@junghanacs/entwurf 0.20.1 → 0.22.0

package/CHANGELOG.md

@@ -4,6 +4,467 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.22.0 - 2026-09-17
+
+### Added
+
+- **A Codex sibling opened into a directory the vendor has no answer for now SAYS SO
+  (`codex-launch-cwd-undecided`).** `entwurf_fresh_call` reads the launch directory against the
+  operator's Codex config and prints what it saw — and then opens the window anyway. **It is a
+  diagnostic, not a gate, and that is the product decision (GLG, 2026-09-17):** the vendor's
+  consent screen is self-repairing for the human this rail exists to put a window in front of, one
+  answer teaches the vendor that directory for good, and a refusal would replace that with "no
+  window, go run codex yourself, then call again" while having to be right about a decision this
+  process cannot fully see. The UNATTENDED case is answered where it belongs —
+  `smoke-codex-fresh-live` asserts the same leaf up front, so a release gate with nobody at the
+  keyboard reads a named precondition instead of a callback timeout. `[source rust-v0.153.4]` a `--remote` startup — which this
+  argv always is — runs `check_directory_trust` on the `-C` value (`tui/src/lib.rs:1699-1725`), and
+  nothing on that path consults the approval or sandbox policy
+  (`tui/src/onboarding/directory_trust.rs:33-130`): the
+  `--dangerously-bypass-approvals-and-sandbox` token this launcher already carries turns off
+  approvals, never folder consent. A DIRECT decision is keyed to the exact directory and nothing else — for
+  `ProjectTrustHost::Remote` the lookup is `vec![cwd_key]` (`tui/src/config_update.rs:290-296`), with
+  no project-root marker, no git root and no parent inheritance. **The question is whether the
+  directory has been ANSWERED, not whether it is trusted:** a saved `untrusted` folder is
+  explicitly skipped on a remote target (`onboarding/directory_trust.rs:94-96`), so that turn
+  starts too and is not noted at all. A cwd inside an explicitly `untrusted` project gets its OWN
+  note (`codex-launch-cwd-untrusted-ancestor`) because the vendor answers that one with an error
+  rather than a screen — `pass the repository root explicitly with --cd`
+  (`config_update.rs:357-371`) — so its repair names a different directory, not a prompt.
+
+  **The leaf is deliberately NARROWER than the vendor's own judgment and says so rather than
+  claiming equivalence.** It reads the operator's `config.toml`; the vendor reads an effective
+  config — system, managed and cloud layers merged around that file — through its app-server, and
+  an enabled PROJECT LAYER consents on a directory's behalf with no entry at all
+  (`config_update.rs:346-354`). That gap is affordable precisely because nothing here refuses:
+  everything the leaf cannot see stays silent, and a note that turns out to be unnecessary costs a
+  line of stderr. **`[측정 2026-09-16]` this is the
+  failure it retires, not a hypothetical:** four `smoke-codex-fresh-live` runs, one scratch directory
+  each; the two whose directory carried a trust entry (`…-db65N2`, `…-pBXxOJ`, both answered by a
+  human at the keyboard) passed, and the two unattended release-gate runs (`…-2zznHl`, `…-kSsoAn`)
+  died with no rollout written after 21:28 at all — the sibling had opened on a consent screen and
+  started no turn, so there was no birth, no callback, and nothing to address. The caller then waits
+  out its entire timeout on a window that is merely waiting to be answered, which reads as a delivery
+  defect and is a folder question. The directory asked about is read back off codex's own `-C` token
+  rather than recomputed, so the consent question cannot drift from the thread's real start
+  directory, and the inherited default stays resolved in exactly one place.
+
+- **A Codex caller opens its sibling beside its own pane (#95 lane B).** Until now the seat a
+  Codex citizen got came from the app-server's inherited `TMUX`/`TMUX_PANE`, so a sibling opened
+  from Codex landed wherever the operator happened to have started the app-server rather than
+  beside the TUI the operator was looking at. `[측정 2026-09-16, codex-cli 0.153.4]` with
+  `thread-id` in `[tui].terminal_title` the TUI writes its thread UUID into the OSC 0 title and
+  tmux answers with it as `#{pane_title}` — truncated to 32 chars, i.e. 29 graphemes plus `...`
+  (`status_surfaces.rs:892-894`, `:1027-1043`; unchanged at `rust-v0.154.0`). So when the
+  reconciled sender of a fresh call is a record-backed `codex` citizen and `placement` is
+  omitted, that request's own `_meta.threadId` selects the pane whose title carries the token and
+  its `$session` becomes the target. **No vendor patch, no new carrier: one config item.**
+- **`entwurf install-codex-terminal-title` / `uninstall-` / `doctor-`** — a fourth Codex
+  ownership atom, owning only `thread-id` membership within `tui.terminal_title`. A different key
+  and a different axis from `install-codex-statusline`: `status_line` is what a human reads
+  inside the TUI, `terminal_title` is what the multiplexer reports back. The seeded list is
+  `["activity", "project-name", "thread-id"]` — `activity` leads because the herdr Codex detector
+  keys on the spinner and `Action Required` prefix — and an existing operator list is APPENDED to,
+  never reordered. `setup` composes it on a detected Codex host.
