once more only
+ * when the target is still alive; no adapter gets a third attempt.
  */
 export async function deliverViaNativePush(adapter, route, nativeSessionId, content) {
     try {
@@ -29,8 +27,9 @@ export async function deliverViaNativePush(adapter, route, nativeSessionId, cont
         return { success: true, retried: false };
     }
     catch (firstErr) {
-        // 1-shot re-probe → re-send: the volatile LS route may have shifted since the decider
-        // probed it. Re-discover it fresh and retry exactly once.
+        if (!adapter.retriable)
+            throw firstErr;
+        // One re-probe and one retry for adapters whose send boundary is safe to replay.
         const reprobe = await adapter.probe(nativeSessionId);
         if (reprobe.status !== "alive") {
             throw new Error(`native-push deliver: first send failed and re-probe found target ${reprobe.status} (${reprobe.reason}) — not retried`, { cause: firstErr });
@@ -42,16 +41,30 @@ export async function deliverViaNativePush(adapter, route, nativeSessionId, cont
 }
 /**
  * Build the production `sendNativePush(plan, lock)` adapter the runner consumes. It IGNORES
- * `lock` entirely (a native-push plan is lock-free, 봉인 4) — the field exists only to match
- * the DispatchExecutorDeps hand signature. It resolves the adapter from the plan's backend
- * and delivers with the 1-shot retry. A delivery throw surfaces as a REJECTED promise (the
- * runner's try/catch maps it to execution-failed).
+ * `lock` entirely (a native-push plan is lock-free, 봉인 4), resolves the adapter, then applies
+ * that adapter's retry policy. A delivery throw surfaces as a REJECTED promise (the runner's
+ * try/catch maps it to execution-failed).
+ *
+ * SENDER ENVELOPE (measured #95). Direct injection used to hand the adapter the raw
+ * `plan.message`, so a native-push citizen received a body with no sender. The #95 A LIVE run
+ * measured what that costs: a fresh Pi's nonce-only callback landed in the Codex thread as
+ * bare text, and Codex could not name who called it — the callback was uncorrelatable. The
+ * control-socket rail carries the envelope in its RPC framing and the mailbox rail serializes
+ * it into the body; this rail has neither, so it renders the SAME `formatMetaMailboxBody` SSOT
+ * the mailbox uses. Rendered ONCE, before `deliverViaNativePush`, so an Antigravity re-probe
+ * retry replays byte-identical content (including its timestamp) instead of a second render.
+ * The adapter stays a dumb pipe — its signature is unchanged and it never learns about senders.
  */
 export function makeNativePushSend(deps = {}) {
     const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+    const senderProvider = deps.senderProvider;
     // `_lock` is named for the hand contract but NEVER read — native-push owns/releases no lock.
     return async (plan, _lock) => {
+        // Resolve the sender BEFORE the adapter is resolved or touched: a provider throw must
+        // reject this send with nothing injected, not leave a half-delivered conversation.
+        const sender = senderProvider?.();
+        const content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
         const adapter = resolveAdapter(plan.backend);
-        return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, plan.message);
+        return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, content);
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -210,7 +210,13 @@ export function makeProductionEntwurfV2Deps(opts) {
         sendMailbox: (plan, _lock) => sendViaMailbox(plan, _lock),
         // native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
         // so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).
-        sendNativePush: makeNativePushSend({ resolveAdapter: io.resolveNativePushAdapter }),
+        // It also receives the SAME `opts.senderProvider` the mailbox hand got — one envelope
+        // source for all three rails, so a native-push citizen can name its sender exactly as
+        // a mailbox citizen does (#95: an envelope-less direct injection is uncorrelatable).
+        sendNativePush: makeNativePushSend({
+            resolveAdapter: io.resolveNativePushAdapter,
+            senderProvider: opts.senderProvider,
+        }),
     };
     return {
         decide: (input) => decideDispatch(input, deciderDeps),