+- **The seat now follows the CALLER, never the backend being opened, on both fresh-call surfaces.**
+  An explicit `placement.tmuxSession` always wins; then a Codex CALLER's own pane
+  (`codex-title-anchor`); then the caller's own session. The anchored receipt reports its SOURCE and
+  no session name, because a session was observed rather than a name requested.
+- **`entwurf codex-app-server` — the one command that starts the operator's Codex app-server.**
+  Every Codex rail needs a server the operator starts themselves, and the command was
+  `codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`:
+  correct, in three documents, and in the text of a refusal — which meant most operators met it
+  only AFTER something had already failed. This verb owns that SPELLING and nothing else. It
+  `exec`s the vendor in the terminal it was typed in (cwd, pid, tty and exit status are the
+  server's; Ctrl-C is the operator's), creates the control directory, forwards the rest of the
+  argv byte-identical, and strips `PI_SESSION_ID`/`PI_AGENT_ID` so the server every bridge child
+  inherits from cannot carry someone else's identity. The address comes from the SAME leaf
+  delivery, preflight and the LIVE smoke read: the launcher ASKS that resolver through the new
+  internal `entwurf codex-socket-path` rather than re-deriving the path, so there is exactly one
+  spelling of this address instead of two that agree on the inputs somebody thought of.
+  Refusals are named and happen before the exec: a live socket (naming the pid whose `/proc`
+  cmdline actually carries that socket, and saying plainly when the host holds none — never an
+  inferred owner), a resolved address that is not absolute or carries a control character
+  (refused before anything is created: a relative socket is a different file for every process
+  that resolves it, and the bridge that will look for it is the app-server's MCP child with its
+  own cwd), an unidentifiable path, a second
+  `--listen`, a recursive launch, a socket classification nobody wrote, no `codex` on PATH. A dead
+  socket file is reported and launched over. **It is a managed spelling, not a managed
+  lifecycle**: no supervisor, no restart, no daemon, no pid file, and `entwurf_fresh_call` still
+  REJECTS a missing app-server rather than starting one. The tmux seat this server gives caller-seat lookups is reported as a fact, not
+  enforced as a requirement. Typing the raw vendor command remains equivalent.
+
+### Verification
+
+- **Release acceptance for this cut.** `[LIVE 2026-09-17, oracle]` `LIVE=1 ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.22.0.royX2L --cut` → **`MUST: PASS=24 FAIL=0 SKIP=0`**, **`BEHAVIOR:
+  PASS=1 FAIL=0 SKIP=0`**, **`cut: OK`**, exit 0, 18:47–20:02 KST; log preserved at
+  `<scratch>/release-gate.log`. Inside it: `check:full` exit 0 in 521s, `check-gate-qualification`
+  **520/520 killed**, `smoke-entwurf-chain-live` 24 assertions, `smoke-codex-fresh-live` **66
+  assertions** — one more than lane C's 65, because the launch-directory precondition this release
+  adds is asserted before anything launches. Gate env `ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna`,
+  `ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-luna`, `ENTWURF_CODEX_APP_SERVER_PID` naming an
+  operator-started app-server in its own tmux session. Exact-SHA CI at the pre-release commit:
+  run [`35202801617`](https://github.com/junghan0611/entwurf/actions/runs/35202801617)
+  `event=workflow_dispatch` @ `f5d6e10`, all four required jobs success and the `check` job's
+  qualification BODY step success.
+- **The host's Codex hook declaration was measured with the herdr SessionStart group temporarily
+  removed, and that is a debt this release does not pay.** `~/.codex/hooks.json` on `oracle` carries
+  a second SessionStart group installed by herdr, so `doctor-codex-birth` reports the declaration as
+  edited after install and `smoke-codex-fresh-live` cannot run. For this cut the file was moved to
+  `hooks.json.herdr-bak` and re-published by `install-codex-birth`; the vendor's trust receipt for
+  `…/hooks.json:session_start:0:0` survived that re-publication, measured by a real Codex TUI
+  starting with no consent screen. The herdr group is restored after the cut and the doctor goes RED
+  again on purpose. **#117 owns the real repair** — entwurf requires a whole-file digest where the
+  unit it actually owns is one group.
+- **Two gate defects found by the release gate itself, both repaired in test/gate code with zero
+  production bytes.** `check-gate-qualification` scored **518/520** on the first prepared commit and
+  both survivors were launch-directory claims whose assertion could not see the defect its mutant
+  plants. `CODEX-LAUNCH-CWD-ANCESTOR-PLAIN-PATHS-ONLY` guards two predicates — the cwd side and the
+  key side — and every non-plain cell put the encoded character in the KEY, so the key-side filter
+  answered alone and deleting the cwd-side guard changed nothing; cells that vary the CWD against a
+  plain untrusted key now close it. `FRESHCALL-CODEX-LAUNCH-CWD-NOTES-NEVER-REFUSES` asserted the
+  `indexOf("-C")` lookup but not the value read at it, so a note that asked about the REQUESTED cwd
+  instead of codex's own `-C` token passed; the three statements are now pinned contiguously.
+  Neither mutant was stale — each still matched its production line exactly once, which is what made
+  the hole an assertion hole rather than drift.
+- **`smoke-entwurf-chain-live` went red because a model read the operator's policy correctly, and
+  the repair moved the authority rather than the wording.** The native Claude Code hop declined to
+  forward, citing the operator's global AGENTS.md; B, C and D were all born and addressable and the
+  terminus simply received nothing. A first repair put the provenance in the payload and the hop
+  named those sentences as the tell — content that vouches for itself is the shape of an injection,
+  so no sentence inside the payload can settle it. The payload is therefore byte-identical to
+  before, and the fact now rides the disposable world the turn starts in: the gate mints that
+  directory, every `ENTWURF_META_*_DIR` resolves inside it, and it exists because the operator ran
+  `release-gate`, so an `AGENTS.md`/`CLAUDE.md` written there is a standing operator instruction of
+  exactly the kind the operator's own global policy defers to for directory-scoped behaviour. **No
+  negative instruction was added**: a "do not check your policy" line would buy the same green by
+  asking the model to stop reading, and would keep passing after the chain broke. Accepted on the
+  host default model with no model pin.
+
+- **The Codex LIVE card now measures WHERE a sibling starts, and the acceptance is recorded.**
+  `[LIVE 2026-09-16, Codex 0.153.4, 65 assertions, exit 0]` hop 1 requests a cwd and joins four
+  authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor
+  rollout's `session_meta.cwd`, the Entwurf record and the requested scratch; hop 2 requests NEITHER
+  placement NOR cwd, so its directory can only come from the Codex caller's own record. Both are
+  asserted different from the app-server's live `/proc/<pid>/cwd`, which is the failure mode staying
+  visible rather than coincidentally equal. 65 and 56 are different contracts: lane C added the cwd
+  axis on top of lane B's seat axis. Receipts and digests in `DELIVERY.md` / `BASELINE.md`.
+- **Caller-seat LIVE accepted on Linux, 2026-09-16 (Codex 0.153.4): 56 assertions, exit 0.** The
+  operator-owned app-server stayed alone in session A (`$30`/`@41`/`%45`, pid `737636`) while the
+  initial Pi, the omitted-placement Codex it opened, and that Codex's own outbound Pi all landed in a
+  different session S (`$2`: `@46`, `@47`, `@48`). A ≠ S is what makes the run decisive: the
+  app-server's inherited `TMUX` names A, so the pre-#95 environment fallback would have put the
+  outbound Pi there. Its receipt instead records `seat-source=codex-title-anchor`. `DELIVERY.md` owns
+  the coordinates, garden ids and digests, including the 43-assertion run kept as the D1 measurement.
+- **`check-codex-app-server-launch` — 29 assertions, hermetic, plus 9 mutants all killed by
+  their own claim.** A fake vendor on a sandbox PATH under the real name reports the argv, parent
+  and environment it was handed; nothing is asserted by reading the launcher's source.
+  `check-pack-install` proves the INSTALLED verb reaches a vendor at the address the INSTALLED
+  compiled resolver computes — a file-list assertion cannot tell a shipped script from one that
+  resolves its siblings wrongly under `node_modules`.
+- **Independent review caught a false success this gate had certified, and the repair removed the
+  class rather than the instance.** The launcher's first version re-derived the socket path in
+  bash and the gate compared the two spellings over four ASCII-normal inputs they agreed on.
+  `[측정 2026-09-16]` they disagree on `CODEX_HOME=$'\ufeff'` — JS `trim` strips U+FEFF, a POSIX
+  `[:space:]` trim does not, so the managed launch would have started a server at
+  `<BOM>/app-server-control/app-server-control.sock` while delivery looked at `$HOME/.codex` —
+  and on `path.join`'s normalization of a trailing slash or a `..` segment. Widening the matrix
+  would only have added the inputs somebody thought of, so the second spelling was deleted: the
+  launcher asks, the gate's hostile cells (BOM, trailing slash, `..`) keep it asking, and the
+  mutant that used to drop `CODEX_HOME` now re-derives the path in bash instead. The same review
+  found the `/proc` holder assertion over-determined (it accepted the fallback text OR a pid, so
+  deleting the scan passed) and the socket classifier not fail-closed on an unrecognised reading.
+  A second review pass then found that asking one authority for the address does not make the
+  ANSWER safe: the resolver returns `CODEX_HOME` faithfully, so
+  `CODEX_HOME=$'relative\ncontrol-home'` had the launcher create that directory under its caller's
+  cwd and bind a relative socket — a different file for every process that resolves it, while the
+  gate still passed. This launcher is the only Codex surface that CREATES and binds rather than
+  reads, so it now refuses a non-absolute or control-character address before the first write.
+  Every one of those is a discriminating cell with a mutant of its own; the lane is 9.
+- **Two gate defects surfaced on the way and were fixed rather than worked around.** A mutant whose
+  `find` no longer matched had been silently untested since a rename — a stale mutant is a claim
+  nobody is checking, so `check-gate-qualification` scores it red. And the LIVE source-call oracle
+  compared tool arguments with `isDeepStrictEqual`, so a model that omitted the optional `wants_reply`
+  rather than passing it explicitly read as drift; it now normalizes that one key to its schema
+  default. Both are recorded in `VERIFY.md`'s affected-set rules so the inner loop stops missing them.