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -67,11 +67,14 @@ export function actionableRejectHint(reason) {
                 "Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at " +
                 "that garden id by a session that died without cleaning up.");
         case "native-push-target-dead":
-            // The adapter probe found no live host process for the conversation.
-            return "native-push conversation is not live (no host process found). Re-open the conversation, then retry — there is nothing to inject into.";
+            // The adapter probe found no live native host serving this conversation/thread. Stays
+            // backend-neutral: agy speaks conversations over an LS port, Codex threads over an
+            // app-server socket, and this hint is read by callers of both.
+            return "the native-push conversation/thread is not live — no native host (harness process or app-server) answered the probe for it. Re-open that conversation/thread in its own harness, then retry; there is nothing to inject into.";
         case "native-push-probe-indeterminate":
-            // Host up, but no LS port served the conversation — inconclusive, not a hard dead.
-            return "native-push host is up but no port served this conversation (probe inconclusive). Retry once the conversation is loaded, or verify the conversation id.";
+            // Native host up, but nothing served this conversation/thread — inconclusive, not a
+            // hard dead. Backend-neutral for the same reason as the dead cell above.
+            return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
         case "record-less-socket":
             // #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
             // state, not an addressable citizen (the record is the address).

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-mailbox-body.js

@@ -1,22 +1,29 @@
 /**
  * meta-mailbox-body — the SINGLE source for rendering an entwurf message as a
- * meta-bridge mailbox body. Both transports that can deliver to a garden citizen
- * with no live control socket use this:
+ * meta-bridge mailbox body. Every transport that can deliver to a garden citizen
+ * with no live control socket uses this:
  *   - the MCP bridge entwurf_v2 (mcp/entwurf-bridge) — external/Claude-host sends
  *   - the pi-native entwurf_v2 (pi-extensions/entwurf-control.ts) — pi-session sends
+ *   - the native-push rail (pi-extensions/lib/entwurf-v2-native-push.ts) — direct
+ *     injection into an Antigravity conversation or a loaded Codex thread. Its
+ *     THIRD consumer, added after the #95 A LIVE run measured what an envelope-less
+ *     injection costs: a nonce-only callback arrived in a Codex thread as bare text
+ *     and the receiving citizen could not name who had called it.
  *
  * The control-socket path carries the sender envelope inside its RPC framing; the
- * mailbox path is just a file, so the envelope must be SERIALIZED INTO the body —
- * else a receiver reading entwurf_inbox_read would not know who sent it, whether
- * the sender is replyable (and at which sessionId), or whether a reply was wanted.
- * The render mirrors the live "[entwurf received ⟵]" header so a transcript reads
- * the same whether the message arrived over a socket or a mailbox.
+ * mailbox path is just a file and direct injection is just a string, so for both the
+ * envelope must be SERIALIZED INTO the body —
+ * else a receiver — reading entwurf_inbox_read, or reading an injected turn in its own
+ * conversation — would not know who sent it, whether the sender is replyable (and at
+ * which sessionId), or whether a reply was wanted. The render mirrors the live
+ * "[entwurf received ⟵]" header so a transcript reads the same whether the message
+ * arrived over a socket, a mailbox, or direct injection.
  *
  * No filesystem/network IO and no mutation — the only ambient read is
  * process.env.HOME for display abbreviation (so not strictly referentially pure,
- * but deterministic per environment). Extracted so the two senders cannot drift
- * in how a mailbox message presents who-sent-it — the field that round-trips
- * garden-id replies.
+ * but deterministic per environment). Extracted so the three consumers cannot
+ * drift in how a delivered message presents who-sent-it — the field that
+ * round-trips garden-id replies.
  */
 /** `~`-abbreviate a home-relative cwd for display. Reads process.env.HOME. */
 function abbreviateHome(cwd) {
@@ -41,7 +48,9 @@ function formatKstTimestamp(iso) {
         `${pad(kst.getUTCHours())}:${pad(kst.getUTCMinutes())}:${pad(kst.getUTCSeconds())} KST`);
 }
 /**
- * Render the full mailbox body: header envelope + separator + message. A
+ * Render the full body: header envelope + separator + message. The mailbox writes this
+ * into its message file and the native-push rail injects it directly into a live
+ * conversation; both present the sender identically. A
  * replyable sender (pi-session, or a trusted meta-session) advertises its
  * sessionId as the reply address; a non-replyable sender says so WITHOUT
  * losing its origin — a record-backed meta-session that is currently inactive