+
+### Changed
+
+- **`smoke-codex-fresh-live` launches in ONE stable directory instead of a fresh `mkdtemp` per
+  run.** Per-run random scratch made every run an undecided folder — a trust prompt per run, an
+  entry per run in the operator's `~/.codex/config.toml`, and unattended failure whenever nobody was
+  there to answer. The path is now one stable `os.tmpdir()`-rooted directory, answered `Trust`
+  once; the smoke PRINTS it as `launch-cwd <dir>` on every run and asserts that consent by name
+  BEFORE it launches anything, so a missing answer reads as `codex-launch-cwd-undecided` — with the
+  exact `codex -C <dir>` repair command — at the top of the run rather than as a callback timeout
+  twenty assertions later. The directory is printed rather than documented as a literal because
+  `os.tmpdir()` is a host fact: a doc spelling it `$TMPDIR/...` would send an operator with no
+  `TMPDIR` to `/entwurf-codex-fresh-live` in the filesystem root, which is a different directory
+  the vendor consents to separately. Lane C is unaffected: its only requirement of that directory is that it differ
+  from the app-server's own, which the assertion still proves.
+- **The Codex live-spend default comes down to `gpt-5.6-luna`.** The `entwurf-dev` skill's Codex
+  backend default and the `smoke-codex-fresh-live` recommendation in `VERIFY.md` move off
+  `gpt-5.6-sol`. **This is the Codex axis alone** — OMP's fresh default is deliberately unchanged at
+  `openai-codex/gpt-5.6-sol` (`scripts/smoke-omp-fresh-live.ts:14`), because that is the model its
+  two-stage bootstrap callback was actually measured on and moving it would invalidate that
+  receipt. A cost decision, not a gate change: no step moved tier, and the acceptance receipt for
+  the Codex cell must be the run that actually happened on the new default rather than a `sol` run
+  inherited from before.
+
+- **The fixed `codex` tmux home is RETIRED (#95 D1).** 0.21.0 shipped it three days earlier: an
+  omitted-placement Codex TARGET selected an already-existing session named exactly `codex`, where
+  the operator was asked to seat the app-server and every Codex TUI, and the launch receipt labelled
+  that source `Codex home`. GLG retired it the moment the caller-pane anchor stood up — *"무조건
+  은퇴야 … 코덱스의 거처를 만들어주자는 말은 그냥 기술이 안돼서 무마한 개념이야. 제대로 가야지."* The
+  room was a workaround for a mapping that did not exist yet, and keeping it after the anchor landed
+  would have left Codex alone answering "where does a sibling open?" differently from every other
+  backend. `CODEX_HOME_TMUX_SESSION`, the `codex-home` receipt source, its renderer branch, its
+  deterministic cells and its mutant are gone; an omitted seat is the caller's own session for every
+  backend, and the operator seats the app-server wherever they like — Entwurf still never creates,
+  moves or supervises it. The 2026-09-12 home acceptance stays recorded in `DELIVERY.md` and
+  `docs/setup-clean-host.md` as history, not as a live contract. The reshaped LIVE card now REQUIRES
+  the app-server to sit in a different session from the Pi/Codex pair: that separation is what tells
+  the caller-pane anchor apart from the app-server's inherited environment.
+
+### Fixed
+
+- **An in-band refusal now reaches the sender with the reason the RECEIVER gave it
+  (`d49e6cb`, `0c8a42c`).** A completed control-socket RPC that came back `success:false` was
+  finalized as `rejected` with no reason at all, so every named receiver refusal — including the
+  0.21.0 compaction guard's own `compacting` / `busy` — arrived at the caller as a reasonless
+  rejection indistinguishable from "no live route". The send hand now carries that error verbatim
+  when the receiver supplied one, and invents nothing when it did not: receiver evidence is not
+  reclassified into the resolver's taxonomy (`dormant-fire-forget-unsupported`,
+  `mailbox-undeliverable`, …), and the two remain distinguishable at the surface. The gap was one
+  hop wide and entirely invisible to the unit lane — the production `sendOverSocket` closure was
+  what dropped `response.error` before `driveSend` could see it — so the guard that holds it is a
+  production-wiring assertion with its own mutant (`V2PROD-INBAND-ERROR-WIRED`), not another test
+  of the pure function.
+- **A Codex sibling's THREAD now opens where its pane is (#95 lane C).** The seat was right and the
+  directory was not: `[측정 2026-09-16]` a pi → Codex → Claude Code chain recorded the app-server's
+  `~/repos/gh/entwurf` for all three citizens while the panes sat in `~/repos/gh/agent-config`.
+  `[source rust-v0.153.4]` an explicit `--remote <endpoint>` resolves to `AppServerTarget::Remote`
+  (`codex-rs/tui/src/lib.rs:875-876`), and a Remote target takes its new thread's cwd from
+  `remote_cwd_override` alone (`app_server_session.rs:2022-2033`) — absent, the app-server opens the
+  thread in its OWN directory, and the birth hook then records that vendor-supplied cwd honestly.
+  The codex argv now always carries that override as `-C <dir>`, the flag the shared interactive
+  options already expose beside `--dangerously-bypass-approvals-and-sandbox`
+  (`utils/cli/src/shared_options.rs:53-68`), preserved for a remote target at
+  `startup_orchestration.rs:191-194`. **One flag, no vendor patch, no new layer.**
+- **A Codex CALLER that names no cwd opens its sibling in its OWN directory.** This bridge runs as
+  the operator-owned app-server's MCP child, so the directory its process reports is the
+  app-server's rather than the caller's — an omitted `cwd` used to put every sibling of every Codex
+  caller in the app-server's repo, whatever backend was being opened. The surface now hands the
+  composition that citizen's RECORD cwd under the same condition that already carries its thread
+  id, and it is consulted only when the call requested none. One value, two carriers: tmux `-c`
+  places the pane, codex `-C` places the thread. Every other caller's argv is byte-identical, and
+  the receipt names which rule chose the directory (`requested` / the Codex caller's own record
+  directory) instead of calling a caller-record path "requested".
+- **Three named refusals replace a silent wrong seat.** Zero matching panes is
+  `codex-caller-seat-unresolved` (the TUI is on another tmux server, its config carries no
+  `thread-id`, or that server has `allow-set-title off`, which `[측정]` replaces every pane title
+  with the hostname); two or more is `codex-caller-seat-ambiguous`; and a Codex caller whose own
+  `[tui].terminal_title` lacks `thread-id` is refused pre-mutation as `codex-caller-title-missing`
+  with the installer as its repair. None of them falls back to another session, and none opens a
+  window. That caller-side check runs only when the anchor is actually consulted — an explicit
+  seat never reads a title.
+- **A pane title is a placement input and nothing else (Hard Rule 16).** Any process in any pane
+  can emit the same OSC string, so the leaf's answer may only reach a `-t` target; identity,
+  delivery and liveness keep the record + `_meta` join they already had, and the first-turn
+  framing still carries the caller's garden id rather than the thread id a title matched. The leaf
+  (`pi-extensions/lib/codex-caller-seat.ts`) imports nothing at all, which is how that boundary is
+  held by the code rather than by a comment.
+- **The title match is over tokens, not ` | ` segments, and the count is over panes.**
+  `title_setup.rs:183-193` joins the `activity` item to its neighbour with a plain space rather
+  than ` | `, so on a host whose operator list ends in `activity` a working TUI renders
+  `<spinner> <thread-id>` inside one segment and a segment-equality rule would lose the seat
+  exactly while the caller is busy. Counting panes rather than tokens keeps a single pane that
+  shows the same thread twice (`thread-title` beside `thread-id`) from reading as an ambiguity.
+
+## 0.21.0 - 2026-09-13
+
+### Added
+
+- **This is a minor release because Codex support adds a new visible citizen axis, not merely a
+  patch to an existing rail.** The operator-owned exact `codex` tmux home gives the app-server and
+  supported Codex TUIs a stable visible place without making Entwurf their lifecycle manager. UX
+  symmetry means each backend remains a sibling with its own transcript, auth, native tools, and
+  visible seat—not that unlike transports are relabeled as identical. The release also carries the
+  independent #111 and #112 bug repairs.
+- **OpenAI Codex CLI becomes an app-server-backed native-push citizen (#95).**
+  A user-scope `SessionStart` hook, declared in the operator's own `$CODEX_HOME/hooks.json`,
+  mints the V3 record on the first turn and sets the visible thread title. It needs no root:
+  the installer refuses to run as uid 0, and the declaration is trust-gated rather than
+  prompt-free — the operator answers the vendor's prompt with "Trust all" ONCE in their own
+  visible Codex, and the vendor records that decision itself. Entwurf never computes, writes,
+  pre-seeds or reads a `trusted_hash`, and never touches `config.toml`. Because the vendor
+  hashes the declaration identity (event, matcher, handler path) and not the launcher's
+  contents, the payload closure can be upgraded on later releases without asking again. The bridge strictly joins each request's Codex metadata to
+  that record, so multiple visible TUIs may share one app-server without sharing a
+  process marker. The purpose is to preserve Codex's native tools, delegation, and work
+  context as a citizen — not to add an ACP Codex backend or duplicate GPT access.
+- **Codex gets three independently owned install/doctor/inverse atoms.**
+  `install-codex-birth` owns only the fixed `$CODEX_HOME/hooks.json` declaration plus its
+  launcher/payload closure under `${XDG_DATA_HOME:-~/.local/share}/entwurf/codex-birth`, with a
+  digest inventory that licenses an exact inverse and refuses drifted bytes;
+  `install-codex-mcp` owns only `[mcp_servers.entwurf-bridge]`; and
+  `install-codex-statusline` owns only `thread-title`. The MCP atom also owns the exact
+  `env_vars` names that forward `CODEX_HOME`, Entwurf garden/control roots, and the
+  operator-owned app-server's `TMUX`/`TMUX_PANE`. `setup` never escalates or starts it.
+- **`entwurf_fresh_call` accepts `backend: "codex"` on both public tool surfaces and the
+  operator skill.** It requires an explicit model and uses the measured
+  `codex --remote unix://<default-socket> --model … --dangerously-bypass-approvals-and-sandbox`
+  shape. The birth unit, MCP/env boundary, visible title, and the operator-owned app-server
+  socket are checked before tmux mutation. With placement omitted, Codex resolves the exact
+  existing `codex` tmux home; a missing home rejects without creating one. Explicit placement
+  remains an expert override. This does not infer an attached TUI seat from request identity.
+- **Omitted placement becomes a backend-selected policy, and Codex is its first implementation.**
+  Every backend could already be sent to an operator-owned existing seat through explicit
+  `placement.tmuxSession`; that is unchanged, and named `claude`/`pi` seats stay available that
+  way without becoming omitted-placement defaults. What is new is that omitting placement no
+  longer means one thing for every backend: `pi`, `claude-code`, `copilot` and `omp` still open
+  in the caller's seat, while `codex` resolves its exact operator-owned home. tmux remains the
+  visible launch seat, never an address — the garden id is the address and arrives in the
+  callback envelope. Sibling symmetry is transcript, auth, native tools and visibility; it is
+  not a claim that the transports are the same.
+- **Why a client-side home rather than a vendor seat carrier.** Upstream
+  [openai/codex#44774](https://github.com/openai/codex/issues/44774) records the maintainer's
+  preference for client-side terminal/window management, citing multi-client steer semantics and
+  network propagation. Rather than wait for a request→pane carrier or guess one, 0.21.0 takes the
+  client-side route the exact `rust-v0.153.4` source supports: an operator-owned exact home plus
+  explicit placement, with the wider attached-TUI topology left unsupported and unclaimed.
+
+### Changed
+
+- **The native-push rail is adapter-specific instead of Antigravity-shaped.** Codex liveness
+  is `thread/loaded/list` over the app-server WebSocket UDS; delivery is the measured one-shot
+  `codex queue --remote … --thread … --message …`. It has no mailbox, receiver marker, or
+  resume surface. Unlike Antigravity, Codex delivery is never retried because vendor acceptance
+  may precede the CLI receipt; replay would duplicate the user's message.
+- **Codex remains outside ACP and Entwurf remains outside Codex lifecycle ownership.**
+  Entwurf does not install Codex, supply auth, expose a generic app-server API/manager, or
+  start/supervise/restart the app-server or create its tmux home. The supported topology is
+  one operator-owned existing session named `codex` containing the app-server and supported
+  Codex TUIs. N arbitrary attached TUIs across sessions still have no request→TUI seat join;
+  that wider topology is unsupported and unclaimed rather than a blocker to the explicit home.
+- **`entwurf_peers` bounds expensive historical observation to its 32 rendered rows (#112).**
+  Full-store parsing, duplicate/conflict authority, socket liveness, diagnostics, and all 1,012
+  measured payload rows remain intact; older receiver/transcript cells say `unobserved` rather
+  than fabricating facts. On the 1,012-record fixture, repeated warm composition fell from about
+  3.2s to 70–103ms. Generic fact-provider callers remain unbounded unless they explicitly opt in.
+- **Version-coherence gates no longer require concise `AGENTS.md` to duplicate package pins.**
+  The owning runtime/package documents remain checked; removing redundant pin prose from the
+  maintainer guide no longer makes an otherwise coherent floor fail.
+
+### Upgrade note
+
+Codex native delivery requires three user-scope atoms and one operator trust answer. No step
+needs root:
+
+```bash
+entwurf install-codex-birth
+entwurf install-codex-mcp
+entwurf install-codex-statusline
+
+# Then, ONCE, in a visible plain Codex: answer the hook prompt with "Trust all and continue"
+# and send one first turn. Until the vendor records that receipt the hook is declared and
+# never runs, and `doctor-codex-birth` / `setup` stay non-green and say so.
+
+# First create/open the operator-owned tmux session named exactly `codex`.
+# From a pane in that session:
+CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
+mkdir -p "$CODEX_HOME/app-server-control"
+codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+# Seat supported Codex TUIs in this same `codex` session.
+```
+
+Then restart/open Codex and send its first turn. `entwurf setup <project>` never runs sudo and
+never starts the app-server.
+
+### Verification
+
+- The GPT-6 review reopened five surfaces in the candidate: terminal parser, explicit
+  env-name boundary, setup acceptance, fresh preflight safety, and clause-7 composition.
+  The prior “source-complete; only host ownership remains” wording is withdrawn.
+- The 2026-09-11 Codex CLI 0.153.4 run remains pre-amendment evidence: native-push and a
+  public MCP call woke one visible loaded thread; authenticated request identity resolved
+  `agentId=meta-session/codex`, `replyable=true`; and a source hook minted a record in an
+  isolated store. It does not qualify the amended candidate.
+- The 2026-09-12 Codex 0.153.4 explicit-home LIVE passed 57 assertions. A real initial Pi
+  ran at `$150/@397`; the operator app-server remained at `$158/@390/%390`; omitted-placement
+  Codex opened at `$158/@398`; and Codex opened outbound Pi at `$158/@399`. Exact callbacks
+  and addressed delivery succeeded both ways. `DELIVERY.md` carries the garden ids, thread,
+  nonces, preserved log path, and SHA-256.
+- Two red attempts repaired the acceptance itself. “Wait” had let Codex call one-hour
+  `wait_agent`; the task now ends its turn and forbids wait tools. A model also reformatted
+  a copied LAUNCH receipt; the gate compares source-owned tool results rather than treating that prose
+  as raw evidence. Failure cleanup interrupts only the exact smoke-owned active Codex turn and removes
+  only source-receipt-named windows.
+- The second full prepare P5 remained honestly red at **MUST 23 PASS / 1 FAIL / 0 SKIP**. The initial
+  Pi's source transcript proved Codex launch, exact callback, native-push delivery, outbound Pi launch
+  and callback, and Codex's final mailbox enqueue; it also showed the missing observation's direct
+  cause: the model shortened expected launch-report token `…1G5XEKQH` to `…1G5XEKQ`. Enqueue did not
+  prove the fixture read, and cleanup had removed the mailbox needed to distinguish every downstream
+  observer hypothesis. The amendment removes intermediate model coordinate reports entirely: Pi JSONL
+  call/result rows are joined by call id, exact tool name/arguments, non-error result, and uniqueness;
+  Codex uses the corresponding structured app-server MCP items; raw callback events supply garden ids.
+  Mailbox prose can never authorize a window kill. Every drain now persists filename, byte length,
+  SHA-256, observed token candidates, phase-specific selection/exclusion reason and a 0600 body artifact
+  immediately, plus resolved-root/run/source-path manifest and a mandatory fixture/record/transcript/thread
+  snapshot before destructive cleanup on every outcome. That snapshot uses the record owner's `.meta.json`
+  filename, records missing expected sources, and still copies known raw files when optional identity recovery
+  throws; final acceptance also requires known `completed` Codex turn/items state and logs payload validation
+  separately from token/sender candidate selection. The preserved failed-rollout extraction
+  (`c3a28938…`) confirms raw outbound launch → callback → final enqueue but still not fixture read; its tracked
+  positive fixture is explicitly labelled a vendor-source-derived v2 projection, not a captured `thread/read`
+  response. A second defect the amendment itself introduced was then measured and closed: the smoke read the
+  initial Pi's `transcriptPath` once at callback correlation, and a record that gained that path 34s later
+  left every subsequent source observation permanently empty — one 300s red whose chain had in fact run to
+  completion, proven by the Codex thread's own completed final `entwurf_v2` result. The resolution is a pure
+  leaf that re-reads the record while its cached path is empty (an unreadable record stays fail-loud; only
+  "no path yet" is pending), its own `CODEX-LIVE-SOURCE-PATH-RE-RESOLVED` claim and mutant, and an explicit
+  `no unverified child window killed` line so a run that never obtains source evidence names its
+  unrecoverable windows instead of leaking them. Declared inventory is now 475 mutants across 43 lanes.
+  The amended standalone LIVE then passed: **48 assertions, exit 0**, final source audit `initial-pi=3/3`
+  and `codex=3/3` completed exact, all three opened windows reclaimed by their own receipts, artifact
+  `.probe-artifacts/codex-fresh-live-fZccoK/`. Assertion count is not comparable with the pre-amendment 57:
+  that contract counted model coordinate reports this one removes.
+- **Release acceptance for this candidate: `check:full` exit 0 in 502s, then the LIVE release gate
+  `--cut` at MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** Its
+  `check-gate-qualification` MUST step killed 475/475 across 43 lanes with the origin HEAD and
+  work-surface hash identical before and after. The aggregate's own Codex leg repeated the
+  48-assertion source-owned acceptance (artifact `.probe-artifacts/codex-fresh-live-2oId4C/`), and the
+  mux lifecycle MUST passed in the same run. Scratch log sha256 `942d5fa0…`.
+- **Observation, not a repaired defect.** The first acceptance attempt at the identical source
+  fingerprint failed two model-in-loop MUST steps: a callback nonce arrived one character short
+  (`…c70cfb` for `…c70cfb2`) and an addressed instruction carried the wrong payload. Both oracles
+  refused fail-closed and named their cause, and the joined source receipts proved delivery and rails
+  were correct, so nothing in the product was changed. The same candidate, model, and environment then
+  passed. That leaves an intermittent exact-byte transfer failure in the model lane as a recorded
+  observation; the retry does not establish a cause for it.
+- The first 460-mutant qualification honestly stopped at 454/460. One wait-task mutant was
+  stale after the prompt repair; the birth safe-umask mutant was killed earlier by the new
+  package-root mode doctor but carried the wrong assertion label; and four setup claims shared
+  one control-red because `smoke-setup-verdict` ran real pnpm inside the qualifier's
+  node_modules-symlink snapshot. The manifest was re-pinned, safe-umask attribution now has one
+  QK helper at both valid failure leaves, and the setup behavior gate uses a strict fixture
+  pnpm accepting only a no-op `install --frozen-lockfile` or the source-owned `build-bridge`
+  emit, whose snapshot-local dist is removed on exit. The next run killed all 460 mutants but
+  correctly rejected its own impure snapshot: the fixture had called the production dist-lock
+  wrapper, which removed its lock but left the ignored `.tmp-verify` parent. The fixture now
+  invokes the process-exclusive snapshot emit directly; a focused pre/post tree-manifest replay
+  was byte-identical. The fresh run then killed **460/460** mutants across 43 lanes in 53m42s
+  with the origin and snapshot surfaces pure. Biome only collapsed the new manifest arrays onto
+  one line afterward (claim/subject/find/replace bytes and semantics unchanged), and the frozen
+  full floor passed in 506s. The receipt-bearing final candidate passed the full floor again
+  in 501s before the implementation commit and local-main merge.
+
+### Fixed
+
+- **The Copilot receiver parent-death mutant no longer leaves one PID-1 fixture child per qualification run.** P9 found ten reparented Node stubs from ten qualifications. The gate did detect the mutant, but its failing assertion threw before the cleanup statement below it; cleanup now kills the surviving mutant child before asserting, preserving the same attributed red while leaving no process behind.
+- **Control-socket send during Pi compaction is no longer a false `delivered:true` (#111).** A compacting Pi citizen is neither idle nor an ordinary streaming turn, but the receiver only sampled `ctx.isIdle()` and forwarded every non-idle send into `pi.sendMessage({ triggerTurn: true })`. Installed Pi 0.85.1 `sendCustomMessage` then starts `_runAgentPrompt` when not streaming — racing `compact()`'s session rewrite, which is the field path that can make compaction "풀린다". There is no public `ExtensionContext.isCompacting()`. The resident arms on `session_before_compact` and refuses as `compacting`; quiet unknown non-idle (`!idle && ctx.signal === undefined`) is fail-closed as `busy`, not `compacting`, because `ctx.signal` is `agent.activeRun?.abortController.signal` and is already gone during `_handlePostAgentRun` retry/continuation while `_isAgentRunActive` is still true — that cell also covers the manual-compact start race and branch summary, which the public API cannot tell apart. Either token: no `pi.sendMessage`, no `delivered:true`. Idle and live-run steer/followUp are unchanged. Frozen v2 reject taxonomy is untouched — this is an in-band RPC refusal.
+
 ## 0.20.1 - 2026-09-10
 
 ### Fixed
@@ -124,17 +585,15 @@ Hosts with no detected harness, and every Linux host, see no new prompt.
   by the promotion above; it is where a borrowed Mac produces the physical-host
   evidence the CI runner cannot.
 - **`scripts/raw-codex-measure/` — Codex 0.153.4 vendor measurement (#95 step 1).**
-  Nothing is installed: no birth hook, no record, no marker, no doctor, and
-  `entwurf_fresh_call` still cannot open a codex sibling. GLG reversed the
-  2026-08-01 decline on 2026-09-08; live claims that still said otherwise
-  were repaired. The ledger closes step 1: SessionStart fires on the first
-  turn, not at window open; a fourth callback spelling
-  (`mcp__entwurf_bridge__entwurf_v2`); the delivery-capable app-server join
-  cannot use parent-pid as a citizen key; hook-trust is an ownership cost
-  (`/etc/codex`, root-owned), not a capability gap; clause 4 is
-  `thread/name/set` plus a status_line config. Step 2 is not opened.
-  `PIN_CODEX_MINOR` 0.144 → 0.153 is a re-verification of the archived drift
-  probe, not a product pin.
+  **At the measurement landing on 2026-09-08**, no Entwurf Codex unit had been
+  installed or built, no product record/doctor existed, and fresh did not include
+  Codex. Those are dated step-1 facts, not the current candidate state. The ledger
+  established first-turn `SessionStart`, callback spelling
+  `mcp__entwurf_bridge__entwurf_v2`, the shared-app-server refutation of a pid-keyed
+  citizen join, root-owned prompt-free hooks, and `thread/name/set`. Later #95 work
+  added the record/native-push/fresh candidate described under Unreleased.
+  `PIN_CODEX_MINOR` 0.144 → 0.153 was a re-verification of the archived drift probe,
+  not a product pin.
 
 ### Changed
 
@@ -261,9 +720,9 @@ Lane receipts (oracle, 2026-09-09) plus prepare P4/P5 on this host. There is
   CommandLineTools stub. Both are cells the borrowed-Mac probe
   (`scripts/raw-macos-measure/probe.sh`, M6 and M3) is built to answer. Do
   not fill them from a CI image spec.
-- **Codex is not a garden backend in this cut.** Step 1 of #95 closed as
-  measurement; step 2 is not opened. `entwurf_fresh_call` still cannot open a
-  codex sibling.
+- **On the 0.20.0 release date (2026-09-09), Codex was not a garden backend in that
+  cut.** Step 1 of #95 was measurement only and `entwurf_fresh_call` did not include
+  Codex. This is release archaeology; 0.21.0 support supersedes it.
 
 ## 0.19.0 - 2026-09-07
 

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex has native delivery-probe evidence but no managed citizen lane, and Gemini is not a shipped backend. That is the entire scope.
+`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is an unreleased native-push candidate with record birth and delivery-probe evidence (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.